gowalk-cicd 1.0.202 → 1.0.204

package/README.md

@@ -682,6 +682,13 @@ The action exports `diagnostic-path`; the managed deploy template retains its JS
 template to retain artifacts. Failed evidence validation/storage emits a fixed refusal and fails
 the job without replaying provider work or changing its result.
 
+Explicit panel-provisioned `panel-v2` bindings coordinate through the panel database without Git commits.
+The binding supplies an HTTPS `coordinator_url` ending in `/pub/play-edit`; GitHub OIDC tokens use that exact
+URL as audience. Both mobile workflows require `id-token: write`. Repository tokens never reach the panel.
+Acquisition and release replay one immutable owner identity after a lost reply; release seals delayed
+acquisitions. An unreachable panel refuses new provider work and never falls back to Git. Existing v1
+bindings retain the old protocol until the panel retires their Git owner record and activates v2.
+
 Package-owner acquisition rechecks an occupied record within one 60-second wait budget before
 provider work. Every read retains the binding and identity checks; cancellation interrupts the wait.
 Time passing never authorizes clearing an owner. A known CI owner still requires exact terminal

package/android-action/play-upload/owner.cjs

@@ -89,6 +89,9 @@ async function acquire(client, selected, attempted = () => {}, waiting = {}) {
 
 async function withOwner(env, packageName, operation, transport, timing = {}) {
   const selected = record.binding(env, packageName);
+  if (selected.value.protocol === 'panel-v2') {
+    return require('./owner_panel.cjs').withOwner(env, selected, operation, transport, timing);
+  }
   const client = http.client(selected.value.repo, env.GITHUB_TOKEN, transport);
   const controller = new AbortController();
   let cancelled = false, dirty = false, result, failure;

package/android-action/play-upload/owner_panel.cjs

@@ -0,0 +1,63 @@
+// A durable panel owner replaces Git writes only for explicitly migrated bindings.
+const {performance} = require('node:perf_hooks');
+const {setTimeout: delay} = require('node:timers/promises');
+const {isDeepStrictEqual: same} = require('node:util');
+const http = require('./owner_panel_http.cjs');
+
+async function acquire(send, selected, attempted, waiting) {
+  const now = waiting.now || (() => performance.now());
+  const sleep = waiting.sleep || ((ms, signal) => delay(ms, undefined, {signal}));
+  const deadline = now() + 60000;
+  for (let errors = 0; errors < 3;) {
+    if (waiting.signal.aborted) throw new Error('play_owner_cancelled');
+    attempted();
+    let result;
+    try { result = await send('acquire'); }
+    catch { errors++; continue; } // Replay the same owner id, never a second acquisition.
+    if (result.status === 200 && result.body?.ok === true
+        && result.body.generation === selected.value.generation && same(result.body.owner, selected.owner)) return;
+    if (result.status !== 409 || result.body?.code !== 'play_edit_busy') throw new Error('play_owner_unverified');
+    const remaining = deadline - now();
+    if (remaining <= 0) throw new Error('play_owner_busy');
+    await sleep(Math.min(5000, remaining), waiting.signal);
+  }
+  throw new Error('play_owner_unverified');
+}
+
+async function release(send, selected) {
+  for (let attempt = 0; attempt < 3; attempt++) {
+    let result;
+    try { result = await send('release'); } catch { continue; }
+    if (result.status === 200 && result.body?.ok === true && result.body.released === true
+        && result.body.owner_id === selected.owner.id && result.body.generation === selected.value.generation) return;
+  }
+  throw new Error('play_owner_release_unverified');
+}
+
+async function withOwner(env, selected, operation, transport, timing = {}) {
+  const send = http.client(env, selected, transport);
+  const controller = new AbortController();
+  let cancelled = false, dirty = false, result, failure;
+  const stop = () => { cancelled = true; controller.abort(); };
+  process.on('SIGTERM', stop); process.on('SIGINT', stop);
+  try {
+    await acquire(send, selected, () => { dirty = true; }, {...timing, signal: controller.signal});
+    if (cancelled) throw new Error('play_owner_cancelled');
+    result = await operation(() => cancelled);
+  } catch (error) { failure = error; }
+  finally {
+    // Cleanup follows the drained provider, including cancellation. A durable release tombstone
+    // fences a delayed acquire even when none of its replies reached this process.
+    try { if (dirty) await release(send, selected); }
+    catch (error) { failure ||= error; }
+    process.off('SIGTERM', stop); process.off('SIGINT', stop);
+  }
+  if (cancelled && (!failure || failure.name === 'AbortError')) failure = new Error('play_owner_cancelled');
+  if (failure) {
+    if (result !== undefined) failure.operationResult = result;
+    throw failure;
+  }
+  return result;
+}
+
+module.exports = {acquire, release, withOwner};

package/android-action/play-upload/owner_panel_http.cjs

@@ -0,0 +1,71 @@
+// Only audience-bound OIDC reaches the panel. Repository credentials never leave GitHub.
+const https = require('node:https');
+
+function endpoint(value) {
+  let url;
+  try { url = new URL(value); } catch { throw new Error('play_owner_binding_required'); }
+  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash
+      || url.pathname !== '/pub/play-edit' || url.href !== value || url.port) {
+    throw new Error('play_owner_binding_required');
+  }
+  return url;
+}
+
+function request(url, token, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const agent = new https.Agent({keepAlive: false, proxyEnv: {}});
+    let timer, settled = false;
+    const finish = (error, result) => {
+      if (settled) return;
+      settled = true; clearTimeout(timer); agent.destroy();
+      if (error) reject(new Error('play_owner_unverified')); else resolve(result);
+    };
+    const call = https.request(url, {method: data ? 'POST' : 'GET', agent,
+      headers: {Authorization: `Bearer ${token}`, Accept: 'application/json',
+        ...(data ? {'Content-Type': 'application/json', 'Content-Length': data.length} : {})}}, response => {
+      const chunks = []; let size = 0;
+      response.on('data', chunk => {
+        size += chunk.length;
+        if (size > 131072) { finish(true); call.destroy(); }
+        else chunks.push(chunk);
+      });
+      response.on('end', () => {
+        try { finish(false, {status: response.statusCode, body: JSON.parse(Buffer.concat(chunks))}); }
+        catch { finish(true); }
+      });
+      response.on('error', () => finish(true));
+      response.on('aborted', () => finish(true));
+      response.on('close', () => { if (!response.complete) finish(true); });
+    });
+    timer = setTimeout(() => { finish(true); call.destroy(); }, 10000);
+    call.on('error', () => finish(true));
+    call.end(data);
+  });
+}
+
+async function identity(env, audience, transport) {
+  let url;
+  try { url = new URL(env.ACTIONS_ID_TOKEN_REQUEST_URL); } catch { throw new Error('play_owner_unverified'); }
+  const token = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+  if (url.protocol !== 'https:' || !url.hostname.endsWith('.actions.githubusercontent.com')
+      || url.username || url.password || url.hash || url.port
+      || typeof token !== 'string' || !token || /[\r\n]/.test(token)) throw new Error('play_owner_unverified');
+  url.searchParams.set('audience', audience);
+  const response = await transport(url, token);
+  if (response.status !== 200 || typeof response.body?.value !== 'string'
+      || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(response.body.value)) {
+    throw new Error('play_owner_unverified');
+  }
+  return response.body.value;
+}
+
+function client(env, selected, transport = request) {
+  const url = endpoint(selected.value.coordinator_url);
+  return async action => {
+    const token = await identity(env, url.href, transport);
+    return transport(url, token, {action, binding: selected.value, owner: selected.owner});
+  };
+}
+
+module.exports = {endpoint, identity, request, client};

package/android-action/play-upload/owner_record.cjs

@@ -9,6 +9,10 @@ const positive = value => Number.isSafeInteger(value) && value > 0;
 function binding(env, packageName) {
   let value;
   try { value = JSON.parse(env.PLAY_EDIT_BINDING); } catch { throw new Error('play_owner_binding_required'); }
+  if (value?.protocol !== undefined && value.protocol !== 'panel-v2') {
+    throw new Error('play_owner_binding_required');
+  }
+  if (value?.protocol === 'panel-v2') require('./owner_panel_http.cjs').endpoint(value.coordinator_url);
   const prefix = `${env.GITHUB_REPOSITORY}/`;
   const workflow = String(env.GITHUB_WORKFLOW_REF || '');
   const path = workflow.startsWith(prefix) ? workflow.slice(prefix.length).split('@')[0] : '';

package/docs/CONFIGURATION.md

@@ -38,7 +38,6 @@ backend:
   runtime-env: ${{ secrets.BACKEND_RUNTIME_ENV }}
   public-base-url: ${{ vars.BACKEND_PUBLIC_BASE_URL }}
   public-health-url: ${{ vars.BACKEND_PUBLIC_HEALTH_URL }}
-  expected-build-sha: ${{ vars.BACKEND_PUBLIC_HEALTH_URL && github.sha || '' }}
   ingress-required: ${{ vars.BACKEND_INGRESS_REQUIRED || 'false' }}
   ingress-token: ${{ secrets.BACKEND_INGRESS_TOKEN }}
 workflows:
@@ -52,6 +51,12 @@ until the app explicitly replaces their references in this file. Keep passwords,
 signing material, tokens and private keys in GitHub Secrets. Reference their names;
 never put their values in this configuration.
 
+Leave `backend.expected-build-sha` omitted to inherit the managed operation-aware default:
+network diagnostics uses the explicit `diagnostic-build-sha`, while deployment uses its source SHA.
+Upgrades remove only the former generated setting
+`${{ vars.BACKEND_PUBLIC_HEALTH_URL && github.sha || '' }}`, which otherwise overrides the diagnostic
+input. Custom build expressions remain unchanged; callers must supply the observed deployed SHA.
+
 Backend discovery accepts `compose.yaml`, `compose.yml`, `docker-compose.yaml` and
 `docker-compose.yml` inside `backend/` or `server/`, or at the repository root with a Dockerfile in
 exactly one of those source directories. Multiple matches require an explicit selection; no file is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.202",
+  "version": "1.0.204",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/config/settings.mjs

@@ -31,7 +31,14 @@ export function extractSettings(config, file, workflow) {
   }
 }
 
-export function applySettings(config, file, workflow) {
+export function applySettings(config, file, workflow, defaults) {
+  if (file === 'deploy-backend.yml'
+      && config.backend?.['expected-build-sha'] === "${{ vars.BACKEND_PUBLIC_HEALTH_URL && github.sha || '' }}") {
+    // Former generated default masks the diagnostic build input after a configured upgrade.
+    delete config.backend['expected-build-sha'];
+    const path = [...backend, 'expected-build-sha'];
+    assign(workflow, { path, value: at(defaults, path) });
+  }
   for (const { name, path } of settingsPaths(file)) {
     const value = at(config, name);
     if (value !== undefined) assign(workflow, { path, value });

package/src/config/workflows.mjs

@@ -67,7 +67,7 @@ function upgradeWorkflow(root, file, templateDir, state) {
     result = mergeChanges(base.value, current, state.config.workflows[file]?.overrides || [], file);
   }
   if (state.migrating) extractSettings(state.config, file, result);
-  result = applySettings(state.config, file, result);
+  result = applySettings(state.config, file, result, current);
   const options = settingsPaths(file);
   const overrides = differences(current, result)
     .filter(change => !options.some(({ path }) => equal(path, change.path)));

package/templates/deploy.yml

@@ -15,6 +15,7 @@ permissions:
   contents: write
   actions: read
   deployments: write
+  id-token: write
 
 concurrency:
   group: mobile-deploy-${{ github.ref }}

package/templates/mobile-candidate.yml

@@ -9,6 +9,7 @@ permissions:
   contents: write
   actions: read
   deployments: write
+  id-token: write
 
 concurrency:
   group: mobile-candidate-${{ github.event.pull_request.number }}-${{ github.event.pull_request.draft }}