gowalk-cicd 1.0.193 → 1.0.194

package/backend-action/network_host.py

@@ -138,7 +138,7 @@ def vpn_settings(containers, app, service, bridge):
         if row['id'] != identifiers[0] or row['project'] != app or row['service'] != service:
             raise NetworkFailure('network_scope_mismatch')
         added = set(row['cap_add'] or [])
-        allowed = {'NET_ADMIN', 'NET_BIND_SERVICE', 'CHOWN', 'SETUID', 'SETGID'}
+        allowed = {'NET_ADMIN', 'NET_BIND_SERVICE', 'CHOWN', 'SETUID', 'SETGID', 'SETPCAP'}
         safe = (row['privileged'] is False and row['network_mode'] == bridge['name']
                 and 'NET_ADMIN' in added and added.issubset(allowed)
                 and 'ALL' in (row['cap_drop'] or [])

package/backend-action/runtime_projection.py

@@ -3,7 +3,7 @@ import math
 import re
 
 SCHEMA = 'gowalk-cicd/backend-runtime-diagnostics.v1'
-READER_VERSION = '1.0.193'
+READER_VERSION = '1.0.194'
 PROJECT = r'[a-z0-9][a-z0-9-]{0,79}'
 SERVICE = r'[a-z0-9][a-z0-9_-]{0,63}'
 SHA = r'[a-f0-9]{40}'

package/docs/BACKEND_SSH_GATE.md

@@ -130,7 +130,7 @@ socket observations before returning. A changed or ambiguous observation refuses
 - `namespace` reports local rootful Linux Docker, existing host forwarding, read-only XFRM/netfilter
   availability and the selected bridge's observed masquerade rule. Existing VPN settings are observed only
   for this app's exact service. `isolated_net_admin` requires that bridge, no privileged mode, dropping ALL,
-  only NET_ADMIN plus optional NET_BIND_SERVICE/CHOWN/SETUID/SETGID for bootstrap and privilege dropping,
+  only NET_ADMIN plus optional NET_BIND_SERVICE/CHOWN/SETUID/SETGID/SETPCAP for bootstrap and privilege dropping,
   and namespace-only forwarding/redirect settings. This observes grants, not that a daemon actually dropped privileges.
   An absent VPN reports `absent`; these observations do not test creating a namespace or applying capabilities.
 - `firewall` reports observed INPUT/FORWARD policies and explicit UDP ACCEPT rules. Effective ingress

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.193",
+  "version": "1.0.194",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {