gowalk-cicd 1.0.173 → 1.0.174

package/README.md

@@ -47,6 +47,8 @@ workflow the package does not manage that fails to parse is skipped with
 Ready task PRs build shipping binaries alongside validation; the protected merge promotes matching
 binaries through the existing store upload paths. See [candidate artifact reuse](docs/CANDIDATE_ARTIFACTS.md)
 for identity checks, native dependency caches, version handling and adoption of custom workflows.
+For the 2–5 minute delivery target, immutable native bootstrap, verified native-check reuse and
+runner-time receipts, see [CI performance](docs/CI_PERFORMANCE.md).
 
 Mobile delivery requires an explicit release intent. After source, signing, account transport,
 and integration readiness pass, run on the task branch:

package/action/scripts/ci_performance.cjs

@@ -0,0 +1,80 @@
+/* Safe Actions timing receipts. Estimates use rounded job time, never claim to be an invoice. */
+'use strict';
+const fs = require('node:fs');
+const {join} = require('node:path');
+const api = require('./mobile_release_api.cjs');
+
+function seconds(start, end) {
+  const value = (Date.parse(end) - Date.parse(start)) / 1000;
+  return Number.isFinite(value) ? Math.max(0, Math.round(value)) : null;
+}
+
+function category(name) {
+  if (/process|poll|wait/i.test(name)) return 'provider_or_workflow_wait';
+  if (/upload|TestFlight|Google Play/i.test(name)) return 'provider_operation';
+  if (/cache|dependencies|Flutter|Java|Xcode|install/i.test(name)) return 'setup_or_cache';
+  if (/test|coverage|validation/i.test(name)) return 'validation';
+  if (/build|archive|compile|export/i.test(name)) return 'build';
+  return 'other';
+}
+
+function summarize(run, jobs, reuse = {}) {
+  const completed = jobs.filter(job => job.started_at && job.completed_at);
+  const estimates = {};
+  const rows = completed.map(job => {
+    const labels = (job.labels || []).join(' ').toLowerCase();
+    const os = /macos/.test(labels) ? 'macos' : /ubuntu|linux/.test(labels) ? 'linux' : 'unknown';
+    const duration = seconds(job.started_at, job.completed_at);
+    estimates[os] = (estimates[os] || 0) + Math.ceil((duration || 0) / 60);
+    return {id: job.id, name: job.name, conclusion: job.conclusion, os, execution_seconds: duration,
+      steps: (job.steps || []).map(step => ({name: step.name, conclusion: step.conclusion,
+        category: category(step.name), seconds: seconds(step.started_at, step.completed_at)}))};
+  });
+  const last = completed.map(job => job.completed_at).sort().at(-1);
+  return {schema: 'gowalk-cicd/ci-performance.v1', run_id: run.id, run_attempt: run.run_attempt,
+    source_sha: run.head_sha, queue_seconds: run.run_attempt === 1 ? seconds(run.created_at, run.run_started_at) : null,
+    retry_elapsed_before_attempt_seconds: run.run_attempt > 1 ? seconds(run.created_at, run.run_started_at) : 0,
+    delivery_execution_seconds: seconds(run.run_started_at, last),
+    delivery_wall_seconds: seconds(run.created_at, last),
+    estimated_rounded_runner_minutes: estimates, incomplete_jobs: jobs.length - completed.length,
+    reuse, jobs: rows, billing_note: 'Job time estimates only; excludes unfinished jobs and account credits'};
+}
+
+async function collect() {
+  const id = Number(process.env.GITHUB_RUN_ID), attempt = Number(process.env.GITHUB_RUN_ATTEMPT);
+  if (!Number.isSafeInteger(id) || !Number.isSafeInteger(attempt)) throw Error('ci_performance_run_invalid');
+  const run = await api.request('GET', `/actions/runs/${id}/attempts/${attempt}`, undefined, 10000);
+  const jobs = [];
+  for (let page = 1; page <= 5; page++) {
+    const result = await api.request('GET', `/actions/runs/${id}/attempts/${attempt}/jobs?per_page=100&page=${page}`,
+      undefined, 10000);
+    if (!Array.isArray(result.jobs)) throw Error('ci_performance_jobs_invalid');
+    jobs.push(...result.jobs);
+    if (result.jobs.length < 100) break;
+  }
+  const reuse = JSON.parse(process.env.CI_BINARY_REUSE || '{}');
+  return summarize(run, jobs, Object.fromEntries(Object.entries(reuse)
+    .filter(([key, value]) => ['ios', 'android'].includes(key) && ['true', 'false', ''].includes(value))));
+}
+
+async function main() {
+  const receipt = await collect(), target = Number(process.env.CI_DELIVERY_TARGET_SECONDS || 300);
+  const file = join(process.env.RUNNER_TEMP, 'ci-performance.json');
+  fs.writeFileSync(file, JSON.stringify(receipt, null, 2) + '\n');
+  if (process.env.GITHUB_OUTPUT) fs.appendFileSync(process.env.GITHUB_OUTPUT, `receipt-path=${file}\n`);
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    const minutes = JSON.stringify(receipt.estimated_rounded_runner_minutes);
+    fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY,
+      `Delivery: ${receipt.delivery_wall_seconds}s; queue ${receipt.queue_seconds ?? 'unknown on retry'}; ` +
+      `attempt ${receipt.run_attempt}; rounded completed runner minutes ${minutes}.\n`);
+  }
+  if (receipt.delivery_wall_seconds > target) {
+    console.log(`::warning title=ci_delivery_latency::Delivery ${receipt.delivery_wall_seconds}s exceeds ${target}s; ` +
+      'inspect ci-performance.json and repair the slow stage without reducing coverage');
+  }
+}
+
+module.exports = {seconds, category, summarize, collect, main};
+if (require.main === module) main().catch(() => {
+  console.log('::notice title=ci_performance_unavailable::Timing metadata unavailable; validation remains required');
+});

