gowalk-cicd 1.0.181 → 1.0.183

package/README.md

@@ -652,6 +652,19 @@ bounded to 16 KiB. No provider message, path, URL, track or credential is republ
 These observations never authorize a retry. Missing commit output does not prove no mutation,
 and a reported commit does not prove review submission. Unknown failures remain unclassified.
 
+The wrapper also writes validated `gowalk-cicd/play-upload-evidence.v1` JSON outside its
+private upload directory: `attempt-1.json`, optional `attempt-2.json`, and `terminal.json`.
+Each record binds the GitHub run/attempt, source SHA, compiled version code (the optional
+`versionCode` input), and immutable uploader identity. Missing bindings are null, never inferred.
+Attempt records add observed HTTP status/RPC codes and exact known message classes from complete,
+bounded error lines; raw provider prose, paths, URLs and identifiers are discarded. The pinned
+uploader sometimes emits only an error message, so missing status/code fields remain empty.
+These fields do not change retry policy or the original result/diagnostic annotations.
+The action exports `diagnostic-path`; the managed deploy template retains its JSON as
+`play-upload-diagnostics-<run_id>-<run_attempt>` on success or failure. Adopt both action and
+template to retain artifacts. Failed evidence validation/storage emits a fixed refusal and fails
+the job without replaying provider work or changing its result.
+
 Package-owner acquisition rechecks an occupied record within one 60-second wait budget before
 provider work. Every read retains the binding and identity checks; cancellation interrupts the wait.
 Time passing never authorizes clearing an owner. A known CI owner still requires exact terminal
@@ -1227,6 +1240,71 @@ different bytes under the same number. Build numbers come from `/builds`,
 `/preReleaseVersions` **and** `/apps/{id}/buildUploads`, so an unfinished or refused
 reservation is never reused; delete such a reservation only after reading it back.
 
+When an iOS producer was cancelled **after** both `Build and transfer iOS binary` and
+`Retain Apple verification handoff` succeeded, version 1.0.183 provides explicit recovery:
+
+```bash
+node .github/actions/swift-app/scripts/apple_upload_recovery.cjs \
+  ORIGINAL_RUN_ID ORIGINAL_ATTEMPT DEPLOYMENT_ID HANDOFF_ARTIFACT_ID \
+  > "$RUNNER_TEMP/apple-upload-recovery.json"
+```
+
+Run this released helper in an authorized `workflow_dispatch` Actions job on the same
+repository's default branch, after checking out the adopted tooling. The job needs
+`actions: read`, `contents: read`, `deployments: write`, `GITHUB_TOKEN: ${{ github.token }}`
+and the existing `ASC_KEY_P8`, `ASC_KEY_ID`, `ASC_ISSUER_ID` secrets (or the prepared ASC key
+path). Serialize the recovery workflow with normal Mobile Deploy using its exact concurrency
+group and `cancel-in-progress: false`; this prevents a deploy from starting between the
+last provenance read and the receipt write. Use this workflow policy and job environment:
+
+```yaml
+on: workflow_dispatch
+permissions:
+  contents: read
+  actions: read
+  deployments: write
+concurrency:
+  group: mobile-deploy-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  recover:
+    if: ${{ github.ref_name == github.event.repository.default_branch }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      # Invoke the command above with the four verified original identifiers,
+      # then retain its JSON with the pinned, guarded artifact uploader.
+```
+
+Retain `apple-upload-recovery.json` with the existing pinned, guarded artifact uploader.
+The command has no local receipt or caller-provided
+digest option: it downloads the exact original artifact, verifies GitHub's archive SHA-256,
+and accepts only its bounded `apple-verification.json` member. It authenticates the current
+dispatch separately from the original run, attempt, source, repository, branch and deployment.
+
+Recovery requires a terminal cancelled original run and iOS producer with those two
+successful steps in order. A later completed attempt may exist; an active latest attempt
+refuses, including a retry observed immediately before writing the receipt. Fresh Apple
+readback must prove the exact completed upload and file, matching bytes, eligible `VALID`
+build and matching app. Only then can the original deployment become `uploaded`; repeating
+recovery verifies the same evidence without another write. No binary is rebuilt or uploaded,
+and the old handoff's metadata and release notes are never replayed. Missing, expired or
+mismatched evidence remains refused; do not relabel a receipt or impersonate the original
+`GITHUB_*` environment. Normal delivery still refuses cancelled producers.
+
+Retain the recovery proof, then rerun the **whole original deployment workflow**. Its
+upload-once admission reuses the confirmed iOS receipt and skips the iOS binary. Follow that
+new attempt and any unrelated remaining jobs to completion; recovery does not change the
+original cancelled attempt's conclusion. Read current store state for remaining submission
+work without changing an already accepted submission. This exceptional command adds no
+normal delivery job, polling or latency.
+
 Flutter SDK setup retries interrupted manifest and archive GETs, with four attempts
 within 60 seconds for manifests or 30 minutes for archives, with an 8 GiB archive bound. Retries resume private bytes
 with HTTP Range; if the origin ignores Range, a bounded full restart is permitted. The completed archive

package/action/scripts/apple_upload_handoff.cjs

@@ -9,22 +9,12 @@ const positive = value => Number.isSafeInteger(value) && value > 0;
 const id = value => typeof value === 'string' && /^[A-Za-z0-9-]{1,64}$/.test(value);
 const fail = code => { throw Error(`apple_upload_verify_${code}`); };
 
