gowalk-cicd 1.0.180 → 1.0.182

package/README.md

@@ -652,6 +652,19 @@ bounded to 16 KiB. No provider message, path, URL, track or credential is republ
 These observations never authorize a retry. Missing commit output does not prove no mutation,
 and a reported commit does not prove review submission. Unknown failures remain unclassified.
 
+The wrapper also writes validated `gowalk-cicd/play-upload-evidence.v1` JSON outside its
+private upload directory: `attempt-1.json`, optional `attempt-2.json`, and `terminal.json`.
+Each record binds the GitHub run/attempt, source SHA, compiled version code (the optional
+`versionCode` input), and immutable uploader identity. Missing bindings are null, never inferred.
+Attempt records add observed HTTP status/RPC codes and exact known message classes from complete,
+bounded error lines; raw provider prose, paths, URLs and identifiers are discarded. The pinned
+uploader sometimes emits only an error message, so missing status/code fields remain empty.
+These fields do not change retry policy or the original result/diagnostic annotations.
+The action exports `diagnostic-path`; the managed deploy template retains its JSON as
+`play-upload-diagnostics-<run_id>-<run_attempt>` on success or failure. Adopt both action and
+template to retain artifacts. Failed evidence validation/storage emits a fixed refusal and fails
+the job without replaying provider work or changing its result.
+
 Package-owner acquisition rechecks an occupied record within one 60-second wait budget before
 provider work. Every read retains the binding and identity checks; cancellation interrupts the wait.
 Time passing never authorizes clearing an owner. A known CI owner still requires exact terminal

package/action/scripts/set_app_store_whats_new.py

@@ -22,7 +22,8 @@ Non-fatal by design: any failure is reported as a ::warning:: and the action
 continues. The TestFlight upload itself has already succeeded by this point.
 
 Environment:
-  ASC_KEY_ID, ASC_ISSUER_ID, ASC_KEY_PATH  -- App Store Connect API credentials
+  ASC_KEY_ID, ASC_ISSUER_ID                 -- App Store Connect API identity
+  ASC_KEY_PATH / ASC_KEY_P8_PATH             -- existing or prepared key-file path
   MARKETING_VERSION                        -- e.g. "1.2.3"
   APP_STORE_VERSION_ID                     -- appStoreVersion id (REUSE or CREATE)
   APP_STORE_WHATS_NEW_FILE                 -- path to file holding release notes
@@ -228,16 +229,10 @@ def _update_all_localizations(
     token: str, version_id: str, version: str, whats_new: str, seed_locale: str,
     only_if_empty: bool = False,
 ) -> int:
-    """PATCH whatsNew on every existing localization. If none exist, POST a
-    single seed localization in `seed_locale`. Returns the count of
-    localizations written.
-
-    When ``only_if_empty`` is set the text is a fallback backstop: any
-    localization that already has a non-blank whatsNew (e.g. notes a human
-    entered) is left untouched, and only empty ones are filled. This lets the
-    step run unconditionally without clobbering good content, while still
-    guaranteeing no locale ships with an empty "What's New" (which App Store
-    Connect rejects as "This field is required")."""
+    """Write localized notes, creating one seed when no localizations exist.
+    Return the count written. ``only_if_empty`` preserves existing non-blank
+    notes and fills the empty text App Store Connect requires before review.
+    """
     locs = get_json(
         f"/appStoreVersions/{version_id}/appStoreVersionLocalizations", token
     )
@@ -306,7 +301,7 @@ def main() -> int:
     token = make_jwt(
         _require_env("ASC_KEY_ID"),
         _require_env("ASC_ISSUER_ID"),
-        _require_env("ASC_KEY_PATH"),
+        os.environ.get("ASC_KEY_PATH", "").strip() or _require_env("ASC_KEY_P8_PATH"),
     )
 
     ver = get_json(f"/appStoreVersions/{version_id}", token)

package/android-action/play-upload/action.yml

@@ -26,11 +26,16 @@ inputs:
   mobileReleaseIntentScript:
     description: Committed mobile_release.cjs path, invoked after acquiring the package owner and before upload.
     default: ''
+  versionCode:
+    description: Exact compiled version code for sanitized upload diagnostics only.
+    default: ''
 outputs:
   review-pending:
     description: True only after a successful explicitly requested review-hold retry.
   receipt:
     description: Sanitized versioned result with attempt count and upstream identity.
+  diagnostic-path:
+    description: Runner-owned directory with closed per-attempt and terminal diagnostic JSON.
 runs:
   using: node24
   main: run.cjs

package/android-action/play-upload/diagnostics.cjs

@@ -1,4 +1,5 @@
 // Observe only fixed progress/error patterns; never retain provider text in a receipt.
+const provider = require('./provider_evidence.cjs');
 const phases = new Map([
   ['Creating a new Edit for this release', 'edit_create'],
   ['Committing the Edit', 'edit_commit'],
@@ -22,10 +23,11 @@ const limit = 16384;
 
 function create() {
   return {phase: 'startup', signals: new Set(), pending: {stdout: '', stderr: ''},
-    discard: {stdout: false, stderr: false}};
+    discard: {stdout: false, stderr: false}, provider: provider.create()};
 }
 
 function line(state, stream, value) {
+  provider.observe(state.provider, value);
   if (stream === 'stdout') {
     if (phases.has(value)) state.phase = phases.get(value);
     for (const [prefix, phase] of prefixes) if (value.startsWith(prefix)) state.phase = phase;
@@ -70,4 +72,5 @@ function annotation(attempt, result) {
     + ` signals=${signals.join(',') || 'none'}`;
 }
 
-module.exports = {create, consume, snapshot, annotation};
+module.exports = {create, consume, snapshot, annotation,
+  providerSnapshot: state => provider.snapshot(state.provider)};

package/android-action/play-upload/evidence.cjs

@@ -0,0 +1,30 @@
+// This separate, sanitized directory survives cleanup of the private uploader output.
+const {mkdtempSync, writeFileSync} = require('node:fs');
+const {isAbsolute, join} = require('node:path');
+const records = require('./evidence_schema.cjs');
+
+function begin(env) {
+  const binding = records.context(env);
+  let directory = '', failed = false, recorded = 0;
+  try {
+    if (!isAbsolute(env.RUNNER_TEMP || '') || /[\x00-\x1f\x7f]/.test(env.RUNNER_TEMP)) throw new Error();
+    directory = mkdtempSync(join(env.RUNNER_TEMP, 'gowalk-play-evidence-'));
+  } catch { failed = true; }
+  const save = (name, value) => {
+    try {
+      if (!directory || !records.valid(value)) throw new Error();
+      writeFileSync(join(directory, name), JSON.stringify(value) + '\n', {mode: 0o600, flag: 'wx'});
+    } catch { failed = true; }
+  };
+  return {
+    attempt(number, result) {
+      save(`attempt-${number}.json`, records.attempt(binding, number, result));
+      recorded += 1;
+    },
+    terminal(result) { save('terminal.json', records.terminal(binding, result, recorded)); },
+    get path() { return failed ? '' : directory; },
+    get failed() { return failed; },
+  };
+}
+
+module.exports = {begin};

package/android-action/play-upload/evidence_schema.cjs

@@ -0,0 +1,71 @@
+const provider = require('./provider_evidence.cjs');
+const source = require('./source.cjs');
+const schema = 'gowalk-cicd/play-upload-evidence.v1';
+const phases = new Set(['startup', 'edit_create', 'tracks_read', 'bundle_upload', 'track_update', 'edit_commit']);
+const signals = new Set(['connection_reset', 'connection_refused', 'connection_timeout', 'dns_failure',
+  'tls_verification', 'output_truncated']);
+const processSignals = new Set(['none', 'SIGTERM', 'SIGINT', 'SIGKILL', 'other']);
+const codes = new Set(['uploaded', 'review_pending', 'edit_expired', 'edit_deleted', 'review_hold_required',
+  'unclassified_failure', 'upload_cancelled', 'upload_outcome_uncertain', 'uploader_failed',
+  'runner_context_required', 'uploader_integrity_refused', 'uploader_source_unavailable',
+  'mobile_release_intent_unconfirmed', ...require('./owner.cjs').codes]);
+const keys = (value, names) => value && typeof value === 'object' && !Array.isArray(value)
+  && Object.keys(value).sort().join(',') === names.split(',').sort().join(',');
+const integer = (value, minimum, maximum = Number.MAX_SAFE_INTEGER) =>
+  Number.isSafeInteger(value) && value >= minimum && value <= maximum;
+const nullable = (value, check) => value === null || check(value);
+
+function context(env) {
+  const positive = value => /^[1-9][0-9]*$/.test(value || '') && integer(Number(value), 1) ? Number(value) : null;
+  return {run_id: positive(env.GITHUB_RUN_ID), run_attempt: positive(env.GITHUB_RUN_ATTEMPT),
+    source_sha: /^[0-9a-f]{40}$/.test(env.GITHUB_SHA || '') ? env.GITHUB_SHA : null,
+    version_code: positive(env.INPUT_VERSIONCODE || env.ANDROID_BUILD_NUMBER)};
+}
+
+function base(binding, kind) {
+  return {schema, kind, ...binding, upstream_revision: source.revision, upstream_sha256: source.digest};
+}
+
+function attempt(binding, number, result) {
+  const diagnostic = result.diagnostic || {};
+  const observed = Array.isArray(diagnostic.signals) ? diagnostic.signals.filter(value => signals.has(value)) : [];
+  return {...base(binding, 'attempt'), attempt: number,
+    phase: phases.has(diagnostic.phase) ? diagnostic.phase : 'startup',
+    exit_code: integer(result.status, 0, 255) ? result.status : null,
+    signal: processSignals.has(result.signal) ? result.signal : result.signal ? 'other' : 'none',
+    error_count: integer(result.errors, 0) ? result.errors : null,
+    cancelled: result.cancelled === true, commit_reported: result.committed === true,
+    transport_signals: [...new Set(observed)].sort(),
+    provider: provider.valid(result.provider) ? result.provider : provider.snapshot(provider.create())};
+}
+
+function terminal(binding, result, recorded) {
+  return {...base(binding, 'terminal'), recorded_attempts: recorded, result: {
+    ok: result.ok === true, code: codes.has(result.code) ? result.code : 'uploader_failed',
+    attempts: integer(result.attempts, 0, 2) ? result.attempts : 0,
+    review_pending: result.review_pending === true}};
+}
+
+function valid(value) {
+  const fields = 'schema,kind,run_id,run_attempt,source_sha,version_code,upstream_revision,upstream_sha256';
+  if (!value || value.schema !== schema || value.upstream_revision !== source.revision
+      || value.upstream_sha256 !== source.digest || !nullable(value.run_id, item => integer(item, 1))
+      || !nullable(value.run_attempt, item => integer(item, 1))
+      || !nullable(value.version_code, item => integer(item, 1))
+      || !nullable(value.source_sha, item => typeof item === 'string' && /^[0-9a-f]{40}$/.test(item))) return false;
+  if (value.kind === 'terminal') return keys(value, fields + ',recorded_attempts,result')
+    && integer(value.recorded_attempts, 0, 2) && keys(value.result, 'ok,code,attempts,review_pending')
+    && typeof value.result.ok === 'boolean' && codes.has(value.result.code)
+    && integer(value.result.attempts, 0, 2) && typeof value.result.review_pending === 'boolean';
+  return value.kind === 'attempt' && keys(value, fields
+    + ',attempt,phase,exit_code,signal,error_count,cancelled,commit_reported,transport_signals,provider')
+    && integer(value.attempt, 1, 2) && phases.has(value.phase) && processSignals.has(value.signal)
+    && nullable(value.exit_code, item => integer(item, 0, 255))
+    && nullable(value.error_count, item => integer(item, 0)) && typeof value.cancelled === 'boolean'
+    && typeof value.commit_reported === 'boolean' && Array.isArray(value.transport_signals)
+    && value.transport_signals.length <= signals.size
+    && new Set(value.transport_signals).size === value.transport_signals.length
+    && [...value.transport_signals].every(item => signals.has(item)) && provider.valid(value.provider);
+}
+
+module.exports = {schema, context, attempt, terminal, valid};

package/android-action/play-upload/process.cjs

@@ -53,7 +53,8 @@ function execute(program, env, directory, timeout) {
       diagnostics.consume(diagnostic, 'stdout', '\n'); diagnostics.consume(diagnostic, 'stderr', '\n');
       const committed = /(?:^|\n)committedEditId(?:=|<<)/.test(readFileSync(output, 'utf8'));
       resolve({status, signal, cancelled, committed, errors: state.errors,
-        code: state.ambiguous ? 'unclassified_failure' : state.code, diagnostic: diagnostics.snapshot(diagnostic)});
+        code: state.ambiguous ? 'unclassified_failure' : state.code, diagnostic: diagnostics.snapshot(diagnostic),
+        provider: diagnostics.providerSnapshot(diagnostic)});
     });
   });
 }

package/android-action/play-upload/provider_evidence.cjs

@@ -0,0 +1,51 @@
+// Closed observations only. Missing provider fields are never inferred from message text.
+const http = new Set([400, 401, 402, 403, 404, 405, 408, 409, 410, 412, 413, 414, 415,
+  416, 417, 422, 428, 429, 500, 501, 502, 503, 504]);
+const rpc = new Set(['CANCELLED', 'UNKNOWN', 'INVALID_ARGUMENT', 'DEADLINE_EXCEEDED', 'NOT_FOUND',
+  'ALREADY_EXISTS', 'PERMISSION_DENIED', 'RESOURCE_EXHAUSTED', 'FAILED_PRECONDITION', 'ABORTED',
+  'OUT_OF_RANGE', 'UNIMPLEMENTED', 'INTERNAL', 'UNAVAILABLE', 'DATA_LOSS', 'UNAUTHENTICATED']);
+const messages = new Map([
+  ['This edit has expired, please create a new Edit.', 'edit_expired'],
+  ['This Edit has been deleted.', 'edit_deleted'],
+  ['Changes cannot be sent for review automatically. Please set the query parameter changesNotSentForReview to true. '
+    + 'Once committed, the changes in this edit can be sent for review from the Google Play Console UI.',
+  'review_hold_required'],
+  ['Unknown error occurred.', 'uploader_unknown_error'],
+  ['New edit has no ID, cannot continue.', 'edit_id_missing'],
+]);
+const classes = new Set(messages.values());
+
+function create() {
+  return {http: new Set(), rpc: new Set(), classes: new Set()};
+}
+
+function observe(state, value) {
+  const match = /^::error(?: [^\r\n]+)?::(.*)$/.exec(value) || /^Error: (.*)$/.exec(value);
+  if (!match) return;
+  const text = match[1].replace(/%0D/g, '\r').replace(/%0A/g, '\n').replace(/%25/g, '%');
+  if (messages.has(text)) state.classes.add(messages.get(text));
+  const status = /^Request failed with status code ([45]\d\d)(?:\.?$|\.\s)/.exec(text);
+  if (status && http.has(Number(status[1]))) state.http.add(Number(status[1]));
+  let body;
+  try { body = JSON.parse(text); } catch { return; }
+  const error = body?.error;
+  if (!error || typeof error !== 'object' || Array.isArray(error) || !http.has(error.code)) return;
+  state.http.add(error.code);
+  if (rpc.has(error.status)) state.rpc.add(error.status);
+  if (messages.has(error.message)) state.classes.add(messages.get(error.message));
+}
+
+function snapshot(state) {
+  return {http_statuses: [...state.http].sort((a, b) => a - b), rpc_codes: [...state.rpc].sort(),
+    message_classes: [...state.classes].sort()};
+}
+
+function valid(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+      || Object.keys(value).sort().join(',') !== 'http_statuses,message_classes,rpc_codes') return false;
+  return [['http_statuses', http], ['rpc_codes', rpc], ['message_classes', classes]].every(([key, choices]) =>
+    Array.isArray(value[key]) && value[key].length <= choices.size
+    && new Set(value[key]).size === value[key].length && [...value[key]].every(item => choices.has(item)));
+}
+
+module.exports = {create, observe, snapshot, valid};

