gowalk-cicd 1.0.184 → 1.0.186

package/README.md

@@ -5,6 +5,12 @@ optional backend deploy. It supports native Swift/SwiftUI iOS projects, native K
 Android projects, and Flutter apps. Provision encrypted repository secrets, validate a
 task candidate, and promote its release intent. Store builds and uploads run only in GitHub Actions.
 
+Tests must run locally, never in GitHub Actions. Run only the focused tests needed for the
+changed behavior before pushing. The iOS and Android actions never run tests or Flutter analysis;
+legacy `run-tests`, `test-command`, and `test-destination` inputs are accepted but ignored,
+including `run-tests: 'true'`. Build, signing, upload, and delivery health checks remain in Actions.
+See [local validation](docs/LOCAL_VALIDATION.md) for focused execution, receipts and CI verification.
+
 App-specific workflow settings live in `.gowalk-cicd.yml`. The installer migrates supported
 existing settings once and regenerates managed workflows without replacing custom behavior.
 See [configuration](docs/CONFIGURATION.md).
@@ -25,6 +31,8 @@ Writes three core things into your repo:
 
 It also writes:
 
+- `.github/workflows/apple-upload-recovery.yml` — explicit verification-only recovery for a retained iOS upload;
+  it checks the original producer and Apple build before completing that deployment, without rebuilding or uploading
 - `.github/workflows/mobile-candidate.yml` — shipping binaries for ready task PRs
   (dispatch-only while candidate artifacts are off)
 - `.github/workflows/warm-android-cache.yml` — only while Android candidates are enabled: after this
@@ -106,7 +114,7 @@ download segment. A slow segment becomes a cache miss and normal SDK setup
 continues normally; SDK setup errors still fail the
 job. This bounds individual cache segments, not the total cache or SDK download,
 and keeps existing cache keys. A successfully installed SDK is saved before app
-checks run, so a later test/build failure does not force another cold SDK download.
+builds run, so a later build failure does not force another cold SDK download.
 Failed setup never saves an SDK cache; pub dependencies retain their job-end save.
 Pull-request runs (`refs/pull/*`, which includes every candidate build) restore these caches
 but never save them; task branches and the default branch still save. When the caller names
@@ -787,7 +795,6 @@ configuration for either:
 |---|---|---|
 | Detected by | `pubspec.yaml` at the repo root | `settings.gradle(.kts)` + `gradlew` at the root or under `android/` |
 | App module | `android/app` | the one module applying `com.android.application` (version-catalog aliases are resolved; a module named `app` wins a tie against a wear/automotive sibling) |
-| Tests (`run-tests`) | `flutter analyze` + `flutter test` | `gradlew test` (all variants, all modules) |
 | Build | `flutter build appbundle --release --obfuscate --split-debug-info` | `<module>:bundleRelease` |
 | Toolchain installed | Flutter + JDK 17 | JDK 21, or 17 on an old Kotlin — see [Choosing the JDK](#choosing-the-jdk) |
 
@@ -1049,7 +1056,6 @@ schemes, pass inputs in `.github/workflows/deploy.yml`:
   with:
     scheme: MyAppRelease
     bundle-id: com.example.myapp
-    run-tests: 'false'
     uses-non-exempt-encryption: 'false'
 ```
 
@@ -1065,9 +1071,9 @@ common ones:
 | `team-id` | Override the auto-detected team ID |
 | `app-store-apple-id` | Numeric ASC app ID (override auto-lookup) |
 | `certificate-cap-policy` | Deprecated and ignored: CI never creates or revokes certificates. |
-| `run-tests` | `false` to skip the simulator test stage |
+| `run-tests`, `test-command`, `test-destination` | Deprecated and ignored: tests run locally only. |
 | `uses-non-exempt-encryption` | Value for `ITSAppUsesNonExemptEncryption` |
-| `archive` | `false` to build-only (PR runs without secrets) |
+| `archive` | `false` to skip archive, export, and upload |
 | `upload` | `false` to archive but not upload to TestFlight |
 | `manage-app-store-version` | `false` to upload without creating/editing the App Store release slot |
 | `app-store-whats-new` | Inline "What's New" text (overrides files) |
@@ -1225,7 +1231,10 @@ commits completed part transfers with `uploaded: true`, following Apple's
 The IPA endpoint rejected an optional `sourceFileChecksums` SHA_256 object even though
 the generic schema lists that algorithm; the uploader no longer sends that attribute.
 A completed file is reused only when its content-derived filename and size match, and
-any returned file checksum is verified. New receipts retain locally computed SHA-256 and
+any nonnull returned whole-file checksum is verified. An explicit
+`sourceFileChecksums.file: null` means that the optional whole-file checksum is absent;
+a composite checksum does not substitute for a whole-IPA digest.
+New receipts retain locally computed SHA-256 and
 MD5 so Apple's returned checksum can be compared with the exact transferred bytes.
 
 An upload summary can remain `PROCESSING` after Apple exposes a valid eligible build.
@@ -1248,8 +1257,11 @@ different bytes under the same number. Build numbers come from `/builds`,
 `/preReleaseVersions` **and** `/apps/{id}/buildUploads`, so an unfinished or refused
 reservation is never reused; delete such a reservation only after reading it back.
 
-When an iOS producer was cancelled **after** both `Build and transfer iOS binary` and
-`Retain Apple verification handoff` succeeded, version 1.0.183 provides explicit recovery:
+When an iOS deployment failed or was cancelled **after** both `Build and transfer iOS binary`
+and `Retain Apple verification handoff` succeeded, version 1.0.185 provides the managed
+`apple-upload-recovery.yml` workflow. Dispatch it on the repository's default branch with the
+original `producer-run`, `producer-attempt`, `deployment-id` and `handoff-artifact-id` inputs.
+It calls the released helper with those four validated identifiers:
 
 ```bash
 node .github/actions/swift-app/scripts/apple_upload_recovery.cjs \
@@ -1296,7 +1308,8 @@ digest option: it downloads the exact original artifact, verifies GitHub's archi
 and accepts only its bounded `apple-verification.json` member. It authenticates the current
 dispatch separately from the original run, attempt, source, repository, branch and deployment.
 
-Recovery requires a terminal cancelled original run and iOS producer with those two
+Recovery requires a terminal original run: either cancelled with its cancelled iOS producer,
+or failed with a completed successful or failed iOS producer. Both paths require those two
 successful steps in order. A later completed attempt may exist; an active latest attempt
 refuses, including a retry observed immediately before writing the receipt. Fresh Apple
 readback must prove the exact completed upload and file, matching bytes, eligible `VALID`
@@ -1306,10 +1319,13 @@ and the old handoff's metadata and release notes are never replayed. Missing, ex
 mismatched evidence remains refused; do not relabel a receipt or impersonate the original
 `GITHUB_*` environment. Normal delivery still refuses cancelled producers.
 
+The managed workflow retains `apple-recovered-<recovery-run>-<recovery-attempt>` with the
+unchanged `apple-verification.json`, its `.verified.json` proof and derived `.upload-receipt.json`.
+The proof identifies the original producer and the current recovery caller separately.
 Retain the recovery proof, then rerun the **whole original deployment workflow**. Its
 upload-once admission reuses the confirmed iOS receipt and skips the iOS binary. Follow that
 new attempt and any unrelated remaining jobs to completion; recovery does not change the
-original cancelled attempt's conclusion. Read current store state for remaining submission
+original failed or cancelled attempt's conclusion. Read current store state for remaining submission
 work without changing an already accepted submission. This exceptional command adds no
 normal delivery job, polling or latency.
 

package/action/action.yml

@@ -69,9 +69,8 @@ inputs:
     default: "false"
   archive:
     description: >
-      Set to 'false' to skip archive + export + upload entirely. Useful for
-      PR / branch runs that only need to build and test without code signing
-      secrets. When 'false', `upload` is ignored.
+      Set to 'false' to skip archive + export + upload entirely.
+      When 'false', `upload` is ignored.
     required: false
     default: "true"
   manage-app-store-version:
@@ -82,21 +81,15 @@ inputs:
     required: false
     default: "true"
   run-tests:
-    description: "Set to 'false' to skip the simulator test stage"
+    description: DEPRECATED (ignored). Tests run locally, never in GitHub Actions.
     required: false
-    default: ""
+    default: "false"
   test-command:
-    description: >
-      Shell command used for the simulator test stage. Defaults to running
-      `bash Scripts/run-tests.sh` when that file exists, otherwise
-      `xcodebuild test` against the chosen scheme on a booted simulator with
-      code-signing disabled. Override to run a custom runner.
+    description: DEPRECATED (ignored). Custom test commands are never executed.
     required: false
     default: ""
   test-destination:
-    description: >
-      Destination passed to the default `xcodebuild test` invocation when
-      `test-command` is empty and no `Scripts/run-tests.sh` is present.
+    description: DEPRECATED (ignored). Simulator tests run locally only.
     required: false
     default: ""
   uses-non-exempt-encryption:
@@ -276,9 +269,6 @@ runs:
         INPUT_USES_NON_EXEMPT: ${{ inputs.uses-non-exempt-encryption }}
         INPUT_WHATS_NEW: ${{ inputs.app-store-whats-new }}
         INPUT_LOCALE: ${{ inputs.app-store-locale }}
-        INPUT_RUN_TESTS: ${{ inputs.run-tests }}
-        INPUT_TEST_COMMAND: ${{ inputs.test-command }}
-        INPUT_TEST_DESTINATION: ${{ inputs.test-destination }}
       run: |
         # read_config.py runs FIRST (it derives every other value), so it must
         # install its full dep set inline. All later steps reuse these.
@@ -320,48 +310,6 @@ runs:
         key: ${{ steps.native_cache_scope.outputs.key }}
         path: ${{ steps.native_cache_scope.outputs.paths }}
 
-    - name: Run simulator tests
-      if: ${{ (inputs.run-tests || env.CFG_RUN_TESTS) == 'true' && inputs.candidate-binary == '' }}
-      shell: bash
-      env:
-        PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
-        WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
-        SCHEME: ${{ inputs.scheme || env.CFG_SCHEME }}
-        CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
-        TEST_COMMAND: ${{ inputs.test-command || env.CFG_TEST_COMMAND }}
-        TEST_DESTINATION: >-
-          ${{ inputs.test-destination || env.CFG_TEST_DESTINATION
-              || 'platform=iOS Simulator,name=iPhone 15' }}
-      run: |
-        set -o pipefail
-        python3 "$SWIFT_APP_ACTION/scripts/native_dependency_guard.py" "$GITHUB_WORKSPACE" \
-          --container "${WORKSPACE:-$PROJECT}"
-        if [ -n "$TEST_COMMAND" ]; then
-          echo "Running custom test command: $TEST_COMMAND"
-          bash -c "$TEST_COMMAND"
-        elif [ -f "Scripts/run-tests.sh" ]; then
-          echo "Running Scripts/run-tests.sh"
-          bash Scripts/run-tests.sh
-        else
-          if [ -n "$WORKSPACE" ]; then
-            PROJ_ARGS=(-workspace "$WORKSPACE")
-          else
-            PROJ_ARGS=(-project "$PROJECT")
-          fi
-          echo "Running xcodebuild test on $TEST_DESTINATION"
-          xcodebuild \
-            "${PROJ_ARGS[@]}" \
-            -scheme "$SCHEME" \
-            -configuration "$CONFIGURATION" \
-            -destination "$TEST_DESTINATION" \
-            -disableAutomaticPackageResolution -skipPackageUpdates \
-            CODE_SIGNING_ALLOWED=NO \
-            CODE_SIGNING_REQUIRED=NO \
-            CODE_SIGN_IDENTITY="" \
-            DEVELOPMENT_TEAM="" \
-            test
-        fi
-
     - name: Stage ASC API key for authenticated REST uploads
       if: ${{ inputs.archive == 'true' }}
       shell: bash

package/action/scripts/apple_upload_handoff.cjs

@@ -4,6 +4,7 @@ const fs = require('node:fs');
 const {createHash} = require('node:crypto');
 const {join} = require('node:path');
 const github = require('./mobile_release_api.cjs');
+const {historicalProducer, uniqueArtifact} = require('./apple_upload_handoff_history.cjs');
 const SCHEMA = 'gowalk-cicd/apple-upload-handoff.v1';
 const positive = value => Number.isSafeInteger(value) && value > 0;
 const id = value => typeof value === 'string' && /^[A-Za-z0-9-]{1,64}$/.test(value);
@@ -64,26 +65,20 @@ async function verifyProducer(value, artifactId, api = github, recoverCancelled
       run.path !== '.github/workflows/deploy.yml' || run.event !== o.event ||
       `refs/heads/${run.head_branch}` !== o.ref || run.repository?.full_name !== o.repository ||
       run.head_repository?.full_name !== o.repository) fail('producer_run');
-  if (recoverCancelled) {
-    const latest = await api.request('GET', `/actions/runs/${o.run_id}`);
-    if (run.status !== 'completed' || run.conclusion !== 'cancelled' || latest.id !== o.run_id ||
-        latest.status !== 'completed' || !positive(latest.run_attempt) || latest.run_attempt < o.run_attempt ||
-        latest.head_sha !== o.source_sha || latest.path !== run.path || latest.event !== o.event ||
-        latest.head_branch !== run.head_branch || latest.repository?.full_name !== o.repository ||
-        latest.head_repository?.full_name !== o.repository) fail('cancelled_producer_run');
-  }
+  if (recoverCancelled) await historicalProducer(o, run, api, fail);
   const result = await api.request('GET', `/actions/runs/${o.run_id}/attempts/${o.run_attempt}/jobs?per_page=100`);
   if (!Array.isArray(result.jobs) || result.jobs.length >= 100) fail('producer_jobs');
   const jobs = result.jobs.filter(job => job.name === 'iOS TestFlight' || job.name?.endsWith('/ iOS TestFlight'));
   // A later symbol-retention failure does not undo these exact completed steps.
   // The producer's original failure remains red; only Apple delivery is reconciled here.
-  const conclusions = recoverCancelled ? ['cancelled'] : ['success', 'failure'];
+  const conclusions = recoverCancelled && run.conclusion === 'cancelled' ? ['cancelled'] : ['success', 'failure'];
   if (jobs.length !== 1 || jobs[0].status !== 'completed' || !conclusions.includes(jobs[0].conclusion) ||
       jobs[0].head_sha !== o.source_sha || !transferred(jobs[0])) fail('producer_job');
   const artifact = await api.request('GET', `/actions/artifacts/${artifactId}`);
   if (artifact.id !== artifactId || artifact.expired !== false || artifact.workflow_run?.id !== o.run_id ||
       artifact.workflow_run?.head_sha !== o.source_sha ||
       artifact.name !== `apple-verification-${o.run_id}-${o.run_attempt}`) fail('producer_artifact');
+  if (recoverCancelled) await uniqueArtifact(o, artifact, api, fail);
 }
 
 async function phase(value, api = github) {

package/action/scripts/apple_upload_handoff_history.cjs

@@ -0,0 +1,29 @@
+/* Recheck one terminal historical producer and its unique retained handoff. */
+'use strict';
+const positive = value => Number.isSafeInteger(value) && value > 0;
+
+async function historicalProducer(owner, run, api, fail) {
+  const latest = await api.request('GET', `/actions/runs/${owner.run_id}`);
+  const terminal = ['success', 'failure', 'cancelled', 'timed_out', 'action_required',
+    'neutral', 'skipped', 'stale', 'startup_failure'];
+  if (run.status !== 'completed' || !['cancelled', 'failure'].includes(run.conclusion) ||
+      latest.id !== owner.run_id || latest.status !== 'completed' || !terminal.includes(latest.conclusion) ||
+      !positive(latest.run_attempt) || latest.run_attempt < owner.run_attempt ||
+      latest.run_attempt === owner.run_attempt && latest.conclusion !== run.conclusion ||
+      latest.head_sha !== owner.source_sha || latest.path !== run.path || latest.event !== owner.event ||
+      latest.head_branch !== run.head_branch || latest.repository?.full_name !== owner.repository ||
+      latest.head_repository?.full_name !== owner.repository) fail('historical_producer_run');
+}
+
+async function uniqueArtifact(owner, artifact, api, fail) {
+  const result = await api.request('GET', `/actions/runs/${owner.run_id}/artifacts?per_page=100`);
+  if (!Array.isArray(result.artifacts) || result.artifacts.length >= 100 ||
+      !Number.isSafeInteger(result.total_count) || result.total_count !== result.artifacts.length) fail('producer_artifact');
+  const selected = result.artifacts.filter(row => row.name === artifact.name);
+  if (selected.length !== 1 || selected[0].id !== artifact.id || selected[0].expired !== false ||
+      selected[0].workflow_run?.id !== owner.run_id || selected[0].workflow_run?.head_sha !== owner.source_sha ||
+      !/^sha256:[a-f0-9]{64}$/.test(artifact.digest || '') || selected[0].digest !== artifact.digest ||
+      !positive(artifact.size_in_bytes) || selected[0].size_in_bytes !== artifact.size_in_bytes) fail('producer_artifact');
+}
+
+module.exports = {historicalProducer, uniqueArtifact};

package/action/scripts/apple_upload_proof.cjs

@@ -25,7 +25,7 @@ function checksum(attributes, receipt, fail) {
     fail('file_checksum_unverified');
   }
   const file = checksums?.file;
-  if (file === undefined) return;
+  if (file === undefined || file === null) return;
   const digest = file?.algorithm === 'SHA_256' ? receipt.sha256 :
     file?.algorithm === 'MD5' ? receipt.md5 : null;
   const width = file?.algorithm === 'SHA_256' ? 64 : 32;

package/action/scripts/apple_upload_proof.py

@@ -38,6 +38,8 @@ def checksum(attributes, receipt):
     if "file" not in checksums:
         return
     file = checksums["file"]
+    if file is None:
+        return
     if not isinstance(file, dict):
         refuse("file_checksum_unverified")
     algorithm = file.get("algorithm")

package/action/scripts/apple_upload_recovery.cjs

@@ -1,4 +1,4 @@
-/* Explicit Actions recovery of a cancelled producer's authenticated handoff; never upload or metadata. */
+/* Explicit Actions recovery of a terminal producer's authenticated handoff; never upload or metadata. */
 'use strict';
 const fs = require('node:fs');
 const {createHash} = require('node:crypto');
@@ -6,6 +6,7 @@ const {inflateRawSync} = require('node:zlib');
 const github = require('./mobile_release_api.cjs');
 const handoff = require('./apple_upload_handoff.cjs');
 const verifier = require('./apple_upload_verify.cjs');
+const {pinnedArtifact, evidence} = require('./apple_upload_recovery_evidence.cjs');
 const LIMIT = 2 * 1024 * 1024;
 const positive = value => Number.isSafeInteger(value) && value > 0;
 const fail = code => handoff.fail(`recovery_${code}`);
@@ -83,7 +84,8 @@ async function current(env, api) {
       run.repository?.full_name !== repository || run.head_repository?.full_name !== repository ||
       !/^\.github\/workflows\/[\w.-]+\.ya?ml$/.test(run.path || '') ||
       env.GITHUB_WORKFLOW_REF !== `${repository}/${run.path}@${env.GITHUB_REF}`) fail('caller_unverified');
-  return {run_id: runId, run_attempt: attempt, repository, ref: env.GITHUB_REF};
+  return {run_id: runId, run_attempt: attempt, repository, ref: env.GITHUB_REF,
+    source_sha: env.GITHUB_SHA, workflow_path: run.path, event: run.event};
 }
 
 async function recover({runId, attempt, deploymentId, artifactId}, dependencies = {}) {
@@ -91,7 +93,7 @@ async function recover({runId, attempt, deploymentId, artifactId}, dependencies
   const env = dependencies.env || process.env, api = dependencies.api || github;
   const caller = await current(env, api);
   if (runId === caller.run_id) fail('caller_invalid');
-  const artifact = await api.request('GET', `/actions/artifacts/${artifactId}`);
+  const artifact = structuredClone(await api.request('GET', `/actions/artifacts/${artifactId}`));
   if (artifact.id !== artifactId || artifact.expired !== false || artifact.workflow_run?.id !== runId ||
       artifact.name !== `apple-verification-${runId}-${attempt}`) fail('artifact_identity');
   const bytes = await download(artifact, env, dependencies.fetch || fetch);
@@ -101,20 +103,25 @@ async function recover({runId, attempt, deploymentId, artifactId}, dependencies
   if (owner.repository !== caller.repository || owner.ref !== caller.ref || owner.run_id !== runId ||
       owner.run_attempt !== attempt || owner.deployment_id !== deploymentId ||
       owner.source_sha !== artifact.workflow_run?.head_sha) fail('handoff_owner');
-  const result = await verifier.verify(value, artifactId, 900, {...dependencies, api, recoverCancelled: true});
-  return {...result, schema: 'gowalk-cicd/apple-upload-recovered.v1', producer_run: runId,
+  const result = await verifier.verify(value, artifactId, 900,
+    {...dependencies, api: pinnedArtifact(api, artifact), recoverCancelled: true});
+  const proof = {...result, schema: 'gowalk-cicd/apple-upload-recovered.v1', producer_run: runId,
     repository: owner.repository, producer_source_sha: owner.source_sha,
     producer_ref: owner.ref, producer_event: owner.event,
     artifact_id: artifactId, artifact_digest: artifact.digest,
     handoff_sha256: createHash('sha256').update(bytes).digest('hex'),
     ipa_sha256: value.receipt.sha256, file_id: value.receipt.file_id,
-    recovery_run: caller.run_id, recovery_attempt: caller.run_attempt};
+    recovery_run: caller.run_id, recovery_attempt: caller.run_attempt,
+    recovery_source_sha: caller.source_sha, recovery_ref: caller.ref,
+    recovery_event: caller.event, recovery_workflow_path: caller.workflow_path};
+  if (dependencies.writeEvidence === true) Object.assign(proof, evidence(bytes, value, proof, env));
+  return proof;
 }
 
 async function main() {
   if (process.argv.length !== 6) fail('arguments');
   const [runId, attempt, deploymentId, artifactId] = process.argv.slice(2).map(Number);
-  console.log(JSON.stringify(await recover({runId, attempt, deploymentId, artifactId})));
+  console.log(JSON.stringify(await recover({runId, attempt, deploymentId, artifactId}, {writeEvidence: true})));
 }
 
 if (require.main === module) main().catch(error => {

package/action/scripts/apple_upload_recovery_evidence.cjs

@@ -0,0 +1,38 @@
+/* Preserve the exact authenticated handoff and record separately owned verification evidence. */
+'use strict';
+const fs = require('node:fs');
+const {join} = require('node:path');
+const handoff = require('./apple_upload_handoff.cjs');
+const fail = code => handoff.fail(`recovery_${code}`);
+
+function pinnedArtifact(api, original) {
+  return {...api, request: async (method, path, ...args) => {
+    const result = await api.request(method, path, ...args);
+    if (path === `/actions/artifacts/${original.id}` && (result.id !== original.id ||
+        result.digest !== original.digest || result.size_in_bytes !== original.size_in_bytes ||
+        result.expired !== false || result.name !== original.name ||
+        result.workflow_run?.id !== original.workflow_run.id ||
+        result.workflow_run?.head_sha !== original.workflow_run.head_sha)) fail('artifact_changed');
+    return result;
+  }};
+}
+
+function evidence(bytes, value, proof, env) {
+  if (!env.RUNNER_TEMP || /[\r\n]/.test(env.RUNNER_TEMP)) fail('evidence_path');
+  const directory = join(env.RUNNER_TEMP, 'apple-upload-recovery');
+  fs.mkdirSync(directory, {recursive: true, mode: 0o700});
+  const original = join(directory, 'apple-verification.json');
+  const receipt = `${original}.upload-receipt.json`, verified = `${original}.verified.json`;
+  fs.writeFileSync(original, bytes, {mode: 0o600});
+  if (!fs.readFileSync(original).equals(bytes)) fail('evidence_identity');
+  fs.writeFileSync(receipt, JSON.stringify({...value.receipt, stage: 'complete', state: 'COMPLETE',
+    build_id: proof.build_id, upload_resource_state: proof.upload_resource_state,
+    processing_seconds: proof.processing_seconds}, null, 2) + '\n', {mode: 0o600});
+  fs.writeFileSync(verified, JSON.stringify(proof, null, 2) + '\n', {mode: 0o600});
+  if (env.GITHUB_OUTPUT) fs.appendFileSync(env.GITHUB_OUTPUT,
+    `verified=true\nbuild-id=${proof.build_id}\nartifact-directory=${directory}\n` +
+    `handoff-path=${original}\nreceipt-path=${receipt}\nverified-proof-path=${verified}\n`);
+  return {artifact_directory: directory, handoff_path: original, receipt_path: receipt, verified_proof_path: verified};
+}
+
+module.exports = {pinnedArtifact, evidence};

package/action/scripts/local_validation.cjs

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+// Tests run on the owned workspace; Actions verifies an authenticated exact-source result only.
+const { spawnSync } = require('node:child_process');
+const { mkdirSync, rmSync, writeFileSync } = require('node:fs');
+const { dirname, relative, resolve, isAbsolute } = require('node:path');
+const { SCHEMA, CONTEXT, command, identity, readReceipt, sameSource, github, expectedAuthor,
+  verifyStatus, digest } = require('./local_validation_core.cjs');
+
+function localOnly() {
+  if (process.env.GITHUB_ACTIONS === 'true') throw new Error('tests_forbidden_in_github_actions');
+}
+
+function run(args) {
+  localOnly();
+  if (args[0] !== '--receipt' || args[2] !== '--' || !args[3]) throw new Error('receipt_and_command_required');
+  const path = resolve(args[1]);
+  const root = command('git', ['rev-parse', '--show-toplevel']);
+  const nested = relative(root, path);
+  if (nested !== '..' && !nested.startsWith('../') && !isAbsolute(nested)) {
+    throw new Error('receipt_must_be_outside_checkout');
+  }
+  const source = identity();
+  rmSync(path, { force: true });
+  const argv = args.slice(3);
+  const result = spawnSync(argv[0], argv.slice(1), { stdio: 'inherit' });
+  if (result.error || result.status !== 0) throw new Error('local_validation_command_failed');
+  sameSource(source, identity());
+  const receipt = { schema: SCHEMA, ...source, command_sha256: digest(argv) };
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(receipt) + '\n', { mode: 0o600 });
+  console.log(JSON.stringify({ ok: true, result: 'local_validation_passed', ...receipt }));
+}
+
+function publish(args) {
+  localOnly();
+  if (args[0] !== '--receipt' || args.length !== 2) throw new Error('receipt_required');
+  const receipt = readReceipt(args[1]);
+  sameSource(receipt, identity());
+  const commit = github(`repos/${receipt.repository}/git/commits/${receipt.head_sha}`);
+  if (commit.tree.sha !== receipt.tree_sha) throw new Error('remote_tree_mismatch');
+  const status = github(`repos/${receipt.repository}/statuses/${receipt.head_sha}`, {
+    state: 'success', context: CONTEXT, description: `v1:${receipt.tree_sha}:${receipt.command_sha256}`,
+  });
+  verifyStatus(status, receipt.tree_sha, github('user').login);
+  console.log(JSON.stringify({ ok: true, result: 'local_validation_published', ...receipt }));
+}
+
+function check(args) {
+  localOnly();
+  if (args[0] !== '--receipt' || args[2] !== '--sha' || args.length !== 4) throw new Error('receipt_and_sha_required');
+  const receipt = readReceipt(args[1]);
+  if (receipt.head_sha !== args[3]) throw new Error('receipt_head_mismatch');
+  sameSource(receipt, identity());
+  console.log(JSON.stringify({ ok: true, result: 'local_validation_current', ...receipt }));
+}
+
+async function verify(args) {
+  if (args[0] !== '--sha' || args.length !== 2 || !/^[a-f0-9]{40}$/.test(args[1])) {
+    throw new Error('explicit_head_sha_required');
+  }
+  const sha = args[1], repository = process.env.GITHUB_REPOSITORY;
+  const author = expectedAuthor(sha, repository);
+  const tree = github(`repos/${repository}/git/commits/${sha}`).tree.sha;
+  if (command('git', ['rev-parse', 'HEAD^{tree}']) !== tree) throw new Error('checkout_tree_mismatch');
+  let status;
+  for (let attempt = 0; attempt <= 6; attempt += 1) {
+    // The combined /status summary omits creator; full records authenticate the issuer.
+    const statuses = github(`repos/${repository}/commits/${sha}/statuses?per_page=100`);
+    status = statuses.find(item => item.context === CONTEXT);
+    if (status || attempt === 6) break;
+    await new Promise(resolve => setTimeout(resolve, 5000));
+  }
+  verifyStatus(status, tree, author);
+  console.log(JSON.stringify({ ok: true, result: 'local_validation_verified', head_sha: sha, tree_sha: tree }));
+}
+
+async function main() {
+  const [operation, ...args] = process.argv.slice(2);
+  const actions = { run, check, publish, verify };
+  if (!Object.hasOwn(actions, operation)) throw new Error('run_check_publish_or_verify_required');
+  await actions[operation](args);
+}
+
+main().catch(error => {
+  const code = /^[a-z][a-z0-9_]+$/.test(error.message) ? error.message : 'invalid_local_validation_input';
+  console.error(`local_validation_refused: ${code}`);
+  process.exitCode = 1;
+});

package/action/scripts/local_validation_core.cjs

@@ -0,0 +1,84 @@
+const { createHash } = require('node:crypto');
+const { execFileSync } = require('node:child_process');
+const { readFileSync } = require('node:fs');
+
+const SCHEMA = 'gowalk-cicd/local-validation.v1';
+const CONTEXT = 'local-validation';
+
+function command(program, args) {
+  try {
+    return execFileSync(program, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 15000 }).trim();
+  }
+  catch { throw new Error(`${program}_command_failed`); }
+}
+
+function repositoryFromRemote(remote, ssh = args => command('ssh', args)) {
+  const https = remote.match(/^https:\/\/github\.com\/([\w.-]+\/[\w.-]+?)(?:\.git)?$/);
+  if (https) return https[1];
+  const scp = remote.match(/^(?:([\w.-]+)@)?([A-Za-z0-9][\w.-]*):([\w.-]+\/[\w.-]+?)(?:\.git)?$/);
+  const url = remote.match(/^ssh:\/\/(?:([\w.-]+)@)?([A-Za-z0-9][\w.-]*)(?::(22))?\/([\w.-]+\/[\w.-]+?)(?:\.git)?$/);
+  const [user, host, repository] = scp ? scp.slice(1) : url ? [url[1], url[2], url[4]] : [];
+  if (!repository) throw new Error('github_repository_required');
+  if (host === 'github.com' && user === 'git') return repository;
+  const config = Object.fromEntries(ssh(['-G', ...(user ? ['-l', user] : []), host])
+    .split('\n').map(line => line.trim().split(/\s+/, 2)));
+  if (config.hostname !== 'github.com' || config.user !== 'git' || config.port !== '22') {
+    throw new Error('github_repository_required');
+  }
+  return repository;
+}
+
+function identity() {
+  const repository = repositoryFromRemote(command('git', ['remote', 'get-url', 'origin']));
+  if (command('git', ['status', '--porcelain'])) throw new Error('clean_checkout_required');
+  return { repository, head_sha: command('git', ['rev-parse', 'HEAD']),
+    tree_sha: command('git', ['rev-parse', 'HEAD^{tree}']) };
+}
+
+function readReceipt(path) {
+  const receipt = JSON.parse(readFileSync(path, 'utf8'));
+  if (receipt.schema !== SCHEMA || !/^[\w.-]+\/[\w.-]+$/.test(receipt.repository)
+      || !/^[a-f0-9]{40}$/.test(receipt.head_sha) || !/^[a-f0-9]{40}$/.test(receipt.tree_sha)
+      || !/^[a-f0-9]{64}$/.test(receipt.command_sha256)) throw new Error('invalid_local_validation_receipt');
+  return receipt;
+}
+
+function sameSource(receipt, source) {
+  for (const field of ['repository', 'head_sha', 'tree_sha']) {
+    if (receipt[field] !== source[field]) throw new Error('local_validation_source_changed');
+  }
+}
+
+function github(path, fields = {}) {
+  const args = ['api', path];
+  for (const [key, value] of Object.entries(fields)) args.push('-f', `${key}=${value}`);
+  return JSON.parse(command('gh', args));
+}
+
+function expectedAuthor(sha, repository, event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'))) {
+  if (process.env.GITHUB_REPOSITORY !== repository) throw new Error('repository_mismatch');
+  if (event.pull_request) {
+    const pr = event.pull_request;
+    if (pr.head.repo.full_name !== repository || pr.head.sha !== sha) throw new Error('same_repository_head_required');
+    return pr.user.login;
+  }
+  if (process.env.GITHUB_EVENT_NAME === 'workflow_dispatch') {
+    if (process.env.GITHUB_SHA !== sha || event.repository?.full_name !== repository) {
+      throw new Error('dispatch_head_required');
+    }
+    return event.sender.login;
+  }
+  if (event.after !== sha || process.env.GITHUB_SHA !== sha) throw new Error('push_head_required');
+  return event.sender.login;
+}
+
+function verifyStatus(status, tree, author) {
+  if (!status || status.state !== 'success' || status.creator?.login !== author
+      || !new RegExp(`^v1:${tree}:[a-f0-9]{64}$`).test(status.description)) {
+    throw new Error('successful_author_local_validation_required');
+  }
+}
+
+module.exports = { SCHEMA, CONTEXT, command, repositoryFromRemote, identity, readReceipt, sameSource,
+  github, expectedAuthor, verifyStatus,
+  digest: args => createHash('sha256').update(JSON.stringify(args)).digest('hex') };

package/android-action/action.yml

@@ -25,11 +25,9 @@ inputs:
     required: false
     default: ""
   run-tests:
-    description: >-
-      Run the project's analyzer and unit tests before the release build
-      (flutter analyze + flutter test, or the Gradle module's unit tests)
+    description: DEPRECATED (ignored). Tests and analysis run locally, never in GitHub Actions.
     required: false
-    default: "true"
+    default: "false"
   dart-defines:
     description: >-
       Compile-time Dart defines for a Flutter app, one `KEY=VALUE` per line
@@ -110,23 +108,6 @@ runs:
       shell: bash
       run: flutter pub get
 
-    - name: Analyze Flutter app
-      if: ${{ steps.config.outputs.project_kind == 'flutter' && inputs.run-tests == 'true' }}
-      shell: bash
-      run: flutter analyze
-
-    # `flutter test` hard-fails with "Test directory \"test\" not found" when a repo
-    # has no tests, which is not a real failure. Skip instead of blowing up the deploy.
-    - name: Test Flutter app
-      if: ${{ steps.config.outputs.project_kind == 'flutter' && inputs.run-tests == 'true' }}
-      shell: bash
-      run: |
-        if [ -d test ]; then
-          flutter test --no-pub
-        else
-          echo "No test/ directory; skipping flutter test."
-        fi
-
     # Dart obfuscation is mandatory for Flutter apps: every release build is
     # compiled with --obfuscate, and there is deliberately no input or repo
     # variable that switches it off. --split-debug-info is not optional
@@ -217,20 +198,6 @@ runs:
     # additionally overrides them through the Variant API so the resolved
     # versionCode holds even when there is no literal — see
     # scripts/version_override.init.gradle.
-    # `test` is the aggregate task ("Run unit tests for all variants") and is the
-    # only one guaranteed to exist: AGP only creates testXUnitTest tasks for the
-    # variants it enables, and AGP 9 disables the release unit test variant by
-    # default, so `:app:testReleaseUnitTest` is simply absent in many projects.
-    # Running it unqualified also mirrors `flutter test`, which covers the whole
-    # package rather than one module.
-    - name: Test Android app
-      if: ${{ steps.config.outputs.project_kind == 'gradle' && inputs.run-tests == 'true' }}
-      shell: bash
-      working-directory: ${{ steps.config.outputs.gradle_root || '.' }}
-      run: |
-        chmod +x ./gradlew
-        ./gradlew test --console=plain --stacktrace
-
     # ANDROID_BUILD_NUMBER is already in the environment: resolve_android.py
     # exported it through GITHUB_ENV. ANDROID_BUILD_NAME is only set when the
     # caller actually pinned a build-name — empty means "leave versionName

package/bin/cli.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 const __filename = fileURLToPath(import.meta.url);
@@ -8,6 +9,11 @@ const __dirname = dirname(__filename);
 const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
 
 const args = process.argv.slice(2);
+if (args[0] === 'validate') {
+  const helper = join(__dirname, '../action/scripts/local_validation.cjs');
+  const result = spawnSync(process.execPath, [helper, ...args.slice(1)], { stdio: 'inherit' });
+  process.exit(result.status ?? 1);
+}
 if (args[0] === 'release') {
   const platform = args[1] || 'both';
   if (args.length > 2 || !['ios', 'android', 'both'].includes(platform)) {
@@ -51,6 +57,7 @@ What it writes:
 
 Options:
   release [ios|android|both]  Prepare a mobile release intent on the task branch
+  validate run|check|publish|verify  Run local focused checks or verify their authenticated source receipt
   --dry-run        Print what would happen without writing files
   -v, --version    Show version number
   -h, --help       Show this help message

package/docs/CI_PERFORMANCE.md

@@ -1,7 +1,7 @@
 # Native validation and delivery time
 
-Keep routine push-to-verified delivery within 2–5 minutes. Preserve every required check and
-coverage assertion. Measure regressions and fix the slow stage in the same task; lowering a
+Keep routine push-to-verified delivery within 2–5 minutes. Preserve required delivery checks and
+verify the local candidate evidence. Measure regressions and fix the slow stage in the same task; lowering a
 timeout, skipping a failed test or calling a transferred binary production-ready is not a fix.
 Cold toolchain setup and provider processing are recorded separately; neither is hidden from
 total wall time or billed runner time. Compile one frozen candidate and promote its verified
@@ -37,61 +37,17 @@ version and all helper hashes, writes `DEST/release.json`, and outputs `scripts`
 `version`, and `integrity`. Scripts retain their package-relative directory layout. Neither mode
 reads credentials or connects to a store. The receipt schema is `gowalk-cicd/native-tooling.v1`.
 
-## Reuse native checks only with positive proof
-
-The application owns a reviewed JSON configuration, normally `.factory/native-validation.json`:
-
-```json
-{
-  "schema": 1,
-  "input_paths": ["Sources", "Resources", "Tests", "UITests", "project.yml", "App.xcodeproj"],
-  "workflow": ".github/workflows/ios-ci.yml",
-  "jobs": [{"name": "Native tests", "steps": ["Run all native tests", "Verify full coverage"]}],
-  "context_keys": ["package_version", "package_integrity", "xcode", "sdk", "devices", "backend"],
-  "external_context_keys": ["backend"]
-}
-```
-
-Use `input_paths: ["."]` for unknown project layouts; include every source, test, asset, script,
-lockfile, configuration and resource consumed by a reviewed narrower suite. `.github/`, the
-validated configuration and receipt helper bytes always participate. Symlinks, submodules and
-dirty selected inputs cannot establish reusable proof. Generated temporary configurations are
-supported; their canonical contents participate just like a committed configuration.
-
-Pass `NATIVE_VALIDATION_CONTEXT` as a JSON object whose keys match `context_keys`, with nonempty
-string values read from actual execution state. Include the resolved package version/integrity,
-full selected Xcode build, SDK/runtime, device matrix and consumed variables. A floating runner
-label is not a toolchain identity; describe the actual Mac before lookup when necessary.
-
-Every external key requires a fresh `sha256:<64 hex characters>` witness for the exact backend
-deployment/flow revision or canonical relevant response. An origin URL is not an external-state
-witness. Missing proof means full validation. For suites with inherently changing external data,
-run those integration checks afresh outside the reusable portion. Unknown custom scripts or
-undeclared network dependencies keep full coverage; never guess that they are unchanged.
-
-```bash
-node "$SCRIPTS/native_validation.cjs" lookup .factory/native-validation.json
-# After every declared test and coverage check succeeded:
-node "$SCRIPTS/native_validation.cjs" record .factory/native-validation.json
-```
-
-`lookup` needs repository `actions:read`, `GITHUB_TOKEN`, and a checkout containing the prior
-producer commit. Its outputs are `reused`, `reuse-reason`, `fingerprint`, `artifact-name` and,
-on a hit, `source-run`/`source-sha`. Missing external context returns a miss without a fingerprint.
-No completed match or unavailable API proof runs full coverage immediately; it never waits for
-another workflow. Missing local producer history is also a safe miss.
-
-`record` runs inside the producing job after tests, writing `receipt-path` and `artifact-name`.
-Retain that single `native-validation.json` with the pinned `actions/upload-artifact`, seven-day
-retention and the existing artifact process scope. For matrix suites, a collector records only
-after verifying every shard; configure every exact required job and successful step. A later
-lookup verifies the completed successful same-repository run, matching workflow, every named
-job/step, immutable artifact digest and an independently recomputed producer source tree. The
-receipt contains hashes and run identity, never context values or credentials.
-
-Keep the existing required `task/**` push check. A cheap admission may reuse prior success only
-under this proof; its required final check must require either that proof or successful fresh
-coverage. Do not replace the required push check with an unrelated PR merge-ref status.
+## Validate locally, verify the source receipt in Actions
+
+Automated tests never run in GitHub Actions, including self-hosted jobs. Run only impacted checks
+in the owned workspace and publish an authenticated receipt for the frozen clean candidate.
+[Local validation](LOCAL_VALIDATION.md) defines the `gowalk-cicd validate` commands and proof.
+Actions verifies that source proof and keeps build, signing, artifact, upload and health checks.
+Existing custom app workflows require explicit migration: the installer does not infer which
+parts of an arbitrary shell script are tests or rewrite mixed build/test execution blindly.
+The older native-validation artifact reuse helpers remain for compatibility; they do not authorize
+new test execution in Actions. Preserve required check names while replacing their execution with
+local proof verification, and describe that behavior honestly in the job steps.
 
 ## Cache work is part of delivery cost
 

package/docs/CONFIGURATION.md

@@ -62,7 +62,11 @@ Compose service must pass `BACKEND_PUBLIC_BASE_URL` into its container and use i
 The same named repository inputs reach the feature-branch backend preview in `deploy.yml`.
 
 The supported managed files are `deploy.yml`, `mobile-candidate.yml`,
-`warm-android-cache.yml`, `deploy-web.yml` and `deploy-backend.yml`. The installer no longer adds
+`apple-upload-recovery.yml`, `warm-android-cache.yml`, `deploy-web.yml` and `deploy-backend.yml`.
+The installer adds the dispatch-only `apple-upload-recovery.yml` when the rendered mobile
+deployment supports iOS; explicit Android-only deployment excludes it. It preserves recovery
+workflow overrides and removes only an unmodified generated copy when iOS is no longer supported.
+The installer no longer adds
 `deploy-web.yml`, and adds `warm-android-cache.yml` only while candidate artifacts are enabled
 and `mobile.platforms` is not `ios`;
 it removes such a file that is still the unmodified generated one with no overrides,

package/docs/LOCAL_VALIDATION.md

@@ -0,0 +1,61 @@
+# Local validation and Actions integrity
+
+Automated tests run in the owned workspace, never in GitHub Actions, including self-hosted
+jobs. Select only the focused checks affected by the change. Do not repeat a full regression
+on every push, on merge, or before publication. Actions still builds, signs, uploads, checks
+artifacts and verifies deployment health; those operations are not automated test suites.
+
+Commit the complete candidate first. Use a durable receipt path outside the checkout:
+
+```bash
+npx --yes gowalk-cicd@1.0.186 validate run --receipt "$TASK_OUTPUT/local-validation.json" -- \
+  node --test test/changed-behavior.test.mjs
+npx --yes gowalk-cicd@1.0.186 validate check --receipt "$TASK_OUTPUT/local-validation.json" --sha "$HEAD_SHA"
+git push origin HEAD
+npx --yes gowalk-cicd@1.0.186 validate publish --receipt "$TASK_OUTPUT/local-validation.json"
+```
+
+`TASK_OUTPUT` is task-owned durable storage; `HEAD_SHA` is the candidate's `git rev-parse HEAD`.
+The local command is executed directly, with the supplied arguments. Use the project's existing
+focused runner when several checks belong together. `run` refuses Actions and a dirty checkout,
+removes an old receipt at that path, and writes a new one only after the command exits successfully
+and HEAD, repository, tree and checkout cleanliness remain unchanged. `check` verifies that result
+without executing commands or contacting GitHub. `publish` checks it again, reads the remote commit
+tree and posts an authenticated `local-validation` commit status. GitHub authentication uses `gh`.
+
+The receipt schema is `gowalk-cicd/local-validation.v1`, with `repository`, `head_sha`, `tree_sha`
+and `command_sha256`. The command digest is SHA-256 of the actual argument vector encoded as JSON.
+The full committed tree includes dependency lockfiles and configuration. This proof does not claim
+to describe untracked installed dependencies or the whole local machine. The status description is
+`v1:<tree SHA-1>:<command SHA-256>`; receipts and statuses contain no command text or child logs.
+
+Actions verifies the explicitly selected head, using the helper vendored by the installer:
+
+```yaml
+permissions:
+  contents: read
+  statuses: read
+steps:
+  - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+  - name: Verify local candidate validation
+    env:
+      GH_TOKEN: ${{ github.token }}
+      VALIDATION_HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
+    run: node .github/actions/swift-app/scripts/local_validation.cjs verify --sha "$VALIDATION_HEAD"
+```
+
+`verify` executes no tests. A PR requires same-repository head identity and a successful status
+issued by its author; a push requires its exact event SHA and sender. Manual workflow dispatch verifies
+the selected repository, explicit SHA against `GITHUB_SHA`, and the dispatch sender. The checked-out tree must equal
+that head's tree, including on a PR merge ref. If main advanced and changed the merge tree, update
+the task branch and validate the new candidate locally. Missing, failed, wrong-author or mismatched
+proof refuses. A missing status gets six five-second retries for publication immediately after push.
+
+The CLI also accepts `gowalk-cicd validate verify --sha ...`. The installed script and its sibling
+`local_validation_core.cjs` avoid fetching another package in app jobs. Legacy composite inputs
+`run-tests`, `test-command` and `test-destination` are accepted but ignored; composites execute no tests.
+Custom app workflows and required status names need explicit migration. The installer preserves
+unknown app-authored execution rather than guessing how to split an arbitrary mixed build/test script.
+
+For this package, `pr.yml` verifies local proof, release version and the npm archive. Main publication
+packages and publishes that checked artifact without npm lifecycle hooks or a repeated regression.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.184",
+  "version": "1.0.186",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {
@@ -42,7 +42,8 @@
     "docs/BACKEND_SSH_GATE.md",
     "docs/BACKEND_NATIVE.md",
     "docs/CONFIGURATION.md",
-    "docs/CI_PERFORMANCE.md"
+    "docs/CI_PERFORMANCE.md",
+    "docs/LOCAL_VALIDATION.md"
   ],
   "keywords": [
     "ios",

package/remedies.json

@@ -26,8 +26,8 @@
   {
     "schema": "gowalk-cicd/mobile-release-refused.v1",
     "code": "mobile_release_upload_unconfirmed_read_back_retained_binary_before_retry",
-    "fixed_in": "1.0.183",
-    "remedy": "Preserve the original upload owner and artifacts. If an iOS producer was cancelled after both Build and transfer iOS binary and Retain Apple verification handoff succeeded, use apple_upload_recovery.cjs RUN ATTEMPT DEPLOYMENT ARTIFACT from an authorized default-branch workflow_dispatch Actions job. It downloads and authenticates the original artifact, proves the terminal original and latest run, and reads fresh Apple upload/file/build/app evidence before reconciling that deployment. It never rebuilds, uploads or replays metadata. Retain its recovery proof, then rerun the whole original deployment workflow: admission reuses the uploaded receipt without another iOS binary. The old cancellation remains historical evidence; follow the new attempt to completion. Missing or mismatched evidence still refuses."
+    "fixed_in": "1.0.185",
+    "remedy": "Preserve the original upload owner and artifacts. If the original iOS deployment failed or was cancelled after Build and transfer iOS binary and Retain Apple verification handoff succeeded in order, dispatch the managed apple-upload-recovery.yml on the default branch with original producer-run, producer-attempt, deployment-id and handoff-artifact-id. It authenticates the original artifact and unchanged handoff, terminal original and latest run, owner, and fresh Apple upload/file/build/app evidence. A null optional file checksum is absent; present whole-file checksums remain strictly verified. It never rebuilds, uploads, replays metadata or rewrites the original handoff. Retain the original handoff and derived completion proof with distinct current recovery caller, then rerun the whole original deployment: admission reuses the uploaded receipt without another iOS binary. The old failure or cancellation remains historical evidence; follow the new attempt to completion. Missing or mismatched evidence remains refused."
   },
   {
     "schema": "gowalk-cicd/mobile-release-refused.v1",

package/src/config/workflows.mjs

@@ -36,11 +36,11 @@ function render(source, normalized, file) {
 }
 
 const WARM = 'warm-android-cache.yml';
-const MANAGED = ['deploy.yml', 'mobile-candidate.yml', 'deploy-web.yml', 'deploy-backend.yml', WARM];
+const RECOVERY = 'apple-upload-recovery.yml';
+const MANAGED = ['deploy.yml', 'mobile-candidate.yml', 'deploy-web.yml', 'deploy-backend.yml', WARM, RECOVERY];
 
-// A generated file this install no longer wants (deploy-web.yml always; the warm-up without
-// candidates) is removed while it is still what the lock says was generated, with no overrides.
-// Anything customized stays and keeps upgrading.
+// Retire generated workflows only while their locked bytes are unchanged and they have no overrides.
+// App-owned customizations stay and keep upgrading when their automatic use is disabled.
 function retired(root, file, state) {
   if (state.migrating || state.config.workflows[file]?.overrides?.length) return false;
   const previous = load(root, `.github/workflows/${file}`);
@@ -87,8 +87,14 @@ export function planWorkflows(root, templateDir, files, version) {
     if (!MANAGED.includes(file)) throw new MigrationRepair('unknown_managed_workflow', CONFIG);
   }
   const removed = selected.filter(file => file === 'deploy-web.yml' && retired(root, file, state));
-  const writes = selected.filter(file => !removed.includes(file) && file !== WARM)
+  const writes = selected.filter(file => !removed.includes(file) && ![WARM, RECOVERY].includes(file))
     .map(file => upgradeWorkflow(root, file, templateDir, state));
+  const recovery = selected.includes('deploy.yml') && state.config.mobile?.platforms !== 'android';
+  if (recovery || (selected.includes(RECOVERY) && !retired(root, RECOVERY, state))) {
+    writes.push(upgradeWorkflow(root, RECOVERY, templateDir, state));
+  } else if (selected.includes(RECOVERY)) {
+    removed.push(RECOVERY);
+  }
   // Only verified candidate keys can request trusted post-release dependency priming on either OS.
   const candidates = selected.includes('mobile-candidate.yml')
     && state.config.mobile?.['candidate-artifacts'] !== false;
@@ -106,7 +112,7 @@ export function planWorkflows(root, templateDir, files, version) {
   for (const [file, entry] of Object.entries(state.config.workflows)) {
     for (const change of entry.overrides) assertReferences(change.value, file, change.path);
   }
-  writes.push(...planValidation(root, [...selected, WARM]));
+  writes.push(...planValidation(root, [...selected, WARM, RECOVERY]));
   state.lock.package = version;
   const config = state.text && equal(readYaml(state.text, CONFIG).value, state.config)
     ? state.text

package/templates/apple-upload-recovery.yml

@@ -0,0 +1,96 @@
+name: Recover Apple upload
+on:
+  workflow_dispatch:
+    inputs:
+      producer-run:
+        description: Original Mobile Deploy run ID
+        required: true
+        type: string
+      producer-attempt:
+        description: Original Mobile Deploy run attempt
+        required: true
+        type: string
+      deployment-id:
+        description: Original iOS release deployment ID
+        required: true
+        type: string
+      handoff-artifact-id:
+        description: Original Apple verification handoff artifact ID
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+  deployments: write
+
+# Serialize the original owner update with ordinary Mobile Deploy; recovery never uploads.
+concurrency:
+  group: mobile-deploy-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  recover:
+    name: Verify the original Apple upload
+    if: >-
+      ${{ github.event_name == 'workflow_dispatch'
+          && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+      APPLE_RECOVERY_PRODUCER_RUN: ${{ inputs.producer-run }}
+      APPLE_RECOVERY_PRODUCER_ATTEMPT: ${{ inputs.producer-attempt }}
+      APPLE_RECOVERY_DEPLOYMENT_ID: ${{ inputs.deployment-id }}
+      APPLE_RECOVERY_HANDOFF_ARTIFACT_ID: ${{ inputs.handoff-artifact-id }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Validate original upload identifiers
+        shell: bash
+        run: |
+          for value in "$APPLE_RECOVERY_PRODUCER_RUN" "$APPLE_RECOVERY_PRODUCER_ATTEMPT" \
+            "$APPLE_RECOVERY_DEPLOYMENT_ID" "$APPLE_RECOVERY_HANDOFF_ARTIFACT_ID"; do
+            if [[ ! "$value" =~ ^[1-9][0-9]*$ ]]; then
+              echo "::error title=apple_upload_recovery_failed::invalid_recovery_identifiers"
+              exit 1
+            fi
+          done
+      - name: Prepare Apple API access
+        env:
+          CI_ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+          CI_ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          CI_ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+        run: |
+          umask 077
+          mkdir -p creds
+          if [ -n "${CI_ASC_KEY_P8:-}" ]; then
+            : "${CI_ASC_KEY_ID:?ASC_KEY_ID secret is required with ASC_KEY_P8}"
+            : "${CI_ASC_ISSUER_ID:?ASC_ISSUER_ID secret is required with ASC_KEY_P8}"
+            printf '%s' "$CI_ASC_KEY_P8" > "creds/AuthKey_${CI_ASC_KEY_ID}_Issuer_${CI_ASC_ISSUER_ID}.p8"
+          fi
+          python3 -m pip install --quiet --break-system-packages PyJWT cryptography requests
+          PYTHONPATH=.github/actions/swift-app/scripts python3 - <<'PY'
+          import os
+          from pathlib import Path
+          from read_config import emit_credentials
+          emit_credentials(Path(os.environ['GITHUB_ENV']), Path(os.environ['GITHUB_WORKSPACE']))
+          PY
+      - name: Verify the original upload and reconcile its owner
+        id: recover
+        run: |
+          node .github/actions/swift-app/scripts/apple_upload_recovery.cjs \
+            "$APPLE_RECOVERY_PRODUCER_RUN" "$APPLE_RECOVERY_PRODUCER_ATTEMPT" \
+            "$APPLE_RECOVERY_DEPLOYMENT_ID" "$APPLE_RECOVERY_HANDOFF_ARTIFACT_ID"
+      - name: Retain verified Apple recovery proof
+        if: ${{ steps.recover.outputs.verified == 'true' }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ github.workspace }}/.github/actions/android-app/scripts/artifact_env.cjs"
+        with:
+          name: apple-recovered-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/apple-upload-recovery/apple-verification.json
+            ${{ runner.temp }}/apple-upload-recovery/apple-verification.json.verified.json
+            ${{ runner.temp }}/apple-upload-recovery/apple-verification.json.upload-receipt.json
+          if-no-files-found: error
+          retention-days: 7