gowalk-cicd 1.0.182 → 1.0.183

package/README.md

@@ -1240,6 +1240,71 @@ different bytes under the same number. Build numbers come from `/builds`,
 `/preReleaseVersions` **and** `/apps/{id}/buildUploads`, so an unfinished or refused
 reservation is never reused; delete such a reservation only after reading it back.
 
+When an iOS producer was cancelled **after** both `Build and transfer iOS binary` and
+`Retain Apple verification handoff` succeeded, version 1.0.183 provides explicit recovery:
+
+```bash
+node .github/actions/swift-app/scripts/apple_upload_recovery.cjs \
+  ORIGINAL_RUN_ID ORIGINAL_ATTEMPT DEPLOYMENT_ID HANDOFF_ARTIFACT_ID \
+  > "$RUNNER_TEMP/apple-upload-recovery.json"
+```
+
+Run this released helper in an authorized `workflow_dispatch` Actions job on the same
+repository's default branch, after checking out the adopted tooling. The job needs
+`actions: read`, `contents: read`, `deployments: write`, `GITHUB_TOKEN: ${{ github.token }}`
+and the existing `ASC_KEY_P8`, `ASC_KEY_ID`, `ASC_ISSUER_ID` secrets (or the prepared ASC key
+path). Serialize the recovery workflow with normal Mobile Deploy using its exact concurrency
+group and `cancel-in-progress: false`; this prevents a deploy from starting between the
+last provenance read and the receipt write. Use this workflow policy and job environment:
+
+```yaml
+on: workflow_dispatch
+permissions:
+  contents: read
+  actions: read
+  deployments: write
+concurrency:
+  group: mobile-deploy-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  recover:
+    if: ${{ github.ref_name == github.event.repository.default_branch }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+      ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+      ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+      # Invoke the command above with the four verified original identifiers,
+      # then retain its JSON with the pinned, guarded artifact uploader.
+```
+
+Retain `apple-upload-recovery.json` with the existing pinned, guarded artifact uploader.
+The command has no local receipt or caller-provided
+digest option: it downloads the exact original artifact, verifies GitHub's archive SHA-256,
+and accepts only its bounded `apple-verification.json` member. It authenticates the current
+dispatch separately from the original run, attempt, source, repository, branch and deployment.
+
+Recovery requires a terminal cancelled original run and iOS producer with those two
+successful steps in order. A later completed attempt may exist; an active latest attempt
+refuses, including a retry observed immediately before writing the receipt. Fresh Apple
+readback must prove the exact completed upload and file, matching bytes, eligible `VALID`
+build and matching app. Only then can the original deployment become `uploaded`; repeating
+recovery verifies the same evidence without another write. No binary is rebuilt or uploaded,
+and the old handoff's metadata and release notes are never replayed. Missing, expired or
+mismatched evidence remains refused; do not relabel a receipt or impersonate the original
+`GITHUB_*` environment. Normal delivery still refuses cancelled producers.
+
+Retain the recovery proof, then rerun the **whole original deployment workflow**. Its
+upload-once admission reuses the confirmed iOS receipt and skips the iOS binary. Follow that
+new attempt and any unrelated remaining jobs to completion; recovery does not change the
+original cancelled attempt's conclusion. Read current store state for remaining submission
+work without changing an already accepted submission. This exceptional command adds no
+normal delivery job, polling or latency.
+
 Flutter SDK setup retries interrupted manifest and archive GETs, with four attempts
 within 60 seconds for manifests or 30 minutes for archives, with an 8 GiB archive bound. Retries resume private bytes
 with HTTP Range; if the origin ignores Range, a bounded full restart is permitted. The completed archive

package/action/scripts/apple_upload_handoff.cjs

@@ -9,22 +9,12 @@ const positive = value => Number.isSafeInteger(value) && value > 0;
 const id = value => typeof value === 'string' && /^[A-Za-z0-9-]{1,64}$/.test(value);
 const fail = code => { throw Error(`apple_upload_verify_${code}`); };
 
-function read(path, digest, attempt, env = process.env) {
-  if (fs.statSync(path).size > 2 * 1024 * 1024) fail('handoff_size');
-  const bytes = fs.readFileSync(path);
-  if (bytes.length > 2 * 1024 * 1024 || !/^[a-f0-9]{64}$/.test(digest || '') ||
-      createHash('sha256').update(bytes).digest('hex') !== digest) fail('handoff_digest');
-  const value = JSON.parse(bytes), owner = value.owner || {}, r = value.receipt || {}, m = value.metadata || {};
-  const event = JSON.parse(fs.readFileSync(env.GITHUB_EVENT_PATH, 'utf8'));
-  if (value.schema !== SCHEMA || owner.repository !== env.GITHUB_REPOSITORY ||
+function validate(value) {
+  const owner = value?.owner || {}, r = value?.receipt || {}, m = value?.metadata || {};
+  if (value?.schema !== SCHEMA ||
       !/^[\w.-]+\/[\w.-]+$/.test(owner.repository || '') || !/^[a-f0-9]{40}$/.test(owner.source_sha || '') ||
-      owner.source_sha !== env.GITHUB_SHA || owner.ref !== env.GITHUB_REF || !owner.ref?.startsWith('refs/heads/') ||
-      owner.ref !== `refs/heads/${event.repository?.default_branch}` ||
-      !['push', 'workflow_dispatch'].includes(owner.event) || owner.event !== env.GITHUB_EVENT_NAME ||
-      !positive(owner.run_id) || owner.run_id !== Number(env.GITHUB_RUN_ID) || !positive(owner.run_attempt) ||
-      !positive(attempt) || !positive(Number(env.GITHUB_RUN_ATTEMPT)) ||
-      owner.run_attempt !== attempt || attempt > Number(env.GITHUB_RUN_ATTEMPT) ||
-      !positive(owner.deployment_id) || owner.deployment_id !== Number(env.MOBILE_RELEASE_DEPLOYMENT_ID)) {
+      !owner.ref?.startsWith('refs/heads/') || !['push', 'workflow_dispatch'].includes(owner.event) ||
+      !positive(owner.run_id) || !positive(owner.run_attempt) || !positive(owner.deployment_id)) {
     fail('handoff_owner');
   }
   if (r.schema !== 'gowalk-cicd/apple-build-upload-receipt.v1' || r.stage !== 'transferred' ||
@@ -40,6 +30,22 @@ function read(path, digest, attempt, env = process.env) {
   return value;
 }
 
+function read(path, digest, attempt, env = process.env) {
+  if (fs.statSync(path).size > 2 * 1024 * 1024) fail('handoff_size');
+  const bytes = fs.readFileSync(path);
+  if (bytes.length > 2 * 1024 * 1024 || !/^[a-f0-9]{64}$/.test(digest || '') ||
+      createHash('sha256').update(bytes).digest('hex') !== digest) fail('handoff_digest');
+  const value = validate(JSON.parse(bytes)), owner = value.owner;
+  const event = JSON.parse(fs.readFileSync(env.GITHUB_EVENT_PATH, 'utf8'));
+  if (owner.repository !== env.GITHUB_REPOSITORY || owner.source_sha !== env.GITHUB_SHA ||
+      owner.ref !== env.GITHUB_REF || owner.ref !== `refs/heads/${event.repository?.default_branch}` ||
+      owner.event !== env.GITHUB_EVENT_NAME || owner.run_id !== Number(env.GITHUB_RUN_ID) ||
+      !positive(attempt) || !positive(Number(env.GITHUB_RUN_ATTEMPT)) ||
+      owner.run_attempt !== attempt || attempt > Number(env.GITHUB_RUN_ATTEMPT) ||
+      owner.deployment_id !== Number(env.MOBILE_RELEASE_DEPLOYMENT_ID)) fail('handoff_owner');
+  return value;
+}
+
 function transferred(job) {
   if (!Array.isArray(job.steps)) return false;
   const selected = ['Build and transfer iOS binary', 'Retain Apple verification handoff'].map(name =>
@@ -49,7 +55,7 @@ function transferred(job) {
   return selected[0][0].number < selected[1][0].number;
 }
 
-async function verifyProducer(value, artifactId, api = github) {
+async function verifyProducer(value, artifactId, api = github, recoverCancelled = false) {
   if (!positive(artifactId)) fail('artifact_identity');
   const o = value.owner;
   const run = await api.request('GET', `/actions/runs/${o.run_id}/attempts/${o.run_attempt}`);
@@ -57,12 +63,21 @@ async function verifyProducer(value, artifactId, api = github) {
       run.path !== '.github/workflows/deploy.yml' || run.event !== o.event ||
       `refs/heads/${run.head_branch}` !== o.ref || run.repository?.full_name !== o.repository ||
       run.head_repository?.full_name !== o.repository) fail('producer_run');
+  if (recoverCancelled) {
+    const latest = await api.request('GET', `/actions/runs/${o.run_id}`);
+    if (run.status !== 'completed' || run.conclusion !== 'cancelled' || latest.id !== o.run_id ||
+        latest.status !== 'completed' || !positive(latest.run_attempt) || latest.run_attempt < o.run_attempt ||
+        latest.head_sha !== o.source_sha || latest.path !== run.path || latest.event !== o.event ||
+        latest.head_branch !== run.head_branch || latest.repository?.full_name !== o.repository ||
+        latest.head_repository?.full_name !== o.repository) fail('cancelled_producer_run');
+  }
   const result = await api.request('GET', `/actions/runs/${o.run_id}/attempts/${o.run_attempt}/jobs?per_page=100`);
   if (!Array.isArray(result.jobs) || result.jobs.length >= 100) fail('producer_jobs');
   const jobs = result.jobs.filter(job => job.name === 'iOS TestFlight' || job.name?.endsWith('/ iOS TestFlight'));
   // A later symbol-retention failure does not undo these exact completed steps.
   // The producer's original failure remains red; only Apple delivery is reconciled here.
-  if (jobs.length !== 1 || jobs[0].status !== 'completed' || !['success', 'failure'].includes(jobs[0].conclusion) ||
+  const conclusions = recoverCancelled ? ['cancelled'] : ['success', 'failure'];
+  if (jobs.length !== 1 || jobs[0].status !== 'completed' || !conclusions.includes(jobs[0].conclusion) ||
       jobs[0].head_sha !== o.source_sha || !transferred(jobs[0])) fail('producer_job');
   const artifact = await api.request('GET', `/actions/artifacts/${artifactId}`);
   if (artifact.id !== artifactId || artifact.expired !== false || artifact.workflow_run?.id !== o.run_id ||
@@ -100,4 +115,4 @@ function metadata(value, env = process.env) {
   }
 }
 
-module.exports = {read, verifyProducer, phase, metadata, fail};
+module.exports = {read, validate, verifyProducer, phase, metadata, fail};

package/action/scripts/apple_upload_recovery.cjs

@@ -0,0 +1,126 @@
+/* Explicit Actions recovery of a cancelled producer's authenticated handoff; never upload or metadata. */
+'use strict';
+const fs = require('node:fs');
+const {createHash} = require('node:crypto');
+const {inflateRawSync} = require('node:zlib');
+const github = require('./mobile_release_api.cjs');
+const handoff = require('./apple_upload_handoff.cjs');
+const verifier = require('./apple_upload_verify.cjs');
+const LIMIT = 2 * 1024 * 1024;
+const positive = value => Number.isSafeInteger(value) && value > 0;
+const fail = code => handoff.fail(`recovery_${code}`);
+
+// This archive contains one fixed JSON member. Parse in memory; never extract paths or trust a local receipt.
+function unpack(bytes) {
+  try {
+    if (bytes.length > LIMIT) fail('artifact_size');
+    const end = bytes.lastIndexOf(Buffer.from('504b0506', 'hex'));
+    if (end < 0 || end + 22 + bytes.readUInt16LE(end + 20) !== bytes.length ||
+        bytes.readUInt16LE(end + 4) !== 0 || bytes.readUInt16LE(end + 6) !== 0 ||
+        bytes.readUInt16LE(end + 8) !== 1 || bytes.readUInt16LE(end + 10) !== 1) fail('archive_invalid');
+    const at = bytes.readUInt32LE(end + 16), directorySize = bytes.readUInt32LE(end + 12);
+    if (at + directorySize !== end || bytes.readUInt32LE(at) !== 0x02014b50) fail('archive_invalid');
+    const flags = bytes.readUInt16LE(at + 8), method = bytes.readUInt16LE(at + 10);
+    const packed = bytes.readUInt32LE(at + 20), size = bytes.readUInt32LE(at + 24);
+    const length = bytes.readUInt16LE(at + 28), name = bytes.subarray(at + 46, at + 46 + length);
+    const mode = (bytes.readUInt32LE(at + 38) >>> 16) & 0xf000;
+    if (name.toString('utf8') !== 'apple-verification.json' || flags & 1 || ![0, 8].includes(method) ||
+        ![0, 0x8000].includes(mode) || size > LIMIT || packed > LIMIT ||
+        46 + length + bytes.readUInt16LE(at + 30) + bytes.readUInt16LE(at + 32) !== directorySize ||
+        bytes.readUInt16LE(at + 34) !== 0 || bytes.readUInt32LE(at + 42) !== 0 ||
+        bytes.readUInt32LE(0) !== 0x04034b50 || bytes.readUInt16LE(6) !== flags ||
+        bytes.readUInt16LE(8) !== method) fail('archive_invalid');
+    const localLength = bytes.readUInt16LE(26), start = 30 + localLength + bytes.readUInt16LE(28);
+    if (!bytes.subarray(30, 30 + localLength).equals(name) || start + packed > at) fail('archive_invalid');
+    const compressed = bytes.subarray(start, start + packed);
+    const content = method ? inflateRawSync(compressed, {maxOutputLength: LIMIT}) : compressed;
+    if (content.length !== size || content.length > LIMIT) fail('archive_invalid');
+    return content;
+  } catch { fail('archive_invalid'); }
+}
+
+async function download(artifact, env = process.env, fetcher = fetch) {
+  if (!positive(artifact?.id) || !/^sha256:[a-f0-9]{64}$/.test(artifact.digest || '') ||
+      !positive(artifact.size_in_bytes) || artifact.size_in_bytes > LIMIT ||
+      !/^[\w.-]+\/[\w.-]+$/.test(env.GITHUB_REPOSITORY || '')) fail('artifact_invalid');
+  const signal = AbortSignal.timeout(30000);
+  const response = await fetcher(`https://api.github.com/repos/${env.GITHUB_REPOSITORY}/actions/artifacts/${artifact.id}/zip`,
+    {redirect: 'manual', signal, headers: {Authorization: `Bearer ${env.GITHUB_TOKEN || ''}`,
+      'User-Agent': 'gowalk-cicd', Accept: 'application/vnd.github+json'}});
+  const url = new URL(response.headers.get('location') || 'https://invalid.invalid');
+  if (response.status !== 302 || url.protocol !== 'https:' || url.username || url.password ||
+      url.port || url.hash || !/(?:\.blob\.core\.windows\.net|\.githubusercontent\.com)$/.test(url.hostname)) {
+    fail('artifact_unavailable');
+  }
+  // The signed storage URL receives no repository credential, and cannot redirect again.
+  const body = await fetcher(url, {redirect: 'error', signal});
+  if (!body.ok || !body.body) fail('artifact_unavailable');
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of body.body) {
+    size += chunk.length;
+    if (size > LIMIT || size > artifact.size_in_bytes) fail('artifact_size');
+    chunks.push(chunk);
+  }
+  const bytes = Buffer.concat(chunks);
+  if (bytes.length !== artifact.size_in_bytes ||
+      `sha256:${createHash('sha256').update(bytes).digest('hex')}` !== artifact.digest) fail('artifact_digest');
+  return unpack(bytes);
+}
+
+async function current(env, api) {
+  const runId = Number(env.GITHUB_RUN_ID), attempt = Number(env.GITHUB_RUN_ATTEMPT);
+  const event = JSON.parse(fs.readFileSync(env.GITHUB_EVENT_PATH, 'utf8'));
+  const repository = env.GITHUB_REPOSITORY, branch = event.repository?.default_branch;
+  if (env.GITHUB_ACTIONS !== 'true' || env.GITHUB_EVENT_NAME !== 'workflow_dispatch' ||
+      !/^[\w.-]+\/[\w.-]+$/.test(repository || '') || !positive(runId) || !positive(attempt) ||
+      !branch || env.GITHUB_REF !== `refs/heads/${branch}` || !/^[a-f0-9]{40}$/.test(env.GITHUB_SHA || '')) {
+    fail('caller_invalid');
+  }
+  const run = await api.request('GET', `/actions/runs/${runId}/attempts/${attempt}`);
+  if (run.id !== runId || run.run_attempt !== attempt || run.status !== 'in_progress' ||
+      run.event !== 'workflow_dispatch' || run.head_branch !== branch || run.head_sha !== env.GITHUB_SHA ||
+      run.repository?.full_name !== repository || run.head_repository?.full_name !== repository ||
+      !/^\.github\/workflows\/[\w.-]+\.ya?ml$/.test(run.path || '') ||
+      env.GITHUB_WORKFLOW_REF !== `${repository}/${run.path}@${env.GITHUB_REF}`) fail('caller_unverified');
+  return {run_id: runId, run_attempt: attempt, repository, ref: env.GITHUB_REF};
+}
+
+async function recover({runId, attempt, deploymentId, artifactId}, dependencies = {}) {
+  if (![runId, attempt, deploymentId, artifactId].every(positive)) fail('arguments');
+  const env = dependencies.env || process.env, api = dependencies.api || github;
+  const caller = await current(env, api);
+  if (runId === caller.run_id) fail('caller_invalid');
+  const artifact = await api.request('GET', `/actions/artifacts/${artifactId}`);
+  if (artifact.id !== artifactId || artifact.expired !== false || artifact.workflow_run?.id !== runId ||
+      artifact.name !== `apple-verification-${runId}-${attempt}`) fail('artifact_identity');
+  const bytes = await download(artifact, env, dependencies.fetch || fetch);
+  let parsed;
+  try { parsed = JSON.parse(bytes.toString('utf8')); } catch { fail('handoff_invalid'); }
+  const value = handoff.validate(parsed), owner = value.owner;
+  if (owner.repository !== caller.repository || owner.ref !== caller.ref || owner.run_id !== runId ||
+      owner.run_attempt !== attempt || owner.deployment_id !== deploymentId ||
+      owner.source_sha !== artifact.workflow_run?.head_sha) fail('handoff_owner');
+  const result = await verifier.verify(value, artifactId, 900, {...dependencies, api, recoverCancelled: true});
+  return {...result, schema: 'gowalk-cicd/apple-upload-recovered.v1', producer_run: runId,
+    repository: owner.repository, producer_source_sha: owner.source_sha,
+    producer_ref: owner.ref, producer_event: owner.event,
+    artifact_id: artifactId, artifact_digest: artifact.digest,
+    handoff_sha256: createHash('sha256').update(bytes).digest('hex'),
+    ipa_sha256: value.receipt.sha256, file_id: value.receipt.file_id,
+    recovery_run: caller.run_id, recovery_attempt: caller.run_attempt};
+}
+
+async function main() {
+  if (process.argv.length !== 6) fail('arguments');
+  const [runId, attempt, deploymentId, artifactId] = process.argv.slice(2).map(Number);
+  console.log(JSON.stringify(await recover({runId, attempt, deploymentId, artifactId})));
+}
+
+if (require.main === module) main().catch(error => {
+  const code = /^(apple_upload_verify|apple_upload_reconcile|mobile_release)_[a-z0-9_]+$/.test(error?.message || '') ?
+    error.message : 'apple_upload_verify_recovery_unavailable';
+  console.error('::error title=apple_upload_recovery_refused::' + JSON.stringify({code}));
+  process.exitCode = 1;
+});
+module.exports = {unpack, download, current, recover};

package/action/scripts/apple_upload_verify.cjs

@@ -42,7 +42,7 @@ async function verify(value, artifactId, timeout, dependencies = {}) {
   const sleep = dependencies.sleep || delay, started = now(), deadline = started + timeout * 1000;
   const key = dependencies.get ? null : credential();
   const get = dependencies.get || (path => apple.appleGet(path, key, Math.max(1, Math.min(30000, deadline - now()))));
-  await handoff.verifyProducer(value, artifactId, api);
+  await handoff.verifyProducer(value, artifactId, api, dependencies.recoverCancelled === true);
   await handoff.phase(value, api);
   let proof;
   do {
@@ -52,6 +52,8 @@ async function verify(value, artifactId, timeout, dependencies = {}) {
     await sleep(Math.min(10000, deadline - now()));
   } while (now() < deadline);
   if (!proof) handoff.fail('processing_pending');
+  // Explicit historical recovery rechecks its terminal producer before the only write.
+  if (dependencies.recoverCancelled === true) await handoff.verifyProducer(value, artifactId, api, true);
   const prior = await handoff.phase(value, api);
   if (prior === 'uploading') await api.status(value.owner.deployment_id, 'uploaded', 'success');
   if (await handoff.phase(value, api) !== 'uploaded') handoff.fail('write_unconfirmed');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.182",
+  "version": "1.0.183",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/remedies.json

@@ -23,6 +23,12 @@
     "fixed_in": "1.0.132",
     "remedy": "Read the original run, attempt and deployment receipt before retrying. A completed uploaded receipt is reused with its original evidence; finish its metadata and submission work. An uploading receipt is ambiguous even when a later owner refusal reports no provider attempt. Adopt the 1.0.132 action and workflow together to place future Android intent writes inside acquired Play ownership. For an existing receipt, prove the exact provider build/version or use supported retained-binary recovery; never relabel it building by hand or clear ownership on elapsed time."
   },
+  {
+    "schema": "gowalk-cicd/mobile-release-refused.v1",
+    "code": "mobile_release_upload_unconfirmed_read_back_retained_binary_before_retry",
+    "fixed_in": "1.0.183",
+    "remedy": "Preserve the original upload owner and artifacts. If an iOS producer was cancelled after both Build and transfer iOS binary and Retain Apple verification handoff succeeded, use apple_upload_recovery.cjs RUN ATTEMPT DEPLOYMENT ARTIFACT from an authorized default-branch workflow_dispatch Actions job. It downloads and authenticates the original artifact, proves the terminal original and latest run, and reads fresh Apple upload/file/build/app evidence before reconciling that deployment. It never rebuilds, uploads or replays metadata. Retain its recovery proof, then rerun the whole original deployment workflow: admission reuses the uploaded receipt without another iOS binary. The old cancellation remains historical evidence; follow the new attempt to completion. Missing or mismatched evidence still refuses."
+  },
   {
     "schema": "gowalk-cicd/mobile-release-refused.v1",
     "code": "mobile_release_http_500",