gowalk-cicd 1.0.211 → 1.0.213

package/README.md

@@ -1335,6 +1335,16 @@ and the old handoff's metadata and release notes are never replayed. Missing, ex
 mismatched evidence remains refused; do not relabel a receipt or impersonate the original
 `GITHUB_*` environment. Normal delivery still refuses cancelled producers.
 
+From 1.0.212, incomplete GitHub job-step metadata is reconciled by reading the exact producer job
+within a 60-second budget per producer observation, also bounded by the verification deadline.
+From 1.0.213, historical recovery's final producer recheck gets a fresh budget after Apple processing.
+Complete observations add no wait. Producer identity, successful ordered transfer/handoff steps and artifact checks remain
+required; contradictory identity, duplicate steps or explicit transfer failure refuse immediately.
+`apple_upload_verify_producer_job_metadata_unavailable` means the required observations remained
+unavailable, not that the upload failed. Preserve its handoff and build; after GitHub supplies the
+complete steps, rerun only the failed **Verify Apple processing** job or use the managed recovery
+workflow. Never upload another binary to resolve this observation failure.
+
 The managed workflow retains `apple-recovered-<recovery-run>-<recovery-attempt>` with the
 unchanged `apple-verification.json`, its `.verified.json` proof and derived `.upload-receipt.json`.
 The proof identifies the original producer and the current recovery caller separately.

package/action/scripts/apple_upload_handoff.cjs

@@ -5,6 +5,7 @@ const {createHash} = require('node:crypto');
 const {join} = require('node:path');
 const github = require('./mobile_release_api.cjs');
 const {historicalProducer, uniqueArtifact} = require('./apple_upload_handoff_history.cjs');
+const {verifySteps} = require('./apple_upload_producer.cjs');
 const SCHEMA = 'gowalk-cicd/apple-upload-handoff.v1';
 const positive = value => Number.isSafeInteger(value) && value > 0;
 const id = value => typeof value === 'string' && /^[A-Za-z0-9-]{1,64}$/.test(value);
@@ -48,16 +49,7 @@ function read(path, digest, attempt, env = process.env) {
   return value;
 }
 
-function transferred(job) {
-  if (!Array.isArray(job.steps)) return false;
-  const selected = ['Build and transfer iOS binary', 'Retain Apple verification handoff'].map(name =>
-    job.steps.filter(step => step.name === name));
-  if (selected.some(steps => steps.length !== 1 || steps[0].status !== 'completed' ||
-      steps[0].conclusion !== 'success' || !positive(steps[0].number))) return false;
-  return selected[0][0].number < selected[1][0].number;
-}
-
-async function verifyProducer(value, artifactId, api = github, recoverCancelled = false) {
+async function verifyProducer(value, artifactId, api = github, recoverCancelled = false, options = {}) {
   if (!positive(artifactId)) fail('artifact_identity');
   const o = value.owner;
   const run = await api.request('GET', `/actions/runs/${o.run_id}/attempts/${o.run_attempt}`);
@@ -73,7 +65,8 @@ async function verifyProducer(value, artifactId, api = github, recoverCancelled
   // The producer's original failure remains red; only Apple delivery is reconciled here.
   const conclusions = recoverCancelled && run.conclusion === 'cancelled' ? ['cancelled'] : ['success', 'failure'];
   if (jobs.length !== 1 || jobs[0].status !== 'completed' || !conclusions.includes(jobs[0].conclusion) ||
-      jobs[0].head_sha !== o.source_sha || !transferred(jobs[0])) fail('producer_job');
+      jobs[0].head_sha !== o.source_sha) fail('producer_job');
+  await verifySteps(jobs[0], o, api, fail, options);
   const artifact = await api.request('GET', `/actions/artifacts/${artifactId}`);
   if (artifact.id !== artifactId || artifact.expired !== false || artifact.workflow_run?.id !== o.run_id ||
       artifact.workflow_run?.head_sha !== o.source_sha ||

package/action/scripts/apple_upload_producer.cjs

@@ -0,0 +1,47 @@
+/* Reconcile incomplete GitHub step observations without relaxing producer identity or transfer proof. */
+'use strict';
+const {setTimeout: delay} = require('node:timers/promises');
+const positive = value => Number.isSafeInteger(value) && value > 0;
+const names = ['Build and transfer iOS binary', 'Retain Apple verification handoff'];
+
+function stepsReady(job, fail) {
+  if (!Array.isArray(job.steps)) fail('producer_job');
+  const selected = names.map(name => job.steps.filter(step => step.name === name));
+  for (const steps of selected) {
+    if (steps.length > 1) fail('producer_job');
+    if (!steps.length) continue;
+    const step = steps[0];
+    if (!positive(step.number) || step.conclusion && step.conclusion !== 'success') fail('producer_job');
+  }
+  if (selected.some(steps => !steps.length || steps[0].status !== 'completed' ||
+      steps[0].conclusion !== 'success')) return false;
+  if (selected[0][0].number >= selected[1][0].number) fail('producer_job');
+  return true;
+}
+
+function identity(job, original, owner, fail) {
+  if (!positive(job.id) || job.id !== original.id || job.name !== original.name ||
+      job.run_id !== owner.run_id || job.run_attempt !== owner.run_attempt ||
+      job.head_sha !== owner.source_sha || job.status !== original.status ||
+      job.conclusion !== original.conclusion) fail('producer_job');
+}
+
+async function verifySteps(original, owner, api, fail, options = {}) {
+  const now = options.now || Date.now, sleep = options.sleep || delay;
+  const deadline = Math.min(options.deadline ?? Infinity, now() + 60000);
+  identity(original, original, owner, fail);
+  if (now() >= deadline) fail('producer_job_metadata_unavailable');
+  if (stepsReady(original, fail)) return;
+  while (now() < deadline) {
+    const job = await api.request('GET', `/actions/jobs/${original.id}`, undefined,
+      Math.max(1, Math.min(10000, deadline - now())));
+    identity(job, original, owner, fail);
+    if (now() >= deadline) fail('producer_job_metadata_unavailable');
+    if (stepsReady(job, fail)) return;
+    if (now() < deadline) await sleep(Math.min(5000, deadline - now()));
+  }
+  // Missing metadata is not failed transfer proof and must never authorize another upload.
+  fail('producer_job_metadata_unavailable');
+}
+
+module.exports = {verifySteps};

package/action/scripts/apple_upload_verify.cjs

@@ -25,7 +25,9 @@ async function verify(value, artifactId, timeout, dependencies = {}) {
   const sleep = dependencies.sleep || delay, started = now(), deadline = started + timeout * 1000;
   const key = dependencies.get ? null : credential();
   const get = dependencies.get || (path => apple.appleGet(path, key, Math.max(1, Math.min(30000, deadline - now()))));
-  await handoff.verifyProducer(value, artifactId, api, dependencies.recoverCancelled === true);
+  // Each producer observation has its own bounded metadata readback within this verification deadline.
+  const observation = {now, sleep, deadline};
+  await handoff.verifyProducer(value, artifactId, api, dependencies.recoverCancelled === true, observation);
   await handoff.phase(value, api);
   let proof;
   do {
@@ -36,7 +38,7 @@ async function verify(value, artifactId, timeout, dependencies = {}) {
   } while (now() < deadline);
   if (!proof) handoff.fail('processing_pending');
   // Explicit historical recovery rechecks its terminal producer before the only write.
-  if (dependencies.recoverCancelled === true) await handoff.verifyProducer(value, artifactId, api, true);
+  if (dependencies.recoverCancelled === true) await handoff.verifyProducer(value, artifactId, api, true, observation);
   const prior = await handoff.phase(value, api);
   if (prior === 'uploading') await api.status(value.owner.deployment_id, 'uploaded', 'success');
   if (await handoff.phase(value, api) !== 'uploaded') handoff.fail('write_unconfirmed');

package/action/scripts/mobile_release_api.cjs

@@ -10,6 +10,7 @@ function request(method, path, body, timeoutMs = 30000) {
     throw Error('mobile_release_repository_invalid');
   }
   const data = body === undefined ? null : JSON.stringify(body);
+  let timer;
   return new Promise((resolve, reject) => {
     const req = https.request({hostname: 'api.github.com', path: `/repos/${repo}${path}`, method,
       headers: {'User-Agent': 'gowalk-cicd', Accept: 'application/vnd.github+json',
@@ -25,10 +26,10 @@ function request(method, path, body, timeoutMs = 30000) {
         try { resolve(JSON.parse(text)); } catch { reject(Error('mobile_release_receipt_invalid')); }
       });
     });
-    req.setTimeout(timeoutMs, () => req.destroy(Error('timeout')));
+    timer = setTimeout(() => req.destroy(Error('timeout')), timeoutMs);
     req.on('error', () => reject(Error('mobile_release_receipt_transport_unconfirmed')));
     req.end(data);
-  });
+  }).finally(() => clearTimeout(timer));
 }
 
 function uncertain(error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.211",
+  "version": "1.0.213",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {