gowalk-cicd 1.0.171 → 1.0.172

package/README.md

@@ -813,11 +813,11 @@ it: the retain step runs even when that action failed (a metadata error after
 the upload must not discard the symbols of a build that is already live), and
 an action that succeeded without writing symbols fails the job.
 
-Artifacts follow the repository's retention setting — 90 days unless you
-change it under *Settings → Actions → Artifact and log retention* (private
-repositories allow up to 400). A production release usually outlives that, so
-either raise the setting or, better, upload the symbols to your crash reporter,
-which is where crashes arrive anyway.
+Artifacts follow the artifact retention setting, which an organization can cap far
+below GitHub's 90-day default (*Settings → Actions → Artifact and log retention*).
+A production release outlives that, so the durable copy belongs in your crash
+reporter: with `FIREBASE_APP_ID` the Android job uploads its Dart symbols to
+Crashlytics. iOS Dart symbols exist only as this artifact.
 
 To read an obfuscated crash, download the artifact for that exact build and
 run `flutter symbolize` with the file matching the device's architecture:
@@ -1092,6 +1092,9 @@ Signing credentials are refused from maintenance commits; use encrypted reposito
 **Source-of-truth resolution.** The auto-bump writes the new value
 into the file your project actually reads from, in this order:
 
+0. **Flutter root `pubspec.yaml`** (project under the root `ios/`, M.m.p values only): the
+   `version:` name, keeping `+build`. The Runner's `$(FLUTTER_BUILD_NAME)` and Android's
+   versionName both read it; literal pbxproj values are synced, `$(…)` references are left alone.
 1. **xcodegen `project.yml`** (preferred when present): regex-rewrite
    of the `MARKETING_VERSION:` key, preserving formatting. The
    generated `*.xcodeproj` is regenerated on every build, so editing
@@ -1164,7 +1167,7 @@ A failed upload emits the typed `apple_build_upload_failed` error annotation wit
 the receipt's own identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`,
 `provider_status`, `provider_code`, `provider_pointer`). Exception text is never
 published. The job also retains the exact exported IPA as `apple-ipa-<run>-<attempt>`
-(14 days) so a continuation can complete that same upload identity instead of rebuilding
+(7 days) so a continuation can complete that same upload identity instead of rebuilding
 different bytes under the same number. Build numbers come from `/builds`,
 `/preReleaseVersions` **and** `/apps/{id}/buildUploads`, so an unfinished or refused
 reservation is never reused; delete such a reservation only after reading it back.

package/action/action.yml

@@ -808,7 +808,7 @@ runs:
         name: apple-ipa-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/export/*.ipa
         if-no-files-found: ignore
-        retention-days: 14
+        retention-days: 7
 
     # The whatsNew backstop. An empty "What's New" makes a version
     # un-submittable (ASC: "This field is required" on every locale). With an

package/action/scripts/commit_bot_changes.sh

@@ -11,6 +11,7 @@ fi
 staged="$(git diff --cached --name-only)"
 # marketing-version-auto-bump (mmv_floor_check) writes the bumped value
 # into the project's source-of-truth (resolved by version_utils):
+#   - a Flutter app's root pubspec.yaml `version:`
 #   - xcodegen project.yml / project.yaml / Project.yml / Project.yaml
 #   - *.xcconfig referenced by the project
 #   - project.pbxproj (only when no xcodegen spec is present)
@@ -19,7 +20,7 @@ staged="$(git diff --cached --name-only)"
 # commit; surface it in the subject so reviewers see the version
 # delta without diffing.
 subject="ci: bot maintenance [skip ci]"
-if grep -qE '(\.pbxproj|Info\.plist|(^|/)[Pp]roject\.ya?ml|\.xcconfig)$' <<<"$staged"; then
+if grep -qE '(\.pbxproj|Info\.plist|(^|/)[Pp]roject\.ya?ml|\.xcconfig|^pubspec\.yaml)$' <<<"$staged"; then
   subject="ci: bump MARKETING_VERSION [skip ci]"
 fi
 

package/action/scripts/mobile_artifact_inventory.cjs

@@ -1,11 +1,13 @@
 /* Reuse completed candidate artifacts immediately; a miss never reserves or waits for a runner. */
 'use strict';
 const {execFileSync} = require('node:child_process');
-const {mkdirSync, mkdtempSync, readFileSync, appendFileSync} = require('node:fs');
+const {mkdirSync, mkdtempSync, readdirSync, readFileSync, appendFileSync} = require('node:fs');
 const {join} = require('node:path');
 const {createHash} = require('node:crypto');
+const {inflateRawSync} = require('node:zlib');
 const inputs = require('./mobile_inputs.cjs');
 const api = require('./mobile_release_api.cjs');
+const {appleGet} = require('./reconcile_apple_upload.cjs');
 
 function identity(platform) {
   const manifest = inputs.read(JSON.parse(process.env.MOBILE_RELEASE_VARIABLES || '{}'));
@@ -54,6 +56,104 @@ async function find(platform, deadline) {
   return null;
 }
 
+// Admission reads the candidate's receipt without downloading its binary: the zip's central
+// directory, then that one entry, by HTTP range from the artifact's storage link.
+async function remoteReceipt(artifact, deadline) {
+  const signal = () => AbortSignal.timeout(Math.max(1, deadline - Date.now()));
+  const zip = `https://api.github.com/repos/${process.env.GITHUB_REPOSITORY}/actions/artifacts/${artifact.id}/zip`;
+  const link = await fetch(zip, {redirect: 'manual', signal: signal(), headers: {'User-Agent': 'gowalk-cicd',
+    Authorization: `Bearer ${process.env.GITHUB_TOKEN || ''}`, Accept: 'application/vnd.github+json'}});
+  const url = link.headers.get('location') || '', size = artifact.size_in_bytes;
+  if (link.status !== 302 || !url.startsWith('https://') || !Number.isSafeInteger(size)) {
+    throw Error('mobile_artifact_receipt_unavailable');
+  }
+  const bytes = async (start, end) => {
+    const response = await fetch(url, {headers: {Range: `bytes=${start}-${end - 1}`}, signal: signal()});
+    const body = response.status === 206 ? Buffer.from(await response.arrayBuffer()) : null;
+    if (!body) await response.body?.cancel();
+    if (body?.length !== end - start) throw Error('mobile_artifact_receipt_unavailable');
+    return body;
+  };
+  const from = Math.max(0, size - 65557), tail = await bytes(from, size);
+  const end = tail.lastIndexOf(Buffer.from('504b0506', 'hex'));
+  if (end < 0) throw Error('mobile_artifact_receipt_unavailable');
+  const count = tail.readUInt16LE(end + 10), length = tail.readUInt32LE(end + 12), offset = tail.readUInt32LE(end + 16);
+  const directory = offset >= from ? tail.subarray(offset - from, offset - from + length)
+    : await bytes(offset, offset + length);
+  for (let entry = 0, at = 0; entry < count; entry++) {
+    if (directory.readUInt32LE(at) !== 0x02014b50) break;
+    const named = directory.readUInt16LE(at + 28);
+    if (directory.toString('utf8', at + 46, at + 46 + named) === 'mobile-binary.json') {
+      const method = directory.readUInt16LE(at + 10), packed = directory.readUInt32LE(at + 20);
+      const local = directory.readUInt32LE(at + 42);
+      if (![0, 8].includes(method) || packed > 2 * 1024 * 1024) break;
+      const header = await bytes(local, local + 30);
+      const start = local + 30 + header.readUInt16LE(26) + header.readUInt16LE(28);
+      const data = await bytes(start, start + packed);
+      return JSON.parse((method ? inflateRawSync(data) : data).toString('utf8'));
+    }
+    at += 46 + named + directory.readUInt16LE(at + 30) + directory.readUInt16LE(at + 32);
+  }
+  throw Error('mobile_artifact_receipt_unavailable');
+}
+
+// The iOS job's credential step writes creds/AuthKey_<KEY_ID>_Issuer_<ISSUER>.p8 (or the app tracks
+// it); admission has no credential files and receives the same encrypted secrets instead.
+const KEY_FILE = /^AuthKey_([A-Z0-9]{8,10})_Issuer_([0-9a-fA-F-]{36})\.p8$/;
+function appleKey() {
+  const {CI_ASC_KEY_P8: pem, CI_ASC_KEY_ID: id, CI_ASC_ISSUER_ID: issuer} = process.env;
+  if (pem) return {pem, id, issuer};
+  const folder = join(process.env.GITHUB_WORKSPACE, 'creds');
+  let names = [];
+  try { names = readdirSync(folder).filter(name => KEY_FILE.test(name)); } catch { /* no creds folder */ }
+  if (names.length !== 1) throw Error('mobile_artifact_apple_key_absent');
+  const [, keyId, issuerId] = KEY_FILE.exec(names[0]);
+  return {pem: readFileSync(join(folder, names[0]), 'utf8'), id: keyId, issuer: issuerId};
+}
+
+// App Store Connect consumed the candidate's build number once any source next_build_number.py
+// reads holds it or a higher one, unless the (version, build) upload is this very IPA, which the
+// uploader resumes. Such a candidate is rebuilt under a fresh number instead of failing its upload.
+async function consumed(receipt, key, deadline, get = appleGet) {
+  const environment = receipt.environment || {}, app = environment.CFG_APP_STORE_APPLE_ID || '';
+  const build = environment.BUILD_NUMBER || '', version = environment.MARKETING_VERSION || '';