-function read(path, digest, attempt, env = process.env) {
-  if (fs.statSync(path).size > 2 * 1024 * 1024) fail('handoff_size');
-  const bytes = fs.readFileSync(path);
-  if (bytes.length > 2 * 1024 * 1024 || !/^[a-f0-9]{64}$/.test(digest || '') ||
-      createHash('sha256').update(bytes).digest('hex') !== digest) fail('handoff_digest');
-  const value = JSON.parse(bytes), owner = value.owner || {}, r = value.receipt || {}, m = value.metadata || {};
-  const event = JSON.parse(fs.readFileSync(env.GITHUB_EVENT_PATH, 'utf8'));
-  if (value.schema !== SCHEMA || owner.repository !== env.GITHUB_REPOSITORY ||
+function validate(value) {
+  const owner = value?.owner || {}, r = value?.receipt || {}, m = value?.metadata || {};
+  if (value?.schema !== SCHEMA ||
       !/^[\w.-]+\/[\w.-]+$/.test(owner.repository || '') || !/^[a-f0-9]{40}$/.test(owner.source_sha || '') ||
-      owner.source_sha !== env.GITHUB_SHA || owner.ref !== env.GITHUB_REF || !owner.ref?.startsWith('refs/heads/') ||
-      owner.ref !== `refs/heads/${event.repository?.default_branch}` ||
-      !['push', 'workflow_dispatch'].includes(owner.event) || owner.event !== env.GITHUB_EVENT_NAME ||
-      !positive(owner.run_id) || owner.run_id !== Number(env.GITHUB_RUN_ID) || !positive(owner.run_attempt) ||
-      !positive(attempt) || !positive(Number(env.GITHUB_RUN_ATTEMPT)) ||
-      owner.run_attempt !== attempt || attempt > Number(env.GITHUB_RUN_ATTEMPT) ||
-      !positive(owner.deployment_id) || owner.deployment_id !== Number(env.MOBILE_RELEASE_DEPLOYMENT_ID)) {
+      !owner.ref?.startsWith('refs/heads/') || !['push', 'workflow_dispatch'].includes(owner.event) ||
+      !positive(owner.run_id) || !positive(owner.run_attempt) || !positive(owner.deployment_id)) {
     fail('handoff_owner');
   }
   if (r.schema !== 'gowalk-cicd/apple-build-upload-receipt.v1' || r.stage !== 'transferred' ||
@@ -40,6 +30,22 @@ function read(path, digest, attempt, env = process.env) {
   return value;
 }
 
+function read(path, digest, attempt, env = process.env) {
+  if (fs.statSync(path).size > 2 * 1024 * 1024) fail('handoff_size');
+  const bytes = fs.readFileSync(path);
+  if (bytes.length > 2 * 1024 * 1024 || !/^[a-f0-9]{64}$/.test(digest || '') ||
+      createHash('sha256').update(bytes).digest('hex') !== digest) fail('handoff_digest');
+  const value = validate(JSON.parse(bytes)), owner = value.owner;
+  const event = JSON.parse(fs.readFileSync(env.GITHUB_EVENT_PATH, 'utf8'));
+  if (owner.repository !== env.GITHUB_REPOSITORY || owner.source_sha !== env.GITHUB_SHA ||
+      owner.ref !== env.GITHUB_REF || owner.ref !== `refs/heads/${event.repository?.default_branch}` ||
+      owner.event !== env.GITHUB_EVENT_NAME || owner.run_id !== Number(env.GITHUB_RUN_ID) ||
+      !positive(attempt) || !positive(Number(env.GITHUB_RUN_ATTEMPT)) ||
+      owner.run_attempt !== attempt || attempt > Number(env.GITHUB_RUN_ATTEMPT) ||
+      owner.deployment_id !== Number(env.MOBILE_RELEASE_DEPLOYMENT_ID)) fail('handoff_owner');
+  return value;
+}
+
 function transferred(job) {
   if (!Array.isArray(job.steps)) return false;
   const selected = ['Build and transfer iOS binary', 'Retain Apple verification handoff'].map(name =>
@@ -49,7 +55,7 @@ function transferred(job) {
   return selected[0][0].number < selected[1][0].number;
 }
 
-async function verifyProducer(value, artifactId, api = github) {
+async function verifyProducer(value, artifactId, api = github, recoverCancelled = false) {
   if (!positive(artifactId)) fail('artifact_identity');
   const o = value.owner;
   const run = await api.request('GET', `/actions/runs/${o.run_id}/attempts/${o.run_attempt}`);
@@ -57,12 +63,21 @@ async function verifyProducer(value, artifactId, api = github) {
       run.path !== '.github/workflows/deploy.yml' || run.event !== o.event ||
       `refs/heads/${run.head_branch}` !== o.ref || run.repository?.full_name !== o.repository ||
       run.head_repository?.full_name !== o.repository) fail('producer_run');
+  if (recoverCancelled) {
+    const latest = await api.request('GET', `/actions/runs/${o.run_id}`);
+    if (run.status !== 'completed' || run.conclusion !== 'cancelled' || latest.id !== o.run_id ||
+        latest.status !== 'completed' || !positive(latest.run_attempt) || latest.run_attempt < o.run_attempt ||
+        latest.head_sha !== o.source_sha || latest.path !== run.path || latest.event !== o.event ||
+        latest.head_branch !== run.head_branch || latest.repository?.full_name !== o.repository ||
+        latest.head_repository?.full_name !== o.repository) fail('cancelled_producer_run');
+  }
   const result = await api.request('GET', `/actions/runs/${o.run_id}/attempts/${o.run_attempt}/jobs?per_page=100`);
   if (!Array.isArray(result.jobs) || result.jobs.length >= 100) fail('producer_jobs');
   const jobs = result.jobs.filter(job => job.name === 'iOS TestFlight' || job.name?.endsWith('/ iOS TestFlight'));
   // A later symbol-retention failure does not undo these exact completed steps.
   // The producer's original failure remains red; only Apple delivery is reconciled here.
-  if (jobs.length !== 1 || jobs[0].status !== 'completed' || !['success', 'failure'].includes(jobs[0].conclusion) ||
+  const conclusions = recoverCancelled ? ['cancelled'] : ['success', 'failure'];
+  if (jobs.length !== 1 || jobs[0].status !== 'completed' || !conclusions.includes(jobs[0].conclusion) ||
       jobs[0].head_sha !== o.source_sha || !transferred(jobs[0])) fail('producer_job');
   const artifact = await api.request('GET', `/actions/artifacts/${artifactId}`);
   if (artifact.id !== artifactId || artifact.expired !== false || artifact.workflow_run?.id !== o.run_id ||
@@ -100,4 +115,4 @@ function metadata(value, env = process.env) {
   }
 }
 
-module.exports = {read, verifyProducer, phase, metadata, fail};
+module.exports = {read, validate, verifyProducer, phase, metadata, fail};

package/action/scripts/apple_upload_recovery.cjs

@@ -0,0 +1,126 @@
+/* Explicit Actions recovery of a cancelled producer's authenticated handoff; never upload or metadata. */
+'use strict';
+const fs = require('node:fs');
+const {createHash} = require('node:crypto');
+const {inflateRawSync} = require('node:zlib');
+const github = require('./mobile_release_api.cjs');
+const handoff = require('./apple_upload_handoff.cjs');
+const verifier = require('./apple_upload_verify.cjs');
+const LIMIT = 2 * 1024 * 1024;
+const positive = value => Number.isSafeInteger(value) && value > 0;
+const fail = code => handoff.fail(`recovery_${code}`);
+
+// This archive contains one fixed JSON member. Parse in memory; never extract paths or trust a local receipt.
+function unpack(bytes) {
+  try {
+    if (bytes.length > LIMIT) fail('artifact_size');
+    const end = bytes.lastIndexOf(Buffer.from('504b0506', 'hex'));
+    if (end < 0 || end + 22 + bytes.readUInt16LE(end + 20) !== bytes.length ||
+        bytes.readUInt16LE(end + 4) !== 0 || bytes.readUInt16LE(end + 6) !== 0 ||
+        bytes.readUInt16LE(end + 8) !== 1 || bytes.readUInt16LE(end + 10) !== 1) fail('archive_invalid');
+    const at = bytes.readUInt32LE(end + 16), directorySize = bytes.readUInt32LE(end + 12);
+    if (at + directorySize !== end || bytes.readUInt32LE(at) !== 0x02014b50) fail('archive_invalid');
+    const flags = bytes.readUInt16LE(at + 8), method = bytes.readUInt16LE(at + 10);
+    const packed = bytes.readUInt32LE(at + 20), size = bytes.readUInt32LE(at + 24);
+    const length = bytes.readUInt16LE(at + 28), name = bytes.subarray(at + 46, at + 46 + length);
+    const mode = (bytes.readUInt32LE(at + 38) >>> 16) & 0xf000;
+    if (name.toString('utf8') !== 'apple-verification.json' || flags & 1 || ![0, 8].includes(method) ||
+        ![0, 0x8000].includes(mode) || size > LIMIT || packed > LIMIT ||
+        46 + length + bytes.readUInt16LE(at + 30) + bytes.readUInt16LE(at + 32) !== directorySize ||
+        bytes.readUInt16LE(at + 34) !== 0 || bytes.readUInt32LE(at + 42) !== 0 ||
+        bytes.readUInt32LE(0) !== 0x04034b50 || bytes.readUInt16LE(6) !== flags ||
+        bytes.readUInt16LE(8) !== method) fail('archive_invalid');
+    const localLength = bytes.readUInt16LE(26), start = 30 + localLength + bytes.readUInt16LE(28);
+    if (!bytes.subarray(30, 30 + localLength).equals(name) || start + packed > at) fail('archive_invalid');
+    const compressed = bytes.subarray(start, start + packed);
+    const content = method ? inflateRawSync(compressed, {maxOutputLength: LIMIT}) : compressed;
+    if (content.length !== size || content.length > LIMIT) fail('archive_invalid');
+    return content;
+  } catch { fail('archive_invalid'); }
+}
+
+async function download(artifact, env = process.env, fetcher = fetch) {
+  if (!positive(artifact?.id) || !/^sha256:[a-f0-9]{64}$/.test(artifact.digest || '') ||
+      !positive(artifact.size_in_bytes) || artifact.size_in_bytes > LIMIT ||
+      !/^[\w.-]+\/[\w.-]+$/.test(env.GITHUB_REPOSITORY || '')) fail('artifact_invalid');
+  const signal = AbortSignal.timeout(30000);
+  const response = await fetcher(`https://api.github.com/repos/${env.GITHUB_REPOSITORY}/actions/artifacts/${artifact.id}/zip`,
+    {redirect: 'manual', signal, headers: {Authorization: `Bearer ${env.GITHUB_TOKEN || ''}`,
+      'User-Agent': 'gowalk-cicd', Accept: 'application/vnd.github+json'}});
+  const url = new URL(response.headers.get('location') || 'https://invalid.invalid');
+  if (response.status !== 302 || url.protocol !== 'https:' || url.username || url.password ||
+      url.port || url.hash || !/(?:\.blob\.core\.windows\.net|\.githubusercontent\.com)$/.test(url.hostname)) {
+    fail('artifact_unavailable');
+  }
+  // The signed storage URL receives no repository credential, and cannot redirect again.
+  const body = await fetcher(url, {redirect: 'error', signal});
+  if (!body.ok || !body.body) fail('artifact_unavailable');
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of body.body) {
+    size += chunk.length;
+    if (size > LIMIT || size > artifact.size_in_bytes) fail('artifact_size');
+    chunks.push(chunk);
+  }
+  const bytes = Buffer.concat(chunks);
+  if (bytes.length !== artifact.size_in_bytes ||
+      `sha256:${createHash('sha256').update(bytes).digest('hex')}` !== artifact.digest) fail('artifact_digest');
+  return unpack(bytes);
+}
+
+async function current(env, api) {
+  const runId = Number(env.GITHUB_RUN_ID), attempt = Number(env.GITHUB_RUN_ATTEMPT);
+  const event = JSON.parse(fs.readFileSync(env.GITHUB_EVENT_PATH, 'utf8'));
+  const repository = env.GITHUB_REPOSITORY, branch = event.repository?.default_branch;
+  if (env.GITHUB_ACTIONS !== 'true' || env.GITHUB_EVENT_NAME !== 'workflow_dispatch' ||
+      !/^[\w.-]+\/[\w.-]+$/.test(repository || '') || !positive(runId) || !positive(attempt) ||
+      !branch || env.GITHUB_REF !== `refs/heads/${branch}` || !/^[a-f0-9]{40}$/.test(env.GITHUB_SHA || '')) {
+    fail('caller_invalid');
+  }
+  const run = await api.request('GET', `/actions/runs/${runId}/attempts/${attempt}`);
+  if (run.id !== runId || run.run_attempt !== attempt || run.status !== 'in_progress' ||
+      run.event !== 'workflow_dispatch' || run.head_branch !== branch || run.head_sha !== env.GITHUB_SHA ||
+      run.repository?.full_name !== repository || run.head_repository?.full_name !== repository ||
+      !/^\.github\/workflows\/[\w.-]+\.ya?ml$/.test(run.path || '') ||
+      env.GITHUB_WORKFLOW_REF !== `${repository}/${run.path}@${env.GITHUB_REF}`) fail('caller_unverified');
+  return {run_id: runId, run_attempt: attempt, repository, ref: env.GITHUB_REF};
+}
+
+async function recover({runId, attempt, deploymentId, artifactId}, dependencies = {}) {
+  if (![runId, attempt, deploymentId, artifactId].every(positive)) fail('arguments');
+  const env = dependencies.env || process.env, api = dependencies.api || github;
+  const caller = await current(env, api);
+  if (runId === caller.run_id) fail('caller_invalid');
+  const artifact = await api.request('GET', `/actions/artifacts/${artifactId}`);
+  if (artifact.id !== artifactId || artifact.expired !== false || artifact.workflow_run?.id !== runId ||
+      artifact.name !== `apple-verification-${runId}-${attempt}`) fail('artifact_identity');
+  const bytes = await download(artifact, env, dependencies.fetch || fetch);
+  let parsed;
+  try { parsed = JSON.parse(bytes.toString('utf8')); } catch { fail('handoff_invalid'); }
+  const value = handoff.validate(parsed), owner = value.owner;
+  if (owner.repository !== caller.repository || owner.ref !== caller.ref || owner.run_id !== runId ||
+      owner.run_attempt !== attempt || owner.deployment_id !== deploymentId ||
+      owner.source_sha !== artifact.workflow_run?.head_sha) fail('handoff_owner');
+  const result = await verifier.verify(value, artifactId, 900, {...dependencies, api, recoverCancelled: true});
+  return {...result, schema: 'gowalk-cicd/apple-upload-recovered.v1', producer_run: runId,
+    repository: owner.repository, producer_source_sha: owner.source_sha,
+    producer_ref: owner.ref, producer_event: owner.event,
+    artifact_id: artifactId, artifact_digest: artifact.digest,
+    handoff_sha256: createHash('sha256').update(bytes).digest('hex'),
+    ipa_sha256: value.receipt.sha256, file_id: value.receipt.file_id,
+    recovery_run: caller.run_id, recovery_attempt: caller.run_attempt};
+}
+
+async function main() {
+  if (process.argv.length !== 6) fail('arguments');
+  const [runId, attempt, deploymentId, artifactId] = process.argv.slice(2).map(Number);
+  console.log(JSON.stringify(await recover({runId, attempt, deploymentId, artifactId})));
+}
+
+if (require.main === module) main().catch(error => {
+  const code = /^(apple_upload_verify|apple_upload_reconcile|mobile_release)_[a-z0-9_]+$/.test(error?.message || '') ?
+    error.message : 'apple_upload_verify_recovery_unavailable';
+  console.error('::error title=apple_upload_recovery_refused::' + JSON.stringify({code}));
+  process.exitCode = 1;
+});
+module.exports = {unpack, download, current, recover};

package/action/scripts/apple_upload_verify.cjs

@@ -42,7 +42,7 @@ async function verify(value, artifactId, timeout, dependencies = {}) {
   const sleep = dependencies.sleep || delay, started = now(), deadline = started + timeout * 1000;
   const key = dependencies.get ? null : credential();
   const get = dependencies.get || (path => apple.appleGet(path, key, Math.max(1, Math.min(30000, deadline - now()))));
-  await handoff.verifyProducer(value, artifactId, api);
+  await handoff.verifyProducer(value, artifactId, api, dependencies.recoverCancelled === true);
   await handoff.phase(value, api);
   let proof;
   do {
@@ -52,6 +52,8 @@ async function verify(value, artifactId, timeout, dependencies = {}) {
     await sleep(Math.min(10000, deadline - now()));
   } while (now() < deadline);
   if (!proof) handoff.fail('processing_pending');
+  // Explicit historical recovery rechecks its terminal producer before the only write.
+  if (dependencies.recoverCancelled === true) await handoff.verifyProducer(value, artifactId, api, true);
   const prior = await handoff.phase(value, api);
   if (prior === 'uploading') await api.status(value.owner.deployment_id, 'uploaded', 'success');
   if (await handoff.phase(value, api) !== 'uploaded') handoff.fail('write_unconfirmed');

package/android-action/play-upload/action.yml

@@ -26,11 +26,16 @@ inputs:
   mobileReleaseIntentScript:
     description: Committed mobile_release.cjs path, invoked after acquiring the package owner and before upload.
     default: ''
+  versionCode:
+    description: Exact compiled version code for sanitized upload diagnostics only.
+    default: ''
 outputs:
   review-pending:
     description: True only after a successful explicitly requested review-hold retry.
   receipt:
     description: Sanitized versioned result with attempt count and upstream identity.
+  diagnostic-path:
+    description: Runner-owned directory with closed per-attempt and terminal diagnostic JSON.
 runs:
   using: node24
   main: run.cjs

package/android-action/play-upload/diagnostics.cjs

@@ -1,4 +1,5 @@
 // Observe only fixed progress/error patterns; never retain provider text in a receipt.
+const provider = require('./provider_evidence.cjs');
 const phases = new Map([
   ['Creating a new Edit for this release', 'edit_create'],
   ['Committing the Edit', 'edit_commit'],
@@ -22,10 +23,11 @@ const limit = 16384;
 
 function create() {
   return {phase: 'startup', signals: new Set(), pending: {stdout: '', stderr: ''},
-    discard: {stdout: false, stderr: false}};
+    discard: {stdout: false, stderr: false}, provider: provider.create()};
 }
 
 function line(state, stream, value) {
+  provider.observe(state.provider, value);
   if (stream === 'stdout') {
     if (phases.has(value)) state.phase = phases.get(value);
     for (const [prefix, phase] of prefixes) if (value.startsWith(prefix)) state.phase = phase;
@@ -70,4 +72,5 @@ function annotation(attempt, result) {
     + ` signals=${signals.join(',') || 'none'}`;
 }
 
-module.exports = {create, consume, snapshot, annotation};
+module.exports = {create, consume, snapshot, annotation,
+  providerSnapshot: state => provider.snapshot(state.provider)};

package/android-action/play-upload/evidence.cjs

@@ -0,0 +1,30 @@
+// This separate, sanitized directory survives cleanup of the private uploader output.
+const {mkdtempSync, writeFileSync} = require('node:fs');
+const {isAbsolute, join} = require('node:path');
+const records = require('./evidence_schema.cjs');
+
+function begin(env) {
+  const binding = records.context(env);
+  let directory = '', failed = false, recorded = 0;
+  try {
+    if (!isAbsolute(env.RUNNER_TEMP || '') || /[\x00-\x1f\x7f]/.test(env.RUNNER_TEMP)) throw new Error();
+    directory = mkdtempSync(join(env.RUNNER_TEMP, 'gowalk-play-evidence-'));
+  } catch { failed = true; }
+  const save = (name, value) => {
+    try {
+      if (!directory || !records.valid(value)) throw new Error();
+      writeFileSync(join(directory, name), JSON.stringify(value) + '\n', {mode: 0o600, flag: 'wx'});
+    } catch { failed = true; }
+  };
+  return {
+    attempt(number, result) {
+      save(`attempt-${number}.json`, records.attempt(binding, number, result));
+      recorded += 1;
+    },
+    terminal(result) { save('terminal.json', records.terminal(binding, result, recorded)); },
+    get path() { return failed ? '' : directory; },
+    get failed() { return failed; },
+  };
+}
+
+module.exports = {begin};

package/android-action/play-upload/evidence_schema.cjs

@@ -0,0 +1,71 @@
+const provider = require('./provider_evidence.cjs');
+const source = require('./source.cjs');
+const schema = 'gowalk-cicd/play-upload-evidence.v1';
+const phases = new Set(['startup', 'edit_create', 'tracks_read', 'bundle_upload', 'track_update', 'edit_commit']);
+const signals = new Set(['connection_reset', 'connection_refused', 'connection_timeout', 'dns_failure',
+  'tls_verification', 'output_truncated']);
+const processSignals = new Set(['none', 'SIGTERM', 'SIGINT', 'SIGKILL', 'other']);
+const codes = new Set(['uploaded', 'review_pending', 'edit_expired', 'edit_deleted', 'review_hold_required',
+  'unclassified_failure', 'upload_cancelled', 'upload_outcome_uncertain', 'uploader_failed',
+  'runner_context_required', 'uploader_integrity_refused', 'uploader_source_unavailable',
+  'mobile_release_intent_unconfirmed', ...require('./owner.cjs').codes]);
+const keys = (value, names) => value && typeof value === 'object' && !Array.isArray(value)
+  && Object.keys(value).sort().join(',') === names.split(',').sort().join(',');
+const integer = (value, minimum, maximum = Number.MAX_SAFE_INTEGER) =>
+  Number.isSafeInteger(value) && value >= minimum && value <= maximum;
+const nullable = (value, check) => value === null || check(value);
+
+function context(env) {
+  const positive = value => /^[1-9][0-9]*$/.test(value || '') && integer(Number(value), 1) ? Number(value) : null;
+  return {run_id: positive(env.GITHUB_RUN_ID), run_attempt: positive(env.GITHUB_RUN_ATTEMPT),
+    source_sha: /^[0-9a-f]{40}$/.test(env.GITHUB_SHA || '') ? env.GITHUB_SHA : null,
+    version_code: positive(env.INPUT_VERSIONCODE || env.ANDROID_BUILD_NUMBER)};
+}
+
+function base(binding, kind) {
+  return {schema, kind, ...binding, upstream_revision: source.revision, upstream_sha256: source.digest};
+}
+
+function attempt(binding, number, result) {
+  const diagnostic = result.diagnostic || {};
+  const observed = Array.isArray(diagnostic.signals) ? diagnostic.signals.filter(value => signals.has(value)) : [];
+  return {...base(binding, 'attempt'), attempt: number,
+    phase: phases.has(diagnostic.phase) ? diagnostic.phase : 'startup',
+    exit_code: integer(result.status, 0, 255) ? result.status : null,
+    signal: processSignals.has(result.signal) ? result.signal : result.signal ? 'other' : 'none',
+    error_count: integer(result.errors, 0) ? result.errors : null,
+    cancelled: result.cancelled === true, commit_reported: result.committed === true,
+    transport_signals: [...new Set(observed)].sort(),
+    provider: provider.valid(result.provider) ? result.provider : provider.snapshot(provider.create())};
+}
+
+function terminal(binding, result, recorded) {
+  return {...base(binding, 'terminal'), recorded_attempts: recorded, result: {
+    ok: result.ok === true, code: codes.has(result.code) ? result.code : 'uploader_failed',
+    attempts: integer(result.attempts, 0, 2) ? result.attempts : 0,
+    review_pending: result.review_pending === true}};
+}
+
+function valid(value) {
+  const fields = 'schema,kind,run_id,run_attempt,source_sha,version_code,upstream_revision,upstream_sha256';
+  if (!value || value.schema !== schema || value.upstream_revision !== source.revision
+      || value.upstream_sha256 !== source.digest || !nullable(value.run_id, item => integer(item, 1))
+      || !nullable(value.run_attempt, item => integer(item, 1))
+      || !nullable(value.version_code, item => integer(item, 1))
+      || !nullable(value.source_sha, item => typeof item === 'string' && /^[0-9a-f]{40}$/.test(item))) return false;
+  if (value.kind === 'terminal') return keys(value, fields + ',recorded_attempts,result')
+    && integer(value.recorded_attempts, 0, 2) && keys(value.result, 'ok,code,attempts,review_pending')
+    && typeof value.result.ok === 'boolean' && codes.has(value.result.code)
+    && integer(value.result.attempts, 0, 2) && typeof value.result.review_pending === 'boolean';
+  return value.kind === 'attempt' && keys(value, fields
+    + ',attempt,phase,exit_code,signal,error_count,cancelled,commit_reported,transport_signals,provider')
+    && integer(value.attempt, 1, 2) && phases.has(value.phase) && processSignals.has(value.signal)
+    && nullable(value.exit_code, item => integer(item, 0, 255))
+    && nullable(value.error_count, item => integer(item, 0)) && typeof value.cancelled === 'boolean'
+    && typeof value.commit_reported === 'boolean' && Array.isArray(value.transport_signals)
+    && value.transport_signals.length <= signals.size
+    && new Set(value.transport_signals).size === value.transport_signals.length
+    && [...value.transport_signals].every(item => signals.has(item)) && provider.valid(value.provider);
+}
+
+module.exports = {schema, context, attempt, terminal, valid};

package/android-action/play-upload/process.cjs

@@ -53,7 +53,8 @@ function execute(program, env, directory, timeout) {
       diagnostics.consume(diagnostic, 'stdout', '\n'); diagnostics.consume(diagnostic, 'stderr', '\n');
       const committed = /(?:^|\n)committedEditId(?:=|<<)/.test(readFileSync(output, 'utf8'));
       resolve({status, signal, cancelled, committed, errors: state.errors,
-        code: state.ambiguous ? 'unclassified_failure' : state.code, diagnostic: diagnostics.snapshot(diagnostic)});
+        code: state.ambiguous ? 'unclassified_failure' : state.code, diagnostic: diagnostics.snapshot(diagnostic),
+        provider: diagnostics.providerSnapshot(diagnostic)});
     });
   });
 }

package/android-action/play-upload/provider_evidence.cjs

@@ -0,0 +1,51 @@
+// Closed observations only. Missing provider fields are never inferred from message text.
+const http = new Set([400, 401, 402, 403, 404, 405, 408, 409, 410, 412, 413, 414, 415,
+  416, 417, 422, 428, 429, 500, 501, 502, 503, 504]);
+const rpc = new Set(['CANCELLED', 'UNKNOWN', 'INVALID_ARGUMENT', 'DEADLINE_EXCEEDED', 'NOT_FOUND',
+  'ALREADY_EXISTS', 'PERMISSION_DENIED', 'RESOURCE_EXHAUSTED', 'FAILED_PRECONDITION', 'ABORTED',
+  'OUT_OF_RANGE', 'UNIMPLEMENTED', 'INTERNAL', 'UNAVAILABLE', 'DATA_LOSS', 'UNAUTHENTICATED']);
+const messages = new Map([
+  ['This edit has expired, please create a new Edit.', 'edit_expired'],
+  ['This Edit has been deleted.', 'edit_deleted'],
+  ['Changes cannot be sent for review automatically. Please set the query parameter changesNotSentForReview to true. '
+    + 'Once committed, the changes in this edit can be sent for review from the Google Play Console UI.',
+  'review_hold_required'],
+  ['Unknown error occurred.', 'uploader_unknown_error'],
+  ['New edit has no ID, cannot continue.', 'edit_id_missing'],
+]);
+const classes = new Set(messages.values());
+
+function create() {
+  return {http: new Set(), rpc: new Set(), classes: new Set()};
+}
+
+function observe(state, value) {
+  const match = /^::error(?: [^\r\n]+)?::(.*)$/.exec(value) || /^Error: (.*)$/.exec(value);
+  if (!match) return;
+  const text = match[1].replace(/%0D/g, '\r').replace(/%0A/g, '\n').replace(/%25/g, '%');
+  if (messages.has(text)) state.classes.add(messages.get(text));
+  const status = /^Request failed with status code ([45]\d\d)(?:\.?$|\.\s)/.exec(text);
+  if (status && http.has(Number(status[1]))) state.http.add(Number(status[1]));
+  let body;
+  try { body = JSON.parse(text); } catch { return; }
+  const error = body?.error;
+  if (!error || typeof error !== 'object' || Array.isArray(error) || !http.has(error.code)) return;
+  state.http.add(error.code);
+  if (rpc.has(error.status)) state.rpc.add(error.status);
+  if (messages.has(error.message)) state.classes.add(messages.get(error.message));
+}
+
+function snapshot(state) {
+  return {http_statuses: [...state.http].sort((a, b) => a - b), rpc_codes: [...state.rpc].sort(),
+    message_classes: [...state.classes].sort()};
+}
+
+function valid(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+      || Object.keys(value).sort().join(',') !== 'http_statuses,message_classes,rpc_codes') return false;
+  return [['http_statuses', http], ['rpc_codes', rpc], ['message_classes', classes]].every(([key, choices]) =>
+    Array.isArray(value[key]) && value[key].length <= choices.size
+    && new Set(value[key]).size === value[key].length && [...value[key]].every(item => choices.has(item)));
+}
+
+module.exports = {create, observe, snapshot, valid};

