gowalk-cicd 1.0.177 → 1.0.178

package/README.md

@@ -524,6 +524,10 @@ remain readable by the panel. Masked fields are never reconstructed and credenti
 Protected vhost failures add `backend_vhost_failed` (`gowalk-cicd/backend-vhost-failed.v1`) with fixed
 brace-free `operation`, `stage`, `reason`, `child_exit` and `signals`; see `docs/BACKEND_EDGE.md`.
 It preserves the existing refusal and records only bounded observed facts, never private child output.
+Edge health failures add `backend_health_failed` (`gowalk-cicd/backend-health-failed.v1`) with fixed
+brace-free `probe`, `reason`, `curl_exit`, `http_status` and `attempt`; see `docs/BACKEND_EDGE.md`.
+Only the final failed probe's bounded observations appear, with no URLs, bodies, headers or credentials.
+Ingress refusal, strict TLS, exact-build acceptance, retry bounds and the original failed result remain.
 An interrupted locked Pod fetch can retry once within the existing 900-second install budget.
 `native_pods_retry` (`gowalk-cicd/native-pods-retry.v1`) reports `attempt:2` and `reason:partial_transfer`;
 successful preparation reports `pod_attempts`. Dependency locks, relay and TLS checks remain enforced.

package/backend-action/edge_health.py

@@ -9,6 +9,25 @@ import time
 from edge_inputs import load, TOKEN_HEADER
 from edge_vhost import NGINX_DIR, paths, recorded_domain
 
+PROBES = frozenset({"configuration", "origin_missing_token", "origin_invalid_token", "origin_authorized",
+                    "legacy_identity", "legacy", "public"})
+REASONS = frozenset({"unclassified", "path_invalid", "request_failed", "http_refused", "json_invalid",
+                     "body_shape", "build_missing", "build_mismatch"})
+
+
+def report(probe, reason, *, curl_exit=None, http_status=None, attempt=None):
+    probe = probe if type(probe) is str and probe in PROBES else "unclassified"
+    reason = reason if type(reason) is str and reason in REASONS else "unclassified"
+    code = str(curl_exit) if type(curl_exit) is int and -255 <= curl_exit <= 255 else "none"
+    status = str(http_status) if type(http_status) is int and 100 <= http_status <= 599 else "none"
+    count = str(attempt) if type(attempt) is int and 1 <= attempt <= 15 else "none"
+    message = ("::error title=backend_health_failed::gowalk-cicd/backend-health-failed.v1 "
+               "probe={} reason={} curl_exit={} http_status={} attempt={}\n")
+    try:
+        sys.stderr.write(message.format(probe, reason, code, status, count))
+    except (OSError, ValueError):
+        pass  # Diagnostic delivery must not replace the original refusal.
+
 
 def request(url, *, headers=None, run=subprocess.run):
     # curl retains its strict TLS/time bounds. Private headers and bounded response
@@ -27,46 +46,89 @@ def request(url, *, headers=None, run=subprocess.run):
         return result.returncode, int(status) if status.isdigit() else 0, data
 
 
-def healthy(url, sha="", *, headers=None, fetch=request, sleep=time.sleep):
+def response_reason(code, status, body, sha):
+    if code != 0:
+        return "request_failed"
+    if not 200 <= status < 300:
+        return "http_refused"
+    if sha:
+        try:
+            value = json.loads(body)
+        except ValueError:
+            return "json_invalid"
+        if not isinstance(value, dict):
+            return "body_shape"
+        if "build_sha" not in value:
+            return "build_missing"
+        if value.get("build_sha") != sha:
+            return "build_mismatch"
+    return None
+
+
+def healthy(url, sha="", *, headers=None, fetch=request, sleep=time.sleep, probe="public"):
     for attempt in range(15):
+        code = status = None
+        reason = "unclassified"
         try:
             code, status, body = fetch(url, headers=headers)
-            valid = code == 0 and 200 <= status < 300
-            if valid and sha:
-                value = json.loads(body)
-                valid = isinstance(value, dict) and value.get("build_sha") == sha
-            if valid:
+            reason = response_reason(code, status, body, sha)
+            if reason is None:
                 return
         except (OSError, ValueError, subprocess.SubprocessError):
-            pass
+            reason = "request_failed" if code is None else "unclassified"
         if attempt != 14:
             sleep(2)
+    report(probe, reason, curl_exit=code, http_status=status, attempt=15)
     raise ValueError("backend_public_health_failed")
 
 
+def origin_refusal(url, headers, probe, fetch):
+    try:
+        code, status, _body = fetch(url, headers=headers)
+    except (OSError, ValueError, subprocess.SubprocessError):
+        report(probe, "request_failed", attempt=1)
+        raise
+    if code != 0 or status != 403:
+        report(probe, "request_failed" if code != 0 else "http_refused",
+               curl_exit=code, http_status=status, attempt=1)
+        raise ValueError("backend_origin_ingress_unverified")
+
+
 def verify(config, app, domain, health, *, nginx_dir=NGINX_DIR, fetch=request, sleep=time.sleep):
-    value = load(config)
+    try:
+        value = load(config)
+    except (OSError, ValueError, subprocess.SubprocessError):
+        report("configuration", "unclassified")
+        raise
     if not health.startswith("/") or any(character in health for character in "\r\n?#"):
+        report("configuration", "path_invalid")
         raise ValueError("backend_health_path_invalid")
     origin_url = f"https://{domain}{health}"
     if value["ingress_required"] == "true":
-        for headers in (None, {TOKEN_HEADER: "invalid-backend-ingress-token"}):
-            code, status, _body = fetch(origin_url, headers=headers)
-            if code != 0 or status != 403:
-                raise ValueError("backend_origin_ingress_unverified")
+        for probe, headers in (("origin_missing_token", None),
+                               ("origin_invalid_token", {TOKEN_HEADER: "invalid-backend-ingress-token"})):
+            origin_refusal(origin_url, headers, probe, fetch)
         healthy(origin_url, value["expected_build_sha"], headers={TOKEN_HEADER: value["ingress_token"]},
-                fetch=fetch, sleep=sleep)
-        legacy = recorded_domain(paths(config, app, nginx_dir)[0])
+                fetch=fetch, sleep=sleep, probe="origin_authorized")
+        try:
+            legacy = recorded_domain(paths(config, app, nginx_dir)[0])
+        except (OSError, ValueError, subprocess.SubprocessError):
+            report("legacy_identity", "unclassified")
+            raise
         if legacy:
-            healthy(f"https://{legacy}{health}", fetch=fetch, sleep=sleep)
+            healthy(f"https://{legacy}{health}", fetch=fetch, sleep=sleep, probe="legacy")
     public = value["public_health_url"] or origin_url
     healthy(public, value["expected_build_sha"], fetch=fetch, sleep=sleep)
     return {"ok": True, "public_health_verified": True, "build_sha": value["expected_build_sha"],
             "ingress_verified": value["ingress_required"] == "true"}
 
 
-if __name__ == "__main__":
+def main():
     try:
         print(json.dumps(verify(*sys.argv[1:5])))
     except (OSError, ValueError, subprocess.SubprocessError):
         sys.exit("backend_edge_health_failed")
+
+
+if __name__ == "__main__":
+    main()

package/docs/BACKEND_EDGE.md

@@ -57,3 +57,19 @@ They are observed patterns, not a unique cause or retry permission. No raw error
 token or child output is included. A failed restoration adds a separate rollback refusal while keeping
 the original failure visible; absence of that extra line alone does not prove successful restoration.
 The generic `backend_edge_vhost_refused`, changed/unchanged stdout, ingress, TLS and deploy gates remain.
+
+Health refusals add the fixed stderr annotation `backend_health_failed` with schema
+`gowalk-cicd/backend-health-failed.v1`. Its brace-free fields are `probe`, `reason`, `curl_exit`,
+`http_status` and `attempt`. Probes are configuration, origin_missing_token, origin_invalid_token,
+origin_authorized, legacy_identity, legacy and public; unknown metadata becomes unclassified.
+Reasons are unclassified, path_invalid, request_failed, http_refused, json_invalid, body_shape,
+build_missing and build_mismatch. No URL, response body, build identity, header, credential, path,
+exception text or subprocess output enters the annotation. Curl exit is an observed integer from
+-255 to 255, HTTP status from 100 to 599 and attempt from 1 to 15; other values become `none`.
+An exhausted health check emits only its final attempt's facts, clearing any previous observations.
+These facts identify the failed probe, not a unique cause or permission to retry or bypass it.
+Missing-token and invalid-token checks remain single requests requiring completed 403 responses.
+Healthy-origin, retained-legacy and public checks retain 15 attempts with two seconds between them,
+strict TLS, existing curl time/body bounds and exact build checks. A successful check emits no
+failure annotation and returns the existing result. Original exceptions and the generic CLI refusal
+`backend_edge_health_failed` with exit 1 remain unchanged, including when diagnostic delivery fails.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.177",
+  "version": "1.0.178",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {