gowalk-cicd 1.0.23 → 1.0.24

package/action/.daemux-version

@@ -1 +1 @@
-1.0.23
+1.0.24

package/action/scripts/capabilities.py

@@ -66,6 +66,28 @@ CAPABILITY_BY_ENTITLEMENT = {
 # so we say what is missing and stop.
 APP_ATTEST_ENTITLEMENT = "com.apple.developer.devicecheck.appattest-environment"
 
+# CarPlay capabilities are Apple-GRANTED per App ID (the CarPlay entitlement
+# request at https://developer.apple.com/contact/carplay/); the ASC API's
+# capabilityType enum has no CarPlay member, so a POST would 409 exactly like
+# App Attest. They live in MANUAL_ENTITLEMENTS (message, no POST) and in
+# PROFILE_ENTITLEMENT_KEYS (cache invalidation) — see the notes on each.
+CARPLAY_ENTITLEMENTS = {
+    "com.apple.developer.carplay-charging",
+    "com.apple.developer.carplay-fueling",
+    "com.apple.developer.carplay-parking",
+    "com.apple.developer.carplay-quick-ordering",
+    "com.apple.developer.carplay-maps",
+    "com.apple.developer.carplay-audio",
+    "com.apple.developer.carplay-communication",
+}
+
+_CARPLAY_MESSAGE = (
+    "a CarPlay entitlement, which Apple grants per App ID through the CarPlay "
+    "entitlement request form (developer.apple.com/contact/carplay/) — the "
+    "App Store Connect API cannot enable it. Request it from Apple, wait for "
+    "the grant, then re-run"
+)
+
 MANUAL_ENTITLEMENTS = {
     # App Attest is a real App ID capability in the developer portal, but it is
     # absent from the ASC API's capabilityType enum entirely — POSTing it
@@ -82,6 +104,7 @@ MANUAL_ENTITLEMENTS = {
     "com.apple.developer.in-app-payments": "Apple Pay",
     "com.apple.developer.pass-type-identifiers": "Wallet",
     "com.apple.developer.default-data-protection": "Data Protection",
+    **{key: _CARPLAY_MESSAGE for key in CARPLAY_ENTITLEMENTS},
 }
 
 
@@ -95,7 +118,16 @@ MANUAL_ENTITLEMENTS = {
 # Apple Pay, Wallet, Data Protection): those need App ID configuration this
 # action does not perform, so treating them as missing would regenerate the
 # profile on every single run without ever fixing anything.
-PROFILE_ENTITLEMENT_KEYS = set(CAPABILITY_BY_ENTITLEMENT) | {APP_ATTEST_ENTITLEMENT}
+#
+# CarPlay IS included, deliberately: a profile cached before Apple granted
+# the capability would otherwise be reinstalled until it expires, failing
+# every archive with no hint. Before the grant this forces a regenerate on
+# every run — which still fails, but loudly, with Apple's own message (and
+# the fail-fast in profile_manager); after the grant the fresh profile
+# carries the key and the check goes quiet.
+PROFILE_ENTITLEMENT_KEYS = (
+    set(CAPABILITY_BY_ENTITLEMENT) | {APP_ATTEST_ENTITLEMENT} | CARPLAY_ENTITLEMENTS
+)
 
 
 def missing_profile_entitlements(
@@ -109,6 +141,22 @@ def missing_profile_entitlements(
     }
 
 
+def missing_carplay_entitlements(
+    profile_entitlements: dict, required_keys: set[str]
+) -> set[str]:
+    """CarPlay keys the app needs that an issued profile does not carry.
+
+    Used as a pre-archive assertion: a freshly minted profile without the
+    granted CarPlay capability means Apple has not (yet) granted it, and the
+    archive would die later with an opaque xcodebuild error.
+    """
+    return {
+        key
+        for key in required_keys & CARPLAY_ENTITLEMENTS
+        if key not in profile_entitlements
+    }
+
+
 def read_entitlement_keys(path: Path) -> set[str]:
     """Top-level keys of an entitlements plist; empty when unreadable."""
     try:

package/action/scripts/profile_manager.py

@@ -262,6 +262,8 @@ def _provision_bundle(
     bundle_pk = bundle_pk or ensure_bundle_id(token, bid)
     delete_profile_by_name(token, name)
     profile_der = create_profile(token, name, bundle_pk, cert_id)
+    if entitlement_keys:
+        _assert_carplay_entitlements(profile_der, entitlement_keys, bid, name)
     uuid, team_id, expiration = install_profile(profile_der)
     creds_store.write_cached_profile(creds_dir, uuid, profile_der)
     entry = {
@@ -275,6 +277,38 @@ def _provision_bundle(
     return name, uuid, team_id, entry
 
 
+def _assert_carplay_entitlements(
+    profile_der: bytes, entitlement_keys: set[str], bid: str, name: str
+) -> None:
+    """Fail fast when a fresh profile lacks a required CarPlay capability.
+
+    CarPlay capabilities are Apple-granted per App ID and cannot be enabled
+    through the ASC API. Without this check the run dies much later inside
+    ``xcodebuild archive`` with an opaque "doesn't include the ... capability"
+    — here it dies immediately, saying exactly what to do.
+    """
+    try:
+        plist = decode_profile_plist(profile_der, _PROFILE_DIRS[0])
+    except (OSError, subprocess.CalledProcessError, ValueError) as exc:
+        print(f"::warning::could not inspect fresh profile for {bid}: {exc!r}")
+        return
+    missing = capabilities.missing_carplay_entitlements(
+        plist.get("Entitlements") or {}, entitlement_keys
+    )
+    if not missing:
+        return
+    keys = ", ".join(sorted(missing))
+    raise SystemExit(
+        f"::error::Profile {name} for {bid} was issued WITHOUT {keys}. "
+        f"CarPlay capabilities are granted by Apple per App ID via the "
+        f"CarPlay entitlement request (developer.apple.com/contact/carplay/) "
+        f"and cannot be enabled through the App Store Connect API. Until the "
+        f"grant lands, keep the CarPlay key out of the entitlements file "
+        f"used by this configuration; once Apple confirms it on the App ID, "
+        f"re-run — the profile is regenerated automatically."
+    )
+
+
 def _gc_orphan_profiles(
     creds_dir: Path, old_manifest: dict, new_entries: list[dict]
 ) -> None:

package/action/scripts/test_capabilities.py

@@ -199,5 +199,63 @@ class ReconcileTest(unittest.TestCase):
         self.assertTrue(any("App Groups" in w for w in warnings), warnings)
 
 
+class CarPlayEntitlementsTest(unittest.TestCase):
+    CHARGING = "com.apple.developer.carplay-charging"
+
+    def test_every_carplay_key_is_manual_with_a_request_form_message(self) -> None:
+        for key in capabilities.CARPLAY_ENTITLEMENTS:
+            self.assertIn(key, capabilities.MANUAL_ENTITLEMENTS, key)
+            self.assertIn("carplay", capabilities.MANUAL_ENTITLEMENTS[key].lower())
+
+    def test_carplay_never_maps_to_an_asc_capability_post(self) -> None:
+        # The ASC capabilityType enum has no CarPlay member; a POST would 409.
+        self.assertEqual(
+            capabilities.required_capabilities(capabilities.CARPLAY_ENTITLEMENTS),
+            set(),
+        )
+
+    def test_cached_profile_without_carplay_is_detected_as_stale(self) -> None:
+        # The self-correcting-cache check: a profile minted pre-grant must be
+        # regenerated once the entitlements file declares CarPlay.
+        self.assertEqual(
+            capabilities.missing_profile_entitlements(
+                {"application-identifier": "T.com.gowalk.ev"}, {self.CHARGING}
+            ),
+            {self.CHARGING},
+        )
+
+    def test_profile_carrying_carplay_passes_both_checks(self) -> None:
+        entitlements = {self.CHARGING: True}
+        self.assertEqual(
+            capabilities.missing_profile_entitlements(entitlements, {self.CHARGING}),
+            set(),
+        )
+        self.assertEqual(
+            capabilities.missing_carplay_entitlements(entitlements, {self.CHARGING}),
+            set(),
+        )
+
+    def test_missing_carplay_ignores_non_carplay_keys(self) -> None:
+        self.assertEqual(
+            capabilities.missing_carplay_entitlements(
+                {}, {"aps-environment", "keychain-access-groups"}
+            ),
+            set(),
+        )
+
+    def test_reconcile_warns_but_does_not_post_for_carplay(self) -> None:
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
+                mock.patch.object(capabilities, "request") as posted, \
+                mock.patch("builtins.print") as printed:
+            regenerate = capabilities.reconcile(
+                "tok", "PK", "com.gowalk.ev", {self.CHARGING}
+            )
+
+        posted.assert_not_called()
+        self.assertFalse(regenerate)
+        warnings = [c.args[0] for c in printed.call_args_list if c.args]
+        self.assertTrue(any("carplay" in w.lower() for w in warnings), warnings)
+
+
 if __name__ == "__main__":
     unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.23
+1.0.24

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.23
+1.0.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.23",
+  "version": "1.0.24",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {