gowalk-cicd 1.0.198 → 1.0.200

package/README.md

@@ -23,6 +23,10 @@ From the root of your app repo:
 npx --yes gowalk-cicd
 ```
 
+To update only backend delivery while preserving mobile tooling and workflows, use
+`npx --yes gowalk-cicd --backend-only`. The lock records the backend release separately;
+see [scoped installation](docs/CONFIGURATION.md).
+
 Writes three core things into your repo:
 
 - `.github/actions/swift-app/` — the vendored composite action (action.yml + scripts)
@@ -374,6 +378,9 @@ Place these files under `creds/`:
    keyPassword=<upload key password>
    ```
 
+   A relative `storeFile` resolves beside this file; when no keystore is there,
+   it resolves from the repository root (`creds/android-upload-key.jks`).
+
 3. One Google service-account JSON key. Its filename is unrestricted
    (`Gowalk.json` is valid); the action identifies it by the
    `type: service_account` JSON fields.

package/android-action/scripts/android_config.py

@@ -86,6 +86,9 @@ def find_signing_config(workspace: Path) -> SigningConfig:
     if configured_store:
         raw_path = Path(configured_store).expanduser()
         keystore = raw_path if raw_path.is_absolute() else properties.parent / raw_path
+        if not raw_path.is_absolute() and not keystore.is_file() and (workspace / raw_path).is_file():
+            # Provisioned properties may name the keystore from the checkout root (creds/<file>).
+            keystore = workspace / raw_path
     else:
         keystore = _single(
             sorted([*creds.glob("*.jks"), *creds.glob("*.keystore")]),

package/bin/cli.mjs

@@ -31,6 +31,7 @@ if (args[0] === 'release') {
   }
 }
 let dryRun = false;
+let backendOnly = false;
 
 for (const arg of args) {
   switch (arg) {
@@ -59,6 +60,7 @@ Options:
   release [ios|android|both]  Prepare a mobile release intent on the task branch
   validate run|check|publish|verify  Run local focused checks or verify their authenticated source receipt
   --dry-run        Print what would happen without writing files
+  --backend-only   Update backend tooling without changing mobile tooling or workflows
   -v, --version    Show version number
   -h, --help       Show this help message
 
@@ -75,6 +77,9 @@ After install:
     case '--dry-run':
       dryRun = true;
       break;
+    case '--backend-only':
+      backendOnly = true;
+      break;
     default:
       console.error(`Unknown option: ${arg}`);
       console.error(`Run with --help for usage.`);
@@ -84,7 +89,7 @@ After install:
 
 const { runInstall } = await import('../src/install.mjs');
 try {
-  await runInstall({ dryRun });
+  await runInstall({ dryRun, backendOnly });
 } catch (error) {
   console.error(JSON.stringify(error.result || {
     schema: 'gowalk-cicd/migration-repair.v1', code: 'installer_unavailable',

package/docs/CONFIGURATION.md

@@ -5,6 +5,23 @@ extracts supported settings from existing workflows into `.gowalk-cicd.yml` and
 renders the managed workflows in the same change. Later upgrades read that file.
 The installer does this locally; app CI gains no configuration job or preflight.
 
+For backend-only work in a repository whose mobile tooling must stay unchanged, run
+`npx --yes gowalk-cicd@<version> --backend-only` (also accepts `--dry-run`). It updates only
+`.github/actions/backend-app/`, `deploy-backend.yml` and their configuration/lock state.
+Mobile actions, workflows, validation workflows and release intents retain their exact bytes.
+Existing backend settings and workflow overrides are preserved by the normal migration rules.
+The separate backend deploy still follows its existing protected merge and push trigger.
+
+For this scoped installation, `.gowalk-cicd.lock.json` records `backend_package`; `package`
+continues to name the last full installation. Verify `backend_package` (or `package` after a
+full install), the backend action's `.daemux-version`, the published package integrity and the
+installed backend bytes. A scoped backend upgrade makes no claim that mobile tooling is current.
+The next full installation updates all tooling and removes the scoped version override.
+Repositories with existing managed mobile workflows require their existing `.gowalk-cicd.yml`
+configuration before scoped installation; it never partially migrates an unconfigured mobile
+installation. An interrupted full installation also refuses a backend-only retry, preserving
+its journal instead of applying mobile writes outside the requested scope.
+
 ```yaml
 schema: 1
 mobile:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.198",
+  "version": "1.0.200",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/config/transaction.mjs

@@ -44,7 +44,7 @@ function apply(root, writes, dryRun) {
   if (!dryRun) unlinkSync(join(root, JOURNAL));
 }
 
-export function recoverWorkflows(root, dryRun) {
+export function recoverWorkflows(root, dryRun, { backendOnly = false } = {}) {
   if (!existsSync(join(root, JOURNAL))) return false;
   let journal;
   try { journal = JSON.parse(readFileSync(join(root, JOURNAL), 'utf8')); }
@@ -52,14 +52,18 @@ export function recoverWorkflows(root, dryRun) {
   if (journal.schema !== 1 || !Array.isArray(journal.writes)) {
     throw new MigrationRepair('invalid_pending_migration', JOURNAL);
   }
+  if (backendOnly && journal.scope !== 'backend') {
+    throw new MigrationRepair('pending_migration_scope_mismatch', JOURNAL);
+  }
   apply(root, journal.writes, dryRun);
   return true;
 }
 
-export function writeWorkflows(root, writes, dryRun) {
+export function writeWorkflows(root, writes, dryRun, { backendOnly = false } = {}) {
   if (!writes.length) return;
   const planned = writes.map(write => ({ ...write, before: current(join(root, write.file)) }));
   for (const write of planned) validate(root, write);
-  if (!dryRun) atomicWrite(join(root, JOURNAL), JSON.stringify({ schema: 1, writes: planned }));
+  if (!dryRun) atomicWrite(join(root, JOURNAL), JSON.stringify({ schema: 1,
+    ...(backendOnly ? { scope: 'backend' } : {}), writes: planned }));
   apply(root, planned, dryRun);
 }

package/src/config/workflows.mjs

@@ -80,9 +80,14 @@ function upgradeWorkflow(root, file, templateDir, state) {
   return { file: `.github/workflows/${file}`, content: output };
 }
 
-export function planWorkflows(root, templateDir, files, version) {
+export function planWorkflows(root, templateDir, files, version, { backendOnly = false } = {}) {
   const state = configState(root);
-  const selected = [...new Set([...files, ...Object.keys(state.config.workflows)])];
+  if (backendOnly && state.migrating && MANAGED.some(file => file !== 'deploy-backend.yml'
+      && load(root, `.github/workflows/${file}`) !== null)) {
+    throw new MigrationRepair('backend_scope_requires_existing_config', CONFIG);
+  }
+  const selected = backendOnly ? ['deploy-backend.yml']
+    : [...new Set([...files, ...Object.keys(state.config.workflows)])];
   for (const file of selected) {
     if (!MANAGED.includes(file)) throw new MigrationRepair('unknown_managed_workflow', CONFIG);
   }
@@ -113,8 +118,12 @@ export function planWorkflows(root, templateDir, files, version) {
   for (const [file, entry] of Object.entries(workflows)) {
     for (const change of entry.overrides) assertReferences(change.value, file, change.path);
   }
-  writes.push(...planValidation(root, [...selected, WARM, RECOVERY]));
-  state.lock.package = version;
+  if (backendOnly) state.lock.backend_package = version;
+  else {
+    writes.push(...planValidation(root, [...selected, WARM, RECOVERY]));
+    state.lock.package = version;
+    delete state.lock.backend_package;
+  }
   const config = state.text && equal(readYaml(state.text, CONFIG).value, state.config)
     ? state.text
     : '# App-owned settings. Edit this file, then run gowalk-cicd to render workflows.\n' + encode(state.config);

package/src/install.mjs

@@ -23,6 +23,7 @@ import { dirname } from 'node:path';
 import { planWorkflows, writeWorkflows } from './config/workflows.mjs';
 import { recoverWorkflows } from './config/transaction.mjs';
 import { backendLayout } from './backend-layout.mjs';
+import { MigrationRepair } from './config/yaml.mjs';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -201,32 +202,38 @@ function printSummary() {
   console.log('  npx --yes gowalk-cicd');
 }
 
-export async function runInstall({ dryRun = false } = {}) {
+export async function runInstall({ dryRun = false, backendOnly = false } = {}) {
   const repoRoot = findRepoRoot(process.cwd());
   console.log(`Installing gowalk-cicd into ${repoRoot}${dryRun ? ' (dry-run)' : ''}`);
   console.log('');
-  if (recoverWorkflows(repoRoot, dryRun) && dryRun) return;
+  if (recoverWorkflows(repoRoot, dryRun, { backendOnly }) && dryRun) return;
 
   const layout = backendLayout(repoRoot);
+  if (backendOnly && !layout && !existsSync(join(repoRoot, BACKEND_ACTION_DEST_REL))
+      && !existsSync(join(repoRoot, '.github/workflows/deploy-backend.yml'))) {
+    throw new MigrationRepair('backend_layout_missing', '.github/workflows/deploy-backend.yml');
+  }
   // deploy-web.yml is no longer added; an existing one is upgraded, or removed
   // when it is still the unmodified generated file (planWorkflows).
-  const files = ['deploy.yml', 'mobile-candidate.yml'];
-  if (layout || existsSync(join(repoRoot, BACKEND_ACTION_DEST_REL))) files.push('deploy-backend.yml');
+  const files = backendOnly ? ['deploy-backend.yml'] : ['deploy.yml', 'mobile-candidate.yml'];
+  if (!backendOnly && (layout || existsSync(join(repoRoot, BACKEND_ACTION_DEST_REL)))) files.push('deploy-backend.yml');
   for (const file of ['deploy-web.yml', 'deploy-backend.yml']) {
-    if (existsSync(join(repoRoot, '.github/workflows', file)) && !files.includes(file)) files.push(file);
+    if (!backendOnly && existsSync(join(repoRoot, '.github/workflows', file)) && !files.includes(file)) files.push(file);
   }
   const version = String(JSON.parse(readFileSync(PACKAGE_JSON, 'utf8')).version);
-  const writes = planWorkflows(repoRoot, join(PACKAGE_DIR, 'templates'), files, version);
+  const writes = planWorkflows(repoRoot, join(PACKAGE_DIR, 'templates'), files, version, { backendOnly });
   const workflows = workflowText(repoRoot, writes);
 
-  copyAction(ACTION_SRC, ACTION_DEST_REL, repoRoot, dryRun, workflows);
-  copyAction(ANDROID_ACTION_SRC, ANDROID_ACTION_DEST_REL, repoRoot, dryRun, workflows);
-  writeVersionMarkers(repoRoot, dryRun);
+  if (!backendOnly) {
+    copyAction(ACTION_SRC, ACTION_DEST_REL, repoRoot, dryRun, workflows);
+    copyAction(ANDROID_ACTION_SRC, ANDROID_ACTION_DEST_REL, repoRoot, dryRun, workflows);
+    writeVersionMarkers(repoRoot, dryRun);
+  }
   if (files.includes('deploy-backend.yml')) {
     copyAction(BACKEND_ACTION_SRC, BACKEND_ACTION_DEST_REL, repoRoot, dryRun, workflows);
     if (!dryRun) writeFileSync(join(repoRoot, BACKEND_VERSION_MARKER_REL), version);
   }
-  writeWorkflows(repoRoot, writes, dryRun);
+  writeWorkflows(repoRoot, writes, dryRun, { backendOnly });
 
   const gi = checkGitignore(repoRoot);
   printGitignoreWarning(gi);
@@ -237,5 +244,7 @@ export async function runInstall({ dryRun = false } = {}) {
     return;
   }
 
-  printSummary();
+  if (backendOnly) {
+    console.log('\nDone. Backend tooling updated; mobile files and release intents are unchanged.');
+  } else printSummary();
 }