gowalk-cicd 1.0.17 → 1.0.19

package/README.md

@@ -103,6 +103,49 @@ in Play Console; every later run detects API readiness and uploads to the
 `internal` track automatically. Override the track or status with repository
 variables `GOOGLE_PLAY_TRACK` and `GOOGLE_PLAY_STATUS`.
 
+### Runner disk space
+
+An `ubuntu-24.04` runner leaves roughly 14 GB free on `/`, and a release Flutter
+build — Gradle caches, build intermediates, and a 100–200 MB AAB — does not
+reliably fit. The failure surfaces far from its cause:
+
+```
+> java.io.IOException: No space left on device
+zip I/O error: No space left on device
+```
+
+The Android job removes the preinstalled toolchains a Flutter build never uses
+(.NET, the Android NDK, GHC, PowerShell, Swift, Chromium, global node modules)
+and prunes Docker images, reclaiming roughly 25 GB in a few seconds. It prints
+`df -h /` before and after. Linux only; skipped in Bitrise mode.
+
+### Private git dependencies (Flutter)
+
+A Flutter app can depend on private git packages:
+
+```yaml
+dependencies:
+  my_package:
+    git: https://github.com/my-org/my_package.git
+```
+
+The runner has no credentials for those, so `flutter pub get` fails with
+`could not read Username for 'https://github.com'`. Embedding a PAT in the URL
+works but publishes the token into your source and into every copy of the
+lockfile.
+
+Set the repository **secret** `GIT_PRIVATE_TOKEN` instead — a PAT with `repo`
+read access — and the workflow rewrites `https://github.com/` to an
+authenticated remote for the duration of the job. Plain URLs keep working and
+the token lives in one revocable place:
+
+```bash
+gh secret set GIT_PRIVATE_TOKEN --repo my-org/my-app
+```
+
+Without the secret the step is skipped, so repos that do not need it are
+unaffected.
+
 ### Localized release notes
 
 Both stores pick up per-locale release notes from committed files:

package/action/.daemux-version

@@ -1 +1 @@
-1.0.17
+1.0.19

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.17
+1.0.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.17",
+  "version": "1.0.19",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -130,6 +130,22 @@ jobs:
           else
             echo "enabled=false" >> "$GITHUB_OUTPUT"
           fi
+      # A release Flutter build (Gradle caches + intermediates + a 100-200 MB AAB)
+      # does not fit in the ~14 GB an ubuntu runner leaves free on /, and the
+      # failure surfaces far from its cause: "No space left on device" out of
+      # aapt2, zip, or Gradle's own cache writer. Reclaiming the preinstalled
+      # toolchains this build will never use buys ~25 GB and costs a few seconds.
+      - name: Free runner disk space
+        if: ${{ steps.mode.outputs.mode == 'local' && runner.os == 'Linux' }}
+        shell: bash
+        run: |
+          echo "Before:"; df -h / | tail -1
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android/sdk/ndk \
+                      /opt/ghc /usr/local/.ghcup /usr/local/share/powershell \
+                      /usr/share/swift /usr/local/share/chromium \
+                      /usr/local/lib/node_modules 2>/dev/null || true
+          sudo docker image prune --all --force >/dev/null 2>&1 || true
+          echo "After:";  df -h / | tail -1
       - name: Set up Java
         if: ${{ steps.mode.outputs.mode == 'local' }}
         uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
@@ -143,6 +159,21 @@ jobs:
         with:
           channel: stable
           cache: true
+      # Flutter apps can depend on private git packages. Most repos in this fleet
+      # embed a PAT directly in the pubspec URL, which publishes the token into
+      # source and into every fork of the lockfile. Setting the optional
+      # GIT_PRIVATE_TOKEN secret instead lets plain
+      # https://github.com/<org>/<repo>.git URLs resolve on the runner, so the
+      # token lives in one revocable place. No secret, no step — repos that do
+      # not need it are unaffected.
+      - name: Authenticate private git dependencies
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' && secrets.GIT_PRIVATE_TOKEN != '' }}
+        shell: bash
+        env:
+          GIT_PRIVATE_TOKEN: ${{ secrets.GIT_PRIVATE_TOKEN }}
+        run: |
+          git config --global url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+          echo "::add-mask::$GIT_PRIVATE_TOKEN"
       # Same reason as the iOS job: apps using AppLocalizations must generate it
       # before anything analyses or compiles them. No-op for apps without l10n.
       - name: Generate localizations