+  const file = `${receipt.files?.['export/app.ipa']}.ipa`;
+  if (!/^\d+$/.test(app) || !/^[1-9]\d*$/.test(build) || !/^\d+(\.\d+)*$/.test(version) ||
+      !/^[a-f0-9]{64}\.ipa$/.test(file)) {
+    throw Error('mobile_artifact_receipt_invalid');
+  }
+  const read = async (path, query) =>
+    get(query ? `${path}?${new URLSearchParams(query)}` : path, key, Math.max(1, deadline - Date.now()));
+  const [builds, trains, uploads] = await Promise.all([
+    read('/builds', {'filter[app]': app, sort: '-version', limit: 200}),
+    read('/preReleaseVersions', {'filter[app]': app, include: 'builds', limit: 200}),
+    read(`/apps/${app}/buildUploads`, {'filter[platform]': 'IOS', limit: 200})]);
+  const versions = [...builds.data || [], ...(trains.included || []).filter(row => row.type === 'builds')]
+    .map(row => row.attributes?.version).concat((uploads.data || []).map(row => row.attributes?.cfBundleVersion));
+  if (!versions.map(Number).some(number => Number.isSafeInteger(number) && number >= Number(build))) return false;
+  const same = ((await read(`/apps/${app}/buildUploads`, {'filter[cfBundleVersion]': build,
+    'filter[cfBundleShortVersionString]': version, 'filter[platform]': 'IOS', limit: 200}))
+    .data || []).filter(row => row.attributes?.state?.state !== 'FAILED');
+  if (same.length !== 1) return true;
+  const assets = ((await read(`/buildUploads/${same[0].id}/buildUploadFiles`)).data || [])
+    .filter(row => row.attributes?.assetType === 'ASSET');
+  return assets.length !== 1 || assets[0].attributes.fileName !== file;
+}
+
+// Any doubt keeps today's reuse: the probe takes at most 30 s and adds no failure mode. The log
+// names only our own codes, never a URL, key or token from an error message.
+async function stale(read) {
+  const deadline = Date.now() + 30000;
+  try {
+    const key = appleKey();
+    return await consumed(await read(deadline), key, deadline);
+  } catch (error) {
+    const code = /^[a-z0-9_]+$/.test(error?.message || '') ? error.message : 'mobile_artifact_probe_unavailable';
+    console.log(`::notice::Candidate build-number probe unavailable (${code}); reusing the candidate`);
+    return false;
+  }
+}
+
 async function restore(platform) {
   const deadline = Date.now() + 120000;
   const found = await find(platform, deadline);
@@ -69,6 +169,11 @@ async function restore(platform) {
   const operation = platform === 'ios' ? 'verify' : 'restore';
   execFileSync('python3', [join(__dirname, 'mobile_artifact_files.py'), operation, platform, directory],
     {stdio: ['ignore', 'inherit', 'pipe'], env: {...process.env, MOBILE_ARTIFACT_FINGERPRINT: fingerprint}});
+  if (platform === 'ios' && await stale(async () => receipt)) {
+    output('restored', 'false');
+    return console.log(`::notice::App Store Connect already holds candidate build ${receipt.environment.BUILD_NUMBER}` +
+      ' or a higher one; building a fresh binary');
+  }
   output('directory', directory);
   output('restored', 'true');
   console.log(`::notice::Reusing ${platform} binary from candidate run ${run.id}`);
@@ -96,6 +201,12 @@ async function main([operation, platform, directory]) {
     // Admission picks the iOS runner from this answer; any doubt keeps the macOS build path.
     let found = null;
     try { found = await find(platform, Date.now() + 30000); } catch { /* optional optimization */ }
+    if (found && platform === 'ios' && await stale(deadline => remoteReceipt(found.artifact, deadline))) {
+      // 'consumed' routes to macOS and skips the restore, so a flaky second probe there cannot
+      // reuse what this one proved stale.
+      console.log(`Candidate ${platform} binary in run ${found.run.id} holds a consumed build number`);
+      return output('found', 'consumed');
+    }
     console.log(found ? `Candidate ${platform} binary in run ${found.run.id}` : `No candidate ${platform} binary`);
     return output('found', found ? 'true' : 'false');
   }
@@ -108,7 +219,7 @@ async function main([operation, platform, directory]) {
   }
 }
 
-module.exports = {identity, candidate, find, restore, pack, main};
+module.exports = {identity, candidate, find, remoteReceipt, consumed, stale, restore, pack, main};
 if (require.main === module) main(process.argv.slice(2)).catch(() => {
   console.error('::error::mobile_artifact_pack_failed');
   process.exitCode = 1;

package/action/scripts/reconcile_apple_upload.cjs

@@ -48,21 +48,21 @@ async function verifyOwner(deploymentId, runId, attempt, api = github) {
   return 'pending';
 }
 
-async function appleGet(path) {
+async function appleGet(path, key = {pem: process.env.ASC_KEY_P8, id: process.env.ASC_KEY_ID,
+  issuer: process.env.ASC_ISSUER_ID}, timeout = 30000) {
   if (!path.startsWith('/') || path.includes('..')) refuse('path_invalid');
   const now = Math.floor(Date.now() / 1000);
   const encoded = value => Buffer.from(JSON.stringify(value)).toString('base64url');
-  const header = encoded({alg: 'ES256', kid: process.env.ASC_KEY_ID, typ: 'JWT'});
-  const payload = encoded({iss: process.env.ASC_ISSUER_ID, iat: now, exp: now + 1200,
-    aud: 'appstoreconnect-v1'});
+  const header = encoded({alg: 'ES256', kid: key.id, typ: 'JWT'});
+  const payload = encoded({iss: key.issuer, iat: now, exp: now + 1200, aud: 'appstoreconnect-v1'});
   let signature;
   try {
     signature = crypto.sign('sha256', Buffer.from(`${header}.${payload}`),
-      {key: process.env.ASC_KEY_P8, dsaEncoding: 'ieee-p1363'}).toString('base64url');
+      {key: key.pem, dsaEncoding: 'ieee-p1363'}).toString('base64url');
   } catch { refuse('apple_key_invalid'); }
   const response = await fetch(`https://api.appstoreconnect.apple.com/v1${path}`, {
     headers: {Authorization: `Bearer ${header}.${payload}.${signature}`, Accept: 'application/json'},
-    signal: AbortSignal.timeout(30000),
+    signal: AbortSignal.timeout(timeout),
   });
   if (!response.ok) refuse(`apple_http_${response.status}`);
   try { return await response.json(); } catch { refuse('apple_response_invalid'); }

package/action/scripts/source_maintenance.py

@@ -23,7 +23,7 @@ def source_paths() -> list[str]:
                 or re.search(r"\.(?:p8|p12|pfx|pem|key|keystore|jks|mobileprovision)$", name, re.I)):
             raise ValueError("source_maintenance_secret_path_refused")
         managed = name.startswith((".github/actions/swift-app/", ".github/actions/android-app/"))
-        version = re.search(r"(?:\.pbxproj|\.plist|(?:^|/)[Pp]roject\.ya?ml|\.xcconfig)$", name)
+        version = re.search(r"(?:\.pbxproj|\.plist|(?:^|/)[Pp]roject\.ya?ml|\.xcconfig|^pubspec\.yaml)$", name)
         if not (managed or version):
             raise ValueError("source_maintenance_unexpected_path")
     return names

package/action/scripts/source_preflight.py

@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
-"""Refuse app artwork and icon coverage the stores reject, before the build runs.
+"""Refuse app source the stores or the iOS build reject, before the build runs.
 
-Two failures cost a whole release each and are both visible in the checked-out
-source in under a second:
+Three failures cost a whole release (or a macOS job) each and are all visible in
+the checked-out source in under a second:
 
 * the app still ships its framework's PLACEHOLDER icon. Apple refuses that under
   guideline 2.3.8 ("the app icons appear to be placeholder icons") after a full
@@ -12,8 +12,11 @@ source in under a second:
 * the asset catalog does not cover a device family the target declares. Apple
   refuses that at DELIVERY (ITMS-90023), after the archive, the signing and the
   upload have all been paid for.
+* the Podfile.lock was resolved by another CocoaPods than the app's Gemfile.lock
+  installs. `pod install --deployment` refuses the lock's `COCOAPODS:` trailer
+  alone, 3.4 macOS minutes in (`ios-airpods-finder2`, 2026-09-28).
 
-Both checks read only what the app actually SHIPS. An appiconset routinely keeps
+The icon checks read only what the app actually SHIPS. An appiconset routinely keeps
 files nothing references, and `flutter create` leaves its stock icons behind
 after real artwork is installed under another name; hashing a directory instead
 of the declared set convicts apps that ship correctly.
@@ -325,10 +328,57 @@ def check_icon_coverage(root: Path) -> list[dict]:
     return failures
 
 
+#: The CocoaPods that RESOLVED a Podfile.lock (its trailer) and the one a
+#: Gemfile.lock installs (its 4-space `specs:` entry, never a dependency line).
+LOCK_COCOAPODS = re.compile(r"^COCOAPODS:\s*([0-9][0-9A-Za-z.\-]*)\s*$", re.MULTILINE)
+GEM_COCOAPODS = re.compile(r"^ {4}cocoapods \(([0-9][0-9A-Za-z.\-]*)\)\s*$", re.MULTILINE)
+
+
+def first_version(path: Path, pattern: re.Pattern) -> str:
+    try:
+        found = pattern.search(path.read_text(encoding="utf-8", errors="replace"))
+    except OSError:
+        return ""
+    return found.group(1) if found else ""
+
+
+def check_cocoapods_version(root: Path) -> list[dict]:
+    """The Podfile.lock CI installs against the CocoaPods its bundle resolves.
+
+    CI installs Pods only where a Podfile sits in `ios/` when `pubspec.yaml`
+    exists, else in the root, with that folder's Gemfile else the root one
+    (`native_pods.prepare`, `native_bundle.prepare`). With no Gemfile CI runs the
+    runner's own `pod`, which nothing here can read, so that and any unreadable
+    half is silent, never a refusal.
+    """
+    folder = root / "ios" if (root / "pubspec.yaml").is_file() else root
+    lock = folder / "Podfile.lock"
+    gemfile = next((path for path in (folder / "Gemfile", root / "Gemfile") if path.is_file()),
+                   None)
+    if gemfile is None or not (folder / "Podfile").is_file():
+        return []
+    gemlock = gemfile.with_name("Gemfile.lock")
+    locked, resolved = first_version(lock, LOCK_COCOAPODS), first_version(gemlock, GEM_COCOAPODS)
+    if not locked or not resolved or locked == resolved:
+        return []
+    lock_name, gem_name = str(lock.relative_to(root)), str(gemlock.relative_to(root))
+    return [{
+        "guideline": "pod_lock_drift",
+        "message": (f"`{lock_name}` was resolved by CocoaPods {locked}, but `{gem_name}` installs "
+                    f"{resolved}. `pod install --deployment` refuses a lock whose `COCOAPODS:` "
+                    "trailer differs from the CocoaPods it runs, minutes into the macOS build."),
+        "next": (f"Set the Gemfile's cocoapods to {locked} and commit its Gemfile.lock, or "
+                 f"re-resolve {lock_name} under {resolved} (`bundle exec pod install`); the two "
+                 "are one decision and move together."),
+        "files": [lock_name, gem_name],
+    }]
+
+
 CHECKS = (
     {"id": "placeholder_icons",
      "run": lambda ctx: check_placeholder_icons(ctx["root"], ctx["flutter"])},
     {"id": "icon_coverage", "run": lambda ctx: check_icon_coverage(ctx["root"])},
+    {"id": "cocoapods_version", "run": lambda ctx: check_cocoapods_version(ctx["root"])},
 )
 
 

package/action/scripts/version_utils.py

@@ -24,6 +24,11 @@ the project's 10-functions-per-file cap. Two concerns live here:
   2. ``write_marketing_version(new_version)`` -- I/O. Writes
      ``new_version`` into the project's source-of-truth. Resolution order:
 
+       0. A Flutter app's root pubspec.yaml ``version:`` (the project is
+          ``ios/``), for a full M.m.p value only. Its name is the Runner's
+          FLUTTER_BUILD_NAME and Android's versionName; literal pbxproj
+          values are synced beside it, ``$(FLUTTER_BUILD_NAME)`` references
+          are left to follow it.
        a. xcodegen project.yml / project.yaml / Project.yml /
           Project.yaml at the workspace root (the source of truth for
           xcodegen consumers; the generated .xcodeproj is regenerated
@@ -69,6 +74,14 @@ _SEM_RE = re.compile(r"^(\d+)\.(\d+)(?:\.(\d+))?$")
 _MARKETING_LINE = re.compile(
     r"^(\s*)MARKETING_VERSION\s*=\s*[^;]+;\s*$", re.MULTILINE,
 )
+# The same line when it holds a literal, not a $(VAR) reference.
+_LITERAL_MARKETING_LINE = re.compile(
+    r"^(\s*)MARKETING_VERSION\s*=(?!\s*[\"']?\$)\s*[^;]+;\s*$", re.MULTILINE,
+)
+# pubspec.yaml's top-level ``version: <M.m.p>[+<build>]``; the build suffix stays.
+_PUBSPEC_VERSION_LINE = re.compile(
+    r"^(version:[ \t]*['\"]?)\d+\.\d+\.\d+(?=[+'\"\s#]|$)", re.MULTILINE,
+)
 # xcodegen project.yml line shape (YAML key colon, optional quotes).
 # Matches "MARKETING_VERSION: 1.0" / "MARKETING_VERSION: '1.0'" /
 # "MARKETING_VERSION: \"1.0\"". Indent preserved via group 1.
@@ -264,8 +277,32 @@ def _write_xcconfig_marketing_version(new_version: str) -> bool:
     return False
 
 
-def _write_pbxproj_marketing_version(pbx: Path, new_version: str) -> bool:
-    """Rewrite every ``MARKETING_VERSION = ...;`` line in pbxproj to
+def _write_pubspec_version(path: Path, new_version: str) -> bool:
+    """Rewrite the version name in pubspec.yaml's ``version:`` line, keeping
+    any ``+build`` suffix. Returns False when the file declares no version or
+    ``new_version`` is not the full M.m.p pub requires."""
+    if not re.fullmatch(r"\d+\.\d+\.\d+", new_version):
+        return False
+    text = path.read_text(encoding="utf-8")
+    new_text, count = _PUBSPEC_VERSION_LINE.subn(
+        rf"\g<1>{new_version}", text, count=1,
+    )
+    if count == 0:
+        return False
+    path.write_text(new_text, encoding="utf-8")
+    print(
+        f"[auto-bump] wrote version {new_version} to {path}",
+        file=sys.stderr,
+    )
+    _record_bumped_path(path)
+    return True
+
+
+def _write_pbxproj_marketing_version(
+    pbx: Path, new_version: str, line: re.Pattern = _MARKETING_LINE,
+) -> bool:
+    """Rewrite every ``MARKETING_VERSION = ...;`` line in pbxproj (every
+    literal one with ``_LITERAL_MARKETING_LINE``) to
     ``MARKETING_VERSION = <new_version>;``. Returns True when at least
     one substitution happened, False otherwise.
 
@@ -275,7 +312,7 @@ def _write_pbxproj_marketing_version(pbx: Path, new_version: str) -> bool:
     it is only ever a *sync* of a value already persisted in the real
     source of truth, never a substitute for writing that source."""
     text = pbx.read_text(encoding="utf-8")
-    new_text, count = _MARKETING_LINE.subn(
+    new_text, count = line.subn(
         rf"\g<1>MARKETING_VERSION = {new_version};", text,
     )
     if count == 0:
@@ -359,13 +396,24 @@ _XCODEGEN_REFUSE_MSG = (
 def write_marketing_version(new_version: str) -> bool:
     """Persist ``new_version`` into the project source-of-truth.
 
-    Resolution order is xcodegen-aware: project.yml -> xcconfig ->
-    project.pbxproj (only without a spec) -> Info.plist. Records every
+    Resolution order is Flutter- and xcodegen-aware: pubspec.yaml ->
+    project.yml -> xcconfig -> project.pbxproj (only without a spec) ->
+    Info.plist. Records every
     successful write to ``$RUNNER_TEMP/<marker>`` so the action.yml
     staging step picks up exactly what was touched (never
     prepare_signing's pbxproj diff). Returns True on the first
     successful write, False when no source of truth resolved."""
     _proj_args, base = _xcodebuild_args()
+    # A Flutter Runner reads $(FLUTTER_BUILD_NAME) from pubspec, which
+    # Android ships too; the template's only literal belongs to RunnerTests.
+    # Root only, like source maintenance's allowlist.
+    pubspec = Path("pubspec.yaml")
+    if (base.resolve() == Path("ios").resolve() and pubspec.is_file()
+            and _write_pubspec_version(pubspec, new_version)):
+        pbx = _resolve_pbxproj_path()
+        if pbx is not None:
+            _write_pbxproj_marketing_version(pbx, new_version, _LITERAL_MARKETING_LINE)
+        return True
     spec_bases = {Path(".").resolve()}
     if base.exists():
         spec_bases.add(base.resolve())

package/android-action/action.yml

@@ -178,9 +178,9 @@ runs:
     # here while the safety net lived in the workflow, that pairing would ship
     # obfuscated bundles and destroy the only copy of their symbols with the
     # runner. Whatever obfuscation needs to be safe must travel in the same
-    # file as the flag. No retention-days: the repository's
-    # own artifact retention setting governs, and unlike a fixed number it can
-    # be raised to cover the life of a release.
+    # file as the flag. No retention-days: the artifact retention setting
+    # governs (an organization can cap it at days), so the durable copy is the
+    # Crashlytics upload below.
     - name: Retain Dart symbol files
       if: ${{ steps.config.outputs.project_kind == 'flutter' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5

package/android-action/play-upload/run.cjs

@@ -32,21 +32,6 @@ async function upload(program, env, directory, execute = processRunner.execute,
   }
 }
 
-//: A code reaches the annotation only as a bare token: it is interpolated into
-//: workflow-command syntax, so anything outside this shape is reported as such
-//: rather than trusted.
-function state(code) {
-  return typeof code === 'string' && /^[a-z0-9_]{1,64}$/.test(code) ? code : 'unknown';
-}
-
-function stateAnnotation(receipt) {
-  return `::${receipt.ok === true ? 'notice' : 'error'} title=play_upload_state::`
-    + `gowalk-cicd/play-upload-state.v1 ok=${receipt.ok === true}`
-    + ` code=${state(receipt.code)} review_pending=${receipt.review_pending === true}`
-    + ` attempts=${Number.isSafeInteger(receipt.attempts) ? receipt.attempts : 'unknown'}`;
-}
-
-
 async function main() {
   let directory, receipt;
   try {
@@ -80,27 +65,12 @@ async function main() {
   if (process.env.GITHUB_OUTPUT) {
     appendFileSync(process.env.GITHUB_OUTPUT, `review-pending=${receipt.review_pending}\nreceipt=${encoded}\n`);
   }
+  // The panel parses a success receipt even when a multi-line secret masks its outer braces.
   console.log(`::${receipt.ok ? 'notice' : 'error'} title=play_upload_result::${encoded}`);
-  // The JSON receipt above does not survive as a READABLE annotation on this job.
-  // `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` is a multi-line JSON secret, so Actions
-  // registers each of its lines as maskable — and its first and last lines are a
-  // bare `{` and `}`. Every brace in this job's output is therefore replaced by
-  // `***`, leaving the payload legible to a person but not parseable by the
-  // panel, which reads typed check-run annotations and is forbidden the log text.
-  // The iOS job emits the same JSON shape unmasked, which is what isolates the
-  // cause to this job's secret rather than to redaction policy in general.
-  //
-  // So the decision-relevant fields also go out brace-free, in the same
-  // key=value shape as `play_upload_diagnostic` — which is emitted from this
-  // very action and arrives unmasked. `review_pending` is the field that
-  // distinguishes an upload from a submission, and losing it is how a green
-  // Android job reads as "Play is done" when the AAB sits unreviewed on a
-  // test track.
-  console.log(stateAnnotation(receipt));
   if (!receipt.ok) process.exitCode = 1;
 }
 
-module.exports = {upload, main, state, stateAnnotation};
+module.exports = {upload, main};
 if (require.main === module) void main().catch(() => {
   process.stderr.write('play_upload_receipt_failed\n'); process.exitCode = 1;
 });

package/docs/CANDIDATE_ARTIFACTS.md

@@ -36,6 +36,15 @@ choice inside that expression, and runs its reviewed build-only steps (Xcode sel
 macOS only. The candidate receipt carries the checkout-relative source Info.plist, so a promotion
 can persist a planned version without `xcodebuild`.
 
+A candidate IPA whose build number App Store Connect has since consumed is rebuilt, not reused:
+once any source `next_build_number.py` reads holds that number or a higher one, and the
+(version, build) upload is not this very IPA, admission answers `consumed`: the macOS job skips the
+restore on every attempt and builds under a fresh number (a "Re-run all jobs" asks admission again).
+An interrupted upload of the same bytes still resumes. Admission reads only the receipt from the
+artifact (its zip directory and one entry, by range) and asks with the `ASC_KEY_*` secrets; every
+other restore repeats the probe with the key in `creds/`. A probe that cannot answer within 30
+seconds keeps the reuse and logs its failure code.
+
 The iOS action restores the frozen build number, marketing version, metadata and symbols, discovers
 the current ASC key, and runs its existing version-slot, upload and metadata operations. A changed
 store version cannot silently relabel an existing IPA. Candidate version planning can select the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.171",
+  "version": "1.0.172",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-web.yml

@@ -58,4 +58,4 @@ jobs:
           name: web-${{ github.event.repository.name }}-${{ github.run_number }}
           path: build/web
           if-no-files-found: error
-          retention-days: 30
+          retention-days: 7

package/templates/deploy.yml

@@ -43,13 +43,19 @@ jobs:
           MOBILE_CANDIDATE_BUILD: ${{ inputs.candidate-build && 'true' || 'false' }}
         run: node .github/actions/swift-app/scripts/mobile_release.cjs admit "$DEPLOY_PLATFORMS"
       # A verified candidate IPA only needs REST calls to ship, so the iOS job
-      # takes a Linux runner for it (see the job's runs-on). Reads only.
+      # takes a Linux runner for it (see the job's runs-on). Reads only: the
+      # ASC key asks App Store Connect whether the candidate's build number is
+      # still free; a consumed one answers 'consumed' and is rebuilt on macOS
+      # under a fresh number.
       - name: Look up the candidate iOS binary
         id: ios_candidate
         if: ${{ !inputs.candidate-build && steps.intent.outputs.ios != '' }}
         env:
           GITHUB_TOKEN: ${{ github.token }}
           MOBILE_RELEASE_VARIABLES: ${{ toJSON(vars) }}
+          CI_ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+          CI_ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          CI_ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
         run: node .github/actions/swift-app/scripts/mobile_artifact_inventory.cjs lookup ios
   # Repository variable DEPLOY_PLATFORMS selects which stores this repo ships to:
   #   unset / 'both' — iOS and Android (the default)
@@ -77,9 +83,9 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: true
-      # Placeholder artwork and missing icon coverage are refused from the
-      # checkout alone, so they fail here in under a second instead of after
-      # the Flutter setup and the Pods pass.
+      # Placeholder artwork, missing icon coverage and CocoaPods lock drift are
+      # refused from the checkout alone, so they fail here in under a second
+      # instead of after the Flutter setup and the Pods pass.
       - name: Source preflight
         shell: bash
         run: python3 .github/actions/swift-app/scripts/source_preflight.py "$GITHUB_WORKSPACE"
@@ -113,9 +119,11 @@ jobs:
           printf '%s' "$CI_DISTRIBUTION_META" | base64 --decode > creds/cert.meta.json
           printf '%s' "$CI_DISTRIBUTION_REGISTRY" | base64 --decode > creds/cert.registry.json
           echo "source=encrypted" >> "$GITHUB_OUTPUT"
+      # A build number App Store Connect consumed never frees up, so no attempt
+      # restores a candidate admission answered 'consumed' for.
       - name: Reuse matching candidate binary
         id: reuse
-        if: ${{ !inputs.candidate-build }}
+        if: ${{ !inputs.candidate-build && needs.release.outputs.ios-candidate != 'consumed' }}
         shell: bash
         run: node .github/actions/swift-app/scripts/mobile_artifact_inventory.cjs restore ios
       # Linux cannot build. Nothing has reached a provider yet, so a re-run of the
@@ -277,8 +285,8 @@ jobs:
           fi
       # BUILD_NUMBER comes from the action through GITHUB_ENV, so the artifact
       # is named after the TestFlight build it belongs to. No retention-days:
-      # the repository's artifact retention setting governs (90 days unless
-      # raised), and a crash reporter needs its own copy — see the README.
+      # the artifact retention setting governs (an organization can cap it at
+      # days), so a crash reporter needs its own copy — see the README.
       - name: Retain Dart symbol files
         if: ${{ !cancelled() && steps.ios_symbols.outputs.present == 'true' }}
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -547,6 +555,8 @@ jobs:
           # same define the iOS job passes. Empty leaves the app's default.
           dart-defines: >-
             ${{ vars.ONBOARDING_PUBLIC_ORIGIN != '' && format('ONBOARDING_PUBLIC_ORIGIN={0}', vars.ONBOARDING_PUBLIC_ORIGIN) || '' }}
+      # Keep: a package not yet bound to Play skips the API upload, and the panel's
+      # initial Play setup uploads this bundle through the console.
       - name: Retain signed Android App Bundle
         if: ${{ !inputs.candidate-build }}
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -556,7 +566,7 @@ jobs:
           name: android-${{ steps.android.outputs.package-name || steps.reuse.outputs.package-name }}-${{ steps.android.outputs.build-number || steps.reuse.outputs.build-number }}
           path: ${{ steps.android.outputs.bundle-path || steps.reuse.outputs.bundle-path }}
           if-no-files-found: error
-          retention-days: 30
+          retention-days: 7
       - name: Package candidate shipping binary
         id: candidate_binary
         if: ${{ inputs.candidate-build }}