gowalk-cicd 1.0.184 → 1.0.185

package/README.md

@@ -25,6 +25,8 @@ Writes three core things into your repo:
 
 It also writes:
 
+- `.github/workflows/apple-upload-recovery.yml` — explicit verification-only recovery for a retained iOS upload;
+  it checks the original producer and Apple build before completing that deployment, without rebuilding or uploading
 - `.github/workflows/mobile-candidate.yml` — shipping binaries for ready task PRs
   (dispatch-only while candidate artifacts are off)
 - `.github/workflows/warm-android-cache.yml` — only while Android candidates are enabled: after this
@@ -1225,7 +1227,10 @@ commits completed part transfers with `uploaded: true`, following Apple's
 The IPA endpoint rejected an optional `sourceFileChecksums` SHA_256 object even though
 the generic schema lists that algorithm; the uploader no longer sends that attribute.
 A completed file is reused only when its content-derived filename and size match, and
-any returned file checksum is verified. New receipts retain locally computed SHA-256 and
+any nonnull returned whole-file checksum is verified. An explicit
+`sourceFileChecksums.file: null` means that the optional whole-file checksum is absent;
+a composite checksum does not substitute for a whole-IPA digest.
+New receipts retain locally computed SHA-256 and
 MD5 so Apple's returned checksum can be compared with the exact transferred bytes.
 
 An upload summary can remain `PROCESSING` after Apple exposes a valid eligible build.
@@ -1248,8 +1253,11 @@ different bytes under the same number. Build numbers come from `/builds`,
 `/preReleaseVersions` **and** `/apps/{id}/buildUploads`, so an unfinished or refused
 reservation is never reused; delete such a reservation only after reading it back.
 
-When an iOS producer was cancelled **after** both `Build and transfer iOS binary` and
-`Retain Apple verification handoff` succeeded, version 1.0.183 provides explicit recovery:
+When an iOS deployment failed or was cancelled **after** both `Build and transfer iOS binary`
+and `Retain Apple verification handoff` succeeded, version 1.0.185 provides the managed
+`apple-upload-recovery.yml` workflow. Dispatch it on the repository's default branch with the
+original `producer-run`, `producer-attempt`, `deployment-id` and `handoff-artifact-id` inputs.
+It calls the released helper with those four validated identifiers:
 
 ```bash
 node .github/actions/swift-app/scripts/apple_upload_recovery.cjs \
@@ -1296,7 +1304,8 @@ digest option: it downloads the exact original artifact, verifies GitHub's archi
 and accepts only its bounded `apple-verification.json` member. It authenticates the current
 dispatch separately from the original run, attempt, source, repository, branch and deployment.
 
-Recovery requires a terminal cancelled original run and iOS producer with those two
+Recovery requires a terminal original run: either cancelled with its cancelled iOS producer,
+or failed with a completed successful or failed iOS producer. Both paths require those two
 successful steps in order. A later completed attempt may exist; an active latest attempt
 refuses, including a retry observed immediately before writing the receipt. Fresh Apple
 readback must prove the exact completed upload and file, matching bytes, eligible `VALID`
@@ -1306,10 +1315,13 @@ and the old handoff's metadata and release notes are never replayed. Missing, ex
 mismatched evidence remains refused; do not relabel a receipt or impersonate the original
 `GITHUB_*` environment. Normal delivery still refuses cancelled producers.
 
+The managed workflow retains `apple-recovered-<recovery-run>-<recovery-attempt>` with the
+unchanged `apple-verification.json`, its `.verified.json` proof and derived `.upload-receipt.json`.
+The proof identifies the original producer and the current recovery caller separately.
 Retain the recovery proof, then rerun the **whole original deployment workflow**. Its
 upload-once admission reuses the confirmed iOS receipt and skips the iOS binary. Follow that
 new attempt and any unrelated remaining jobs to completion; recovery does not change the
-original cancelled attempt's conclusion. Read current store state for remaining submission
+original failed or cancelled attempt's conclusion. Read current store state for remaining submission
 work without changing an already accepted submission. This exceptional command adds no
 normal delivery job, polling or latency.
 

package/action/scripts/apple_upload_handoff.cjs

@@ -4,6 +4,7 @@ const fs = require('node:fs');
 const {createHash} = require('node:crypto');
 const {join} = require('node:path');
 const github = require('./mobile_release_api.cjs');
+const {historicalProducer, uniqueArtifact} = require('./apple_upload_handoff_history.cjs');
 const SCHEMA = 'gowalk-cicd/apple-upload-handoff.v1';
 const positive = value => Number.isSafeInteger(value) && value > 0;
 const id = value => typeof value === 'string' && /^[A-Za-z0-9-]{1,64}$/.test(value);
@@ -64,26 +65,20 @@ async function verifyProducer(value, artifactId, api = github, recoverCancelled
       run.path !== '.github/workflows/deploy.yml' || run.event !== o.event ||
       `refs/heads/${run.head_branch}` !== o.ref || run.repository?.full_name !== o.repository ||
       run.head_repository?.full_name !== o.repository) fail('producer_run');
-  if (recoverCancelled) {
-    const latest = await api.request('GET', `/actions/runs/${o.run_id}`);
-    if (run.status !== 'completed' || run.conclusion !== 'cancelled' || latest.id !== o.run_id ||
-        latest.status !== 'completed' || !positive(latest.run_attempt) || latest.run_attempt < o.run_attempt ||
-        latest.head_sha !== o.source_sha || latest.path !== run.path || latest.event !== o.event ||
-        latest.head_branch !== run.head_branch || latest.repository?.full_name !== o.repository ||
-        latest.head_repository?.full_name !== o.repository) fail('cancelled_producer_run');
-  }
+  if (recoverCancelled) await historicalProducer(o, run, api, fail);
   const result = await api.request('GET', `/actions/runs/${o.run_id}/attempts/${o.run_attempt}/jobs?per_page=100`);
   if (!Array.isArray(result.jobs) || result.jobs.length >= 100) fail('producer_jobs');
   const jobs = result.jobs.filter(job => job.name === 'iOS TestFlight' || job.name?.endsWith('/ iOS TestFlight'));
   // A later symbol-retention failure does not undo these exact completed steps.
   // The producer's original failure remains red; only Apple delivery is reconciled here.
-  const conclusions = recoverCancelled ? ['cancelled'] : ['success', 'failure'];
+  const conclusions = recoverCancelled && run.conclusion === 'cancelled' ? ['cancelled'] : ['success', 'failure'];
   if (jobs.length !== 1 || jobs[0].status !== 'completed' || !conclusions.includes(jobs[0].conclusion) ||
       jobs[0].head_sha !== o.source_sha || !transferred(jobs[0])) fail('producer_job');
   const artifact = await api.request('GET', `/actions/artifacts/${artifactId}`);
   if (artifact.id !== artifactId || artifact.expired !== false || artifact.workflow_run?.id !== o.run_id ||
       artifact.workflow_run?.head_sha !== o.source_sha ||
       artifact.name !== `apple-verification-${o.run_id}-${o.run_attempt}`) fail('producer_artifact');
+  if (recoverCancelled) await uniqueArtifact(o, artifact, api, fail);
 }
 
 async function phase(value, api = github) {

package/action/scripts/apple_upload_handoff_history.cjs

@@ -0,0 +1,29 @@
+/* Recheck one terminal historical producer and its unique retained handoff. */
+'use strict';
+const positive = value => Number.isSafeInteger(value) && value > 0;
+
+async function historicalProducer(owner, run, api, fail) {
+  const latest = await api.request('GET', `/actions/runs/${owner.run_id}`);
+  const terminal = ['success', 'failure', 'cancelled', 'timed_out', 'action_required',
+    'neutral', 'skipped', 'stale', 'startup_failure'];
+  if (run.status !== 'completed' || !['cancelled', 'failure'].includes(run.conclusion) ||
+      latest.id !== owner.run_id || latest.status !== 'completed' || !terminal.includes(latest.conclusion) ||
+      !positive(latest.run_attempt) || latest.run_attempt < owner.run_attempt ||
+      latest.run_attempt === owner.run_attempt && latest.conclusion !== run.conclusion ||
+      latest.head_sha !== owner.source_sha || latest.path !== run.path || latest.event !== owner.event ||
+      latest.head_branch !== run.head_branch || latest.repository?.full_name !== owner.repository ||
+      latest.head_repository?.full_name !== owner.repository) fail('historical_producer_run');
+}
+
+async function uniqueArtifact(owner, artifact, api, fail) {
+  const result = await api.request('GET', `/actions/runs/${owner.run_id}/artifacts?per_page=100`);
+  if (!Array.isArray(result.artifacts) || result.artifacts.length >= 100 ||
+      !Number.isSafeInteger(result.total_count) || result.total_count !== result.artifacts.length) fail('producer_artifact');
+  const selected = result.artifacts.filter(row => row.name === artifact.name);
+  if (selected.length !== 1 || selected[0].id !== artifact.id || selected[0].expired !== false ||
+      selected[0].workflow_run?.id !== owner.run_id || selected[0].workflow_run?.head_sha !== owner.source_sha ||
+      !/^sha256:[a-f0-9]{64}$/.test(artifact.digest || '') || selected[0].digest !== artifact.digest ||
+      !positive(artifact.size_in_bytes) || selected[0].size_in_bytes !== artifact.size_in_bytes) fail('producer_artifact');
+}
+
+module.exports = {historicalProducer, uniqueArtifact};

package/action/scripts/apple_upload_proof.cjs

@@ -25,7 +25,7 @@ function checksum(attributes, receipt, fail) {
     fail('file_checksum_unverified');
   }
   const file = checksums?.file;
-  if (file === undefined) return;
+  if (file === undefined || file === null) return;
   const digest = file?.algorithm === 'SHA_256' ? receipt.sha256 :
     file?.algorithm === 'MD5' ? receipt.md5 : null;
   const width = file?.algorithm === 'SHA_256' ? 64 : 32;

package/action/scripts/apple_upload_proof.py

@@ -38,6 +38,8 @@ def checksum(attributes, receipt):
     if "file" not in checksums:
         return
     file = checksums["file"]
+    if file is None:
+        return
     if not isinstance(file, dict):
         refuse("file_checksum_unverified")
     algorithm = file.get("algorithm")

package/action/scripts/apple_upload_recovery.cjs

@@ -1,4 +1,4 @@
-/* Explicit Actions recovery of a cancelled producer's authenticated handoff; never upload or metadata. */
+/* Explicit Actions recovery of a terminal producer's authenticated handoff; never upload or metadata. */
 'use strict';
 const fs = require('node:fs');
 const {createHash} = require('node:crypto');
@@ -6,6 +6,7 @@ const {inflateRawSync} = require('node:zlib');
 const github = require('./mobile_release_api.cjs');
 const handoff = require('./apple_upload_handoff.cjs');
 const verifier = require('./apple_upload_verify.cjs');
+const {pinnedArtifact, evidence} = require('./apple_upload_recovery_evidence.cjs');
 const LIMIT = 2 * 1024 * 1024;
 const positive = value => Number.isSafeInteger(value) && value > 0;
 const fail = code => handoff.fail(`recovery_${code}`);
@@ -83,7 +84,8 @@ async function current(env, api) {
       run.repository?.full_name !== repository || run.head_repository?.full_name !== repository ||
       !/^\.github\/workflows\/[\w.-]+\.ya?ml$/.test(run.path || '') ||
       env.GITHUB_WORKFLOW_REF !== `${repository}/${run.path}@${env.GITHUB_REF}`) fail('caller_unverified');
-  return {run_id: runId, run_attempt: attempt, repository, ref: env.GITHUB_REF};
+  return {run_id: runId, run_attempt: attempt, repository, ref: env.GITHUB_REF,
+    source_sha: env.GITHUB_SHA, workflow_path: run.path, event: run.event};
 }
 
 async function recover({runId, attempt, deploymentId, artifactId}, dependencies = {}) {
@@ -91,7 +93,7 @@ async function recover({runId, attempt, deploymentId, artifactId}, dependencies
   const env = dependencies.env || process.env, api = dependencies.api || github;
   const caller = await current(env, api);
   if (runId === caller.run_id) fail('caller_invalid');
-  const artifact = await api.request('GET', `/actions/artifacts/${artifactId}`);
+  const artifact = structuredClone(await api.request('GET', `/actions/artifacts/${artifactId}`));
   if (artifact.id !== artifactId || artifact.expired !== false || artifact.workflow_run?.id !== runId ||
       artifact.name !== `apple-verification-${runId}-${attempt}`) fail('artifact_identity');
   const bytes = await download(artifact, env, dependencies.fetch || fetch);
@@ -101,20 +103,25 @@ async function recover({runId, attempt, deploymentId, artifactId}, dependencies
   if (owner.repository !== caller.repository || owner.ref !== caller.ref || owner.run_id !== runId ||
       owner.run_attempt !== attempt || owner.deployment_id !== deploymentId ||
       owner.source_sha !== artifact.workflow_run?.head_sha) fail('handoff_owner');
-  const result = await verifier.verify(value, artifactId, 900, {...dependencies, api, recoverCancelled: true});
-  return {...result, schema: 'gowalk-cicd/apple-upload-recovered.v1', producer_run: runId,
+  const result = await verifier.verify(value, artifactId, 900,
+    {...dependencies, api: pinnedArtifact(api, artifact), recoverCancelled: true});
+  const proof = {...result, schema: 'gowalk-cicd/apple-upload-recovered.v1', producer_run: runId,
     repository: owner.repository, producer_source_sha: owner.source_sha,
     producer_ref: owner.ref, producer_event: owner.event,
     artifact_id: artifactId, artifact_digest: artifact.digest,
     handoff_sha256: createHash('sha256').update(bytes).digest('hex'),
     ipa_sha256: value.receipt.sha256, file_id: value.receipt.file_id,
-    recovery_run: caller.run_id, recovery_attempt: caller.run_attempt};
+    recovery_run: caller.run_id, recovery_attempt: caller.run_attempt,
+    recovery_source_sha: caller.source_sha, recovery_ref: caller.ref,
+    recovery_event: caller.event, recovery_workflow_path: caller.workflow_path};
+  if (dependencies.writeEvidence === true) Object.assign(proof, evidence(bytes, value, proof, env));
+  return proof;
 }
 
 async function main() {
   if (process.argv.length !== 6) fail('arguments');
   const [runId, attempt, deploymentId, artifactId] = process.argv.slice(2).map(Number);
-  console.log(JSON.stringify(await recover({runId, attempt, deploymentId, artifactId})));
+  console.log(JSON.stringify(await recover({runId, attempt, deploymentId, artifactId}, {writeEvidence: true})));
 }
 
 if (require.main === module) main().catch(error => {

package/action/scripts/apple_upload_recovery_evidence.cjs

@@ -0,0 +1,38 @@
+/* Preserve the exact authenticated handoff and record separately owned verification evidence. */
+'use strict';
+const fs = require('node:fs');
+const {join} = require('node:path');
+const handoff = require('./apple_upload_handoff.cjs');
+const fail = code => handoff.fail(`recovery_${code}`);
+
+function pinnedArtifact(api, original) {
+  return {...api, request: async (method, path, ...args) => {
+    const result = await api.request(method, path, ...args);
+    if (path === `/actions/artifacts/${original.id}` && (result.id !== original.id ||
+        result.digest !== original.digest || result.size_in_bytes !== original.size_in_bytes ||
+        result.expired !== false || result.name !== original.name ||
+        result.workflow_run?.id !== original.workflow_run.id ||
+        result.workflow_run?.head_sha !== original.workflow_run.head_sha)) fail('artifact_changed');
+    return result;
+  }};
+}
+
+function evidence(bytes, value, proof, env) {
+  if (!env.RUNNER_TEMP || /[\r\n]/.test(env.RUNNER_TEMP)) fail('evidence_path');
+  const directory = join(env.RUNNER_TEMP, 'apple-upload-recovery');
+  fs.mkdirSync(directory, {recursive: true, mode: 0o700});
+  const original = join(directory, 'apple-verification.json');
+  const receipt = `${original}.upload-receipt.json`, verified = `${original}.verified.json`;
+  fs.writeFileSync(original, bytes, {mode: 0o600});
+  if (!fs.readFileSync(original).equals(bytes)) fail('evidence_identity');
+  fs.writeFileSync(receipt, JSON.stringify({...value.receipt, stage: 'complete', state: 'COMPLETE',
+    build_id: proof.build_id, upload_resource_state: proof.upload_resource_state,
+    processing_seconds: proof.processing_seconds}, null, 2) + '\n', {mode: 0o600});
+  fs.writeFileSync(verified, JSON.stringify(proof, null, 2) + '\n', {mode: 0o600});
+  if (env.GITHUB_OUTPUT) fs.appendFileSync(env.GITHUB_OUTPUT,
+    `verified=true\nbuild-id=${proof.build_id}\nartifact-directory=${directory}\n` +
+    `handoff-path=${original}\nreceipt-path=${receipt}\nverified-proof-path=${verified}\n`);
+  return {artifact_directory: directory, handoff_path: original, receipt_path: receipt, verified_proof_path: verified};
+}
+
+module.exports = {pinnedArtifact, evidence};

package/docs/CONFIGURATION.md

@@ -62,7 +62,11 @@ Compose service must pass `BACKEND_PUBLIC_BASE_URL` into its container and use i
 The same named repository inputs reach the feature-branch backend preview in `deploy.yml`.
 
 The supported managed files are `deploy.yml`, `mobile-candidate.yml`,
-`warm-android-cache.yml`, `deploy-web.yml` and `deploy-backend.yml`. The installer no longer adds
+`apple-upload-recovery.yml`, `warm-android-cache.yml`, `deploy-web.yml` and `deploy-backend.yml`.
+The installer adds the dispatch-only `apple-upload-recovery.yml` when the rendered mobile
+deployment supports iOS; explicit Android-only deployment excludes it. It preserves recovery
+workflow overrides and removes only an unmodified generated copy when iOS is no longer supported.
+The installer no longer adds
 `deploy-web.yml`, and adds `warm-android-cache.yml` only while candidate artifacts are enabled
 and `mobile.platforms` is not `ios`;
 it removes such a file that is still the unmodified generated one with no overrides,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.184",
+  "version": "1.0.185",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/remedies.json

@@ -26,8 +26,8 @@
   {
     "schema": "gowalk-cicd/mobile-release-refused.v1",
     "code": "mobile_release_upload_unconfirmed_read_back_retained_binary_before_retry",
-    "fixed_in": "1.0.183",
-    "remedy": "Preserve the original upload owner and artifacts. If an iOS producer was cancelled after both Build and transfer iOS binary and Retain Apple verification handoff succeeded, use apple_upload_recovery.cjs RUN ATTEMPT DEPLOYMENT ARTIFACT from an authorized default-branch workflow_dispatch Actions job. It downloads and authenticates the original artifact, proves the terminal original and latest run, and reads fresh Apple upload/file/build/app evidence before reconciling that deployment. It never rebuilds, uploads or replays metadata. Retain its recovery proof, then rerun the whole original deployment workflow: admission reuses the uploaded receipt without another iOS binary. The old cancellation remains historical evidence; follow the new attempt to completion. Missing or mismatched evidence still refuses."
+    "fixed_in": "1.0.185",
+    "remedy": "Preserve the original upload owner and artifacts. If the original iOS deployment failed or was cancelled after Build and transfer iOS binary and Retain Apple verification handoff succeeded in order, dispatch the managed apple-upload-recovery.yml on the default branch with original producer-run, producer-attempt, deployment-id and handoff-artifact-id. It authenticates the original artifact and unchanged handoff, terminal original and latest run, owner, and fresh Apple upload/file/build/app evidence. A null optional file checksum is absent; present whole-file checksums remain strictly verified. It never rebuilds, uploads, replays metadata or rewrites the original handoff. Retain the original handoff and derived completion proof with distinct current recovery caller, then rerun the whole original deployment: admission reuses the uploaded receipt without another iOS binary. The old failure or cancellation remains historical evidence; follow the new attempt to completion. Missing or mismatched evidence remains refused."
   },
   {
     "schema": "gowalk-cicd/mobile-release-refused.v1",

package/src/config/workflows.mjs

@@ -36,11 +36,11 @@ function render(source, normalized, file) {
 }
 
 const WARM = 'warm-android-cache.yml';
-const MANAGED = ['deploy.yml', 'mobile-candidate.yml', 'deploy-web.yml', 'deploy-backend.yml', WARM];
+const RECOVERY = 'apple-upload-recovery.yml';
+const MANAGED = ['deploy.yml', 'mobile-candidate.yml', 'deploy-web.yml', 'deploy-backend.yml', WARM, RECOVERY];
 
-// A generated file this install no longer wants (deploy-web.yml always; the warm-up without
-// candidates) is removed while it is still what the lock says was generated, with no overrides.
-// Anything customized stays and keeps upgrading.
+// Retire generated workflows only while their locked bytes are unchanged and they have no overrides.
+// App-owned customizations stay and keep upgrading when their automatic use is disabled.
 function retired(root, file, state) {
   if (state.migrating || state.config.workflows[file]?.overrides?.length) return false;
   const previous = load(root, `.github/workflows/${file}`);
@@ -87,8 +87,14 @@ export function planWorkflows(root, templateDir, files, version) {
     if (!MANAGED.includes(file)) throw new MigrationRepair('unknown_managed_workflow', CONFIG);
   }
   const removed = selected.filter(file => file === 'deploy-web.yml' && retired(root, file, state));
-  const writes = selected.filter(file => !removed.includes(file) && file !== WARM)
+  const writes = selected.filter(file => !removed.includes(file) && ![WARM, RECOVERY].includes(file))
     .map(file => upgradeWorkflow(root, file, templateDir, state));
+  const recovery = selected.includes('deploy.yml') && state.config.mobile?.platforms !== 'android';
+  if (recovery || (selected.includes(RECOVERY) && !retired(root, RECOVERY, state))) {
+    writes.push(upgradeWorkflow(root, RECOVERY, templateDir, state));
+  } else if (selected.includes(RECOVERY)) {
+    removed.push(RECOVERY);
+  }
   // Only verified candidate keys can request trusted post-release dependency priming on either OS.
   const candidates = selected.includes('mobile-candidate.yml')
     && state.config.mobile?.['candidate-artifacts'] !== false;
@@ -106,7 +112,7 @@ export function planWorkflows(root, templateDir, files, version) {
   for (const [file, entry] of Object.entries(state.config.workflows)) {
     for (const change of entry.overrides) assertReferences(change.value, file, change.path);
   }
-  writes.push(...planValidation(root, [...selected, WARM]));
+  writes.push(...planValidation(root, [...selected, WARM, RECOVERY]));
   state.lock.package = version;
   const config = state.text && equal(readYaml(state.text, CONFIG).value, state.config)
     ? state.text

package/templates/apple-upload-recovery.yml

@@ -0,0 +1,96 @@
+name: Recover Apple upload
+on:
+  workflow_dispatch:
+    inputs:
+      producer-run:
+        description: Original Mobile Deploy run ID
+        required: true
+        type: string
+      producer-attempt:
+        description: Original Mobile Deploy run attempt
+        required: true
+        type: string
+      deployment-id:
+        description: Original iOS release deployment ID
+        required: true
+        type: string
+      handoff-artifact-id:
+        description: Original Apple verification handoff artifact ID
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+  deployments: write
+
+# Serialize the original owner update with ordinary Mobile Deploy; recovery never uploads.
+concurrency:
+  group: mobile-deploy-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  recover:
+    name: Verify the original Apple upload
+    if: >-
+      ${{ github.event_name == 'workflow_dispatch'
+          && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      APPLE_RECOVERY_PRODUCER_RUN: ${{ inputs.producer-run }}
+      APPLE_RECOVERY_PRODUCER_ATTEMPT: ${{ inputs.producer-attempt }}
+      APPLE_RECOVERY_DEPLOYMENT_ID: ${{ inputs.deployment-id }}
+      APPLE_RECOVERY_HANDOFF_ARTIFACT_ID: ${{ inputs.handoff-artifact-id }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Validate original upload identifiers
+        shell: bash
+        run: |
+          for value in "$APPLE_RECOVERY_PRODUCER_RUN" "$APPLE_RECOVERY_PRODUCER_ATTEMPT" \
+            "$APPLE_RECOVERY_DEPLOYMENT_ID" "$APPLE_RECOVERY_HANDOFF_ARTIFACT_ID"; do
+            if [[ ! "$value" =~ ^[1-9][0-9]*$ ]]; then
+              echo "::error title=apple_upload_recovery_failed::invalid_recovery_identifiers"
+              exit 1
+            fi
+          done
+      - name: Prepare Apple API access
+        env:
+          CI_ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+          CI_ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          CI_ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+        run: |
+          umask 077
+          mkdir -p creds
+          if [ -n "${CI_ASC_KEY_P8:-}" ]; then
+            : "${CI_ASC_KEY_ID:?ASC_KEY_ID secret is required with ASC_KEY_P8}"
+            : "${CI_ASC_ISSUER_ID:?ASC_ISSUER_ID secret is required with ASC_KEY_P8}"
+            printf '%s' "$CI_ASC_KEY_P8" > "creds/AuthKey_${CI_ASC_KEY_ID}_Issuer_${CI_ASC_ISSUER_ID}.p8"
+          fi
+          python3 -m pip install --quiet --break-system-packages PyJWT cryptography requests
+          PYTHONPATH=.github/actions/swift-app/scripts python3 - <<'PY'
+          import os
+          from pathlib import Path
+          from read_config import emit_credentials
+          emit_credentials(Path(os.environ['GITHUB_ENV']), Path(os.environ['GITHUB_WORKSPACE']))
+          PY
+      - name: Verify the original upload and reconcile its owner
+        id: recover
+        run: |
+          node .github/actions/swift-app/scripts/apple_upload_recovery.cjs \
+            "$APPLE_RECOVERY_PRODUCER_RUN" "$APPLE_RECOVERY_PRODUCER_ATTEMPT" \
+            "$APPLE_RECOVERY_DEPLOYMENT_ID" "$APPLE_RECOVERY_HANDOFF_ARTIFACT_ID"
+      - name: Retain verified Apple recovery proof
+        if: ${{ steps.recover.outputs.verified == 'true' }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ github.workspace }}/.github/actions/android-app/scripts/artifact_env.cjs"
+        with:
+          name: apple-recovered-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/apple-upload-recovery/apple-verification.json
+            ${{ runner.temp }}/apple-upload-recovery/apple-verification.json.verified.json
+            ${{ runner.temp }}/apple-upload-recovery/apple-verification.json.upload-receipt.json
+          if-no-files-found: error
+          retention-days: 7