package/android-action/play-upload/run.cjs

@@ -6,6 +6,7 @@ const processRunner = require('./process.cjs');
 const owner = require('./owner.cjs');
 const diagnostics = require('./diagnostics.cjs');
 const releaseIntent = require('./release_intent.cjs');
+const evidence = require('./evidence.cjs');
 
 async function upload(program, env, directory, execute = processRunner.execute, timeout = 3600000,
   cancelled = () => false, report = () => {}) {
@@ -33,9 +34,10 @@ async function upload(program, env, directory, execute = processRunner.execute,
 }
 
 async function main() {
-  let directory, receipt;
+  let directory, receipt, records;
   try {
     const env = {...process.env};
+    records = evidence.begin(env);
     if (!env.PLAY_EDIT_BINDING) throw new Error('play_owner_binding_required');
     env.PLAY_EDIT_PRINCIPAL_SHA256 = require('./owner_principal.cjs').read(env.INPUT_SERVICEACCOUNTJSON);
     if (!env.RUNNER_TEMP || !env.GITHUB_OUTPUT) throw new Error('runner_context_required');
@@ -45,7 +47,9 @@ async function main() {
       if (cancelled()) return {ok: false, code: 'upload_cancelled', attempts: 0, review_pending: false};
       await releaseIntent.begin(env);
       return upload(program, env, directory, processRunner.execute, 3600000, cancelled,
-        (attempt, result) => console.log(diagnostics.annotation(attempt, result)));
+        (attempt, result) => {
+          records.attempt(attempt, result); console.log(diagnostics.annotation(attempt, result));
+        });
     });
   } catch (error) {
     if (owner.codes.includes(error.message)) console.log(owner.annotation(error.message, undefined,
@@ -61,13 +65,19 @@ async function main() {
   } finally { if (directory) rmSync(directory, {recursive: true, force: true}); }
   receipt = {schema: 'gowalk-cicd/play-upload.v1', ...receipt, upstream_revision: source.revision,
     upstream_sha256: source.digest};
+  records?.terminal(receipt);
   const encoded = JSON.stringify(receipt);
   if (process.env.GITHUB_OUTPUT) {
     appendFileSync(process.env.GITHUB_OUTPUT, `review-pending=${receipt.review_pending}\nreceipt=${encoded}\n`);
+    appendFileSync(process.env.GITHUB_OUTPUT, `diagnostic-path=${records?.path || ''}\n`);
   }
   // The panel parses a success receipt even when a multi-line secret masks its outer braces.
   console.log(`::${receipt.ok ? 'notice' : 'error'} title=play_upload_result::${encoded}`);
   if (!receipt.ok) process.exitCode = 1;
+  if (records?.failed) {
+    console.log('::error title=play_upload_evidence_failed::Sanitized upload evidence could not be retained.');
+    process.exitCode = 1;
+  }
 }
 
 module.exports = {upload, main};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.180",
+  "version": "1.0.182",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -658,6 +658,17 @@ jobs:
           userFraction: >-
             ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
           whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
+          versionCode: ${{ steps.android.outputs.build-number || steps.reuse.outputs.build-number }}
+
+      - name: Retain sanitized Play upload diagnostics
+        if: ${{ always() && steps.play-upload.outputs.diagnostic-path != '' }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ github.workspace }}/.github/actions/android-app/scripts/artifact_env.cjs"
+        with:
+          name: play-upload-diagnostics-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ steps.play-upload.outputs.diagnostic-path }}/*.json
+          if-no-files-found: error
 
       # The retry landed the bundle without submitting it. That is a fact for
       - name: Record confirmed Android upload