gowalk-cicd 1.0.201 → 1.0.203

package/docs/CONFIGURATION.md

@@ -38,7 +38,6 @@ backend:
   runtime-env: ${{ secrets.BACKEND_RUNTIME_ENV }}
   public-base-url: ${{ vars.BACKEND_PUBLIC_BASE_URL }}
   public-health-url: ${{ vars.BACKEND_PUBLIC_HEALTH_URL }}
-  expected-build-sha: ${{ vars.BACKEND_PUBLIC_HEALTH_URL && github.sha || '' }}
   ingress-required: ${{ vars.BACKEND_INGRESS_REQUIRED || 'false' }}
   ingress-token: ${{ secrets.BACKEND_INGRESS_TOKEN }}
 workflows:
@@ -52,6 +51,12 @@ until the app explicitly replaces their references in this file. Keep passwords,
 signing material, tokens and private keys in GitHub Secrets. Reference their names;
 never put their values in this configuration.
 
+Leave `backend.expected-build-sha` omitted to inherit the managed operation-aware default:
+network diagnostics uses the explicit `diagnostic-build-sha`, while deployment uses its source SHA.
+Upgrades remove only the former generated setting
+`${{ vars.BACKEND_PUBLIC_HEALTH_URL && github.sha || '' }}`, which otherwise overrides the diagnostic
+input. Custom build expressions remain unchanged; callers must supply the observed deployed SHA.
+
 Backend discovery accepts `compose.yaml`, `compose.yml`, `docker-compose.yaml` and
 `docker-compose.yml` inside `backend/` or `server/`, or at the repository root with a Dockerfile in
 exactly one of those source directories. Multiple matches require an explicit selection; no file is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.201",
+  "version": "1.0.203",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/config/build-steps.mjs

@@ -1,5 +1,8 @@
 // Reviewed build-only recipes. Names alone never authorize candidate execution.
-const RUBY = 'ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b';
+const RUBY = new Set([
+  'ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b',
+  'ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8',
+]);
 // The optional grep drops beta and release-candidate Xcodes, whose builds App Store Connect refuses.
 const XCODE = /^XCODE_PATH=\$\(ls -d \/Applications\/Xcode_\d+\*\.app (?:\| grep -viE 'beta\|release_candidate\|_rc' )?\| sort -V \| tail -1\)\n/;
 const XCODE_END = 'sudo xcode-select -s "$XCODE_PATH/Contents/Developer"\nxcodebuild -version\nswift --version\n';
@@ -13,9 +16,10 @@ const SDK = /^\s*"\$ANDROID_HOME\/cmdline-tools\/latest\/bin\/sdkmanager" 'platf
 export function reviewedBuildStep(step) {
   const allowed = ['name', 'id', 'uses', 'with', 'run', 'if', 'shell'];
   if (!step || Object.keys(step).some(key => !allowed.includes(key))) return false;
-  if (step.uses === RUBY && !step.run) {
+  if (RUBY.has(step.uses) && !step.run) {
     return Object.entries(step.with || {}).every(([key, value]) =>
-      ['ruby-version', 'bundler'].includes(key) && /^\d+(?:\.\d+){0,2}$/.test(String(value)));
+      key === 'bundler-cache' ? value === false
+        : ['ruby-version', 'bundler'].includes(key) && /^\d+(?:\.\d+){0,2}$/.test(String(value)));
   }
   if (step.uses || step.with || step.shell && step.shell !== 'bash' || typeof step.run !== 'string') return false;
   return XCODE.test(step.run) && step.run.replace(XCODE, '') === XCODE_END

package/src/config/settings.mjs

@@ -31,7 +31,14 @@ export function extractSettings(config, file, workflow) {
   }
 }
 
-export function applySettings(config, file, workflow) {
+export function applySettings(config, file, workflow, defaults) {
+  if (file === 'deploy-backend.yml'
+      && config.backend?.['expected-build-sha'] === "${{ vars.BACKEND_PUBLIC_HEALTH_URL && github.sha || '' }}") {
+    // Former generated default masks the diagnostic build input after a configured upgrade.
+    delete config.backend['expected-build-sha'];
+    const path = [...backend, 'expected-build-sha'];
+    assign(workflow, { path, value: at(defaults, path) });
+  }
   for (const { name, path } of settingsPaths(file)) {
     const value = at(config, name);
     if (value !== undefined) assign(workflow, { path, value });

package/src/config/workflows.mjs

@@ -67,7 +67,7 @@ function upgradeWorkflow(root, file, templateDir, state) {
     result = mergeChanges(base.value, current, state.config.workflows[file]?.overrides || [], file);
   }
   if (state.migrating) extractSettings(state.config, file, result);
-  result = applySettings(state.config, file, result);
+  result = applySettings(state.config, file, result, current);
   const options = settingsPaths(file);
   const overrides = differences(current, result)
     .filter(change => !options.some(({ path }) => equal(path, change.path)));