gowalk-cicd 1.0.196 → 1.0.198

package/backend-action/action.yml

@@ -306,9 +306,11 @@ runs:
       run: |
         RESULT_DIR="$(mktemp -d "$RUNNER_TEMP/backend-runtime-diagnostics.XXXXXX")"
         echo "result=$RESULT_DIR/result.json" >> "$GITHUB_OUTPUT"
+        echo "transport=$RESULT_DIR/transport.json" >> "$GITHUB_OUTPUT"
         python3 "${{ github.action_path }}/runtime_diagnostics.py" \
           --app "$DIAGNOSTIC_APP" --service "$DIAGNOSTIC_SERVICE" --expected-build-sha "$DIAGNOSTIC_BUILD" \
-          --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER" --output "$RESULT_DIR/result.json"
+          --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER" --output "$RESULT_DIR/result.json" \
+          --transport-output "$RESULT_DIR/transport.json"
 
     - name: Retain scoped backend runtime result
       if: always() && inputs.operation == 'runtime-diagnostics'
@@ -317,7 +319,9 @@ runs:
         NODE_OPTIONS: --require "${{ github.action_path }}/scripts/artifact_env.cjs"
       with:
         name: backend-runtime-diagnostics-${{ github.job }}-${{ github.run_attempt }}
-        path: ${{ steps.runtime_diagnostics.outputs.result }}
+        path: |
+          ${{ steps.runtime_diagnostics.outputs.result }}
+          ${{ steps.runtime_diagnostics.outputs.transport }}
         if-no-files-found: error
 
     - name: Read scoped backend network prerequisites

package/backend-action/identity_diagnostics.py

@@ -40,7 +40,7 @@ class ReaderFailure(Exception):
         super().__init__(self.code)
 
 
-def transfer(selector, process, payload, offset, data):
+def transfer(selector, process, payload, offset, data, errors):
     for key, _ in selector.select(0.1):
         if key.fileobj is process.stdin:
             offset += os.write(process.stdin.fileno(), payload[offset:offset + 4096])
@@ -48,23 +48,27 @@ def transfer(selector, process, payload, offset, data):
                 selector.unregister(process.stdin)
                 process.stdin.close()
         else:
-            chunk = os.read(process.stdout.fileno(), 65536)
+            chunk = os.read(key.fileobj.fileno(), 65536)
             if not chunk:
-                selector.unregister(process.stdout)
-            data.extend(chunk)
-            if len(data) > LIMIT:
+                selector.unregister(key.fileobj)
+            (errors if key.fileobj is process.stderr else data).extend(chunk)
+            if len(data) + len(errors) > LIMIT:
                 raise ReaderFailure('output_limit')
     return offset
 
 
-def bounded(argv, *, payload=None, seconds=30, with_status=False):
+def bounded(argv, *, payload=None, seconds=30, with_status=False, with_stderr=False):
     """Bound output, runtime and owned process cleanup without printing stderr."""
     process = subprocess.Popen(argv, stdin=subprocess.PIPE if payload else subprocess.DEVNULL,
-                               stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, start_new_session=True)
-    deadline, data = time.monotonic() + seconds, bytearray()
+                               stdout=subprocess.PIPE,
+                               stderr=subprocess.PIPE if with_stderr else subprocess.DEVNULL,
+                               start_new_session=True)
+    deadline, data, errors = time.monotonic() + seconds, bytearray(), bytearray()
     try:
         with selectors.DefaultSelector() as selector:
             selector.register(process.stdout, selectors.EVENT_READ)
+            if with_stderr:
+                selector.register(process.stderr, selectors.EVENT_READ)
             if payload:
                 os.set_blocking(process.stdin.fileno(), False)
                 selector.register(process.stdin, selectors.EVENT_WRITE)
@@ -72,12 +76,14 @@ def bounded(argv, *, payload=None, seconds=30, with_status=False):
             while selector.get_map():
                 if time.monotonic() >= deadline:
                     raise ReaderFailure('command_timeout')
-                offset = transfer(selector, process, payload, offset, data)
+                offset = transfer(selector, process, payload, offset, data, errors)
         try:
             status = process.wait(timeout=max(0.01, deadline - time.monotonic()))
         except subprocess.TimeoutExpired:
             raise ReaderFailure('command_timeout') from None
         if with_status:
+            if with_stderr:
+                return status, bytes(data), bytes(errors)
             return status, bytes(data)
         if status:
             raise ReaderFailure('command_failed')
@@ -90,6 +96,8 @@ def bounded(argv, *, payload=None, seconds=30, with_status=False):
             pass
         process.wait(timeout=5)
         process.stdout.close()
+        if process.stderr:
+            process.stderr.close()
         if process.stdin and not process.stdin.closed:
             process.stdin.close()
 

package/backend-action/runtime_diagnostics.py

@@ -3,27 +3,50 @@ import argparse
 import json
 import re
 import shlex
+import sys
 from pathlib import Path
 
 from identity_diagnostics import ReaderFailure, bounded, retain_result
 from runtime_projection import RuntimeFailure, envelope, scope, validate
 
 
-def local(args):
+def transport_signals(status, raw):
+    """Observe fixed SSH failure labels; private stderr never enters a receipt."""
+    lines = raw.decode('utf-8', errors='replace').splitlines()
+    patterns = {
+        1: [('gate_refused', r'backend_ssh_refused')],
+        127: [('remote_command_unavailable',
+               r'(?:/bin/)?(?:bash|sh): (?:(?:line )?\d+: )?gowalk-backend: (?:command )?not found')],
+        255: [
+            ('authentication_refused', r'[^\r\n]+: Permission denied \([a-z,-]+\)\.'),
+            ('host_key_refused', r'Host key verification failed\.'),
+            ('connection_refused', r'ssh: connect to host [^\r\n ]+ port \d+: Connection refused'),
+            ('connection_timeout', r'ssh: connect to host [^\r\n ]+ port \d+: (?:Connection|Operation) timed out'),
+            ('name_resolution_failed', r'ssh: Could not resolve hostname [^\r\n ]+: [^\r\n]+'),
+        ],
+    }
+    return [name for name, pattern in patterns.get(status, [])
+            if any(re.fullmatch(pattern, line) for line in lines)]
+
+
+def local(args, transport=None):
     scope(args.app, args.service, args.expected_build_sha)
     if (not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9.-]{0,252}', args.host or '')
             or not re.fullmatch(r'[a-z_][a-z0-9_-]{0,31}', args.user)):
         raise RuntimeFailure('invalid_scope')
     command = shlex.join(['gowalk-backend', 'runtime-diagnostics', args.app, args.service, args.expected_build_sha])
     try:
-        status, raw = bounded(['ssh', '-T', '-i', str(Path.home() / '.ssh/backend_deploy'),
+        status, raw, errors = bounded(['ssh', '-T', '-i', str(Path.home() / '.ssh/backend_deploy'),
             '-o', 'IdentitiesOnly=yes', '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=yes',
             '-o', 'ConnectTimeout=10', '-o', 'ServerAliveInterval=5', '-o', 'ServerAliveCountMax=2',
-            '-o', 'ClearAllForwardings=yes', args.user + '@' + args.host, command], seconds=75, with_status=True)
+            '-o', 'ClearAllForwardings=yes', args.user + '@' + args.host, command],
+            seconds=75, with_status=True, with_stderr=True)
     except ReaderFailure as error:
         raise RuntimeFailure(error.code) from None
     except OSError:
         raise RuntimeFailure('transport_failure') from None
+    if transport is not None:
+        transport.update(exit_status=status, signals=transport_signals(status, errors))
     if status not in (0, 1):
         raise RuntimeFailure('transport_failure')
     if status == 1 and not raw.strip():
@@ -45,14 +68,22 @@ def main():
     parser.add_argument('--host', required=True)
     parser.add_argument('--user', default='root')
     parser.add_argument('--output', required=True)
+    parser.add_argument('--transport-output', help='Separate closed SSH observation receipt')
     args = parser.parse_args()
+    transport = {'schema': 'gowalk-cicd/backend-runtime-transport.v1', 'exit_status': None, 'signals': []}
     try:
-        result = local(args)
+        result = local(args, transport)
     except Exception as error:
         result = envelope(args.app, args.service, args.expected_build_sha,
                           error.code if isinstance(error, RuntimeFailure) else 'unclassified', reader_version=None)
     try:
         retain_result(args.output, result)
+        if args.transport_output:
+            retain_result(args.transport_output, transport)
+            status = 'unknown' if transport['exit_status'] is None else str(transport['exit_status'])
+            print('::notice title=backend_runtime_transport::schema=' + transport['schema']
+                  + ' exit_status=' + status + ' signals=' + (','.join(transport['signals']) or 'none'),
+                  file=sys.stderr)
     except ReaderFailure:
         result = envelope(args.app, args.service, args.expected_build_sha, 'artifact_write_failed', reader_version=None)
     print(json.dumps(result, separators=(',', ':')))

package/backend-action/runtime_image_health.py

@@ -5,6 +5,7 @@ import re
 import subprocess
 
 from runtime_healthcheck import bounded_tmpfs, cache_healthcheck
+from runtime_model import escape_interpolation
 
 
 def eligible(service):
@@ -17,7 +18,14 @@ def eligible(service):
 def image_health(command, name, service):
     reference = service.get('image')
     if not reference:
-        result = subprocess.run(command + ['config', '--images', name],
+        resolver = list(command)
+        option = next((flag for flag in ('--file', '-f') if flag in resolver), None)
+        if option:
+            resolver[resolver.index(option) + 1] = '-'
+        else:
+            resolver.extend(['--file', '-'])
+        selected = {'services': {name: {'build': '.'}}}
+        result = subprocess.run(resolver + ['config', '--images', name], input=json.dumps(selected),
                                 capture_output=True, text=True, timeout=30, check=True)
         references = result.stdout.split()
         if len(references) != 1:
@@ -44,6 +52,7 @@ def inherit_healthchecks(model, command):
         candidate = copy.deepcopy(service)
         candidate.setdefault('healthcheck', {})['test'] = health['Test']
         if cache_healthcheck(candidate):
+            candidate['healthcheck']['test'] = escape_interpolation(candidate['healthcheck']['test'])
             service['healthcheck'] = candidate['healthcheck']
             service.update(image=image['Id'], pull_policy='never')
             changed = True

package/docs/BACKEND_HEALTHCHECKS.md

@@ -36,6 +36,10 @@ wraps only a missing Compose test, retaining explicit timing and disabled/custom
 launch model pins the transformed service to that inspected image ID with pulling disabled, so a
 moving tag cannot substitute another image's healthcheck. Explicit registry-refresh policies and
 non-build services retain their existing image/pull behavior. No pre-build image healthcheck is reused.
+Imported image commands escape literal dollars once at the Compose boundary, preserving Python
+strings and container-shell expansion without interpreting them against the deployment host environment.
+Default image names resolve from an isolated service model with the same Compose project name;
+dependency images cannot make that selection ambiguous.
 
 ## Adopt an existing API
 

package/docs/BACKEND_SSH_GATE.md

@@ -68,7 +68,7 @@ consumer code or an uploaded script. An older/refusing gate has no reader receip
 `runtime_reader_unavailable`; locally synthesized failures carry `reader_version: null`, never host-adoption proof.
 A collector refusal carries its actual `reader_version` and fixed failure code.
 
-The `backend-runtime-diagnostics-<job>-<attempt>` artifact contains only `result.json`, schema
+The `backend-runtime-diagnostics-<job>-<attempt>` artifact contains `result.json`, schema
 `gowalk-cicd/backend-runtime-diagnostics.v1`. Success binds the expected/observed build to the running API's
 `BUILD_SHA`, enumerates at most 32 exact-project containers (including stopped ones), and rechecks their exact
 project/service/working-directory labels. It returns container and image IDs, effective memory/reservation/CPU/PID
@@ -77,6 +77,18 @@ Docker's display precision. CPU samples are Docker's bounded observations, not a
 collector never launches workload, reads logs, executes in containers or inspects a shared database's cgroup.
 Both container identity/configuration and the private profile are rechecked before returning success.
 
+The same artifact also retains `transport.json`, schema `gowalk-cicd/backend-runtime-transport.v1`.
+Its fixed fields also appear in the brace-free `backend_runtime_transport` notice. It reports the SSH child's
+`exit_status` (null when no complete exit was observed) and fixed `signals`: `gate_refused`,
+`remote_command_unavailable`, `authentication_refused`, `host_key_refused`, `connection_refused`,
+`connection_timeout` or `name_resolution_failed`. Unknown text yields no signal; stderr and remote
+command output never enter this receipt. The original `result.json` schema and failure codes remain
+unchanged. These observations explain a refused read, never attest host reader installation or authorize
+a retry or transport bypass. Exit 127 without the exact command-not-found observation does not prove a
+missing reader; a gate refusal does not identify its policy or ownership cause. Normal backend deployment
+does not install the trusted reader, and an updated workflow client alone cannot repair an unavailable
+host command. Install the published host runtime through the procedure below.
+
 `database.mode: host_profile` with `binding_matches_profile: true` proves this app's root-owned profile supplied
 the API's current private `DATABASE_URL`. `removed_services` describes that profile's applied removals; a remaining
 removed service refuses. `app_service` means the runtime connection names another reported service.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.196",
+  "version": "1.0.198",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {