gowalk-cicd 1.0.205 → 1.0.207

package/action/action.yml

@@ -458,6 +458,7 @@ runs:
       if: ${{ inputs.archive == 'true' && inputs.candidate-binary == '' }}
       shell: bash
       env:
+        CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
         PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
         WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
         TEAM_ID: ${{ inputs.team-id || env.CFG_TEAM_ID }}

package/action/scripts/pbxproj_editor.py

@@ -102,9 +102,8 @@ def _entitlements_from_configs(
     there — a missed entitlements file costs a clearer error, a wrong one costs
     a wrong App ID edit.
 
-    Only the ARCHIVE configuration counts: CI archives Release, so its
-    CODE_SIGN_ENTITLEMENTS (falling back to Profile, then to every config
-    only when neither exists) decides provisioning. An entitlement wired
+    Only the archive configuration counts. Callers pass that configuration
+    alone when provisioning. An entitlement wired
     into Debug alone — the standard way to simulator-test an Apple-granted
     capability (CarPlay) before the grant lands — must NOT force that
     capability onto the App ID for the archive.
@@ -132,14 +131,14 @@ def _entitlements_from_configs(
     return ""
 
 
-def discover_signable_targets(project_path: str) -> list[dict]:
+def discover_signable_targets(project_path: str, configuration: str = "Release") -> list[dict]:
     """Return one entry per signable native target.
 
     Each entry:
     ``{"name": str, "bundle_id": str, "config_ids": [str,...],
     "entitlements": str}`` where ``config_ids`` is the list of
-    XCBuildConfiguration UUIDs whose ``buildSettings`` dict we need to patch
-    (typically Debug + Release) and ``entitlements`` is the target's
+    selected archive XCBuildConfiguration UUID whose ``buildSettings`` dict
+    we need to patch, and ``entitlements`` is the target's
     CODE_SIGN_ENTITLEMENTS path relative to the project directory ("" when the
     target declares none).
     """
@@ -155,10 +154,20 @@ def discover_signable_targets(project_path: str) -> list[dict]:
         name = obj.get("name") or "<unknown>"
         config_list = objects.get(obj.get("buildConfigurationList")) or {}
         config_ids = list(config_list.get("buildConfigurations") or [])
-        bundle_id = _bundle_id_from_configs(objects, config_ids)
+        selected = [cid for cid in config_ids
+                    if (objects.get(cid) or {}).get("name") == configuration]
+        if len(selected) != 1:
+            raise SystemExit(
+                f"discover_signable_targets: {name!r} has no unique "
+                f"{configuration!r} configuration"
+            )
+        bundle_id = _bundle_id_from_configs(objects, selected)
         if not bundle_id:
-            print(f"skip target {name!r}: no PRODUCT_BUNDLE_IDENTIFIER")
-            continue
+            raise SystemExit(
+                f"discover_signable_targets: {name!r} has no literal "
+                f"PRODUCT_BUNDLE_IDENTIFIER in {configuration!r}"
+            )
+        config_ids = selected
         targets.append(
             {
                 "name": name,

package/action/scripts/prepare_signing.py

@@ -197,7 +197,7 @@ def main() -> None:
     token = make_jwt(env("ASC_KEY_ID"), env("ASC_ISSUER_ID"), env("ASC_KEY_PATH"))
     creds_dir = _resolve_creds_dir()
 
-    targets = discover_signable_targets(project)
+    targets = discover_signable_targets(project, optional_env("CONFIGURATION") or "Release")
     bundle_ids = sorted({t["bundle_id"] for t in targets})
     print(f"Signable targets ({len(targets)}):")
     for t in targets:

package/backend-action/network_inventory.py

@@ -31,7 +31,7 @@ def run(arguments, *, optional=False):
 def decode(raw, *, lines=False):
     try:
         value = [json.loads(line) for line in raw.splitlines()] if lines else json.loads(raw)
-        if not isinstance(value, list) or len(value) > 1024:
+        if not isinstance(value, list):
             raise ValueError()
         return value
     except (ValueError, TypeError, UnicodeError):
@@ -43,7 +43,7 @@ def identifiers(raw):
         values = raw.decode('ascii').splitlines()
     except UnicodeError:
         raise NetworkFailure('network_invalid') from None
-    if len(values) > 1024 or len(set(values)) != len(values) or any(not re.fullmatch(CID, x) for x in values):
+    if len(set(values)) != len(values) or any(not re.fullmatch(CID, x) for x in values):
         raise NetworkFailure('network_invalid')
     return sorted(values)
 

package/docs/BACKEND_SSH_GATE.md

@@ -129,6 +129,11 @@ it never means a VPN is provisioned, traffic is reachable, a pool is globally un
 The reader binds the existing API's `BUILD_SHA`, checks its exact project/service/directory labels, and
 rechecks application identity, selected network inventory, host addresses/routes, Docker UDP bindings and
 socket observations before returning. A changed or ambiguous observation refuses the result.
+Host-wide inventories are bounded only by each command's 1 MiB output limit; a larger one refuses
+`output_limit`. `ip -j address show` reaches it first, at roughly 2,000 host interfaces (one bridge per app
+plus a veth per attached container). Host runtimes before 1.0.206 refused a shared host with more than 1024
+interfaces, routes, networks or running containers as `network_invalid`. `reader_version` stays `1.0.194`
+for client compatibility, so prove adoption with the install receipt and the forced command's release path.
 
 - `bridge` reports only the selected app bridge's actual network ID/name, ownership key, interface and IPAM.
 - `overlap` distinguishes selected-bridge foreign/host overlaps and proposed-pool selected/foreign/host

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.205",
+  "version": "1.0.207",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {