gowalk-cicd 1.0.208 → 1.0.209

package/action/action.yml

@@ -10,6 +10,10 @@ description: >
   consumers. App Store provisioning profiles are reconciled at runtime.
 
 inputs:
+  native-preparation-manifest:
+    description: Tracked manifest for app-owned native dependency preparation
+    required: false
+    default: ''
   candidate-binary:
     description: Verified candidate artifact directory supplied by the package workflow
     required: false
@@ -233,6 +237,16 @@ runs:
         sudo xcode-select -s "$XCODE_PATH"
         xcodebuild -version
 
+    - name: Prepare manifest-bound native dependencies
+      if: ${{ inputs.candidate-binary == '' && inputs.native-preparation-manifest != '' }}
+      shell: bash
+      env:
+        NATIVE_PREPARATION_MANIFEST: ${{ inputs.native-preparation-manifest }}
+      run: |
+        python3 "$SWIFT_APP_ACTION/scripts/native_preparation.py" prepare \
+          "$GITHUB_WORKSPACE" "$NATIVE_PREPARATION_MANIFEST" "$RUNNER_TEMP/native-preparation.json"
+        printf 'NATIVE_PREPARATION_MANIFEST=%s\n' "$NATIVE_PREPARATION_MANIFEST" >> "$GITHUB_ENV"
+
     - name: Describe native dependency cache
       if: ${{ inputs.candidate-binary == '' }}
       id: native_cache_scope

package/action/scripts/mobile_artifact_files.py

@@ -95,6 +95,12 @@ def pack(platform: str, directory: Path) -> None:
             raise ValueError("mobile_artifact_binary_ambiguous")
         (directory / "export").mkdir()
         shutil.copyfile(binaries[0], directory / "export" / "app.ipa")
+        manifest = os.environ.get("NATIVE_PREPARATION_MANIFEST", "")
+        if manifest:
+            import native_preparation
+            receipt = temp / "native-preparation.json"
+            native_preparation.verify(Path(os.environ["GITHUB_WORKSPACE"]).resolve(), manifest, receipt, outputs=True)
+            shutil.copyfile(receipt, directory / "native-preparation.json")
         symbols = ["firebase-symbols", "dart-symbols/ios"]
     else:
         binary = Path(os.environ["MOBILE_ARTIFACT_BINARY"])
@@ -120,6 +126,14 @@ def verify(platform: str, directory: Path) -> dict:
             or value.get("credential_fingerprints") != credentials(platform)
             or value.get("files") != files(directory)):
         raise ValueError("mobile_artifact_inputs_mismatch")
+    if platform == "ios":
+        manifest = os.environ.get("NATIVE_PREPARATION_MANIFEST", "")
+        if manifest:
+            import native_preparation
+            native_preparation.verify(Path(os.environ["GITHUB_WORKSPACE"]).resolve(), manifest,
+                                      directory / "native-preparation.json")
+        elif "native-preparation.json" in value["files"]:
+            raise ValueError("mobile_artifact_inputs_mismatch")
     expected = set(IOS_ENV if platform == "ios" else ANDROID_ENV)
     environment = value.get("environment", {})
     if set(environment) not in (expected, expected - {SOURCE_PLIST}) or any(

package/action/scripts/native_preparation.py

@@ -0,0 +1,166 @@
+#!/usr/bin/env python3
+"""Prepare and attest tracked, app-authored native build dependencies."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path, PurePosixPath
+import re
+import subprocess
+import sys
+
+SCHEMA = 'gowalk-cicd/native-preparation.v1'
+RECEIPT = 'gowalk-cicd/native-preparation-receipt.v1'
+MAX_FILES = 10000
+
+
+def digest(path):
+    with path.open('rb') as stream:
+        return hashlib.file_digest(stream, 'sha256').hexdigest()
+
+
+def command(*args, cwd):
+    return subprocess.run(args, cwd=cwd, check=True, stdout=subprocess.PIPE,
+                          stderr=subprocess.DEVNULL, text=True).stdout
+
+
+def path_at(root, name):
+    if not isinstance(name, str) or len(name) > 500 or not re.fullmatch(r'[A-Za-z0-9_./-]+', name):
+        raise ValueError('native_preparation_path_invalid')
+    path = PurePosixPath(name)
+    if path.is_absolute() or any(part in ('', '.', '..') for part in name.split('/')):
+        raise ValueError('native_preparation_path_invalid')
+    if 'creds' in path.parts or '.git' in path.parts or any(part.startswith('.env') for part in path.parts):
+        raise ValueError('native_preparation_path_invalid')
+    result = root.joinpath(*path.parts)
+    current = root
+    for part in path.parts:
+        current = current / part
+        if current.is_symlink():
+            raise ValueError('native_preparation_symlink')
+    return result
+
+
+def tracked(root, name):
+    path = path_at(root, name)
+    if not path.is_file():
+        raise ValueError('native_preparation_input_absent')
+    command('git', 'ls-files', '--error-unmatch', '--', name, cwd=root)
+    command('git', 'diff', '--quiet', 'HEAD', '--', name, cwd=root)
+    return digest(path)
+
+
+def load(root, name):
+    manifest_hash = tracked(root, name)
+    path = path_at(root, name)
+    if path.stat().st_size > 65536:
+        raise ValueError('native_preparation_manifest_invalid')
+    data = json.loads(path.read_text())
+    if (not isinstance(data, dict) or set(data) != {'schema', 'script', 'inputs', 'outputs'}
+            or data['schema'] != SCHEMA or not isinstance(data['inputs'], list)
+            or not isinstance(data['outputs'], list) or not data['outputs']
+            or len(data['inputs']) > 100 or len(data['outputs']) > 100):
+        raise ValueError('native_preparation_manifest_invalid')
+    inputs = [name, data['script'], *data['inputs']]
+    if len(set(inputs)) != len(inputs) or len(set(data['outputs'])) != len(data['outputs']):
+        raise ValueError('native_preparation_manifest_invalid')
+    hashes = {item: tracked(root, item) for item in inputs}
+    if hashes[name] != manifest_hash or not os.access(path_at(root, data['script']), os.X_OK):
+        raise ValueError('native_preparation_script_invalid')
+    for output in data['outputs']:
+        path_at(root, output)
+        if command('git', 'ls-files', '-z', '--', output, cwd=root):
+            raise ValueError('native_preparation_output_tracked')
+        command('git', 'check-ignore', '-q', '--', output, cwd=root)
+    return data, hashes
+
+
+def output_tree(root, name):
+    path = path_at(root, name)
+    if not path.exists():
+        raise ValueError('native_preparation_output_absent')
+    paths = [path] if path.is_file() else sorted(path.rglob('*'))
+    entries = []
+    for item in paths:
+        if item.is_symlink():
+            raise ValueError('native_preparation_symlink')
+        if item.is_file():
+            entries.append([item.relative_to(root).as_posix(), digest(item)])
+            if len(entries) > MAX_FILES:
+                raise ValueError('native_preparation_output_limit')
+        elif not item.is_dir():
+            raise ValueError('native_preparation_output_invalid')
+    if not entries:
+        raise ValueError('native_preparation_output_absent')
+    return {'path': name, 'files': len(entries), 'sha256': hashlib.sha256(
+        json.dumps(entries, ensure_ascii=True, separators=(',', ':')).encode()).hexdigest()}
+
+
+def identity(root, name):
+    data, inputs = load(root, name)
+    return data, {'schema': RECEIPT, 'manifest': name, 'inputs': inputs}
+
+
+def prepare(root, manifest, receipt):
+    data, result = identity(root, manifest)
+    command('git', 'diff', '--quiet', 'HEAD', '--', cwd=root)
+    allowed = ('PATH', 'HOME', 'TMPDIR', 'RUNNER_TEMP', 'APP_ROBOT_TASK_SCRATCH', 'DEVELOPER_DIR', 'SDKROOT',
+               'CI', 'GITHUB_ACTIONS', 'GITHUB_RUN_ID', 'GITHUB_RUN_ATTEMPT', 'GITHUB_JOB')
+    environment = {key: os.environ[key] for key in allowed if key in os.environ}
+    if environment.get('GITHUB_ACTIONS') == 'true':
+        environment['CI'] = 'true'
+    environment['GITHUB_WORKSPACE'] = str(root)
+    subprocess.run([str(path_at(root, data['script']))], cwd=root, env=environment, check=True)
+    command('git', 'diff', '--quiet', 'HEAD', '--', cwd=root)
+    _, after = identity(root, manifest)
+    if result != after:
+        raise ValueError('native_preparation_input_changed')
+    result['toolchain'] = command('xcodebuild', '-version', cwd=root).strip()
+    result['outputs'] = [output_tree(root, name) for name in data['outputs']]
+    receipt.write_text(json.dumps(result, sort_keys=True, indent=2) + '\n')
+
+
+def verify(root, manifest, receipt, *, outputs=False):
+    data, expected = identity(root, manifest)
+    if receipt.is_symlink() or not receipt.is_file() or receipt.stat().st_size > 1024 * 1024:
+        raise ValueError('native_preparation_receipt_invalid')
+    actual = json.loads(receipt.read_text())
+    if (not isinstance(actual, dict) or set(actual) != set(expected) | {'toolchain', 'outputs'}
+            or any(actual.get(k) != v for k, v in expected.items())
+            or not isinstance(actual.get('toolchain'), str) or not actual['toolchain']
+            or not isinstance(actual.get('outputs'), list) or len(actual['outputs']) != len(data['outputs'])):
+        raise ValueError('native_preparation_receipt_invalid')
+    for expected_path, item in zip(data['outputs'], actual['outputs']):
+        if (not isinstance(item, dict) or set(item) != {'path', 'files', 'sha256'}
+                or item['path'] != expected_path or type(item['files']) is not int
+                or not 0 < item['files'] <= MAX_FILES or not isinstance(item['sha256'], str)
+                or len(item['sha256']) != 64 or any(c not in '0123456789abcdef' for c in item['sha256'])):
+            raise ValueError('native_preparation_receipt_invalid')
+    if outputs and (actual['outputs'] != [output_tree(root, name) for name in data['outputs']]
+                    or actual['toolchain'] != command('xcodebuild', '-version', cwd=root).strip()):
+        raise ValueError('native_preparation_output_changed')
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('operation', choices=['prepare', 'verify', 'verify-outputs'])
+    parser.add_argument('root', type=Path)
+    parser.add_argument('manifest')
+    parser.add_argument('receipt', type=Path)
+    args = parser.parse_args()
+    try:
+        root = args.root.resolve(strict=True)
+        if args.operation == 'prepare':
+            prepare(root, args.manifest, args.receipt)
+        else:
+            verify(root, args.manifest, args.receipt, outputs=args.operation == 'verify-outputs')
+    except (ValueError, OSError, subprocess.SubprocessError, TypeError, KeyError) as error:
+        code = str(error) if isinstance(error, ValueError) and str(error).startswith('native_preparation_') else \
+            'native_preparation_failed'
+        print(code, file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

package/docs/CANDIDATE_ARTIFACTS.md

@@ -70,3 +70,45 @@ and pinned cache programs as release builds. Cache Pods and `.factory/toolchain/
 helper's lockfile/Ruby/Xcode/architecture identity; `pod install --deployment` and committed locks
 remain required. Beyond that conditional dependency priming, no compile warm-up, machine affinity, reservation
 or factory wait protocol is added.
+
+## App-owned native preparation
+
+A native iOS app whose Xcode graph consumes generated, lockfile-pinned local frameworks may set
+`mobile.ios.native-preparation-manifest` in `.gowalk-cicd.yml` to a tracked JSON file:
+
+```json
+{
+  "schema": "gowalk-cicd/native-preparation.v1",
+  "script": "tools/ios/prepare-libraries.sh",
+  "inputs": ["tools/ios/library.lock.json"],
+  "outputs": [".factory/cache/library/ios/Example.xcframework"]
+}
+```
+
+All names are repository-relative. The manifest, executable script and declared inputs must be
+regular tracked files matching the frozen checkout. The tracked tree must remain unchanged through
+preparation. Output trees must be gitignored, contain no tracked files and cannot contain symlinks.
+The script itself must pin and verify its downloaded inputs, must not run tests, and must
+produce all declared outputs with the active Xcode toolchain. The helper executes it as an argument,
+not as an interpolated shell command. App-authored source and this build recipe are subject to the
+same review and trusted-candidate policy as Xcode build phases.
+The child receives a narrow environment, including the nonsecret GitHub run, attempt and job
+identity so a recipe can distinguish a fresh build from same-job cache reuse; credentials and
+unrelated workflow variables are not forwarded.
+
+The action runs preparation after selecting Xcode and before Xcode project detection on an actual
+macOS build. It records the source and output hashes and Xcode version, then checks those outputs
+again before packing a candidate. The preparation receipt travels as an authenticated candidate
+artifact file. Promotion verifies its manifest and source hashes along with the binary's existing
+source, credential and artifact checks, and does not rebuild or require generated frameworks on
+Linux. Missing, stale or malformed evidence fails closed. The full tracked mobile source, including
+all scripts, lockfiles and configuration, remains part of the candidate fingerprint; the manifest
+is not a substitute for reviewing a dependency recipe or testing the produced software.
+
+Custom validation workflows that need the same graph can invoke the shipped helper before their
+native dependency guard:
+
+```sh
+python3 .github/actions/swift-app/scripts/native_preparation.py prepare \
+  "$GITHUB_WORKSPACE" tools/ios/native-deps.json "$RUNNER_TEMP/native-preparation.json"
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.208",
+  "version": "1.0.209",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/config/schema.mjs

@@ -44,6 +44,11 @@ function validateNamedSettings(config) {
   if (candidate !== undefined && typeof candidate !== 'boolean') {
     throw new MigrationRepair('candidate_setting_requires_boolean', '.gowalk-cicd.yml');
   }
+  const manifest = config.mobile?.ios?.['native-preparation-manifest'];
+  if (manifest !== undefined && (typeof manifest !== 'string' || !/^[A-Za-z0-9_.\/-]+$/.test(manifest) ||
+      manifest.startsWith('/') || manifest.split('/').some(part => !part || part === '.' || part === '..'))) {
+    throw new MigrationRepair('native_preparation_manifest_path_invalid', '.gowalk-cicd.yml');
+  }
   for (const platform of ['ios', 'android']) {
     const value = config.mobile?.[platform];
     const allowed = fields.filter(path => path[1] === platform).map(path => path[2]);

package/src/config/settings.mjs

@@ -6,7 +6,8 @@ const ios = ['jobs', 'ios', 'steps', 'items', 'id:ios', 'with'];
 const android = ['jobs', 'android', 'steps', 'items', 'id:android', 'with'];
 const backend = ['jobs', 'deploy', 'steps', 'items', 'name:Deploy backend', 'with'];
 const inputs = {
-  ios: ['project', 'workspace', 'scheme', 'configuration', 'bundle-id', 'team-id', 'firebase-app-id'],
+  ios: ['project', 'workspace', 'scheme', 'configuration', 'bundle-id', 'team-id', 'firebase-app-id',
+    'native-preparation-manifest'],
   android: ['project-dir', 'module', 'variant', 'firebase-app-id', 'dart-defines'],
   backend: ['ssh-key', 'host', 'app-name', 'api-domain', 'backend-dir', 'compose-file', 'health-path', 'runtime-env',
     'public-health-url', 'public-base-url', 'expected-build-sha', 'ingress-required', 'ingress-token'],
@@ -16,6 +17,8 @@ export function settingsPaths(file) {
   if (file === 'deploy.yml') return [
     { name: ['mobile', 'platforms'], path: mobile },
     ...inputs.ios.map(key => ({ name: ['mobile', 'ios', key], path: [...ios, key] })),
+    { name: ['mobile', 'ios', 'native-preparation-manifest'],
+      path: ['jobs', 'ios', 'env', 'NATIVE_PREPARATION_MANIFEST'] },
     ...inputs.android.map(key => ({ name: ['mobile', 'android', key], path: [...android, key] })),
   ];
   if (file === 'deploy-backend.yml') return inputs.backend.map(key => ({