package/action/scripts/mobile_artifact_inventory.cjs

@@ -46,12 +46,17 @@ async function candidate(artifact) {
 async function find(platform, deadline) {
   const fingerprint = identity(platform);
   const prefix = `mobile-binary-${platform}-${fingerprint}-`;
-  const inventory = await api.request('GET', '/actions/artifacts?per_page=100', undefined, 5000);
-  if (!Array.isArray(inventory.artifacts)) throw Error('mobile_artifact_inventory_invalid');
-  for (const artifact of inventory.artifacts.filter(row => row.name?.startsWith(prefix)).slice(0, 5)) {
-    if (Date.now() >= deadline) break;
-    const run = await candidate(artifact);
-    if (run && artifact.name === `${prefix}${run.id}-${run.artifact_attempt}`) return {artifact, run, fingerprint};
+  let checked = 0;
+  for (let page = 1; page <= 10 && Date.now() < deadline; page++) {
+    const inventory = await api.request('GET', `/actions/artifacts?per_page=100&page=${page}`, undefined,
+      Math.max(1, Math.min(5000, deadline - Date.now())));
+    if (!Array.isArray(inventory.artifacts)) throw Error('mobile_artifact_inventory_invalid');
+    for (const artifact of inventory.artifacts.filter(row => row.name?.startsWith(prefix))) {
+      if (Date.now() >= deadline || checked++ >= 5) return null;
+      const run = await candidate(artifact);
+      if (run && artifact.name === `${prefix}${run.id}-${run.artifact_attempt}`) return {artifact, run, fingerprint};
+    }
+    if (inventory.artifacts.length < 100) break;
   }
   return null;
 }

package/action/scripts/native_bootstrap.py

@@ -0,0 +1,136 @@
+"""Resolve the latest public package once; install only its verified immutable native helpers."""
+from __future__ import annotations
+
+import base64
+import hashlib
+import io
+import json
+import os
+from pathlib import Path, PurePosixPath
+import re
+import sys
+import tarfile
+from urllib.parse import urlparse
+from urllib.request import urlopen
+
+REGISTRY = "https://registry.npmjs.org/gowalk-cicd"
+SCHEMA = "gowalk-cicd/native-tooling.v1"
+LIMIT = 8 * 1024 * 1024
+
+
+def read(url: str) -> bytes:
+    parsed = urlparse(url)
+    if parsed.scheme != "https" or parsed.netloc != "registry.npmjs.org" or parsed.username:
+        raise ValueError("native_tooling_origin_invalid")
+    with urlopen(url, timeout=20) as response:
+        if urlparse(response.url).netloc != "registry.npmjs.org":
+            raise ValueError("native_tooling_origin_invalid")
+        data = response.read(LIMIT + 1)
+    if len(data) > LIMIT:
+        raise ValueError("native_tooling_response_too_large")
+    return data
+
+
+def metadata(version: str) -> dict:
+    if version != "latest" and not re.fullmatch(r"\d+\.\d+\.\d+", version):
+        raise ValueError("native_tooling_version_invalid")
+    value = json.loads(read(f"{REGISTRY}/{version}"))
+    selected, dist = value.get("version", ""), value.get("dist", {})
+    if (value.get("name") != "gowalk-cicd" or not re.fullmatch(r"\d+\.\d+\.\d+", selected)
+            or (version != "latest" and version != selected)
+            or dist.get("tarball") != f"{REGISTRY}/-/gowalk-cicd-{selected}.tgz"
+            or not re.fullmatch(r"sha512-[A-Za-z0-9+/]{86}==", dist.get("integrity", ""))):
+        raise ValueError("native_tooling_metadata_invalid")
+    return {"schema": SCHEMA, "version": selected, "integrity": dist["integrity"], "tarball": dist["tarball"]}
+
+
+def archive(release: dict) -> dict[str, bytes]:
+    content = read(release["tarball"])
+    digest = "sha512-" + base64.b64encode(hashlib.sha512(content).digest()).decode()
+    if digest != release["integrity"]:
+        raise ValueError("native_tooling_integrity_mismatch")
+    files = {}
+    with tarfile.open(fileobj=io.BytesIO(content), mode="r:gz") as package:
+        for member in package.getmembers():
+            path = PurePosixPath(member.name)
+            if not (member.name.startswith("package/action/scripts/")
+                    or member.name.startswith("package/android-action/scripts/")):
+                continue
+            if member.isdir():
+                continue
+            if not member.isfile() or ".." in path.parts or member.size > 2 * 1024 * 1024:
+                raise ValueError("native_tooling_archive_invalid")
+            name = str(path.relative_to("package"))
+            if name in files:
+                raise ValueError("native_tooling_archive_invalid")
+            files[name] = package.extractfile(member).read()
+    if "action/scripts/native_validation.cjs" not in files:
+        raise ValueError("native_tooling_release_missing_validation")
+    return files
+
+
+def hashes(files: dict[str, bytes]) -> dict:
+    return {name: hashlib.sha256(data).hexdigest() for name, data in sorted(files.items())}
+
+
+def output(values: dict) -> None:
+    destination = os.environ.get("GITHUB_OUTPUT")
+    if destination:
+        with open(destination, "a") as stream:
+            for key, value in values.items():
+                if "\n" in str(value) or "\r" in str(value):
+                    raise ValueError("native_tooling_output_invalid")
+                stream.write(f"{key}={value}\n")
+    else:
+        print(json.dumps(values))
+
+
+def resolve(receipt: Path) -> None:
+    release = metadata("latest")
+    release["files"] = hashes(archive(release))
+    receipt.parent.mkdir(parents=True, exist_ok=True)
+    receipt.write_text(json.dumps(release, sort_keys=True) + "\n")
+    output({"version": release["version"], "integrity": release["integrity"],
+            "receipt-path": str(receipt), "release-json": json.dumps(release, separators=(",", ":"))})
+
+
+def install(receipt: Path, destination: Path) -> None:
+    if destination.is_symlink():
+        raise ValueError("native_tooling_destination_invalid")
+    destination = destination.resolve()
+    release = json.loads(receipt.read_text())
+    expected = metadata(release.get("version", ""))
+    if any(release.get(key) != value for key, value in expected.items()):
+        raise ValueError("native_tooling_release_changed")
+    files = archive(expected)
+    if release.get("files") != hashes(files):
+        raise ValueError("native_tooling_helper_mismatch")
+    destination.mkdir(parents=True, exist_ok=True)
+    for name, data in files.items():
+        target = destination / name
+        if target.is_symlink() or any(parent.is_symlink() for parent in target.parents):
+            raise ValueError("native_tooling_destination_invalid")
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes(data)
+    (destination / "release.json").write_text(json.dumps(release, sort_keys=True) + "\n")
+    output({"version": release["version"], "integrity": release["integrity"],
+            "scripts": str(destination / "action/scripts"),
+            "android-scripts": str(destination / "android-action/scripts")})
+
+
+def main() -> None:
+    if len(sys.argv) == 3 and sys.argv[1] == "resolve":
+        resolve(Path(sys.argv[2]))
+    elif len(sys.argv) == 4 and sys.argv[1] == "install":
+        install(Path(sys.argv[2]), Path(sys.argv[3]))
+    else:
+        raise ValueError("native_tooling_command_invalid")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except Exception as error:
+        code = str(error) if re.fullmatch(r"native_tooling_[a-z_]+", str(error)) else "native_tooling_unavailable"
+        print(f"::error title=native_tooling_refused::{code}", file=sys.stderr)
+        raise SystemExit(1) from None

package/action/scripts/native_validation.cjs

@@ -0,0 +1,82 @@
+/* Reuse completed native coverage only when every declared source, workflow and execution input matches. */
+'use strict';
+const fs = require('node:fs');
+const {join} = require('node:path');
+const inputs = require('./native_validation_inputs.cjs');
+const github = require('./native_validation_github.cjs');
+const SCHEMA = 'gowalk-cicd/native-validation.v1';
+
+function output(values) {
+  if (!process.env.GITHUB_OUTPUT) return console.log(JSON.stringify(values));
+  for (const [name, value] of Object.entries(values)) {
+    if (/[\r\n]/.test(String(value))) throw Error('native_validation_output_invalid');
+    fs.appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`);
+  }
+}
+
+async function lookup(config, values, fingerprint) {
+  const deadline = Date.now() + 30000;
+  const name = `native-validation-${fingerprint}`;
+  const inventory = await github.request(`/actions/artifacts?name=${name}&per_page=20`, deadline);
+  if (!Array.isArray(inventory.artifacts)) throw Error('native_validation_inventory_invalid');
+  for (const artifact of inventory.artifacts.slice(0, 5)) {
+    if (artifact.name !== name || artifact.expired !== false || Date.now() >= deadline) continue;
+    const receipt = await github.download(artifact, deadline);
+    if (receipt.schema !== SCHEMA || receipt.fingerprint !== fingerprint ||
+        !Number.isSafeInteger(receipt.run_id) || !Number.isSafeInteger(receipt.run_attempt)) continue;
+    if (!await github.producer(artifact, receipt, config, deadline)) continue;
+    // A present local commit gives an independent tree proof; absent commits are a safe miss.
+    if (inputs.fingerprint(config, values, receipt.source_sha) !== fingerprint) continue;
+    return {'source-run': receipt.run_id, 'source-sha': receipt.source_sha,
+      reused: 'true', 'reuse-reason': 'verified_identical_inputs'};
+  }
+  return {reused: 'false', 'reuse-reason': 'no_matching_success'};
+}
+
+function record(config, fingerprint) {
+  const receipt = {schema: SCHEMA, fingerprint, source_sha: inputs.git('rev-parse', 'HEAD').trim(),
+    run_id: Number(process.env.GITHUB_RUN_ID), run_attempt: Number(process.env.GITHUB_RUN_ATTEMPT),
+    run_head_sha: process.env.GITHUB_SHA};
+  if (!Number.isSafeInteger(receipt.run_id) || receipt.run_id <= 0 ||
+      !Number.isSafeInteger(receipt.run_attempt) || receipt.run_attempt <= 0 ||
+      !/^[a-f0-9]{40}$/.test(receipt.run_head_sha || '')) throw Error('native_validation_run_invalid');
+  const directory = join(process.env.RUNNER_TEMP, 'gowalk-native-validation');
+  fs.mkdirSync(directory, {recursive: true});
+  const file = join(directory, 'native-validation.json');
+  fs.writeFileSync(file, JSON.stringify(receipt) + '\n');
+  return {'receipt-path': file};
+}
+
+async function main([operation, file]) {
+  if (!['lookup', 'record'].includes(operation) || !file) throw Error('native_validation_command_invalid');
+  const config = inputs.configuration(file);
+  let values;
+  try { values = inputs.context(config); }
+  catch (error) {
+    if (operation !== 'lookup') throw error;
+    return output({reused: 'false', 'reuse-reason': 'external_or_execution_context_unavailable'});
+  }
+  let fingerprint;
+  try { fingerprint = inputs.fingerprint(config, values); }
+  catch (error) {
+    if (operation !== 'lookup') throw error;
+    return output({reused: 'false', 'reuse-reason': 'inputs_unverifiable'});
+  }
+  let result;
+  if (operation === 'record') result = record(config, fingerprint);
+  else {
+    try { result = await lookup(config, values, fingerprint); }
+    catch {
+      result = {reused: 'false', 'reuse-reason': 'proof_unavailable'};
+      console.log('::notice::Native validation proof unavailable; run full coverage');
+    }
+  }
+  output({fingerprint, 'artifact-name': `native-validation-${fingerprint}`, ...result});
+}
+
+module.exports = {SCHEMA, output, lookup, record, main};
+if (require.main === module) main(process.argv.slice(2)).catch(error => {
+  const code = /^native_validation_[a-z_]+$/.test(error.message) ? error.message : 'native_validation_unavailable';
+  console.error(`::error title=native_validation_refused::${code}`);
+  process.exitCode = 1;
+});

package/action/scripts/native_validation_github.cjs

@@ -0,0 +1,73 @@
+/* Bounded read-only GitHub proof; artifact names alone never establish successful validation. */
+'use strict';
+const {inflateRawSync} = require('node:zlib');
+const {createHash} = require('node:crypto');
+const api = require('./mobile_release_api.cjs');
+
+async function request(path, deadline) {
+  const remaining = deadline - Date.now();
+  if (remaining <= 0) throw Error('native_validation_lookup_deadline');
+  return api.request('GET', path, undefined, Math.min(5000, remaining));
+}
+
+async function producer(artifact, receipt, config, deadline) {
+  const run = await request(`/actions/runs/${receipt.run_id}/attempts/${receipt.run_attempt}`, deadline);
+  const repo = process.env.GITHUB_REPOSITORY;
+  if (artifact.workflow_run?.id !== run.id || run.id !== receipt.run_id ||
+      run.run_attempt !== receipt.run_attempt || run.status !== 'completed' || run.conclusion !== 'success' ||
+      !['push', 'pull_request'].includes(run.event) || run.path !== config.workflow ||
+      run.repository?.full_name !== repo || run.head_repository?.full_name !== repo ||
+      run.head_sha !== receipt.source_sha || !/^[a-f0-9]{40}$/.test(receipt.run_head_sha || '') ||
+      (run.event === 'push' && receipt.run_head_sha !== receipt.source_sha)) return false;
+  const jobs = await request(`/actions/runs/${run.id}/attempts/${run.run_attempt}/jobs?per_page=100`, deadline);
+  if (!Array.isArray(jobs.jobs) || jobs.total_count > 100 || jobs.jobs.length >= 100) return false;
+  return config.jobs.every(required => {
+    const matches = jobs.jobs.filter(job => job.name === required.name);
+    return matches.length === 1 && matches[0].head_sha === run.head_sha && matches[0].conclusion === 'success' &&
+      required.steps.every(name => matches[0].steps?.some(step => step.name === name && step.conclusion === 'success'));
+  });
+}
+
+function unpack(bytes) {
+  const end = bytes.lastIndexOf(Buffer.from('504b0506', 'hex'));
+  if (end < 0 || bytes.readUInt16LE(end + 10) !== 1) throw Error('native_validation_artifact_invalid');
+  const at = bytes.readUInt32LE(end + 16);
+  if (bytes.readUInt32LE(at) !== 0x02014b50) throw Error('native_validation_artifact_invalid');
+  const length = bytes.readUInt16LE(at + 28), method = bytes.readUInt16LE(at + 10);
+  const name = bytes.toString('utf8', at + 46, at + 46 + length);
+  if (name !== 'native-validation.json' || ![0, 8].includes(method)) throw Error('native_validation_artifact_invalid');
+  const local = bytes.readUInt32LE(at + 42), packed = bytes.readUInt32LE(at + 20);
+  const start = local + 30 + bytes.readUInt16LE(local + 26) + bytes.readUInt16LE(local + 28);
+  const content = bytes.subarray(start, start + packed);
+  return JSON.parse((method ? inflateRawSync(content, {maxOutputLength: 65536}) : content).toString('utf8'));
+}
+
+async function download(artifact, deadline) {
+  if (!Number.isSafeInteger(artifact.id) || !/^sha256:[a-f0-9]{64}$/.test(artifact.digest || '') ||
+      artifact.size_in_bytes > 131072) throw Error('native_validation_artifact_invalid');
+  const signal = () => AbortSignal.timeout(Math.max(1, Math.min(5000, deadline - Date.now())));
+  const url = `https://api.github.com/repos/${process.env.GITHUB_REPOSITORY}/actions/artifacts/${artifact.id}/zip`;
+  const response = await fetch(url, {redirect: 'manual', signal: signal(), headers: {
+    Authorization: `Bearer ${process.env.GITHUB_TOKEN || ''}`, 'User-Agent': 'gowalk-cicd'}});
+  const location = new URL(response.headers.get('location') || 'https://invalid.invalid');
+  if (response.status !== 302 || location.protocol !== 'https:' || location.username || location.password ||
+      !/(?:\.blob\.core\.windows\.net|\.githubusercontent\.com)$/.test(location.hostname)) {
+    throw Error('native_validation_artifact_unavailable');
+  }
+  const body = await fetch(location, {redirect: 'error', signal: signal()});
+  if (!body.ok) throw Error('native_validation_artifact_unavailable');
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of body.body) {
+    size += chunk.length;
+    if (size > 131072) throw Error('native_validation_artifact_too_large');
+    chunks.push(chunk);
+  }
+  const bytes = Buffer.concat(chunks);
+  if ('sha256:' + createHash('sha256').update(bytes).digest('hex') !== artifact.digest) {
+    throw Error('native_validation_artifact_digest_mismatch');
+  }
+  return unpack(bytes);
+}
+
+module.exports = {request, producer, unpack, download};

package/action/scripts/native_validation_inputs.cjs

@@ -0,0 +1,68 @@
+/* Exact native validation inputs. Unknown projects use input_paths: ['.']. */
+'use strict';
+const fs = require('node:fs');
+const {execFileSync} = require('node:child_process');
+const {createHash} = require('node:crypto');
+const {join} = require('node:path');
+const hash = value => createHash('sha256').update(value).digest('hex');
+const git = (...args) => execFileSync('git', args, {encoding: 'utf8', timeout: 10000,
+  stdio: ['ignore', 'pipe', 'ignore']});
+const HELPERS = ['native_validation.cjs', 'native_validation_inputs.cjs', 'native_validation_github.cjs',
+  'mobile_release_api.cjs'];
+
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])]));
+}
+
+function configuration(file) {
+  if (fs.lstatSync(file).isSymbolicLink()) throw Error('native_validation_config_invalid');
+  const config = JSON.parse(fs.readFileSync(file, 'utf8'));
+  const list = value => Array.isArray(value) && value.length > 0 && value.length <= 100;
+  const path = value => typeof value === 'string' && value.length > 0 && value.length < 300 &&
+    !value.startsWith('/') && !/[\r\n\\*?\[\]]/.test(value) && !value.split('/').includes('..');
+  const fields = ['schema', 'input_paths', 'workflow', 'jobs', 'context_keys', 'external_context_keys'];
+  if (Object.keys(config).some(key => !fields.includes(key)) ||
+      config.schema !== 1 || !list(config.input_paths) || !config.input_paths.every(path) ||
+      !/^\.github\/workflows\/[\w.-]+\.ya?ml$/.test(config.workflow || '') || !list(config.jobs) ||
+      !config.jobs.every(job => typeof job.name === 'string' && job.name.length > 0 &&
+        list(job.steps) && job.steps.every(step => typeof step === 'string' && step.length > 0)) ||
+      !list(config.context_keys) || !config.context_keys.every(key => /^[a-zA-Z_][\w.-]*$/.test(key)) ||
+      !['package_version', 'package_integrity'].every(key => config.context_keys.includes(key)) ||
+      !Array.isArray(config.external_context_keys) ||
+      config.external_context_keys.some(key => !config.context_keys.includes(key))) {
+    throw Error('native_validation_config_invalid');
+  }
+  return config;
+}
+
+function context(config) {
+  const values = JSON.parse(process.env.NATIVE_VALIDATION_CONTEXT || '{}');
+  if (config.context_keys.some(key => typeof values[key] !== 'string' || !values[key].trim())) {
+    throw Error('native_validation_context_missing');
+  }
+  if (config.external_context_keys.some(key => !/^sha256:[a-f0-9]{64}$/.test(values[key]))) {
+    throw Error('native_validation_external_witness_missing');
+  }
+  return Object.fromEntries(config.context_keys.map(key => [key, values[key]]));
+}
+
+function selected(name, config) {
+  return name.startsWith('.github/') || config.input_paths.some(path =>
+    path === '.' || name === path.replace(/\/$/, '') || name.startsWith(path.replace(/\/$/, '') + '/'));
+}
+
+function fingerprint(config, values, ref = 'HEAD') {
+  const rows = git('ls-tree', '-r', '-z', ref).split('\0').filter(Boolean).filter(row =>
+    selected(row.slice(row.indexOf('\t') + 1), config));
+  if (!rows.length || rows.some(row => !/^100(?:644|755) blob [a-f0-9]{40}\t/.test(row))) {
+    throw Error('native_validation_source_unverifiable');
+  }
+  if (ref === 'HEAD' && git('diff', '--name-only', '-z', 'HEAD').split('\0')
+    .some(name => name && selected(name, config))) throw Error('native_validation_inputs_dirty');
+  const helper = HELPERS.map(file => [file, hash(fs.readFileSync(join(__dirname, file)))]);
+  return hash(JSON.stringify(canonical({config, context: values, source: rows.sort(), helper})));
+}
+
+module.exports = {canonical, configuration, context, selected, fingerprint, git, hash};

package/action/scripts/upload_build.py

@@ -165,14 +165,17 @@ def deliver(ipa: Path, report: Path, timeout: int) -> dict:
     receipt.update("file_reserved", file_id=file["id"])
     transfer_all(ipa, file, info)
     receipt.update("transferred")
-    deadline = time.monotonic() + timeout
+    processing_started = time.monotonic()
+    deadline = processing_started + timeout
     while True:
         current = api("GET", f"/buildUploads/{record['id']}", params={"include": "build"})["data"]
         state = ((current.get("attributes") or {}).get("state") or {}).get("state")
         build_id = (((current.get("relationships") or {}).get("build") or {}).get("data") or {}).get("id")
         if state == "COMPLETE":
-            return receipt.update("complete", state=state, build_id=build_id)
-        receipt.update("processing", state=state, build_id=build_id)
+            return receipt.update("complete", state=state, build_id=build_id,
+                                  processing_seconds=round(time.monotonic() - processing_started, 3))
+        receipt.update("processing", state=state, build_id=build_id,
+                       processing_seconds=round(time.monotonic() - processing_started, 3))
         if state == "FAILED":
             raise UploadError("processing_failed",
                               "Apple build upload failed processing; inspect the upload ID's provider errors")

package/android-action/scripts/prime_gradle.py

@@ -0,0 +1,63 @@
+"""Prime release dependency artifacts without compiling, signing, testing or uploading an app."""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+
+from android_config import find_gradle_root, project_kind
+from gradle_wrapper import ensure_toolchain
+
+INIT = """
+gradle.projectsEvaluated {
+    rootProject.tasks.register('gowalkPrimeDependencies') {
+        doLast {
+            int resolved = 0
+            rootProject.allprojects.each { target ->
+                target.configurations.findAll { config ->
+                    config.canBeResolved && config.name.toLowerCase().contains('release') &&
+                        config.name.toLowerCase().endsWith('classpath')
+                }.each { config ->
+                    config.resolvedConfiguration.resolvedArtifacts.each { artifact -> artifact.file.length() }
+                    resolved++
+                }
+            }
+            if (resolved == 0) throw new GradleException('No release dependency configuration')
+        }
+    }
+}
+"""
+
+
+def prepare(root: Path, run=subprocess.run) -> Path:
+    if project_kind(root) == "flutter":
+        run(["flutter", "pub", "get"], cwd=root, check=True, timeout=60,
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        sdk = Path(os.environ["FLUTTER_ROOT"])
+        ensure_toolchain(root, sdk)
+        properties = root / "android/local.properties"
+        lines = properties.read_text().splitlines() if properties.exists() else []
+        lines = [line for line in lines if not line.startswith(("flutter.sdk=", "sdk.dir="))]
+        lines.extend([f"flutter.sdk={sdk}", f"sdk.dir={os.environ['ANDROID_HOME']}"])
+        properties.write_text("\n".join(lines) + "\n")
+    return find_gradle_root(root)
+
+
+def prime(root: Path, run=subprocess.run) -> None:
+    directory = prepare(root, run)
+    wrapper = directory / "gradlew"
+    wrapper.chmod(wrapper.stat().st_mode | 0o100)
+    with tempfile.TemporaryDirectory(prefix="gowalk-prime-", dir=os.environ.get("RUNNER_TEMP")) as scratch:
+        init = Path(scratch) / "dependencies.gradle"
+        init.write_text(INIT)
+        run([str(wrapper), "--no-daemon", "--console=plain", "--init-script", str(init),
+             "gowalkPrimeDependencies"], cwd=directory, check=True, timeout=180,
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+
+if __name__ == "__main__":
+    try:
+        prime(Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve())
+    except (OSError, ValueError, RuntimeError, subprocess.SubprocessError):
+        raise SystemExit("Dependency priming unavailable; the required build resolves its dependencies") from None

package/docs/CI_PERFORMANCE.md

@@ -0,0 +1,107 @@
+# Native validation and delivery time
+
+Keep routine push-to-verified delivery within 2–5 minutes. Preserve every required check and
+coverage assertion. Measure regressions and fix the slow stage in the same task; lowering a
+timeout, skipping a failed test or calling a transferred binary production-ready is not a fix.
+Cold toolchain setup and provider processing are recorded separately; neither is hidden from
+total wall time or billed runner time. Compile one frozen candidate and promote its verified
+binary. REST-only iOS promotion runs on Linux; do not disable candidate reuse to repair an
+unrelated custom workflow setting. A full-build fallback still uploads and waits for provider
+processing on its Mac; the receipt reports that cost and never declares transfer alone verified.
+
+`deploy.yml` retains `ci-performance-<run>-<attempt>` with queue time, completed-job execution,
+step categories, run attempt, binary reuse and rounded runner-minute estimates by OS. These are
+time estimates, not billing invoices. `incomplete_jobs` counts the reporting job and any other
+still-running jobs; their unfinished time is excluded. Retry receipts separate elapsed time before
+the latest attempt from queue time, which is unavailable for a retry. Apple upload receipts separately retain exact
+`processing_seconds`; provider-operation steps include transfer and API work as well as waiting.
+An optional `.gowalk-cicd.yml` setting `performance: {target-seconds: 300}` accepts 60–300 seconds;
+the report warns on slower delivery without turning failed coverage or upload green.
+
+## Resolve once, install the same public tooling everywhere
+
+The repository adopts this helper through the normal released package installer. At execution,
+the helper resolves **latest**, then freezes the version, SHA-512 archive integrity and SHA-256
+of every runtime helper. It does not freeze future tasks to that version.
+
+```bash
+python3 .github/actions/swift-app/scripts/native_bootstrap.py resolve "$RUNNER_TEMP/release.json"
+python3 .github/actions/swift-app/scripts/native_bootstrap.py install \
+  "$RUNNER_TEMP/release.json" "$RUNNER_TEMP/gowalk-ci-transport"
+```
+
+`resolve` writes GitHub outputs `version`, `integrity`, `receipt-path`, and compact `release-json`.
+Pass `release-json` unchanged between jobs through a structured environment value written to a
+file; never interpolate JSON into shell source. `install` independently verifies the exact npm
+version and all helper hashes, writes `DEST/release.json`, and outputs `scripts`, `android-scripts`,
+`version`, and `integrity`. Scripts retain their package-relative directory layout. Neither mode
+reads credentials or connects to a store. The receipt schema is `gowalk-cicd/native-tooling.v1`.
+
+## Reuse native checks only with positive proof
+
+The application owns a reviewed JSON configuration, normally `.factory/native-validation.json`:
+
+```json
+{
+  "schema": 1,
+  "input_paths": ["Sources", "Resources", "Tests", "UITests", "project.yml", "App.xcodeproj"],
+  "workflow": ".github/workflows/ios-ci.yml",
+  "jobs": [{"name": "Native tests", "steps": ["Run all native tests", "Verify full coverage"]}],
+  "context_keys": ["package_version", "package_integrity", "xcode", "sdk", "devices", "backend"],
+  "external_context_keys": ["backend"]
+}
+```
+
+Use `input_paths: ["."]` for unknown project layouts; include every source, test, asset, script,
+lockfile, configuration and resource consumed by a reviewed narrower suite. `.github/`, the
+validated configuration and receipt helper bytes always participate. Symlinks, submodules and
+dirty selected inputs cannot establish reusable proof. Generated temporary configurations are
+supported; their canonical contents participate just like a committed configuration.
+
+Pass `NATIVE_VALIDATION_CONTEXT` as a JSON object whose keys match `context_keys`, with nonempty
+string values read from actual execution state. Include the resolved package version/integrity,
+full selected Xcode build, SDK/runtime, device matrix and consumed variables. A floating runner
+label is not a toolchain identity; describe the actual Mac before lookup when necessary.
+
+Every external key requires a fresh `sha256:<64 hex characters>` witness for the exact backend
+deployment/flow revision or canonical relevant response. An origin URL is not an external-state
+witness. Missing proof means full validation. For suites with inherently changing external data,
+run those integration checks afresh outside the reusable portion. Unknown custom scripts or
+undeclared network dependencies keep full coverage; never guess that they are unchanged.
+
+```bash
+node "$SCRIPTS/native_validation.cjs" lookup .factory/native-validation.json
+# After every declared test and coverage check succeeded:
+node "$SCRIPTS/native_validation.cjs" record .factory/native-validation.json
+```
+
+`lookup` needs repository `actions:read`, `GITHUB_TOKEN`, and a checkout containing the prior
+producer commit. Its outputs are `reused`, `reuse-reason`, `fingerprint`, `artifact-name` and,
+on a hit, `source-run`/`source-sha`. Missing external context returns a miss without a fingerprint.
+No completed match or unavailable API proof runs full coverage immediately; it never waits for
+another workflow. Missing local producer history is also a safe miss.
+
+`record` runs inside the producing job after tests, writing `receipt-path` and `artifact-name`.
+Retain that single `native-validation.json` with the pinned `actions/upload-artifact`, seven-day
+retention and the existing artifact process scope. For matrix suites, a collector records only
+after verifying every shard; configure every exact required job and successful step. A later
+lookup verifies the completed successful same-repository run, matching workflow, every named
+job/step, immutable artifact digest and an independently recomputed producer source tree. The
+receipt contains hashes and run identity, never context values or credentials.
+
+Keep the existing required `task/**` push check. A cheap admission may reuse prior success only
+under this proof; its required final check must require either that proof or successful fresh
+coverage. Do not replace the required push check with an unrelated PR merge-ref status.
+
+## Cache work is part of delivery cost
+
+Android keys include Gradle files, wrapper, properties, Flutter lockfiles and the Flutter pin.
+Only trusted default-branch jobs save shared caches; candidates restore them. After a successful
+Android release, a missing default-branch key primes release dependency artifacts without
+compilation, signing, test execution or upload. Priming has a five-minute step budget and saves
+only a complete graph. It replaces the earlier thirty-minute unsigned full build. A failure is
+optional: the next required candidate still resolves and validates its own dependencies.
+
+Observe actual cache ref/key/hit and runner minutes. Do not promote arbitrary PR cache bytes
+into default-branch scope or start unconditional warm-up builds. Native Pods/gems caches keep
+their existing lockfile, Ruby, Xcode and architecture identities.

package/docs/CONFIGURATION.md

@@ -108,3 +108,7 @@ always answered `local`; a deleted step answers null. An upgrade therefore drops
 never ran (delete it), and beside `always()`, `failure()` or `cancelled()` the conjunct also
 meant that the steps before `mode` succeeded (restate that). `env`, `run` and job outputs are
 not checked; there `steps.mode` renders empty.
+
+Routine delivery targets and exact native validation proof are documented in
+[CI_PERFORMANCE.md](CI_PERFORMANCE.md). The optional top-level
+`performance: {target-seconds: 300}` setting accepts 60–300 seconds and controls latency reporting.

package/docs/GRADLE_CACHE.md

@@ -23,17 +23,13 @@ therefore retains useful downloads after failure as well as after successful del
 adds no extra main validation, upload retry or release dispatch.
 
 A release that promotes its candidate compiles nothing, so it saves nothing. While Android
-candidates are enabled, the installer adds `warm-android-cache.yml`: after this app's own successful
-`Mobile Deploy` push run on the default branch whose release intent names Android, it looks up the
-android job's exact Gradle key on the android job's runner (Linux only). GitHub also matches the key
-as a prefix, so earlier `-warm-`/`-partial-` saves count. A lookup that times out stops; one the
-cache service rejects reads as a miss. Only on a miss does it compile the unsigned bundle once, with
-no credentials other than `GIT_PRIVATE_TOKEN`, no store call and no upload task. A finished build,
-or one stopped at 30 minutes, saves `<key>-warm-<run_id>-<attempt>`; an earlier failure saves nothing
-and the next release retries. A later real main build still saves the exact key. It never fails or
-delays a release; a queued warm-up that a newer one replaces shows as cancelled. It declares
-`cache-mode: write` because a `workflow_run` job otherwise gets a read-only cache token. No dispatch,
-schedule or pre-warm; android job overrides do not reach it.
+candidates are enabled, `warm-android-cache.yml` checks the default branch's exact Gradle key
+after a successful main Android release. On a miss it resolves release dependency artifacts
+without compiling, signing or uploading. The step is bounded to five minutes and only a complete
+graph is saved under a distinct `-warm-` key. Failed priming leaves the next required build to
+resolve its dependencies. Keys include Flutter lockfiles and the Flutter version pin as well as
+Gradle configuration. This replaces the old unsigned full-bundle warm-up, which could run thirty
+minutes. Default-branch cache access and matching compatible restore prefixes are preserved.
 
 On adoption, preserve app-specific dependency inputs, platforms and existing restore identities.
 Candidate and release workflows need compatible keys, paths and compression versions to share

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.173",
+  "version": "1.0.174",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {
@@ -39,7 +39,8 @@
     "docs/GRADLE_CACHE.md",
     "docs/CANDIDATE_ARTIFACTS.md",
     "docs/BACKEND_EDGE.md",
-    "docs/CONFIGURATION.md"
+    "docs/CONFIGURATION.md",
+    "docs/CI_PERFORMANCE.md"
   ],
   "keywords": [
     "ios",

package/src/config/schema.mjs

@@ -6,10 +6,16 @@ export function validateConfig(config, lock) {
   if (config.schema !== 1 || lock.schema !== 1 || !mapping(config.workflows) || !mapping(lock.workflows)) {
     throw new MigrationRepair('unsupported_config_version', '.gowalk-cicd.yml');
   }
-  if (Object.keys(config).some(key => !['schema', 'mobile', 'backend', 'workflows'].includes(key))) {
+  if (Object.keys(config).some(key => !['schema', 'mobile', 'backend', 'workflows', 'performance'].includes(key))) {
     throw new MigrationRepair('unknown_config_setting', '.gowalk-cicd.yml');
   }
   validateNamedSettings(config);
+  if (config.performance !== undefined && (!mapping(config.performance) ||
+      Object.keys(config.performance).some(key => key !== 'target-seconds') ||
+      !Number.isInteger(config.performance['target-seconds']) ||
+      config.performance['target-seconds'] < 60 || config.performance['target-seconds'] > 300)) {
+    throw new MigrationRepair('invalid_delivery_target', '.gowalk-cicd.yml');
+  }
   for (const [file, entry] of Object.entries(config.workflows)) {
     if (!mapping(entry) || Object.keys(entry).some(key => key !== 'overrides') || !Array.isArray(entry.overrides)) {
       throw new MigrationRepair('invalid_workflow_overrides', file);

package/src/config/settings.mjs

@@ -36,6 +36,10 @@ export function applySettings(config, file, workflow) {
     const value = at(config, name);
     if (value !== undefined) assign(workflow, { path, value });
   }
+  if (file === 'deploy.yml' && config.performance?.['target-seconds'] !== undefined) {
+    assign(workflow, {path: ['jobs', 'timing', 'env', 'CI_DELIVERY_TARGET_SECONDS'],
+      value: String(config.performance['target-seconds'])});
+  }
   const job = file === 'deploy.yml' ? 'backend-preview' : file === 'deploy-backend.yml' ? 'deploy' : null;
   if (job) {
     for (const [key, output, variable] of [['backend-dir', 'path', 'BACKEND_DIR_INPUT'],

package/templates/deploy.yml

@@ -66,6 +66,8 @@ jobs:
   ios:
     needs: release
     name: iOS TestFlight
+    outputs:
+      reused: ${{ steps.reuse.outputs.restored }}
     env:
       MOBILE_CANDIDATE_BUILD: ${{ inputs.candidate-build && 'true' || 'false' }}
       MOBILE_RELEASE_VARIABLES: ${{ toJSON(vars) }}
@@ -331,6 +333,8 @@ jobs:
   android:
     needs: release
     name: Android Google Play
+    outputs:
+      reused: ${{ steps.reuse.outputs.restored }}
     env:
       MOBILE_CANDIDATE_BUILD: ${{ inputs.candidate-build && 'true' || 'false' }}
       MOBILE_RELEASE_VARIABLES: ${{ toJSON(vars) }}
@@ -454,7 +458,8 @@ jobs:
           key: >-
             ${{ format('setup-java-{0}-{1}-gradle-{2}', runner.os, steps.gradle_scope.outputs.arch,
                 hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'buildSrc/**/Versions.kt',
-                'buildSrc/**/Dependencies.kt', 'gradle/*.versions.toml', '**/versions.properties')) }}
+                'buildSrc/**/Dependencies.kt', 'gradle/*.versions.toml', '**/versions.properties',
+                '**/pubspec.lock', '.flutter-version', '**/gradle.properties')) }}
           restore-keys: >-
             ${{ format('setup-java-{0}-{1}-gradle-', runner.os, steps.gradle_scope.outputs.arch) }}
       - name: Set up Flutter
@@ -685,6 +690,33 @@ jobs:
                 || format('{0}-partial-{1}-{2}', steps.gradle_cache.outputs.cache-primary-key,
                     github.run_id, github.run_attempt) }}
 
+  timing:
+    name: Delivery timing
+    needs: [release, ios, android]
+    if: ${{ always() }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 2
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      CI_DELIVERY_TARGET_SECONDS: '300'
+      CI_BINARY_REUSE: >-
+        {"ios":"${{ needs.ios.outputs.reused }}","android":"${{ needs.android.outputs.reused }}"}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      - name: Record delivery time and runner minutes
+        id: timing
+        continue-on-error: true
+        run: node .github/actions/swift-app/scripts/ci_performance.cjs
+      - name: Retain delivery timing
+        if: ${{ steps.timing.outputs.receipt-path != '' }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+        env:
+          NODE_OPTIONS: --require "${{ github.workspace }}/.github/actions/android-app/scripts/artifact_env.cjs"
+        with:
+          name: ci-performance-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ steps.timing.outputs.receipt-path }}
+          retention-days: 7
+
   # GitHub only registers a newly added workflow after it reaches the default
   # branch. A brand-new app's feature branch therefore cannot dispatch the
   # separate Backend Deploy workflow yet. Reuse this already-registered mobile

package/templates/warm-android-cache.yml

@@ -2,8 +2,8 @@ name: Warm Android build cache
 
 # Candidates restore only what the default branch saved, and a release that promotes its
 # candidate compiles nothing, so main may hold no Gradle cache for the inputs candidates build.
-# After this app's own default-branch release that included Android succeeds, this compiles the
-# Android bundle once, unsigned, when main has no entry for the android job's Gradle key. It runs on
+# After this app's own default-branch release that included Android succeeds, this resolves
+# release dependencies without compiling when main has no entry for the android job's Gradle key. It runs on
 # no other event: never on a candidate, a dispatch or a schedule. Installed only with candidates.
 on:
   workflow_run:
@@ -30,7 +30,7 @@ jobs:
       group: warm-android-cache
       cancel-in-progress: false
     # A backstop only: each long step is bounded below, so a cold build never reaches it.
-    timeout-minutes: 60
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         continue-on-error: true
@@ -80,7 +80,8 @@ jobs:
           key: >-
             ${{ format('setup-java-{0}-{1}-gradle-{2}', runner.os, steps.gradle_scope.outputs.arch,
                 hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'buildSrc/**/Versions.kt',
-                'buildSrc/**/Dependencies.kt', 'gradle/*.versions.toml', '**/versions.properties')) }}
+                'buildSrc/**/Dependencies.kt', 'gradle/*.versions.toml', '**/versions.properties',
+                '**/pubspec.lock', '.flutter-version', '**/gradle.properties')) }}
       # Only a lookup that ended without a match goes on. An empty kind: no Android project.
       - name: Resolve the Android build inputs
         id: build_inputs
@@ -133,7 +134,7 @@ jobs:
         if: ${{ steps.build_inputs.outputs.project_kind != '' }}
         uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
         continue-on-error: true
-        timeout-minutes: 5
+        timeout-minutes: 2
         with:
           distribution: temurin
           java-version: ${{ steps.jdk.outputs.version }}
@@ -142,7 +143,7 @@ jobs:
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
         uses: ./.github/actions/android-app/flutter-setup
         continue-on-error: true
-        timeout-minutes: 10
+        timeout-minutes: 6
         with:
           channel: stable
           cache: true
@@ -187,61 +188,23 @@ jobs:
               grep -m1 '^org.gradle.jvmargs' "$f"
             fi
           done
-      - name: Generate localizations
-        if: ${{ steps.flutter.outputs.enabled == 'true' }}
-        continue-on-error: true
-        timeout-minutes: 5
-        shell: bash
-        run: |
-          if [ -f l10n.yaml ]; then
-            flutter pub get
-            flutter gen-l10n
-          fi
-      # What a candidate compiles, with no credentials, signing, version write, store read or
-      # upload: an init script outside the cached paths disables every upload task. The compiler's
-      # output stays inert and it stops within 30 minutes.
-      - name: Build the release bundle without signing it
+      # Resolve release dependency artifacts only. No app compiler, signing or upload task runs.
+      - name: Prime release dependencies without compiling
         id: build
         if: >-
           ${{ steps.java.outcome == 'success'
               && (steps.flutter.outputs.enabled != 'true' || steps.flutter_setup.outcome == 'success') }}
         continue-on-error: true
+        timeout-minutes: 5
         shell: bash
-        working-directory: ${{ steps.build_inputs.outputs.gradle_root || '.' }}
-        env:
-          PROJECT_KIND: ${{ steps.build_inputs.outputs.project_kind }}
-          GRADLE_MODULE: ${{ steps.build_inputs.outputs.gradle_module }}
         run: |
-          mkdir -p "$HOME/.gradle/init.d"
-          cat > "$HOME/.gradle/init.d/gowalk-no-uploads.gradle" <<'GRADLE'
-          gradle.beforeProject { project ->
-              project.tasks.configureEach { task ->
-                  def name = task.name.toLowerCase()
-                  if (name.contains('upload') || name.startsWith('bugsnagrelease')) task.enabled = false
-              }
-          }
-          GRADLE
-          if [ "$PROJECT_KIND" = flutter ]; then
-            python3 .github/actions/android-app/scripts/android_config.py --flutter-toolchain
-            build=(flutter build appbundle --release --obfuscate --split-debug-info "$RUNNER_TEMP/dart-symbols/android")
-          else
-            chmod +x ./gradlew
-            build=(./gradlew "${GRADLE_MODULE}:bundleRelease" --console=plain)
-          fi
-          token=$(openssl rand -hex 16)
-          echo "::stop-commands::$token"
           status=0
-          timeout -k 30 30m "${build[@]}" || status=$?
-          echo "::$token::"
+          python3 .github/actions/android-app/scripts/prime_gradle.py || status=$?
           echo "status=$status" >> "$GITHUB_OUTPUT"
-          echo "Build exit status $status (124: stopped at 30 minutes)."
           exit "$status"
-      # Only a finished build or one stopped at 30 minutes saves: an early failure (the candidate
-      # compiled this commit, so a transient fault) saves nothing, and the next release retries.
-      # Never the android job's exact key: a real default-branch build still saves that one,
-      # which replaces whatever this warm-up compiled differently.
+      # A complete dependency graph can serve later candidates; failed/partial priming saves nothing.
       - name: Save Gradle dependencies
-        if: ${{ always() && (steps.build.outputs.status == '0' || steps.build.outputs.status == '124') }}
+        if: ${{ always() && steps.build.outputs.status == '0' }}
         uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25
         continue-on-error: true
         timeout-minutes: 2