gowalk-cicd 1.0.19 → 1.0.21

package/README.md

@@ -103,6 +103,26 @@ in Play Console; every later run detects API readiness and uploads to the
 `internal` track automatically. Override the track or status with repository
 variables `GOOGLE_PLAY_TRACK` and `GOOGLE_PLAY_STATUS`.
 
+### Google Play upload retry
+
+A Play edit is a short-lived server-side object, and an AAB upload that runs
+long enough outlives one:
+
+```
+##[error]This edit has expired, please create a new Edit.
+##[error]This Edit has been deleted.
+```
+
+Neither says anything about the build, which is signed and retained by that
+point. The upload step therefore runs with `continue-on-error` and a second
+attempt follows when the first fails — a fresh edit succeeds. Both attempts
+failing still fails the job.
+
+One caveat this makes explicit: **nothing else should hold an edit open on the
+same package while a deploy runs.** A script that polls `edits.insert` /
+`edits.delete` to inspect track state will invalidate the edit the upload is
+using, and the deploy fails for a reason that has nothing to do with the app.
+
 ### Runner disk space
 
 An `ubuntu-24.04` runner leaves roughly 14 GB free on `/`, and a release Flutter
@@ -143,8 +163,13 @@ the token lives in one revocable place:
 gh secret set GIT_PRIVATE_TOKEN --repo my-org/my-app
 ```
 
-Without the secret the step is skipped, so repos that do not need it are
-unaffected.
+Without the secret the step prints a note and exits 0, so repos that do not need
+it are unaffected.
+
+> The emptiness check happens in the shell rather than in the step's `if:`.
+> GitHub does not expose the `secrets` context to a step-level `if:` — putting
+> it there does not evaluate to false, it makes the entire workflow file invalid
+> and every run fails before any job starts.
 
 ### Localized release notes
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.19
+1.0.21

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.19
+1.0.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.19",
+  "version": "1.0.21",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -166,14 +166,23 @@ jobs:
       # https://github.com/<org>/<repo>.git URLs resolve on the runner, so the
       # token lives in one revocable place. No secret, no step — repos that do
       # not need it are unaffected.
+      # The `secrets` context is NOT available in a step-level `if:` — using it
+      # there does not evaluate false, it makes the whole workflow file invalid
+      # and every run fails before any job starts. So the secret comes in as env
+      # and the emptiness check happens in the shell.
       - name: Authenticate private git dependencies
-        if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' && secrets.GIT_PRIVATE_TOKEN != '' }}
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
         shell: bash
         env:
           GIT_PRIVATE_TOKEN: ${{ secrets.GIT_PRIVATE_TOKEN }}
         run: |
-          git config --global url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+          if [ -z "${GIT_PRIVATE_TOKEN:-}" ]; then
+            echo "No GIT_PRIVATE_TOKEN secret; private git dependencies must carry their own credentials."
+            exit 0
+          fi
           echo "::add-mask::$GIT_PRIVATE_TOKEN"
+          git config --global url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+          echo "Configured authenticated github.com remotes for pub."
       # Same reason as the iOS job: apps using AppLocalizations must generate it
       # before anything analyses or compiles them. No-op for apps without l10n.
       - name: Generate localizations
@@ -217,7 +226,18 @@ jobs:
           python3 .github/actions/android-app/scripts/play_preflight.py \
             --package "$PACKAGE_NAME" \
             --service-account "$SERVICE_ACCOUNT"
+      # Play edits are short-lived server-side objects, and an AAB upload that runs
+      # long — a 100-200 MB bundle, a slow runner, or anything else holding an edit
+      # open on the same package — outlives one. The failures read as
+      # "This edit has expired, please create a new Edit." or "This Edit has been
+      # deleted." Neither says anything about the build, which is already signed and
+      # retained by this point; a second attempt opens a fresh edit and succeeds.
+      # Note this also means nothing else should be creating edits against these
+      # packages while a deploy runs — an external poller that opens and deletes an
+      # edit will invalidate the one this step is holding.
       - name: Upload Android release to Google Play
+        id: play-upload
+        continue-on-error: true
         if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' }}
         uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
         with:
@@ -234,3 +254,15 @@ jobs:
           # files (e.g. whatsnew-en-US, whatsnew-de-DE) and they ship with every
           # release. Empty when the directory is absent — the action skips it.
           whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
+
+      - name: Retry Google Play upload
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' && steps.play-upload.outcome == 'failure' }}
+        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
+        with:
+          serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
+          packageName: ${{ steps.android.outputs.package-name }}
+          releaseFiles: ${{ steps.android.outputs.bundle-path }}
+          tracks: ${{ vars.GOOGLE_PLAY_TRACK || 'internal' }}
+          status: ${{ vars.GOOGLE_PLAY_STATUS || 'completed' }}
+          userFraction: ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
+          whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}