gowalk-cicd 1.0.185 → 1.0.186

package/README.md

@@ -5,6 +5,12 @@ optional backend deploy. It supports native Swift/SwiftUI iOS projects, native K
 Android projects, and Flutter apps. Provision encrypted repository secrets, validate a
 task candidate, and promote its release intent. Store builds and uploads run only in GitHub Actions.
 
+Tests must run locally, never in GitHub Actions. Run only the focused tests needed for the
+changed behavior before pushing. The iOS and Android actions never run tests or Flutter analysis;
+legacy `run-tests`, `test-command`, and `test-destination` inputs are accepted but ignored,
+including `run-tests: 'true'`. Build, signing, upload, and delivery health checks remain in Actions.
+See [local validation](docs/LOCAL_VALIDATION.md) for focused execution, receipts and CI verification.
+
 App-specific workflow settings live in `.gowalk-cicd.yml`. The installer migrates supported
 existing settings once and regenerates managed workflows without replacing custom behavior.
 See [configuration](docs/CONFIGURATION.md).
@@ -108,7 +114,7 @@ download segment. A slow segment becomes a cache miss and normal SDK setup
 continues normally; SDK setup errors still fail the
 job. This bounds individual cache segments, not the total cache or SDK download,
 and keeps existing cache keys. A successfully installed SDK is saved before app
-checks run, so a later test/build failure does not force another cold SDK download.
+builds run, so a later build failure does not force another cold SDK download.
 Failed setup never saves an SDK cache; pub dependencies retain their job-end save.
 Pull-request runs (`refs/pull/*`, which includes every candidate build) restore these caches
 but never save them; task branches and the default branch still save. When the caller names
@@ -789,7 +795,6 @@ configuration for either:
 |---|---|---|
 | Detected by | `pubspec.yaml` at the repo root | `settings.gradle(.kts)` + `gradlew` at the root or under `android/` |
 | App module | `android/app` | the one module applying `com.android.application` (version-catalog aliases are resolved; a module named `app` wins a tie against a wear/automotive sibling) |
-| Tests (`run-tests`) | `flutter analyze` + `flutter test` | `gradlew test` (all variants, all modules) |
 | Build | `flutter build appbundle --release --obfuscate --split-debug-info` | `<module>:bundleRelease` |
 | Toolchain installed | Flutter + JDK 17 | JDK 21, or 17 on an old Kotlin — see [Choosing the JDK](#choosing-the-jdk) |
 
@@ -1051,7 +1056,6 @@ schemes, pass inputs in `.github/workflows/deploy.yml`:
   with:
     scheme: MyAppRelease
     bundle-id: com.example.myapp
-    run-tests: 'false'
     uses-non-exempt-encryption: 'false'
 ```
 
@@ -1067,9 +1071,9 @@ common ones:
 | `team-id` | Override the auto-detected team ID |
 | `app-store-apple-id` | Numeric ASC app ID (override auto-lookup) |
 | `certificate-cap-policy` | Deprecated and ignored: CI never creates or revokes certificates. |
-| `run-tests` | `false` to skip the simulator test stage |
+| `run-tests`, `test-command`, `test-destination` | Deprecated and ignored: tests run locally only. |
 | `uses-non-exempt-encryption` | Value for `ITSAppUsesNonExemptEncryption` |
-| `archive` | `false` to build-only (PR runs without secrets) |
+| `archive` | `false` to skip archive, export, and upload |
 | `upload` | `false` to archive but not upload to TestFlight |
 | `manage-app-store-version` | `false` to upload without creating/editing the App Store release slot |
 | `app-store-whats-new` | Inline "What's New" text (overrides files) |

package/action/action.yml

@@ -69,9 +69,8 @@ inputs:
     default: "false"
   archive:
     description: >
-      Set to 'false' to skip archive + export + upload entirely. Useful for
-      PR / branch runs that only need to build and test without code signing
-      secrets. When 'false', `upload` is ignored.
+      Set to 'false' to skip archive + export + upload entirely.
+      When 'false', `upload` is ignored.
     required: false
     default: "true"
   manage-app-store-version:
@@ -82,21 +81,15 @@ inputs:
     required: false
     default: "true"
   run-tests:
-    description: "Set to 'false' to skip the simulator test stage"
+    description: DEPRECATED (ignored). Tests run locally, never in GitHub Actions.
     required: false
-    default: ""
+    default: "false"
   test-command:
-    description: >
-      Shell command used for the simulator test stage. Defaults to running
-      `bash Scripts/run-tests.sh` when that file exists, otherwise
-      `xcodebuild test` against the chosen scheme on a booted simulator with
-      code-signing disabled. Override to run a custom runner.
+    description: DEPRECATED (ignored). Custom test commands are never executed.
     required: false
     default: ""
   test-destination:
-    description: >
-      Destination passed to the default `xcodebuild test` invocation when
-      `test-command` is empty and no `Scripts/run-tests.sh` is present.
+    description: DEPRECATED (ignored). Simulator tests run locally only.
     required: false
     default: ""
   uses-non-exempt-encryption:
@@ -276,9 +269,6 @@ runs:
         INPUT_USES_NON_EXEMPT: ${{ inputs.uses-non-exempt-encryption }}
         INPUT_WHATS_NEW: ${{ inputs.app-store-whats-new }}
         INPUT_LOCALE: ${{ inputs.app-store-locale }}
-        INPUT_RUN_TESTS: ${{ inputs.run-tests }}
-        INPUT_TEST_COMMAND: ${{ inputs.test-command }}
-        INPUT_TEST_DESTINATION: ${{ inputs.test-destination }}
       run: |
         # read_config.py runs FIRST (it derives every other value), so it must
         # install its full dep set inline. All later steps reuse these.
@@ -320,48 +310,6 @@ runs:
         key: ${{ steps.native_cache_scope.outputs.key }}
         path: ${{ steps.native_cache_scope.outputs.paths }}
 
-    - name: Run simulator tests
-      if: ${{ (inputs.run-tests || env.CFG_RUN_TESTS) == 'true' && inputs.candidate-binary == '' }}
-      shell: bash
-      env:
-        PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
-        WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
-        SCHEME: ${{ inputs.scheme || env.CFG_SCHEME }}
-        CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
-        TEST_COMMAND: ${{ inputs.test-command || env.CFG_TEST_COMMAND }}
-        TEST_DESTINATION: >-
-          ${{ inputs.test-destination || env.CFG_TEST_DESTINATION
-              || 'platform=iOS Simulator,name=iPhone 15' }}
-      run: |
-        set -o pipefail
-        python3 "$SWIFT_APP_ACTION/scripts/native_dependency_guard.py" "$GITHUB_WORKSPACE" \
-          --container "${WORKSPACE:-$PROJECT}"
-        if [ -n "$TEST_COMMAND" ]; then
-          echo "Running custom test command: $TEST_COMMAND"
-          bash -c "$TEST_COMMAND"
-        elif [ -f "Scripts/run-tests.sh" ]; then
-          echo "Running Scripts/run-tests.sh"
-          bash Scripts/run-tests.sh
-        else
-          if [ -n "$WORKSPACE" ]; then
-            PROJ_ARGS=(-workspace "$WORKSPACE")
-          else
-            PROJ_ARGS=(-project "$PROJECT")
-          fi
-          echo "Running xcodebuild test on $TEST_DESTINATION"
-          xcodebuild \
-            "${PROJ_ARGS[@]}" \
-            -scheme "$SCHEME" \
-            -configuration "$CONFIGURATION" \
-            -destination "$TEST_DESTINATION" \
-            -disableAutomaticPackageResolution -skipPackageUpdates \
-            CODE_SIGNING_ALLOWED=NO \
-            CODE_SIGNING_REQUIRED=NO \
-            CODE_SIGN_IDENTITY="" \
-            DEVELOPMENT_TEAM="" \
-            test
-        fi
-
     - name: Stage ASC API key for authenticated REST uploads
       if: ${{ inputs.archive == 'true' }}
       shell: bash

package/action/scripts/local_validation.cjs

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+// Tests run on the owned workspace; Actions verifies an authenticated exact-source result only.
+const { spawnSync } = require('node:child_process');
+const { mkdirSync, rmSync, writeFileSync } = require('node:fs');
+const { dirname, relative, resolve, isAbsolute } = require('node:path');
+const { SCHEMA, CONTEXT, command, identity, readReceipt, sameSource, github, expectedAuthor,
+  verifyStatus, digest } = require('./local_validation_core.cjs');
+
+function localOnly() {
+  if (process.env.GITHUB_ACTIONS === 'true') throw new Error('tests_forbidden_in_github_actions');
+}
+
+function run(args) {
+  localOnly();
+  if (args[0] !== '--receipt' || args[2] !== '--' || !args[3]) throw new Error('receipt_and_command_required');
+  const path = resolve(args[1]);
+  const root = command('git', ['rev-parse', '--show-toplevel']);
+  const nested = relative(root, path);
+  if (nested !== '..' && !nested.startsWith('../') && !isAbsolute(nested)) {
+    throw new Error('receipt_must_be_outside_checkout');
+  }
+  const source = identity();
+  rmSync(path, { force: true });
+  const argv = args.slice(3);
+  const result = spawnSync(argv[0], argv.slice(1), { stdio: 'inherit' });
+  if (result.error || result.status !== 0) throw new Error('local_validation_command_failed');
+  sameSource(source, identity());
+  const receipt = { schema: SCHEMA, ...source, command_sha256: digest(argv) };
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(receipt) + '\n', { mode: 0o600 });
+  console.log(JSON.stringify({ ok: true, result: 'local_validation_passed', ...receipt }));
+}
+
+function publish(args) {
+  localOnly();
+  if (args[0] !== '--receipt' || args.length !== 2) throw new Error('receipt_required');
+  const receipt = readReceipt(args[1]);
+  sameSource(receipt, identity());
+  const commit = github(`repos/${receipt.repository}/git/commits/${receipt.head_sha}`);
+  if (commit.tree.sha !== receipt.tree_sha) throw new Error('remote_tree_mismatch');
+  const status = github(`repos/${receipt.repository}/statuses/${receipt.head_sha}`, {
+    state: 'success', context: CONTEXT, description: `v1:${receipt.tree_sha}:${receipt.command_sha256}`,
+  });
+  verifyStatus(status, receipt.tree_sha, github('user').login);
+  console.log(JSON.stringify({ ok: true, result: 'local_validation_published', ...receipt }));
+}
+
+function check(args) {
+  localOnly();
+  if (args[0] !== '--receipt' || args[2] !== '--sha' || args.length !== 4) throw new Error('receipt_and_sha_required');
+  const receipt = readReceipt(args[1]);
+  if (receipt.head_sha !== args[3]) throw new Error('receipt_head_mismatch');
+  sameSource(receipt, identity());
+  console.log(JSON.stringify({ ok: true, result: 'local_validation_current', ...receipt }));
+}
+
+async function verify(args) {
+  if (args[0] !== '--sha' || args.length !== 2 || !/^[a-f0-9]{40}$/.test(args[1])) {
+    throw new Error('explicit_head_sha_required');
+  }
+  const sha = args[1], repository = process.env.GITHUB_REPOSITORY;
+  const author = expectedAuthor(sha, repository);
+  const tree = github(`repos/${repository}/git/commits/${sha}`).tree.sha;
+  if (command('git', ['rev-parse', 'HEAD^{tree}']) !== tree) throw new Error('checkout_tree_mismatch');
+  let status;
+  for (let attempt = 0; attempt <= 6; attempt += 1) {
+    // The combined /status summary omits creator; full records authenticate the issuer.
+    const statuses = github(`repos/${repository}/commits/${sha}/statuses?per_page=100`);
+    status = statuses.find(item => item.context === CONTEXT);
+    if (status || attempt === 6) break;
+    await new Promise(resolve => setTimeout(resolve, 5000));
+  }
+  verifyStatus(status, tree, author);
+  console.log(JSON.stringify({ ok: true, result: 'local_validation_verified', head_sha: sha, tree_sha: tree }));
+}
+
+async function main() {
+  const [operation, ...args] = process.argv.slice(2);
+  const actions = { run, check, publish, verify };
+  if (!Object.hasOwn(actions, operation)) throw new Error('run_check_publish_or_verify_required');
+  await actions[operation](args);
+}
+
+main().catch(error => {
+  const code = /^[a-z][a-z0-9_]+$/.test(error.message) ? error.message : 'invalid_local_validation_input';
+  console.error(`local_validation_refused: ${code}`);
+  process.exitCode = 1;
+});

package/action/scripts/local_validation_core.cjs

@@ -0,0 +1,84 @@
+const { createHash } = require('node:crypto');
+const { execFileSync } = require('node:child_process');
+const { readFileSync } = require('node:fs');
+
+const SCHEMA = 'gowalk-cicd/local-validation.v1';
+const CONTEXT = 'local-validation';
+
+function command(program, args) {
+  try {
+    return execFileSync(program, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 15000 }).trim();
+  }
+  catch { throw new Error(`${program}_command_failed`); }
+}
+
+function repositoryFromRemote(remote, ssh = args => command('ssh', args)) {
+  const https = remote.match(/^https:\/\/github\.com\/([\w.-]+\/[\w.-]+?)(?:\.git)?$/);
+  if (https) return https[1];
+  const scp = remote.match(/^(?:([\w.-]+)@)?([A-Za-z0-9][\w.-]*):([\w.-]+\/[\w.-]+?)(?:\.git)?$/);
+  const url = remote.match(/^ssh:\/\/(?:([\w.-]+)@)?([A-Za-z0-9][\w.-]*)(?::(22))?\/([\w.-]+\/[\w.-]+?)(?:\.git)?$/);
+  const [user, host, repository] = scp ? scp.slice(1) : url ? [url[1], url[2], url[4]] : [];
+  if (!repository) throw new Error('github_repository_required');
+  if (host === 'github.com' && user === 'git') return repository;
+  const config = Object.fromEntries(ssh(['-G', ...(user ? ['-l', user] : []), host])
+    .split('\n').map(line => line.trim().split(/\s+/, 2)));
+  if (config.hostname !== 'github.com' || config.user !== 'git' || config.port !== '22') {
+    throw new Error('github_repository_required');
+  }
+  return repository;
+}
+
+function identity() {
+  const repository = repositoryFromRemote(command('git', ['remote', 'get-url', 'origin']));
+  if (command('git', ['status', '--porcelain'])) throw new Error('clean_checkout_required');
+  return { repository, head_sha: command('git', ['rev-parse', 'HEAD']),
+    tree_sha: command('git', ['rev-parse', 'HEAD^{tree}']) };
+}
+
+function readReceipt(path) {
+  const receipt = JSON.parse(readFileSync(path, 'utf8'));
+  if (receipt.schema !== SCHEMA || !/^[\w.-]+\/[\w.-]+$/.test(receipt.repository)
+      || !/^[a-f0-9]{40}$/.test(receipt.head_sha) || !/^[a-f0-9]{40}$/.test(receipt.tree_sha)
+      || !/^[a-f0-9]{64}$/.test(receipt.command_sha256)) throw new Error('invalid_local_validation_receipt');
+  return receipt;
+}
+
+function sameSource(receipt, source) {
+  for (const field of ['repository', 'head_sha', 'tree_sha']) {
+    if (receipt[field] !== source[field]) throw new Error('local_validation_source_changed');
+  }
+}
+
+function github(path, fields = {}) {
+  const args = ['api', path];
+  for (const [key, value] of Object.entries(fields)) args.push('-f', `${key}=${value}`);
+  return JSON.parse(command('gh', args));
+}
+
+function expectedAuthor(sha, repository, event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'))) {
+  if (process.env.GITHUB_REPOSITORY !== repository) throw new Error('repository_mismatch');
+  if (event.pull_request) {
+    const pr = event.pull_request;
+    if (pr.head.repo.full_name !== repository || pr.head.sha !== sha) throw new Error('same_repository_head_required');
+    return pr.user.login;
+  }
+  if (process.env.GITHUB_EVENT_NAME === 'workflow_dispatch') {
+    if (process.env.GITHUB_SHA !== sha || event.repository?.full_name !== repository) {
+      throw new Error('dispatch_head_required');
+    }
+    return event.sender.login;
+  }
+  if (event.after !== sha || process.env.GITHUB_SHA !== sha) throw new Error('push_head_required');
+  return event.sender.login;
+}
+
+function verifyStatus(status, tree, author) {
+  if (!status || status.state !== 'success' || status.creator?.login !== author
+      || !new RegExp(`^v1:${tree}:[a-f0-9]{64}$`).test(status.description)) {
+    throw new Error('successful_author_local_validation_required');
+  }
+}
+
+module.exports = { SCHEMA, CONTEXT, command, repositoryFromRemote, identity, readReceipt, sameSource,
+  github, expectedAuthor, verifyStatus,
+  digest: args => createHash('sha256').update(JSON.stringify(args)).digest('hex') };

package/android-action/action.yml

@@ -25,11 +25,9 @@ inputs:
     required: false
     default: ""
   run-tests:
-    description: >-
-      Run the project's analyzer and unit tests before the release build
-      (flutter analyze + flutter test, or the Gradle module's unit tests)
+    description: DEPRECATED (ignored). Tests and analysis run locally, never in GitHub Actions.
     required: false
-    default: "true"
+    default: "false"
   dart-defines:
     description: >-
       Compile-time Dart defines for a Flutter app, one `KEY=VALUE` per line
@@ -110,23 +108,6 @@ runs:
       shell: bash
       run: flutter pub get
 
-    - name: Analyze Flutter app
-      if: ${{ steps.config.outputs.project_kind == 'flutter' && inputs.run-tests == 'true' }}
-      shell: bash
-      run: flutter analyze
-
-    # `flutter test` hard-fails with "Test directory \"test\" not found" when a repo
-    # has no tests, which is not a real failure. Skip instead of blowing up the deploy.
-    - name: Test Flutter app
-      if: ${{ steps.config.outputs.project_kind == 'flutter' && inputs.run-tests == 'true' }}
-      shell: bash
-      run: |
-        if [ -d test ]; then
-          flutter test --no-pub
-        else
-          echo "No test/ directory; skipping flutter test."
-        fi
-
     # Dart obfuscation is mandatory for Flutter apps: every release build is
     # compiled with --obfuscate, and there is deliberately no input or repo
     # variable that switches it off. --split-debug-info is not optional
@@ -217,20 +198,6 @@ runs:
     # additionally overrides them through the Variant API so the resolved
     # versionCode holds even when there is no literal — see
     # scripts/version_override.init.gradle.
-    # `test` is the aggregate task ("Run unit tests for all variants") and is the
-    # only one guaranteed to exist: AGP only creates testXUnitTest tasks for the
-    # variants it enables, and AGP 9 disables the release unit test variant by
-    # default, so `:app:testReleaseUnitTest` is simply absent in many projects.
-    # Running it unqualified also mirrors `flutter test`, which covers the whole
-    # package rather than one module.
-    - name: Test Android app
-      if: ${{ steps.config.outputs.project_kind == 'gradle' && inputs.run-tests == 'true' }}
-      shell: bash
-      working-directory: ${{ steps.config.outputs.gradle_root || '.' }}
-      run: |
-        chmod +x ./gradlew
-        ./gradlew test --console=plain --stacktrace
-
     # ANDROID_BUILD_NUMBER is already in the environment: resolve_android.py
     # exported it through GITHUB_ENV. ANDROID_BUILD_NAME is only set when the
     # caller actually pinned a build-name — empty means "leave versionName

package/bin/cli.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 const __filename = fileURLToPath(import.meta.url);
@@ -8,6 +9,11 @@ const __dirname = dirname(__filename);
 const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
 
 const args = process.argv.slice(2);
+if (args[0] === 'validate') {
+  const helper = join(__dirname, '../action/scripts/local_validation.cjs');
+  const result = spawnSync(process.execPath, [helper, ...args.slice(1)], { stdio: 'inherit' });
+  process.exit(result.status ?? 1);
+}
 if (args[0] === 'release') {
   const platform = args[1] || 'both';
   if (args.length > 2 || !['ios', 'android', 'both'].includes(platform)) {
@@ -51,6 +57,7 @@ What it writes:
 
 Options:
   release [ios|android|both]  Prepare a mobile release intent on the task branch
+  validate run|check|publish|verify  Run local focused checks or verify their authenticated source receipt
   --dry-run        Print what would happen without writing files
   -v, --version    Show version number
   -h, --help       Show this help message

package/docs/CI_PERFORMANCE.md

@@ -1,7 +1,7 @@
 # Native validation and delivery time
 
-Keep routine push-to-verified delivery within 2–5 minutes. Preserve every required check and
-coverage assertion. Measure regressions and fix the slow stage in the same task; lowering a
+Keep routine push-to-verified delivery within 2–5 minutes. Preserve required delivery checks and
+verify the local candidate evidence. Measure regressions and fix the slow stage in the same task; lowering a
 timeout, skipping a failed test or calling a transferred binary production-ready is not a fix.
 Cold toolchain setup and provider processing are recorded separately; neither is hidden from
 total wall time or billed runner time. Compile one frozen candidate and promote its verified
@@ -37,61 +37,17 @@ version and all helper hashes, writes `DEST/release.json`, and outputs `scripts`
 `version`, and `integrity`. Scripts retain their package-relative directory layout. Neither mode
 reads credentials or connects to a store. The receipt schema is `gowalk-cicd/native-tooling.v1`.
 
-## Reuse native checks only with positive proof
-
-The application owns a reviewed JSON configuration, normally `.factory/native-validation.json`:
-
-```json
-{
-  "schema": 1,
-  "input_paths": ["Sources", "Resources", "Tests", "UITests", "project.yml", "App.xcodeproj"],
-  "workflow": ".github/workflows/ios-ci.yml",
-  "jobs": [{"name": "Native tests", "steps": ["Run all native tests", "Verify full coverage"]}],
-  "context_keys": ["package_version", "package_integrity", "xcode", "sdk", "devices", "backend"],
-  "external_context_keys": ["backend"]
-}
-```
-
-Use `input_paths: ["."]` for unknown project layouts; include every source, test, asset, script,
-lockfile, configuration and resource consumed by a reviewed narrower suite. `.github/`, the
-validated configuration and receipt helper bytes always participate. Symlinks, submodules and
-dirty selected inputs cannot establish reusable proof. Generated temporary configurations are
-supported; their canonical contents participate just like a committed configuration.
-
-Pass `NATIVE_VALIDATION_CONTEXT` as a JSON object whose keys match `context_keys`, with nonempty
-string values read from actual execution state. Include the resolved package version/integrity,
-full selected Xcode build, SDK/runtime, device matrix and consumed variables. A floating runner
-label is not a toolchain identity; describe the actual Mac before lookup when necessary.
-
-Every external key requires a fresh `sha256:<64 hex characters>` witness for the exact backend
-deployment/flow revision or canonical relevant response. An origin URL is not an external-state
-witness. Missing proof means full validation. For suites with inherently changing external data,
-run those integration checks afresh outside the reusable portion. Unknown custom scripts or
-undeclared network dependencies keep full coverage; never guess that they are unchanged.
-
-```bash
-node "$SCRIPTS/native_validation.cjs" lookup .factory/native-validation.json
-# After every declared test and coverage check succeeded:
-node "$SCRIPTS/native_validation.cjs" record .factory/native-validation.json
-```
-
-`lookup` needs repository `actions:read`, `GITHUB_TOKEN`, and a checkout containing the prior
-producer commit. Its outputs are `reused`, `reuse-reason`, `fingerprint`, `artifact-name` and,
-on a hit, `source-run`/`source-sha`. Missing external context returns a miss without a fingerprint.
-No completed match or unavailable API proof runs full coverage immediately; it never waits for
-another workflow. Missing local producer history is also a safe miss.
-
-`record` runs inside the producing job after tests, writing `receipt-path` and `artifact-name`.
-Retain that single `native-validation.json` with the pinned `actions/upload-artifact`, seven-day
-retention and the existing artifact process scope. For matrix suites, a collector records only
-after verifying every shard; configure every exact required job and successful step. A later
-lookup verifies the completed successful same-repository run, matching workflow, every named
-job/step, immutable artifact digest and an independently recomputed producer source tree. The
-receipt contains hashes and run identity, never context values or credentials.
-
-Keep the existing required `task/**` push check. A cheap admission may reuse prior success only
-under this proof; its required final check must require either that proof or successful fresh
-coverage. Do not replace the required push check with an unrelated PR merge-ref status.
+## Validate locally, verify the source receipt in Actions
+
+Automated tests never run in GitHub Actions, including self-hosted jobs. Run only impacted checks
+in the owned workspace and publish an authenticated receipt for the frozen clean candidate.
+[Local validation](LOCAL_VALIDATION.md) defines the `gowalk-cicd validate` commands and proof.
+Actions verifies that source proof and keeps build, signing, artifact, upload and health checks.
+Existing custom app workflows require explicit migration: the installer does not infer which
+parts of an arbitrary shell script are tests or rewrite mixed build/test execution blindly.
+The older native-validation artifact reuse helpers remain for compatibility; they do not authorize
+new test execution in Actions. Preserve required check names while replacing their execution with
+local proof verification, and describe that behavior honestly in the job steps.
 
 ## Cache work is part of delivery cost
 

package/docs/LOCAL_VALIDATION.md

@@ -0,0 +1,61 @@
+# Local validation and Actions integrity
+
+Automated tests run in the owned workspace, never in GitHub Actions, including self-hosted
+jobs. Select only the focused checks affected by the change. Do not repeat a full regression
+on every push, on merge, or before publication. Actions still builds, signs, uploads, checks
+artifacts and verifies deployment health; those operations are not automated test suites.
+
+Commit the complete candidate first. Use a durable receipt path outside the checkout:
+
+```bash
+npx --yes gowalk-cicd@1.0.186 validate run --receipt "$TASK_OUTPUT/local-validation.json" -- \
+  node --test test/changed-behavior.test.mjs
+npx --yes gowalk-cicd@1.0.186 validate check --receipt "$TASK_OUTPUT/local-validation.json" --sha "$HEAD_SHA"
+git push origin HEAD
+npx --yes gowalk-cicd@1.0.186 validate publish --receipt "$TASK_OUTPUT/local-validation.json"
+```
+
+`TASK_OUTPUT` is task-owned durable storage; `HEAD_SHA` is the candidate's `git rev-parse HEAD`.
+The local command is executed directly, with the supplied arguments. Use the project's existing
+focused runner when several checks belong together. `run` refuses Actions and a dirty checkout,
+removes an old receipt at that path, and writes a new one only after the command exits successfully
+and HEAD, repository, tree and checkout cleanliness remain unchanged. `check` verifies that result
+without executing commands or contacting GitHub. `publish` checks it again, reads the remote commit
+tree and posts an authenticated `local-validation` commit status. GitHub authentication uses `gh`.
+
+The receipt schema is `gowalk-cicd/local-validation.v1`, with `repository`, `head_sha`, `tree_sha`
+and `command_sha256`. The command digest is SHA-256 of the actual argument vector encoded as JSON.
+The full committed tree includes dependency lockfiles and configuration. This proof does not claim
+to describe untracked installed dependencies or the whole local machine. The status description is
+`v1:<tree SHA-1>:<command SHA-256>`; receipts and statuses contain no command text or child logs.
+
+Actions verifies the explicitly selected head, using the helper vendored by the installer:
+
+```yaml
+permissions:
+  contents: read
+  statuses: read
+steps:
+  - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+  - name: Verify local candidate validation
+    env:
+      GH_TOKEN: ${{ github.token }}
+      VALIDATION_HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
+    run: node .github/actions/swift-app/scripts/local_validation.cjs verify --sha "$VALIDATION_HEAD"
+```
+
+`verify` executes no tests. A PR requires same-repository head identity and a successful status
+issued by its author; a push requires its exact event SHA and sender. Manual workflow dispatch verifies
+the selected repository, explicit SHA against `GITHUB_SHA`, and the dispatch sender. The checked-out tree must equal
+that head's tree, including on a PR merge ref. If main advanced and changed the merge tree, update
+the task branch and validate the new candidate locally. Missing, failed, wrong-author or mismatched
+proof refuses. A missing status gets six five-second retries for publication immediately after push.
+
+The CLI also accepts `gowalk-cicd validate verify --sha ...`. The installed script and its sibling
+`local_validation_core.cjs` avoid fetching another package in app jobs. Legacy composite inputs
+`run-tests`, `test-command` and `test-destination` are accepted but ignored; composites execute no tests.
+Custom app workflows and required status names need explicit migration. The installer preserves
+unknown app-authored execution rather than guessing how to split an arbitrary mixed build/test script.
+
+For this package, `pr.yml` verifies local proof, release version and the npm archive. Main publication
+packages and publishes that checked artifact without npm lifecycle hooks or a repeated regression.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.185",
+  "version": "1.0.186",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {
@@ -42,7 +42,8 @@
     "docs/BACKEND_SSH_GATE.md",
     "docs/BACKEND_NATIVE.md",
     "docs/CONFIGURATION.md",
-    "docs/CI_PERFORMANCE.md"
+    "docs/CI_PERFORMANCE.md",
+    "docs/LOCAL_VALIDATION.md"
   ],
   "keywords": [
     "ios",