gowalk-cicd 1.0.204 → 1.0.206

package/action/scripts/local_validation.cjs

@@ -3,6 +3,7 @@
 const { spawnSync } = require('node:child_process');
 const { mkdirSync, rmSync, writeFileSync } = require('node:fs');
 const { dirname, relative, resolve, isAbsolute } = require('node:path');
+const { performance } = require('node:perf_hooks');
 const { SCHEMA, CONTEXT, command, identity, readReceipt, sameSource, github, expectedAuthor,
   verifyStatus, digest } = require('./local_validation_core.cjs');
 
@@ -31,17 +32,18 @@ function run(args) {
   console.log(JSON.stringify({ ok: true, result: 'local_validation_passed', ...receipt }));
 }
 
-function publish(args) {
+async function publish(args) {
   localOnly();
   if (args[0] !== '--receipt' || args.length !== 2) throw new Error('receipt_required');
   const receipt = readReceipt(args[1]);
   sameSource(receipt, identity());
-  const commit = github(`repos/${receipt.repository}/git/commits/${receipt.head_sha}`);
+  const budget = {deadline: performance.now() + 60000};
+  const commit = await github(`repos/${receipt.repository}/git/commits/${receipt.head_sha}`, {}, budget);
   if (commit.tree.sha !== receipt.tree_sha) throw new Error('remote_tree_mismatch');
-  const status = github(`repos/${receipt.repository}/statuses/${receipt.head_sha}`, {
+  const status = await github(`repos/${receipt.repository}/statuses/${receipt.head_sha}`, {
     state: 'success', context: CONTEXT, description: `v1:${receipt.tree_sha}:${receipt.command_sha256}`,
-  });
-  verifyStatus(status, receipt.tree_sha, github('user').login);
+  }, budget);
+  verifyStatus(status, receipt.tree_sha, (await github('user', {}, budget)).login);
   console.log(JSON.stringify({ ok: true, result: 'local_validation_published', ...receipt }));
 }
 
@@ -60,14 +62,16 @@ async function verify(args) {
   }
   const sha = args[1], repository = process.env.GITHUB_REPOSITORY;
   const author = expectedAuthor(sha, repository);
-  const tree = github(`repos/${repository}/git/commits/${sha}`).tree.sha;
+  const budget = {deadline: performance.now() + 60000};
+  const tree = (await github(`repos/${repository}/git/commits/${sha}`, {}, budget)).tree.sha;
   if (command('git', ['rev-parse', 'HEAD^{tree}']) !== tree) throw new Error('checkout_tree_mismatch');
   let status;
   for (let attempt = 0; attempt <= 6; attempt += 1) {
     // The combined /status summary omits creator; full records authenticate the issuer.
-    const statuses = github(`repos/${repository}/commits/${sha}/statuses?per_page=100`);
+    const statuses = await github(`repos/${repository}/commits/${sha}/statuses?per_page=100`, {}, budget);
     status = statuses.find(item => item.context === CONTEXT);
     if (status || attempt === 6) break;
+    if (performance.now() + 5000 >= budget.deadline) throw new Error('github_statuses_deadline');
     await new Promise(resolve => setTimeout(resolve, 5000));
   }
   verifyStatus(status, tree, author);

package/action/scripts/local_validation_core.cjs

@@ -1,5 +1,7 @@
 const { createHash } = require('node:crypto');
-const { execFileSync } = require('node:child_process');
+const { execFileSync, spawnSync } = require('node:child_process');
+const { performance } = require('node:perf_hooks');
+const { setTimeout: sleep } = require('node:timers/promises');
 const { readFileSync } = require('node:fs');
 
 const SCHEMA = 'gowalk-cicd/local-validation.v1';
@@ -49,10 +51,65 @@ function sameSource(receipt, source) {
   }
 }
 
-function github(path, fields = {}) {
-  const args = ['api', path];
+// Preserve only fixed classifications and numeric retry hints, never provider bodies or CLI stderr.
+function githubResponse(result, wallNow) {
+  if (result.error?.code === 'ETIMEDOUT') return {code: 'timeout', retry: true};
+  if (result.error?.code === 'ENOENT') return {code: 'cli_unavailable'};
+  if (result.error?.code === 'ENOBUFS') return {code: 'response_too_large'};
+  if (result.signal) return {code: 'interrupted'};
+  const output = String(result.stdout || '').replace(/\r\n/g, '\n');
+  const split = output.indexOf('\n\n'), header = split < 0 ? '' : output.slice(0, split);
+  const match = /^HTTP\/\S+ ([1-5][0-9]{2})(?: |$)/m.exec(header);
+  if (!match) return result.status === 0 ? {code: 'response_invalid'} : {code: 'transport', retry: true};
+  const status = Number(match[1]);
+  const headers = Object.fromEntries(header.split('\n').slice(1).map(line => {
+    const at = line.indexOf(':'); return [line.slice(0, at).toLowerCase(), line.slice(at + 1).trim()];
+  }));
+  const quota = status === 429 || status === 403 &&
+    (headers['x-ratelimit-remaining'] === '0' || headers['retry-after'] !== undefined);
+  if (quota) {
+    const retry = headers['retry-after'], reset = headers['x-ratelimit-reset'];
+    let delayMs = /^\d+$/.test(retry || '') ? Number(retry) * 1000 : Date.parse(retry) - wallNow;
+    if (headers['x-ratelimit-remaining'] === '0' && /^\d+$/.test(reset || '')) {
+      delayMs = Math.max(Number.isFinite(delayMs) ? delayMs : 0, Number(reset) * 1000 - wallNow);
+    }
+    return {code: `quota_http_${status}`, retry: true, delayMs: Number.isFinite(delayMs)
+      ? Math.max(1000, delayMs) : 60000};
+  }
+  if (status < 200 || status >= 300) return {code: `http_${status}`, retry: [500, 502, 503, 504].includes(status)};
+  if (result.status !== 0) return {code: 'transport', retry: true};
+  try {
+    const value = JSON.parse(output.slice(split + 2));
+    return value && typeof value === 'object' ? {value} : {code: 'response_invalid'};
+  } catch { return {code: 'response_invalid'}; }
+}
+
+async function github(path, fields = {}, options = {}) {
+  const now = options.now || (() => performance.now()), wait = options.sleep || sleep;
+  const execute = options.execute || spawnSync, wallNow = options.wallNow || Date.now;
+  const deadline = options.deadline ?? now() + 60000;
+  const read = Object.keys(fields).length === 0;
+  const operation = path === 'user' ? 'user' : path.includes('/git/commits/') ? 'commit'
+    : path.includes('/statuses') ? 'statuses' : 'request';
+  const args = ['api', path, '--include', '--method', read ? 'GET' : 'POST'];
   for (const [key, value] of Object.entries(fields)) args.push('-f', `${key}=${value}`);
-  return JSON.parse(command('gh', args));
+  for (let attempt = 0; attempt < (read ? 3 : 1); attempt++) {
+    const remaining = deadline - now();
+    if (remaining <= 0) throw new Error(`github_${operation}_deadline`);
+    let result;
+    try {
+      result = execute('gh', args, {encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+        timeout: Math.max(1, Math.min(15000, Math.floor(remaining))), killSignal: 'SIGKILL', maxBuffer: 1024 * 1024});
+    } catch { result = {status: 1}; }
+    const answer = githubResponse(result, wallNow());
+    if (now() >= deadline) throw new Error(`github_${operation}_deadline`);
+    if (Object.hasOwn(answer, 'value')) return answer.value;
+    const pause = answer.delayMs ?? (attempt + 1) * 1000;
+    if (!read || !answer.retry || attempt === 2 || pause >= deadline - now()) {
+      throw new Error(`github_${operation}_${answer.code}`);
+    }
+    await wait(pause);
+  }
 }
 
 function expectedAuthor(sha, repository, event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'))) {
@@ -80,5 +137,5 @@ function verifyStatus(status, tree, author) {
 }
 
 module.exports = { SCHEMA, CONTEXT, command, repositoryFromRemote, identity, readReceipt, sameSource,
-  github, expectedAuthor, verifyStatus,
+  github, githubResponse, expectedAuthor, verifyStatus,
   digest: args => createHash('sha256').update(JSON.stringify(args)).digest('hex') };

package/backend-action/network_inventory.py

@@ -31,7 +31,7 @@ def run(arguments, *, optional=False):
 def decode(raw, *, lines=False):
     try:
         value = [json.loads(line) for line in raw.splitlines()] if lines else json.loads(raw)
-        if not isinstance(value, list) or len(value) > 1024:
+        if not isinstance(value, list):
             raise ValueError()
         return value
     except (ValueError, TypeError, UnicodeError):
@@ -43,7 +43,7 @@ def identifiers(raw):
         values = raw.decode('ascii').splitlines()
     except UnicodeError:
         raise NetworkFailure('network_invalid') from None
-    if len(values) > 1024 or len(set(values)) != len(values) or any(not re.fullmatch(CID, x) for x in values):
+    if len(set(values)) != len(values) or any(not re.fullmatch(CID, x) for x in values):
         raise NetworkFailure('network_invalid')
     return sorted(values)
 

package/docs/BACKEND_SSH_GATE.md

@@ -129,6 +129,11 @@ it never means a VPN is provisioned, traffic is reachable, a pool is globally un
 The reader binds the existing API's `BUILD_SHA`, checks its exact project/service/directory labels, and
 rechecks application identity, selected network inventory, host addresses/routes, Docker UDP bindings and
 socket observations before returning. A changed or ambiguous observation refuses the result.
+Host-wide inventories are bounded only by each command's 1 MiB output limit; a larger one refuses
+`output_limit`. `ip -j address show` reaches it first, at roughly 2,000 host interfaces (one bridge per app
+plus a veth per attached container). Host runtimes before 1.0.206 refused a shared host with more than 1024
+interfaces, routes, networks or running containers as `network_invalid`. `reader_version` stays `1.0.194`
+for client compatibility, so prove adoption with the install receipt and the forced command's release path.
 
 - `bridge` reports only the selected app bridge's actual network ID/name, ownership key, interface and IPAM.
 - `overlap` distinguishes selected-bridge foreign/host overlaps and proposed-pool selected/foreign/host

package/docs/CONFIGURATION.md

@@ -141,3 +141,7 @@ not checked; there `steps.mode` renders empty.
 Routine delivery targets and exact native validation proof are documented in
 [CI_PERFORMANCE.md](CI_PERFORMANCE.md). The optional top-level
 `performance: {target-seconds: 300}` setting accepts 60–300 seconds and controls latency reporting.
+
+Dispatch input descriptions are app-owned help text: custom wording or explicit removal survives upstream
+copy edits. Input types, defaults, options and functional workflow conflicts keep the existing strict
+three-way merge. A removal of an already-absent field does not recreate a retired input or job.

package/docs/LOCAL_VALIDATION.md

@@ -51,6 +51,15 @@ that head's tree, including on a PR merge ref. If main advanced and changed the
 the task branch and validate the new candidate locally. Missing, failed, wrong-author or mismatched
 proof refuses. A missing status gets six five-second retries for publication immediately after push.
 
+GitHub GET proofs recover transport/timeouts and HTTP 500/502/503/504 with at most three attempts.
+Each command is bounded to 15 seconds; all commit/status reads and missing-status waits share one
+60-second deadline per verification. Publishing shares the same bound across its proof calls and
+never retries the status POST. Quota responses honor numeric/date Retry-After and primary reset
+headers only when the delay fits the remaining budget; unknown or longer waits refuse immediately.
+Permission, missing-source and malformed-data failures never retry. Refusals identify only the
+operation and fixed transport/HTTP cause, such as `github_statuses_http_403`,
+`github_commit_timeout` or `github_statuses_quota_http_429`; provider bodies and CLI stderr stay private.
+
 The CLI also accepts `gowalk-cicd validate verify --sha ...`. The installed script and its sibling
 `local_validation_core.cjs` avoid fetching another package in app jobs. Legacy composite inputs
 `run-tests`, `test-command` and `test-destination` are accepted but ignored; composites execute no tests.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.204",
+  "version": "1.0.206",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/config/merge.mjs

@@ -51,8 +51,13 @@ export function selectBaseline(file, source, local) {
   return selected;
 }
 
-function appSetting(path) {
-  const key = path.at(-1);
+function appSetting(change, before, after) {
+  const path = change.path, key = path.at(-1);
+  // A dispatch input's help text does not change its behavior. Preserve app wording or removal
+  // across upstream copy edits, but never recreate an input removed by the new template.
+  if (path.length === 5 && path[0] === 'on' && path[1] === 'workflow_dispatch'
+      && path[2] === 'inputs' && key === 'description' && typeof before === 'string'
+      && typeof after === 'string' && (change.remove || typeof change.value === 'string')) return true;
   if (path.includes('env') || path.includes('with')) {
     return !['candidate-binary', 'upload', 'auto-update', 'manage-app-store-version'].includes(key);
   }
@@ -134,9 +139,11 @@ export function mergeChanges(base, incoming, changes, file) {
   for (const raw of changes) {
     const change = modeChange(file, raw, ownMode);
     const before = at(base, change.path), after = at(incoming, change.path);
+    // An already-absent leaf needs no write; assign would otherwise recreate its retired parents.
+    if (change.remove && after === undefined) continue;
     if (change.path.at(-1) === 'order' && Array.isArray(before) && Array.isArray(after)) {
       assign(result, { path: change.path, value: mergeOrder(before, change.value, after, file, change.path) });
-    } else if (equal(before, after) || equal(change.value, after) || appSetting(change.path)) {
+    } else if (equal(before, after) || equal(change.value, after) || appSetting(change, before, after)) {
       assign(result, iosChange(file, before, after, change));
     } else {
       throw new MigrationRepair('custom_workflow_conflict', file, change.path);