package/android-action/play-upload/run.cjs

@@ -6,6 +6,7 @@ const processRunner = require('./process.cjs');
 const owner = require('./owner.cjs');
 const diagnostics = require('./diagnostics.cjs');
 const releaseIntent = require('./release_intent.cjs');
+const evidence = require('./evidence.cjs');
 
 async function upload(program, env, directory, execute = processRunner.execute, timeout = 3600000,
   cancelled = () => false, report = () => {}) {
@@ -33,9 +34,10 @@ async function upload(program, env, directory, execute = processRunner.execute,
 }
 
 async function main() {
-  let directory, receipt;
+  let directory, receipt, records;
   try {
     const env = {...process.env};
+    records = evidence.begin(env);
     if (!env.PLAY_EDIT_BINDING) throw new Error('play_owner_binding_required');
     env.PLAY_EDIT_PRINCIPAL_SHA256 = require('./owner_principal.cjs').read(env.INPUT_SERVICEACCOUNTJSON);
     if (!env.RUNNER_TEMP || !env.GITHUB_OUTPUT) throw new Error('runner_context_required');
@@ -45,7 +47,9 @@ async function main() {
       if (cancelled()) return {ok: false, code: 'upload_cancelled', attempts: 0, review_pending: false};
       await releaseIntent.begin(env);
       return upload(program, env, directory, processRunner.execute, 3600000, cancelled,
-        (attempt, result) => console.log(diagnostics.annotation(attempt, result)));
+        (attempt, result) => {
+          records.attempt(attempt, result); console.log(diagnostics.annotation(attempt, result));
+        });
     });
   } catch (error) {
     if (owner.codes.includes(error.message)) console.log(owner.annotation(error.message, undefined,
@@ -61,13 +65,19 @@ async function main() {
   } finally { if (directory) rmSync(directory, {recursive: true, force: true}); }
   receipt = {schema: 'gowalk-cicd/play-upload.v1', ...receipt, upstream_revision: source.revision,
     upstream_sha256: source.digest};
+  records?.terminal(receipt);
   const encoded = JSON.stringify(receipt);
   if (process.env.GITHUB_OUTPUT) {
     appendFileSync(process.env.GITHUB_OUTPUT, `review-pending=${receipt.review_pending}\nreceipt=${encoded}\n`);
+    appendFileSync(process.env.GITHUB_OUTPUT, `diagnostic-path=${records?.path || ''}\n`);
   }
   // The panel parses a success receipt even when a multi-line secret masks its outer braces.
   console.log(`::${receipt.ok ? 'notice' : 'error'} title=play_upload_result::${encoded}`);
   if (!receipt.ok) process.exitCode = 1;
+  if (records?.failed) {
+    console.log('::error title=play_upload_evidence_failed::Sanitized upload evidence could not be retained.');
+    process.exitCode = 1;
+  }
 }
 
 module.exports = {upload, main};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.181",
+  "version": "1.0.183",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/remedies.json

@@ -23,6 +23,12 @@
     "fixed_in": "1.0.132",
     "remedy": "Read the original run, attempt and deployment receipt before retrying. A completed uploaded receipt is reused with its original evidence; finish its metadata and submission work. An uploading receipt is ambiguous even when a later owner refusal reports no provider attempt. Adopt the 1.0.132 action and workflow together to place future Android intent writes inside acquired Play ownership. For an existing receipt, prove the exact provider build/version or use supported retained-binary recovery; never relabel it building by hand or clear ownership on elapsed time."
   },
+  {
+    "schema": "gowalk-cicd/mobile-release-refused.v1",
+    "code": "mobile_release_upload_unconfirmed_read_back_retained_binary_before_retry",
+    "fixed_in": "1.0.183",
+    "remedy": "Preserve the original upload owner and artifacts. If an iOS producer was cancelled after both Build and transfer iOS binary and Retain Apple verification handoff succeeded, use apple_upload_recovery.cjs RUN ATTEMPT DEPLOYMENT ARTIFACT from an authorized default-branch workflow_dispatch Actions job. It downloads and authenticates the original artifact, proves the terminal original and latest run, and reads fresh Apple upload/file/build/app evidence before reconciling that deployment. It never rebuilds, uploads or replays metadata. Retain its recovery proof, then rerun the whole original deployment workflow: admission reuses the uploaded receipt without another iOS binary. The old cancellation remains historical evidence; follow the new attempt to completion. Missing or mismatched evidence still refuses."
+  },
   {
     "schema": "gowalk-cicd/mobile-release-refused.v1",
     "code": "mobile_release_http_500",

package/templates/deploy.yml

@@ -658,6 +658,17 @@ jobs:
           userFraction: >-
             ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
           whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
+          versionCode: ${{ steps.android.outputs.build-number || steps.reuse.outputs.build-number }}
+
+      - name: Retain sanitized Play upload diagnostics
+        if: ${{ always() && steps.play-upload.outputs.diagnostic-path != '' }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ github.workspace }}/.github/actions/android-app/scripts/artifact_env.cjs"
+        with:
+          name: play-upload-diagnostics-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ steps.play-upload.outputs.diagnostic-path }}/*.json
+          if-no-files-found: error
 
       # The retry landed the bundle without submitting it. That is a fact for
       - name: Record confirmed Android upload