gowalk-cicd 1.0.203 → 1.0.205

package/README.md

@@ -682,6 +682,13 @@ The action exports `diagnostic-path`; the managed deploy template retains its JS
 template to retain artifacts. Failed evidence validation/storage emits a fixed refusal and fails
 the job without replaying provider work or changing its result.
 
+Explicit panel-provisioned `panel-v2` bindings coordinate through the panel database without Git commits.
+The binding supplies an HTTPS `coordinator_url` ending in `/pub/play-edit`; GitHub OIDC tokens use that exact
+URL as audience. Both mobile workflows require `id-token: write`. Repository tokens never reach the panel.
+Acquisition and release replay one immutable owner identity after a lost reply; release seals delayed
+acquisitions. An unreachable panel refuses new provider work and never falls back to Git. Existing v1
+bindings retain the old protocol until the panel retires their Git owner record and activates v2.
+
 Package-owner acquisition rechecks an occupied record within one 60-second wait budget before
 provider work. Every read retains the binding and identity checks; cancellation interrupts the wait.
 Time passing never authorizes clearing an owner. A known CI owner still requires exact terminal

package/action/scripts/local_validation.cjs

@@ -3,6 +3,7 @@
 const { spawnSync } = require('node:child_process');
 const { mkdirSync, rmSync, writeFileSync } = require('node:fs');
 const { dirname, relative, resolve, isAbsolute } = require('node:path');
+const { performance } = require('node:perf_hooks');
 const { SCHEMA, CONTEXT, command, identity, readReceipt, sameSource, github, expectedAuthor,
   verifyStatus, digest } = require('./local_validation_core.cjs');
 
@@ -31,17 +32,18 @@ function run(args) {
   console.log(JSON.stringify({ ok: true, result: 'local_validation_passed', ...receipt }));
 }
 
-function publish(args) {
+async function publish(args) {
   localOnly();
   if (args[0] !== '--receipt' || args.length !== 2) throw new Error('receipt_required');
   const receipt = readReceipt(args[1]);
   sameSource(receipt, identity());
-  const commit = github(`repos/${receipt.repository}/git/commits/${receipt.head_sha}`);
+  const budget = {deadline: performance.now() + 60000};
+  const commit = await github(`repos/${receipt.repository}/git/commits/${receipt.head_sha}`, {}, budget);
   if (commit.tree.sha !== receipt.tree_sha) throw new Error('remote_tree_mismatch');
-  const status = github(`repos/${receipt.repository}/statuses/${receipt.head_sha}`, {
+  const status = await github(`repos/${receipt.repository}/statuses/${receipt.head_sha}`, {
     state: 'success', context: CONTEXT, description: `v1:${receipt.tree_sha}:${receipt.command_sha256}`,
-  });
-  verifyStatus(status, receipt.tree_sha, github('user').login);
+  }, budget);
+  verifyStatus(status, receipt.tree_sha, (await github('user', {}, budget)).login);
   console.log(JSON.stringify({ ok: true, result: 'local_validation_published', ...receipt }));
 }
 
@@ -60,14 +62,16 @@ async function verify(args) {
   }
   const sha = args[1], repository = process.env.GITHUB_REPOSITORY;
   const author = expectedAuthor(sha, repository);
-  const tree = github(`repos/${repository}/git/commits/${sha}`).tree.sha;
+  const budget = {deadline: performance.now() + 60000};
+  const tree = (await github(`repos/${repository}/git/commits/${sha}`, {}, budget)).tree.sha;
   if (command('git', ['rev-parse', 'HEAD^{tree}']) !== tree) throw new Error('checkout_tree_mismatch');
   let status;
   for (let attempt = 0; attempt <= 6; attempt += 1) {
     // The combined /status summary omits creator; full records authenticate the issuer.
-    const statuses = github(`repos/${repository}/commits/${sha}/statuses?per_page=100`);
+    const statuses = await github(`repos/${repository}/commits/${sha}/statuses?per_page=100`, {}, budget);
     status = statuses.find(item => item.context === CONTEXT);
     if (status || attempt === 6) break;
+    if (performance.now() + 5000 >= budget.deadline) throw new Error('github_statuses_deadline');
     await new Promise(resolve => setTimeout(resolve, 5000));
   }
   verifyStatus(status, tree, author);

package/action/scripts/local_validation_core.cjs

@@ -1,5 +1,7 @@
 const { createHash } = require('node:crypto');
-const { execFileSync } = require('node:child_process');
+const { execFileSync, spawnSync } = require('node:child_process');
+const { performance } = require('node:perf_hooks');
+const { setTimeout: sleep } = require('node:timers/promises');
 const { readFileSync } = require('node:fs');
 
 const SCHEMA = 'gowalk-cicd/local-validation.v1';
@@ -49,10 +51,65 @@ function sameSource(receipt, source) {
   }
 }
 
-function github(path, fields = {}) {
-  const args = ['api', path];
+// Preserve only fixed classifications and numeric retry hints, never provider bodies or CLI stderr.
+function githubResponse(result, wallNow) {
+  if (result.error?.code === 'ETIMEDOUT') return {code: 'timeout', retry: true};
+  if (result.error?.code === 'ENOENT') return {code: 'cli_unavailable'};
+  if (result.error?.code === 'ENOBUFS') return {code: 'response_too_large'};
+  if (result.signal) return {code: 'interrupted'};
+  const output = String(result.stdout || '').replace(/\r\n/g, '\n');
+  const split = output.indexOf('\n\n'), header = split < 0 ? '' : output.slice(0, split);
+  const match = /^HTTP\/\S+ ([1-5][0-9]{2})(?: |$)/m.exec(header);
+  if (!match) return result.status === 0 ? {code: 'response_invalid'} : {code: 'transport', retry: true};
+  const status = Number(match[1]);
+  const headers = Object.fromEntries(header.split('\n').slice(1).map(line => {
+    const at = line.indexOf(':'); return [line.slice(0, at).toLowerCase(), line.slice(at + 1).trim()];
+  }));
+  const quota = status === 429 || status === 403 &&
+    (headers['x-ratelimit-remaining'] === '0' || headers['retry-after'] !== undefined);
+  if (quota) {
+    const retry = headers['retry-after'], reset = headers['x-ratelimit-reset'];
+    let delayMs = /^\d+$/.test(retry || '') ? Number(retry) * 1000 : Date.parse(retry) - wallNow;
+    if (headers['x-ratelimit-remaining'] === '0' && /^\d+$/.test(reset || '')) {
+      delayMs = Math.max(Number.isFinite(delayMs) ? delayMs : 0, Number(reset) * 1000 - wallNow);
+    }
+    return {code: `quota_http_${status}`, retry: true, delayMs: Number.isFinite(delayMs)
+      ? Math.max(1000, delayMs) : 60000};
+  }
+  if (status < 200 || status >= 300) return {code: `http_${status}`, retry: [500, 502, 503, 504].includes(status)};
+  if (result.status !== 0) return {code: 'transport', retry: true};
+  try {
+    const value = JSON.parse(output.slice(split + 2));
+    return value && typeof value === 'object' ? {value} : {code: 'response_invalid'};
+  } catch { return {code: 'response_invalid'}; }
+}
+
+async function github(path, fields = {}, options = {}) {
+  const now = options.now || (() => performance.now()), wait = options.sleep || sleep;
+  const execute = options.execute || spawnSync, wallNow = options.wallNow || Date.now;
+  const deadline = options.deadline ?? now() + 60000;
+  const read = Object.keys(fields).length === 0;
+  const operation = path === 'user' ? 'user' : path.includes('/git/commits/') ? 'commit'
+    : path.includes('/statuses') ? 'statuses' : 'request';
+  const args = ['api', path, '--include', '--method', read ? 'GET' : 'POST'];
   for (const [key, value] of Object.entries(fields)) args.push('-f', `${key}=${value}`);
-  return JSON.parse(command('gh', args));
+  for (let attempt = 0; attempt < (read ? 3 : 1); attempt++) {
+    const remaining = deadline - now();
+    if (remaining <= 0) throw new Error(`github_${operation}_deadline`);
+    let result;
+    try {
+      result = execute('gh', args, {encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: Math.max(1, Math.min(15000, Math.floor(remaining))), killSignal: 'SIGKILL', maxBuffer: 1024 * 1024});
+    } catch { result = {status: 1}; }
+    const answer = githubResponse(result, wallNow());
+    if (now() >= deadline) throw new Error(`github_${operation}_deadline`);
+    if (Object.hasOwn(answer, 'value')) return answer.value;
+    const pause = answer.delayMs ?? (attempt + 1) * 1000;
+    if (!read || !answer.retry || attempt === 2 || pause >= deadline - now()) {
+      throw new Error(`github_${operation}_${answer.code}`);
+    }
+    await wait(pause);
+  }
 }
 
 function expectedAuthor(sha, repository, event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'))) {
@@ -80,5 +137,5 @@ function verifyStatus(status, tree, author) {
 }
 
 module.exports = { SCHEMA, CONTEXT, command, repositoryFromRemote, identity, readReceipt, sameSource,
-  github, expectedAuthor, verifyStatus,
+  github, githubResponse, expectedAuthor, verifyStatus,
   digest: args => createHash('sha256').update(JSON.stringify(args)).digest('hex') };

package/android-action/play-upload/owner.cjs

@@ -89,6 +89,9 @@ async function acquire(client, selected, attempted = () => {}, waiting = {}) {
 
 async function withOwner(env, packageName, operation, transport, timing = {}) {
   const selected = record.binding(env, packageName);
+  if (selected.value.protocol === 'panel-v2') {
+    return require('./owner_panel.cjs').withOwner(env, selected, operation, transport, timing);
+  }
   const client = http.client(selected.value.repo, env.GITHUB_TOKEN, transport);
   const controller = new AbortController();
   let cancelled = false, dirty = false, result, failure;

package/android-action/play-upload/owner_panel.cjs

@@ -0,0 +1,63 @@
+// A durable panel owner replaces Git writes only for explicitly migrated bindings.
+const {performance} = require('node:perf_hooks');
+const {setTimeout: delay} = require('node:timers/promises');
+const {isDeepStrictEqual: same} = require('node:util');
+const http = require('./owner_panel_http.cjs');
+
+async function acquire(send, selected, attempted, waiting) {
+  const now = waiting.now || (() => performance.now());
+  const sleep = waiting.sleep || ((ms, signal) => delay(ms, undefined, {signal}));
+  const deadline = now() + 60000;
+  for (let errors = 0; errors < 3;) {
+    if (waiting.signal.aborted) throw new Error('play_owner_cancelled');
+    attempted();
+    let result;
+    try { result = await send('acquire'); }
+    catch { errors++; continue; } // Replay the same owner id, never a second acquisition.
+    if (result.status === 200 && result.body?.ok === true
+        && result.body.generation === selected.value.generation && same(result.body.owner, selected.owner)) return;
+    if (result.status !== 409 || result.body?.code !== 'play_edit_busy') throw new Error('play_owner_unverified');
+    const remaining = deadline - now();
+    if (remaining <= 0) throw new Error('play_owner_busy');
+    await sleep(Math.min(5000, remaining), waiting.signal);
+  }
+  throw new Error('play_owner_unverified');
+}
+
+async function release(send, selected) {
+  for (let attempt = 0; attempt < 3; attempt++) {
+    let result;
+    try { result = await send('release'); } catch { continue; }
+    if (result.status === 200 && result.body?.ok === true && result.body.released === true
+        && result.body.owner_id === selected.owner.id && result.body.generation === selected.value.generation) return;
+  }
+  throw new Error('play_owner_release_unverified');
+}
+
+async function withOwner(env, selected, operation, transport, timing = {}) {
+  const send = http.client(env, selected, transport);
+  const controller = new AbortController();
+  let cancelled = false, dirty = false, result, failure;
+  const stop = () => { cancelled = true; controller.abort(); };
+  process.on('SIGTERM', stop); process.on('SIGINT', stop);
+  try {
+    await acquire(send, selected, () => { dirty = true; }, {...timing, signal: controller.signal});
+    if (cancelled) throw new Error('play_owner_cancelled');
+    result = await operation(() => cancelled);
+  } catch (error) { failure = error; }
+  finally {
+    // Cleanup follows the drained provider, including cancellation. A durable release tombstone
+    // fences a delayed acquire even when none of its replies reached this process.
+    try { if (dirty) await release(send, selected); }
+    catch (error) { failure ||= error; }
+    process.off('SIGTERM', stop); process.off('SIGINT', stop);
+  }
+  if (cancelled && (!failure || failure.name === 'AbortError')) failure = new Error('play_owner_cancelled');
+  if (failure) {
+    if (result !== undefined) failure.operationResult = result;
+    throw failure;
+  }
+  return result;
+}
+
+module.exports = {acquire, release, withOwner};

package/android-action/play-upload/owner_panel_http.cjs

@@ -0,0 +1,71 @@
+// Only audience-bound OIDC reaches the panel. Repository credentials never leave GitHub.
+const https = require('node:https');
+
+function endpoint(value) {
+  let url;
+  try { url = new URL(value); } catch { throw new Error('play_owner_binding_required'); }
+  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash
+      || url.pathname !== '/pub/play-edit' || url.href !== value || url.port) {
+    throw new Error('play_owner_binding_required');
+  }
+  return url;
+}
+
+function request(url, token, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const agent = new https.Agent({keepAlive: false, proxyEnv: {}});
+    let timer, settled = false;
+    const finish = (error, result) => {
+      if (settled) return;
+      settled = true; clearTimeout(timer); agent.destroy();
+      if (error) reject(new Error('play_owner_unverified')); else resolve(result);
+    };
+    const call = https.request(url, {method: data ? 'POST' : 'GET', agent,
+      headers: {Authorization: `Bearer ${token}`, Accept: 'application/json',
+        ...(data ? {'Content-Type': 'application/json', 'Content-Length': data.length} : {})}}, response => {
+      const chunks = []; let size = 0;
+      response.on('data', chunk => {
+        size += chunk.length;
+        if (size > 131072) { finish(true); call.destroy(); }
+        else chunks.push(chunk);
+      });
+      response.on('end', () => {
+        try { finish(false, {status: response.statusCode, body: JSON.parse(Buffer.concat(chunks))}); }
+        catch { finish(true); }
+      });
+      response.on('error', () => finish(true));
+      response.on('aborted', () => finish(true));
+      response.on('close', () => { if (!response.complete) finish(true); });
+    });
+    timer = setTimeout(() => { finish(true); call.destroy(); }, 10000);
+    call.on('error', () => finish(true));
+    call.end(data);
+  });
+}
+
+async function identity(env, audience, transport) {
+  let url;
+  try { url = new URL(env.ACTIONS_ID_TOKEN_REQUEST_URL); } catch { throw new Error('play_owner_unverified'); }
+  const token = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+  if (url.protocol !== 'https:' || !url.hostname.endsWith('.actions.githubusercontent.com')
+      || url.username || url.password || url.hash || url.port
+      || typeof token !== 'string' || !token || /[\r\n]/.test(token)) throw new Error('play_owner_unverified');
+  url.searchParams.set('audience', audience);
+  const response = await transport(url, token);
+  if (response.status !== 200 || typeof response.body?.value !== 'string'
+      || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(response.body.value)) {
+    throw new Error('play_owner_unverified');
+  }
+  return response.body.value;
+}
+
+function client(env, selected, transport = request) {
+  const url = endpoint(selected.value.coordinator_url);
+  return async action => {
+    const token = await identity(env, url.href, transport);
+    return transport(url, token, {action, binding: selected.value, owner: selected.owner});
+  };
+}
+
+module.exports = {endpoint, identity, request, client};

package/android-action/play-upload/owner_record.cjs

@@ -9,6 +9,10 @@ const positive = value => Number.isSafeInteger(value) && value > 0;
 function binding(env, packageName) {
   let value;
   try { value = JSON.parse(env.PLAY_EDIT_BINDING); } catch { throw new Error('play_owner_binding_required'); }
+  if (value?.protocol !== undefined && value.protocol !== 'panel-v2') {
+    throw new Error('play_owner_binding_required');
+  }
+  if (value?.protocol === 'panel-v2') require('./owner_panel_http.cjs').endpoint(value.coordinator_url);
   const prefix = `${env.GITHUB_REPOSITORY}/`;
   const workflow = String(env.GITHUB_WORKFLOW_REF || '');
   const path = workflow.startsWith(prefix) ? workflow.slice(prefix.length).split('@')[0] : '';

package/docs/CONFIGURATION.md

@@ -141,3 +141,7 @@ not checked; there `steps.mode` renders empty.
 Routine delivery targets and exact native validation proof are documented in
 [CI_PERFORMANCE.md](CI_PERFORMANCE.md). The optional top-level
 `performance: {target-seconds: 300}` setting accepts 60–300 seconds and controls latency reporting.
+
+Dispatch input descriptions are app-owned help text: custom wording or explicit removal survives upstream
+copy edits. Input types, defaults, options and functional workflow conflicts keep the existing strict
+three-way merge. A removal of an already-absent field does not recreate a retired input or job.

package/docs/LOCAL_VALIDATION.md

@@ -51,6 +51,15 @@ that head's tree, including on a PR merge ref. If main advanced and changed the
 the task branch and validate the new candidate locally. Missing, failed, wrong-author or mismatched
 proof refuses. A missing status gets six five-second retries for publication immediately after push.
 
+GitHub GET proofs recover transport/timeouts and HTTP 500/502/503/504 with at most three attempts.
+Each command is bounded to 15 seconds; all commit/status reads and missing-status waits share one
+60-second deadline per verification. Publishing shares the same bound across its proof calls and
+never retries the status POST. Quota responses honor numeric/date Retry-After and primary reset
+headers only when the delay fits the remaining budget; unknown or longer waits refuse immediately.
+Permission, missing-source and malformed-data failures never retry. Refusals identify only the
+operation and fixed transport/HTTP cause, such as `github_statuses_http_403`,
+`github_commit_timeout` or `github_statuses_quota_http_429`; provider bodies and CLI stderr stay private.
+
 The CLI also accepts `gowalk-cicd validate verify --sha ...`. The installed script and its sibling
 `local_validation_core.cjs` avoid fetching another package in app jobs. Legacy composite inputs
 `run-tests`, `test-command` and `test-destination` are accepted but ignored; composites execute no tests.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.203",
+  "version": "1.0.205",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/config/merge.mjs

@@ -51,8 +51,13 @@ export function selectBaseline(file, source, local) {
   return selected;
 }
 
-function appSetting(path) {
-  const key = path.at(-1);
+function appSetting(change, before, after) {
+  const path = change.path, key = path.at(-1);
+  // A dispatch input's help text does not change its behavior. Preserve app wording or removal
+  // across upstream copy edits, but never recreate an input removed by the new template.
+  if (path.length === 5 && path[0] === 'on' && path[1] === 'workflow_dispatch'
+      && path[2] === 'inputs' && key === 'description' && typeof before === 'string'
+      && typeof after === 'string' && (change.remove || typeof change.value === 'string')) return true;
   if (path.includes('env') || path.includes('with')) {
     return !['candidate-binary', 'upload', 'auto-update', 'manage-app-store-version'].includes(key);
   }
@@ -134,9 +139,11 @@ export function mergeChanges(base, incoming, changes, file) {
   for (const raw of changes) {
     const change = modeChange(file, raw, ownMode);
     const before = at(base, change.path), after = at(incoming, change.path);
+    // An already-absent leaf needs no write; assign would otherwise recreate its retired parents.
+    if (change.remove && after === undefined) continue;
     if (change.path.at(-1) === 'order' && Array.isArray(before) && Array.isArray(after)) {
       assign(result, { path: change.path, value: mergeOrder(before, change.value, after, file, change.path) });
-    } else if (equal(before, after) || equal(change.value, after) || appSetting(change.path)) {
+    } else if (equal(before, after) || equal(change.value, after) || appSetting(change, before, after)) {
       assign(result, iosChange(file, before, after, change));
     } else {
       throw new MigrationRepair('custom_workflow_conflict', file, change.path);

package/templates/deploy.yml

@@ -15,6 +15,7 @@ permissions:
   contents: write
   actions: read
   deployments: write
+  id-token: write
 
 concurrency:
   group: mobile-deploy-${{ github.ref }}

package/templates/mobile-candidate.yml

@@ -9,6 +9,7 @@ permissions:
   contents: write
   actions: read
   deployments: write
+  id-token: write
 
 concurrency:
   group: mobile-candidate-${{ github.event.pull_request.number }}-${{ github.event.pull_request.draft }}