gowalk-cicd 1.0.24 → 1.0.26

package/README.md

@@ -145,6 +145,26 @@ Before building, the Android job caps `-Xmx` at 4 GB and `MaxMetaspaceSize` at
 2 GB in the checkout, with a `::warning::` naming the original value. Projects
 already at or below those numbers are left untouched. Linux only.
 
+### When Play will not accept a release for review
+
+Once an app has changes that Google requires a person to submit — most often
+after a policy rejection — the API refuses to commit them:
+
+```
+Changes cannot be sent for review automatically. Please set the query parameter
+changesNotSentForReview to true. Once committed, the changes in this edit can be
+sent for review from the Google Play Console UI.
+```
+
+That fails the whole upload, so the bundle you just built never reaches Play at
+all. The retry re-uploads with `changesNotSentForReview`, which lands the bundle
+and leaves it waiting, then emits a `::warning::` naming the package. Someone
+then presses **Send changes for review** on that app's Publishing overview page.
+There is no API for that press — it is the one step Google deliberately reserves
+for a human, and no amount of tooling removes it.
+
+In the ordinary case the first upload submits normally and the retry is skipped.
+
 ### Google Play upload retry
 
 A Play edit is a short-lived server-side object, and an AAB upload that runs

package/action/.daemux-version

@@ -1 +1 @@
-1.0.24
+1.0.26

package/action/scripts/pbxproj_editor.py

@@ -101,8 +101,22 @@ def _entitlements_from_configs(
     resolve exactly, and then only accepted when the resulting file is really
     there — a missed entitlements file costs a clearer error, a wrong one costs
     a wrong App ID edit.
+
+    Only the ARCHIVE configuration counts: CI archives Release, so its
+    CODE_SIGN_ENTITLEMENTS (falling back to Profile, then to every config
+    only when neither exists) decides provisioning. An entitlement wired
+    into Debug alone — the standard way to simulator-test an Apple-granted
+    capability (CarPlay) before the grant lands — must NOT force that
+    capability onto the App ID for the archive.
     """
-    for cid in config_ids:
+    by_name = {
+        ((objects.get(cid) or {}).get("name") or "").lower(): cid
+        for cid in config_ids
+    }
+    archive_cid = by_name.get("release") or by_name.get("profile")
+    candidates = [archive_cid] if archive_cid else config_ids
+
+    for cid in candidates:
         cfg = objects.get(cid) or {}
         settings = cfg.get("buildSettings") or {}
         value = (settings.get("CODE_SIGN_ENTITLEMENTS") or "").strip().strip('"')

package/action/scripts/test_pbxproj_editor.py

@@ -76,5 +76,78 @@ class EntitlementsFromConfigsTest(unittest.TestCase):
             _entitlements_from_configs({"cfg": {"buildSettings": {}}}, ["cfg"]), "")
 
 
+
+
+class ReleaseConfigPriorityTest(unittest.TestCase):
+    """Release must drive provisioning: an entitlement wired into Debug only
+    (the pre-grant CarPlay simulator-testing setup) must not require the
+    capability on the App ID for the Release archive."""
+
+    def _objects(self):
+        return {
+            "dbg": {
+                "name": "Debug",
+                "buildSettings": {"CODE_SIGN_ENTITLEMENTS": "App/Debug.entitlements"},
+            },
+            "rel": {"name": "Release", "buildSettings": {}},
+            "prof": {"name": "Profile", "buildSettings": {}},
+        }
+
+    def test_debug_only_entitlements_are_invisible_when_release_has_none(self):
+        # The pre-grant CarPlay setup: entitlements wired into Debug for the
+        # simulator, Release deliberately unwired so the archive needs no
+        # Apple-granted capability. The archive config decides — result "".
+        objects = self._objects()
+        self.assertEqual(
+            _entitlements_from_configs(
+                objects, ["dbg", "rel", "prof"], target_name="App",
+                base=Path("/nonexistent")),
+            "",
+        )
+
+    def test_all_configs_scanned_when_no_release_or_profile_exists(self):
+        objects = {
+            "a": {"name": "Staging", "buildSettings": {}},
+            "b": {
+                "name": "Custom",
+                "buildSettings": {"CODE_SIGN_ENTITLEMENTS": "App/App.entitlements"},
+            },
+        }
+        self.assertEqual(
+            _entitlements_from_configs(
+                objects, ["a", "b"], target_name="App", base=Path("/nonexistent")),
+            "App/App.entitlements",
+        )
+
+    def test_release_wins_over_debug_regardless_of_order(self):
+        objects = self._objects()
+        objects["rel"]["buildSettings"]["CODE_SIGN_ENTITLEMENTS"] = (
+            "App/Release.entitlements")
+        for order in (["dbg", "rel", "prof"], ["rel", "dbg", "prof"]):
+            self.assertEqual(
+                _entitlements_from_configs(
+                    objects, order, target_name="App", base=Path("/nonexistent")),
+                "App/Release.entitlements",
+            )
+
+    def test_profile_is_the_archive_config_when_release_does_not_exist(self):
+        objects = {
+            "dbg": {
+                "name": "Debug",
+                "buildSettings": {"CODE_SIGN_ENTITLEMENTS": "App/Debug.entitlements"},
+            },
+            "prof": {
+                "name": "Profile",
+                "buildSettings": {"CODE_SIGN_ENTITLEMENTS": "App/Profile.entitlements"},
+            },
+        }
+        self.assertEqual(
+            _entitlements_from_configs(
+                objects, ["dbg", "prof"], target_name="App",
+                base=Path("/nonexistent")),
+            "App/Profile.entitlements",
+        )
+
+
 if __name__ == "__main__":
     unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.24
+1.0.26

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.24
+1.0.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.24",
+  "version": "1.0.26",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -287,7 +287,20 @@ jobs:
           # release. Empty when the directory is absent — the action skips it.
           whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
 
-      - name: Retry Google Play upload
+      # The retry serves two different failures, and both need a fresh edit:
+      #   * the edit expired mid-upload (a large bundle on a slow runner), and
+      #   * Play refused to auto-submit: "Changes cannot be sent for review
+      #     automatically. Please set changesNotSentForReview to true." Play returns
+      #     this once an app has changes a human must submit — after a policy
+      #     rejection, for instance — and it fails the whole upload, so the built
+      #     bundle never lands at all.
+      # Retrying with changesNotSentForReview gets the bundle onto Play either way.
+      # In the ordinary case the first attempt already submitted it and this is
+      # skipped; in the refused case the bundle is uploaded and waits for someone to
+      # press "Send changes for review" in Play Console, which is the only thing
+      # Google will not let a tool do.
+      - name: Retry Google Play upload without auto-submit
+        id: play-upload-retry
         if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' && steps.play-upload.outcome == 'failure' }}
         uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
         with:
@@ -298,3 +311,13 @@ jobs:
           status: ${{ vars.GOOGLE_PLAY_STATUS || 'completed' }}
           userFraction: ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
           whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
+          changesNotSentForReview: true
+
+      - name: Say what still needs a human
+        if: ${{ always() && steps.play-upload-retry.outcome == 'success' }}
+        shell: bash
+        run: |
+          echo "::warning::Play would not accept this release for review automatically, so it was \
+          uploaded without being submitted. Open Play Console for \
+          ${{ steps.android.outputs.package-name }} and press 'Send changes for review' on the \
+          Publishing overview page. This is normal after a policy rejection."