gowalk-cicd 1.0.26 → 1.0.28

package/CLAUDE.md

@@ -99,3 +99,16 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - Version stamping is per-build-system: Flutter takes `--build-number`, Gradle
   has no equivalent, so `set_gradle_version()` rewrites the literal in the
   checkout the way the iOS action patches the pbxproj. Never commit that edit.
+  The rewrite is best-effort — a module that computes its versionCode has no
+  literal to rewrite — so the Gradle build additionally applies the resolved
+  values through the Variant API (`scripts/version_override.init.gradle`,
+  passed as `--init-script`). That override, not the rewrite, is what makes the
+  number authoritative. Do NOT reach for `-Pandroid.injected.version.code`:
+  those properties were removed in AGP 7.3 and are silently ignored by every
+  AGP 8.x app in the fleet.
+- The JDK is chosen by `scripts/select_jdk.py`, called from the workflow before
+  `setup-java`. The `JAVA_VERSION` repo variable always wins; otherwise Flutter
+  gets 17 and native Gradle gets 21, except that a positively-detected Kotlin
+  Gradle plugin below 1.9.20 drops to 17 (older kapt cannot run under JDK 21).
+  Detection logic belongs in that script, where it is unit-tested — not inline
+  in the workflow template, where nothing can test it.

package/README.md

@@ -133,6 +133,33 @@ in Play Console; every later run detects API readiness and uploads to the
 `internal` track automatically. Override the track or status with repository
 variables `GOOGLE_PLAY_TRACK` and `GOOGLE_PLAY_STATUS`.
 
+### Choosing the JDK
+
+Flutter apps build on JDK 17 and native Gradle apps on JDK 21. Set the
+repository variable `JAVA_VERSION` to pin a different one — it always wins, and
+nothing second-guesses it:
+
+```bash
+gh variable set JAVA_VERSION --body 17
+```
+
+Left unset, the Android job keeps those defaults with one exception: a native
+Gradle app whose Kotlin Gradle plugin is older than **1.9.20** gets JDK 17,
+because 1.9.20 is the release that added JDK 21 support. Older `kapt` reaches
+into `javac` internals that JDK 21 moved, and the build dies with
+
+```
+Execution failed for task ':app:kaptGenerateStubsReleaseKotlin'
+> Internal compiler error. See log for more details
+```
+
+which names neither Kotlin nor the JDK. The job logs the JDK it picked and why.
+
+The downgrade only fires when the Kotlin plugin version can actually be read
+out of the repo — `build.gradle(.kts)`, `gradle.properties`,
+`gradle/libs.versions.toml`, or a `buildSrc` version object. When it cannot, or
+when the project explicitly targets Java 21 or newer, the app keeps JDK 21.
+
 ### Gradle daemon heap
 
 A `gradle.properties` sized for a workstation does not fit a CI runner.
@@ -322,18 +349,35 @@ configuration for either:
 | App module | `android/app` | the one module applying `com.android.application` (version-catalog aliases are resolved; a module named `app` wins a tie against a wear/automotive sibling) |
 | Tests (`run-tests`) | `flutter analyze` + `flutter test` | `gradlew test` (all variants, all modules) |
 | Build | `flutter build appbundle --release` | `<module>:bundleRelease` |
-| Toolchain installed | Flutter + JDK 17 | JDK 21 only |
+| Toolchain installed | Flutter + JDK 17 | JDK 21, or 17 on an old Kotlin — see [Choosing the JDK](#choosing-the-jdk) |
 
 A Flutter app also carries `android/settings.gradle`, so `pubspec.yaml` wins the
 tie — Flutter apps must be built through the Flutter tool.
 
-Gradle has no equivalent of `flutter build --build-number`, so the action
-rewrites the literal `versionCode` (and `versionName`, when `build-name` is
-set) in the app module's build file inside the CI checkout — the Gradle
-counterpart to the iOS action patching the `.pbxproj`. The edit is never
-committed back. If the module computes its `versionCode` instead of declaring a
-literal, the action emits a `::warning::` and leaves the project's own value
-alone.
+Gradle has no equivalent of `flutter build --build-number`, so the action does
+two things. It rewrites the literal `versionCode` (and `versionName`, when
+`build-name` is set) in the app module's build file inside the CI checkout —
+the Gradle counterpart to the iOS action patching the `.pbxproj`, never
+committed back — and it applies the same values to the build through AGP's
+Variant API, using a Gradle init script.
+
+The second one is what makes the resolved `versionCode` authoritative. A module
+that computes its version has no literal to rewrite:
+
+```groovy
+ext.code = 31
+versionCode code
+```
+
+Before, that build shipped whatever the checkout said and Play answered
+`Version code 31 has already been used`, failing the upload and the
+no-auto-submit retry alike — the number was baked into the bundle. The init
+script overrides it whatever the build file does, and needs no cooperation from
+the app.
+
+> AGP's `-Pandroid.injected.version.code` looks like the obvious way to do this
+> and is a silent no-op: the property was removed in AGP 7.3, so every AGP 8.x
+> app ignores it without reporting anything.
 
 ### Build toolchain floors (Flutter apps)
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.26
+1.0.28

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.26
+1.0.28

package/android-action/action.yml

@@ -106,9 +106,11 @@ runs:
         flutter "${args[@]}"
 
     # --- Native Gradle --------------------------------------------------
-    # resolve_android.py has already rewritten versionCode/versionName in the
-    # module build file, so these are plain Gradle invocations with no extra
-    # properties for the project to have to opt into reading.
+    # resolve_android.py rewrites versionCode/versionName in the module build
+    # file when it can find a literal to rewrite, and the build step below
+    # additionally overrides them through the Variant API so the resolved
+    # versionCode holds even when there is no literal — see
+    # scripts/version_override.init.gradle.
     # `test` is the aggregate task ("Run unit tests for all variants") and is the
     # only one guaranteed to exist: AGP only creates testXUnitTest tasks for the
     # variants it enables, and AGP 9 disables the release unit test variant by
@@ -123,13 +125,21 @@ runs:
         chmod +x ./gradlew
         ./gradlew test --console=plain --stacktrace
 
+    # ANDROID_BUILD_NUMBER is already in the environment: resolve_android.py
+    # exported it through GITHUB_ENV. ANDROID_BUILD_NAME is only set when the
+    # caller actually pinned a build-name — empty means "leave versionName
+    # alone", which the init script honours.
     - name: Build release Android App Bundle with Gradle
       if: ${{ steps.config.outputs.project_kind == 'gradle' }}
       shell: bash
       working-directory: ${{ steps.config.outputs.gradle_root || '.' }}
+      env:
+        ANDROID_BUILD_NAME: ${{ inputs.build-name }}
       run: |
         chmod +x ./gradlew
-        ./gradlew "${ANDROID_GRADLE_MODULE}:bundleRelease" --console=plain --stacktrace
+        ./gradlew "${ANDROID_GRADLE_MODULE}:bundleRelease" \
+          --init-script "${{ github.action_path }}/scripts/version_override.init.gradle" \
+          --console=plain --stacktrace
 
     # --- Shared ---------------------------------------------------------
     - name: Locate Android App Bundle

package/android-action/scripts/resolve_android.py

@@ -108,9 +108,11 @@ def auto_build_number(package_name: str, service_account: Path) -> int:
 def apply_gradle_version(project, build_number: int, build_name: str) -> None:
     """Write the resolved versionCode/versionName into the Gradle module.
 
-    A miss is a warning rather than an error: the declared versionCode is still
-    valid for a first upload, and Play rejects a genuine duplicate with a far
-    clearer message than anything this script could guess at here.
+    A miss is not a problem: the build step applies the same values through the
+    Variant API (scripts/version_override.init.gradle), which needs no literal
+    to rewrite and is what makes the resolved versionCode authoritative. This
+    rewrite stays because it also fixes up anything that reads the build file
+    directly, and because it is what the fleet has been running.
     """
     applied = set_gradle_version(project.build_file, build_number, build_name or None)
     relative = project.build_file.name
@@ -118,13 +120,13 @@ def apply_gradle_version(project, build_number: int, build_name: str) -> None:
         print(f"Pinned versionCode {build_number} in {project.module}/{relative}")
     else:
         print(
-            f"::warning::No literal versionCode found in {project.module}/{relative}; "
-            f"leaving the project's own value in place"
+            f"No literal versionCode in {project.module}/{relative}; the Gradle build "
+            f"will be given versionCode {build_number} through the Variant API instead"
         )
     if build_name and not applied["version_name"]:
         print(
-            f"::warning::No literal versionName found in {project.module}/{relative}; "
-            f"build-name {build_name} was not applied"
+            f"No literal versionName in {project.module}/{relative}; the Gradle build "
+            f"will be given versionName {build_name} through the Variant API instead"
         )
 
 

package/android-action/scripts/select_jdk.py

@@ -0,0 +1,213 @@
+#!/usr/bin/env python3
+"""Choose the JDK the Android job installs, without breaking old toolchains.
+
+The workflow used to hardcode the choice: 17 for Flutter, 21 for everything
+else. That silently assumes every native Gradle app is new enough for JDK 21,
+and an old one is not — Kotlin only learned to run kapt under JDK 21 in 1.9.20.
+Older kapt reaches into javac internals that JDK 21 moved, so the build dies with
+
+    Execution failed for task ':app:kaptGenerateStubsReleaseKotlin'
+    > Internal compiler error. See log for more details
+
+which names neither Kotlin nor the JDK. The same build is fine on 17.
+
+Order of precedence:
+
+1. the JAVA_VERSION repository variable, which always wins and is never
+   second-guessed — an app that needs a specific JDK says so and that is that;
+2. Flutter apps: 17, unchanged;
+3. native Gradle apps whose Kotlin Gradle plugin predates JDK 21 support: 17;
+4. everything else: 21, unchanged.
+
+Rule 3 only ever fires on a build that is already broken, and only when the
+Kotlin plugin version is positively identified. A project that explicitly asks
+for Java 21 or newer keeps 21 even on old Kotlin: downgrading it would break a
+build that currently works, and "change nothing that works" outranks the
+kapt repair.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+from pathlib import Path
+
+FLUTTER_JDK = "17"
+GRADLE_JDK = "21"
+LEGACY_KOTLIN_JDK = "17"
+
+# Kotlin 1.9.20 is the first release that supports compiling *and* running kapt
+# under JDK 21. Anything below it needs the older JDK.
+KOTLIN_JDK21_FLOOR = (1, 9, 20)
+
+VERSION = r"([0-9]+(?:\.[0-9]+){1,2})"
+
+# Only the Kotlin *Gradle plugin* version decides this. Patterns deliberately
+# require the plugin coordinate or a version-property assignment, so an
+# unrelated Kotlin-adjacent dependency (kotlinx-coroutines 1.6.4, say) cannot
+# masquerade as an old compiler and drag a modern repo down to JDK 17.
+KOTLIN_PLUGIN_PATTERNS = (
+    # ext.kotlin_version = '1.6.21'   |   kotlinVersion = "1.9.0"
+    re.compile(rf"""kotlin[_-]?version\s*[=:]\s*["']{VERSION}["']""", re.IGNORECASE),
+    # classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:1.6.21"
+    re.compile(rf"""kotlin-gradle-plugin["']?\s*:\s*["']?{VERSION}"""),
+    # id 'org.jetbrains.kotlin.android' version '1.9.0'
+    re.compile(rf"""org\.jetbrains\.kotlin[\w.]*["']\s*\)?\s*version\s*["']{VERSION}["']"""),
+    # kotlin("android") version "1.9.0"
+    re.compile(rf"""kotlin\(\s*["'][\w.-]+["']\s*\)\s*version\s*["']{VERSION}["']"""),
+    # gradle/libs.versions.toml:  kotlin = "1.9.24"
+    # buildSrc Config.kt:         const val kotlin = "1.3.61"
+    # `kotlinx = "..."` deliberately does not match: the coroutines/serialization
+    # libraries version independently of the compiler.
+    re.compile(
+        rf"""(?m)^\s*(?:(?:const|private|internal|public)\s+)*(?:va[lr]\s+)?"""
+        rf"""kotlin(?:[_-]?version)?\s*=\s*["']{VERSION}["']""",
+        re.IGNORECASE,
+    ),
+)
+
+# An explicit request for Java 21+. If the project asks for it, it gets it —
+# see the module docstring.
+JAVA_TARGET_PATTERNS = (
+    re.compile(r"jvmToolchain\s*\(\s*(?:JavaLanguageVersion\.of\s*\(\s*)?([0-9]{2})"),
+    re.compile(r"languageVersion\s*=\s*JavaLanguageVersion\.of\s*\(\s*([0-9]{2})"),
+    re.compile(r"JavaVersion\.VERSION_([0-9]{2})\b"),
+    re.compile(
+        r"""(?:sourceCompatibility|targetCompatibility|jvmTarget)\s*=?\s*["']?([0-9]{2})["']?"""
+    ),
+)
+
+# Where a repo can declare its toolchain. Both roots are checked because the
+# Gradle build lives at the repo root for a standalone Android app and under
+# android/ for a repo that also holds another platform's sources — the same
+# two candidates android_config.GRADLE_ROOT_CANDIDATES uses.
+GRADLE_ROOTS = (".", "android")
+ROOT_FILES = (
+    "build.gradle",
+    "build.gradle.kts",
+    "gradle.properties",
+    "gradle/libs.versions.toml",
+)
+MODULE_FILES = ("build.gradle", "build.gradle.kts")
+BUILDSRC_FILE_LIMIT = 50
+
+
+def parse_version(text: str) -> tuple[int, ...]:
+    """'1.9' -> (1, 9, 0); '1.6.21' -> (1, 6, 21)."""
+    parts = [int(piece) for piece in text.split(".")]
+    while len(parts) < 3:
+        parts.append(0)
+    return tuple(parts[:3])
+
+
+def candidate_files(workspace: Path) -> list[Path]:
+    """Build files that could carry the Kotlin plugin or Java target."""
+    found: list[Path] = []
+    for relative in GRADLE_ROOTS:
+        root = workspace / relative
+        if not root.is_dir():
+            continue
+        for name in ROOT_FILES:
+            path = root / name
+            if path.is_file():
+                found.append(path)
+        # One level down catches :app and any sibling module. Deeper nesting is
+        # not worth walking: a module that pins its own Kotlin plugin version
+        # below the root's is vanishingly rare, and a miss just keeps today's
+        # behaviour.
+        for child in sorted(p for p in root.iterdir() if p.is_dir()):
+            if child.name.startswith(".") or child.name == "build":
+                continue
+            for name in MODULE_FILES:
+                path = child / name
+                if path.is_file():
+                    found.append(path)
+        # A buildSrc repo keeps its versions in Kotlin source rather than in a
+        # build file (`object Config { val kotlin = "1.3.61" }`), so the build
+        # files above say nothing at all. Capped because this is the only place
+        # we walk a tree of unknown depth.
+        sources = sorted((root / "buildSrc" / "src").rglob("*.kt"))
+        found.extend(sources[:BUILDSRC_FILE_LIMIT])
+    return found
+
+
+def _read(path: Path) -> str:
+    try:
+        return path.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return ""
+
+
+def kotlin_plugin_version(workspace: Path) -> tuple[int, ...] | None:
+    """Lowest Kotlin Gradle plugin version this repo declares, or None.
+
+    Lowest rather than highest on purpose: if any module still compiles with an
+    old Kotlin, that module's kapt is the one that will break under JDK 21.
+    """
+    found: list[tuple[int, ...]] = []
+    for path in candidate_files(workspace):
+        text = _read(path)
+        for pattern in KOTLIN_PLUGIN_PATTERNS:
+            found.extend(parse_version(match) for match in pattern.findall(text))
+    return min(found) if found else None
+
+
+def requests_java_21_or_newer(workspace: Path) -> bool:
+    for path in candidate_files(workspace):
+        text = _read(path)
+        for pattern in JAVA_TARGET_PATTERNS:
+            for match in pattern.findall(text):
+                if int(match) >= 21:
+                    return True
+    return False
+
+
+def select_jdk(workspace: Path, override: str, flutter: bool) -> tuple[str, str]:
+    """Return (java-version, why) for actions/setup-java."""
+    override = (override or "").strip()
+    if override:
+        # setup-java takes a bare major version. Anything else is a typo at best,
+        # and a multi-line value would append extra keys to $GITHUB_OUTPUT and
+        # invent step outputs, so refuse it rather than pass it through.
+        if not override.isdigit():
+            print(
+                f"::warning::Ignoring JAVA_VERSION={override!r}; expected a major "
+                "version number such as 17 or 21"
+            )
+        else:
+            return override, "JAVA_VERSION repository variable"
+    if flutter:
+        return FLUTTER_JDK, "Flutter app"
+    kotlin = kotlin_plugin_version(workspace)
+    if kotlin is None:
+        return GRADLE_JDK, "native Gradle app (Kotlin plugin version not declared in-repo)"
+    pretty = ".".join(str(part) for part in kotlin)
+    if kotlin >= KOTLIN_JDK21_FLOOR:
+        return GRADLE_JDK, f"native Gradle app on Kotlin {pretty}"
+    if requests_java_21_or_newer(workspace):
+        return GRADLE_JDK, (
+            f"native Gradle app on Kotlin {pretty}, which predates JDK 21 support, "
+            f"but the project explicitly targets Java 21+"
+        )
+    return LEGACY_KOTLIN_JDK, (
+        f"native Gradle app on Kotlin {pretty}; kapt only supports JDK 21 from "
+        f"1.9.20, so this build needs JDK {LEGACY_KOTLIN_JDK}"
+    )
+
+
+def main() -> None:
+    workspace = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
+    version, why = select_jdk(
+        workspace,
+        os.environ.get("JAVA_VERSION", ""),
+        os.environ.get("FLUTTER_ENABLED", "") == "true",
+    )
+    print(f"Using JDK {version} — {why}")
+    output = os.environ.get("GITHUB_OUTPUT")
+    if output:
+        with Path(output).open("a") as stream:
+            stream.write(f"version={version}\n")
+
+
+if __name__ == "__main__":
+    main()

package/android-action/scripts/test_select_jdk.py

@@ -0,0 +1,213 @@
+#!/usr/bin/env python3
+
+from __future__ import annotations
+
+import tempfile
+import unittest
+from pathlib import Path
+
+from select_jdk import (
+    kotlin_plugin_version,
+    parse_version,
+    requests_java_21_or_newer,
+    select_jdk,
+)
+
+
+class SelectJdkTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temp = tempfile.TemporaryDirectory()
+        self.workspace = Path(self.temp.name)
+
+    def tearDown(self) -> None:
+        self.temp.cleanup()
+
+    def write(self, relative: str, text: str) -> Path:
+        path = self.workspace / relative
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(text)
+        return path
+
+    def version_of(self, flutter: bool = False, override: str = "") -> str:
+        return select_jdk(self.workspace, override, flutter)[0]
+
+    # --- the explicit override ------------------------------------------
+    def test_repo_variable_beats_everything(self) -> None:
+        self.write("build.gradle", "ext.kotlin_version = '1.6.21'")
+
+        for flutter in (True, False):
+            self.assertEqual(self.version_of(flutter=flutter, override="11"), "11")
+
+    def test_override_is_trimmed_and_blank_is_ignored(self) -> None:
+        self.assertEqual(self.version_of(override=" 23 "), "23")
+        self.assertEqual(self.version_of(flutter=True, override="   "), "17")
+
+    def test_malformed_override_is_refused_not_passed_through(self) -> None:
+        # setup-java wants a bare major version. A multi-line value would append
+        # extra `key=value` lines to $GITHUB_OUTPUT and invent step outputs, so a
+        # value that is not all digits must fall through to the normal choice
+        # rather than reach the workflow.
+        self.write("build.gradle", "ext.kotlin_version = '2.0.21'")
+
+        for bad in ("17\nEVIL=1", "seventeen", "17;rm -rf /", "17.0.2"):
+            with self.subTest(override=bad):
+                self.assertEqual(self.version_of(override=bad), "21")
+
+    def test_override_reason_names_the_variable(self) -> None:
+        _, why = select_jdk(self.workspace, "17", flutter=False)
+
+        self.assertIn("JAVA_VERSION", why)
+
+    # --- today's defaults, which must not move --------------------------
+    def test_flutter_still_gets_17(self) -> None:
+        self.assertEqual(self.version_of(flutter=True), "17")
+
+    def test_native_gradle_still_gets_21_by_default(self) -> None:
+        self.assertEqual(self.version_of(), "21")
+
+    def test_modern_kotlin_still_gets_21(self) -> None:
+        self.write("build.gradle", "ext.kotlin_version = '2.0.21'")
+
+        self.assertEqual(self.version_of(), "21")
+
+    def test_kotlin_exactly_at_the_floor_gets_21(self) -> None:
+        self.write("build.gradle", "ext.kotlin_version = '1.9.20'")
+
+        self.assertEqual(self.version_of(), "21")
+
+    def test_unresolvable_kotlin_version_keeps_21(self) -> None:
+        # The overwhelmingly common Groovy idiom: the classpath interpolates a
+        # property, so the coordinate itself carries no digits.
+        self.write(
+            "build.gradle",
+            'classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"',
+        )
+
+        self.assertEqual(self.version_of(), "21")
+
+    def test_kotlinx_dependencies_do_not_masquerade_as_the_plugin(self) -> None:
+        self.write(
+            "app/build.gradle",
+            'implementation "org.jetbrains.kotlinx:kotlinx-coroutines-core:1.6.4"\n'
+            'implementation "org.jetbrains.kotlinx:kotlinx-serialization-json:1.5.1"\n',
+        )
+
+        self.assertIsNone(kotlin_plugin_version(self.workspace))
+        self.assertEqual(self.version_of(), "21")
+
+    # --- the repair -----------------------------------------------------
+    def test_old_kotlin_drops_to_17(self) -> None:
+        # gowalk-public/android-taxi-deals: kapt dies with an "Internal compiler
+        # error" on JDK 21 and builds fine on 17.
+        self.write("build.gradle", "ext.kotlin_version = '1.6.21'")
+
+        version, why = select_jdk(self.workspace, "", flutter=False)
+        self.assertEqual(version, "17")
+        self.assertIn("1.6.21", why)
+
+    def test_old_kotlin_detected_in_the_android_subdirectory(self) -> None:
+        self.write("android/build.gradle", "ext.kotlin_version = '1.7.10'")
+
+        self.assertEqual(self.version_of(), "17")
+
+    def test_old_kotlin_in_a_module_wins_over_a_modern_root(self) -> None:
+        self.write("build.gradle", "ext.kotlin_version = '2.0.21'")
+        self.write("legacy/build.gradle", "ext.kotlin_version = '1.5.31'")
+
+        self.assertEqual(kotlin_plugin_version(self.workspace), (1, 5, 31))
+        self.assertEqual(self.version_of(), "17")
+
+    def test_a_project_that_asks_for_java_21_keeps_21(self) -> None:
+        # Downgrading this one would break a build that works today.
+        self.write("build.gradle", "ext.kotlin_version = '1.8.22'")
+        self.write("app/build.gradle", "kotlin { jvmToolchain(21) }")
+
+        version, why = select_jdk(self.workspace, "", flutter=False)
+        self.assertEqual(version, "21")
+        self.assertIn("explicitly targets Java 21+", why)
+
+    def test_java_17_target_does_not_block_the_downgrade(self) -> None:
+        self.write("build.gradle", "ext.kotlin_version = '1.8.22'")
+        self.write(
+            "app/build.gradle",
+            "compileOptions {\n"
+            "  sourceCompatibility JavaVersion.VERSION_17\n"
+            "  targetCompatibility JavaVersion.VERSION_17\n"
+            "}\n",
+        )
+
+        self.assertFalse(requests_java_21_or_newer(self.workspace))
+        self.assertEqual(self.version_of(), "17")
+
+    def test_legacy_java_8_target_does_not_block_the_downgrade(self) -> None:
+        self.write("build.gradle", "ext.kotlin_version = '1.6.21'")
+        self.write(
+            "app/build.gradle",
+            "compileOptions {\n"
+            "  sourceCompatibility JavaVersion.VERSION_1_8\n"
+            "}\n"
+            'kotlinOptions { jvmTarget = "1.8" }\n',
+        )
+
+        self.assertFalse(requests_java_21_or_newer(self.workspace))
+        self.assertEqual(self.version_of(), "17")
+
+    # --- where the version can be declared ------------------------------
+    def test_reads_the_version_catalog(self) -> None:
+        self.write(
+            "gradle/libs.versions.toml",
+            "[versions]\nkotlin = \"1.7.22\"\nagp = \"8.1.0\"\n",
+        )
+
+        self.assertEqual(kotlin_plugin_version(self.workspace), (1, 7, 22))
+
+    def test_reads_the_plugins_dsl(self) -> None:
+        self.write(
+            "build.gradle",
+            "plugins { id 'org.jetbrains.kotlin.android' version '1.8.10' apply false }",
+        )
+
+        self.assertEqual(kotlin_plugin_version(self.workspace), (1, 8, 10))
+
+    def test_reads_the_kotlin_dsl_accessor(self) -> None:
+        self.write("build.gradle.kts", 'plugins { kotlin("android") version "1.7.20" }')
+
+        self.assertEqual(kotlin_plugin_version(self.workspace), (1, 7, 20))
+
+    def test_reads_a_buildsrc_version_object(self) -> None:
+        # gowalk-public/dating-android keeps its versions in Kotlin source, so
+        # every build file interpolates `Config.Versions.kotlin` and declares
+        # no digits at all.
+        self.write(
+            "build.gradle.kts",
+            'classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:${Config.Versions.kotlin}")',
+        )
+        self.write(
+            "buildSrc/src/main/java/Config.kt",
+            "object Config {\n"
+            "    object Versions {\n"
+            '        val kotlin = "1.3.61"\n'
+            '        val kotlinx = "1.3.3"\n'
+            "    }\n"
+            "}\n",
+        )
+
+        # 1.3.3 is kotlinx, not the compiler, and must not be mistaken for it.
+        self.assertEqual(kotlin_plugin_version(self.workspace), (1, 3, 61))
+        self.assertEqual(self.version_of(), "17")
+
+    def test_reads_a_literal_classpath_coordinate(self) -> None:
+        self.write(
+            "build.gradle",
+            'classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:1.6.10"',
+        )
+
+        self.assertEqual(kotlin_plugin_version(self.workspace), (1, 6, 10))
+
+    def test_two_component_versions_normalise(self) -> None:
+        self.assertEqual(parse_version("1.9"), (1, 9, 0))
+        self.assertEqual(parse_version("1.9.20"), (1, 9, 20))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_version_override.py

@@ -0,0 +1,153 @@
+#!/usr/bin/env python3
+"""The resolved versionCode must actually reach a native Gradle build.
+
+The plugin resolves a versionCode that cannot collide with what Play already
+holds, but a native app declares its own in build.gradle. resolve_android.py
+rewrites that literal when there is one; gowalk-public/carsharing-android has
+
+    ext.code = 31
+    versionCode code
+
+which has no literal to rewrite, so the bundle shipped 31 and Play rejected it
+with "Version code 31 has already been used" — including the no-auto-submit
+retry, because the number was baked into the bundle.
+
+The fix is an init script applied to the Gradle invocation. These tests pin the
+wiring, since nothing else in the suite can run Gradle.
+"""
+
+from __future__ import annotations
+
+import re
+import unittest
+from pathlib import Path
+
+ACTION_DIR = Path(__file__).resolve().parent.parent
+ACTION_YML = ACTION_DIR / "action.yml"
+INIT_SCRIPT = ACTION_DIR / "scripts" / "version_override.init.gradle"
+
+
+def gradle_build_step() -> str:
+    """The `Build release Android App Bundle with Gradle` step, as raw text."""
+    text = ACTION_YML.read_text()
+    start = text.index("- name: Build release Android App Bundle with Gradle")
+    rest = text[start + 1 :]
+    end = rest.find("\n    - name:")
+    return rest if end == -1 else rest[:end]
+
+
+class VersionOverrideWiringTest(unittest.TestCase):
+    def test_the_init_script_ships_with_the_action(self) -> None:
+        self.assertTrue(INIT_SCRIPT.is_file())
+
+    def test_the_gradle_build_applies_the_init_script(self) -> None:
+        step = gradle_build_step()
+
+        self.assertIn("--init-script", step)
+        self.assertIn("scripts/version_override.init.gradle", step)
+        # github.action_path, not a relative path: the step runs with
+        # working-directory set to the Gradle root, which may be android/.
+        self.assertIn("${{ github.action_path }}", step)
+
+    def test_the_gradle_build_passes_the_resolved_build_name(self) -> None:
+        step = gradle_build_step()
+
+        self.assertIn("ANDROID_BUILD_NAME: ${{ inputs.build-name }}", step)
+
+    def test_the_flutter_build_is_left_alone(self) -> None:
+        # The Flutter path already honours the resolved number through
+        # --build-number and must not be handed a Gradle init script.
+        text = ACTION_YML.read_text()
+        start = text.index("- name: Build release Android App Bundle\n")
+        flutter_step = text[start : text.index("# --- Native Gradle", start)]
+
+        self.assertIn("--build-number", flutter_step)
+        self.assertNotIn("--init-script", flutter_step)
+
+    def test_only_the_gradle_build_gets_the_init_script(self) -> None:
+        # Notably not `./gradlew test`: a unit-test run has no versionCode to
+        # get wrong, and the narrower the override's blast radius the better.
+        self.assertEqual(ACTION_YML.read_text().count("--init-script"), 1)
+
+
+class InitScriptTest(unittest.TestCase):
+    """Guard rails that keep the override from touching a build it should not."""
+
+    def setUp(self) -> None:
+        self.source = INIT_SCRIPT.read_text()
+
+    def test_reads_the_values_the_action_exports(self) -> None:
+        self.assertIn("ANDROID_BUILD_NUMBER", self.source)
+        self.assertIn("ANDROID_BUILD_NAME", self.source)
+
+    def test_only_touches_application_modules(self) -> None:
+        self.assertIn("com.android.application", self.source)
+
+    def test_does_nothing_when_neither_value_is_set(self) -> None:
+        # An unset variable means "no opinion" — the project's own value stands.
+        self.assertRegex(
+            self.source, r"if \(versionCode != null \|\| versionName != null\)"
+        )
+
+    def test_a_bad_build_number_warns_instead_of_failing_the_build(self) -> None:
+        self.assertIn("NumberFormatException", self.source)
+        self.assertIn("::warning::", self.source)
+
+    def test_supports_agp_before_and_after_the_variant_api(self) -> None:
+        self.assertIn("androidComponents", self.source)
+        self.assertIn("versionCodeOverride", self.source)
+
+    def test_does_not_use_the_removed_injected_properties(self) -> None:
+        # android.injected.version.code / .name were removed in AGP 7.3 and are
+        # silently ignored by every AGP 8.x app in the fleet. Reaching for them
+        # would look like a fix and change nothing. The init script's header
+        # explains all this, so only the code is checked here.
+        code = "\n".join(
+            line
+            for line in self.source.splitlines()
+            if not line.lstrip().startswith("//")
+        )
+
+        self.assertNotIn("android.injected.version", code)
+        self.assertNotIn("android.injected.version", gradle_build_step())
+
+
+class NonLiteralVersionCodeTest(unittest.TestCase):
+    """The exact shape that defeated the source rewrite."""
+
+    def test_the_carsharing_build_file_has_no_literal_to_rewrite(self) -> None:
+        import tempfile
+
+        from android_config import set_gradle_version
+
+        with tempfile.TemporaryDirectory() as temp:
+            build_file = Path(temp) / "build.gradle"
+            build_file.write_text(
+                "android {\n"
+                "    defaultConfig {\n"
+                "        ext.code = 31\n"
+                "        versionCode code\n"
+                '        versionName "1.${code}"\n'
+                "    }\n"
+                "}\n"
+            )
+
+            applied = set_gradle_version(build_file, 507)
+
+            # Nothing to rewrite, so the checkout still says 31 — which is
+            # precisely why the build needs the Variant API override.
+            self.assertFalse(applied["version_code"])
+            self.assertIn("ext.code = 31", build_file.read_text())
+
+    def test_resolve_android_no_longer_calls_that_a_warning(self) -> None:
+        # It used to emit ::warning::, which annotated the run as a problem
+        # while the real override was about to succeed.
+        source = (ACTION_DIR / "scripts" / "resolve_android.py").read_text()
+        body = source[source.index("def apply_gradle_version") : source.index("def flutter_root")]
+
+        self.assertNotIn("::warning::", body)
+        self.assertIn("Variant API", body)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/version_override.init.gradle

@@ -0,0 +1,79 @@
+// Makes the versionCode this action resolved authoritative for native Gradle
+// builds. Applied with --init-script by the "Build release Android App Bundle
+// with Gradle" step; never applied to a Flutter build, which takes the number
+// through `flutter build --build-number` and already works.
+//
+// Why an init script rather than AGP's injected properties
+// -------------------------------------------------------
+// The obvious answer looks like
+//     ./gradlew ... -Pandroid.injected.version.code=<N>
+// and it is a silent no-op on every app in this fleet. Those properties were
+// removed in AGP 7.3 — verified by disassembling IntegerOption/StringOption
+// across cached AGP releases: android.injected.version.code and
+// android.injected.version.name are present in 4.1 and 7.1 and gone from 7.3
+// onward. Passing them to an AGP 8.x build changes nothing and reports nothing,
+// so the stale versionCode still ships and Play still answers
+// "Version code N has already been used".
+//
+// The supported override is the Variant API, which is what this does. It needs
+// no cooperation from the app and edits none of its sources, so it works
+// whatever the build file does — including the indirection that defeats
+// resolve_android.py's literal rewrite:
+//     ext.code = 31
+//     versionCode code
+//
+// An unset variable means "no opinion": the project's own value stands. That is
+// what keeps versionName alone unless a build-name was actually resolved.
+
+def readSetting = { String name ->
+    def value = System.getenv(name)
+    return value?.trim() ? value.trim() : null
+}
+
+def versionName = readSetting('ANDROID_BUILD_NAME')
+def versionCodeText = readSetting('ANDROID_BUILD_NUMBER')
+
+Integer versionCode = null
+if (versionCodeText != null) {
+    try {
+        versionCode = Integer.parseInt(versionCodeText)
+    } catch (NumberFormatException ignored) {
+        println "::warning::ANDROID_BUILD_NUMBER is not an integer (${versionCodeText}); " +
+                "leaving the project's own versionCode in place"
+    }
+}
+
+if (versionCode != null || versionName != null) {
+    gradle.beforeProject { project ->
+        project.plugins.withId('com.android.application') {
+            // AGP 7.0+ — the current Variant API.
+            def components = project.extensions.findByName('androidComponents')
+            if (components != null) {
+                components.onVariants(components.selector().all()) { variant ->
+                    variant.outputs.each { output ->
+                        if (versionCode != null) output.versionCode.set(versionCode)
+                        if (versionName != null) output.versionName.set(versionName)
+                    }
+                    println "${project.path} ${variant.name}: versionCode=" +
+                            "${versionCode ?: 'unchanged'} versionName=${versionName ?: 'unchanged'}"
+                }
+                return
+            }
+            // AGP < 7.0 — no androidComponents extension exists yet.
+            def android = project.extensions.findByName('android')
+            if (android == null) {
+                println "::warning::${project.path} applies com.android.application but exposes " +
+                        "neither androidComponents nor android; versionCode not overridden"
+                return
+            }
+            android.applicationVariants.all { variant ->
+                variant.outputs.each { output ->
+                    if (versionCode != null) output.versionCodeOverride = versionCode
+                    if (versionName != null) output.versionNameOverride = versionName
+                }
+                println "${project.path} ${variant.name}: versionCode=" +
+                        "${versionCode ?: 'unchanged'} versionName=${versionName ?: 'unchanged'}"
+            }
+        }
+    }
+}

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.26
+1.0.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.26",
+  "version": "1.0.28",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -59,6 +59,23 @@ jobs:
             ~/Library/Caches/CocoaPods
           key: pods-${{ runner.os }}-${{ hashFiles('ios/Podfile.lock', 'pubspec.lock') }}
           restore-keys: pods-${{ runner.os }}-
+      # Same as the android job: a private git dependency (e.g. the pomogator
+      # onboarding SDK) is cloned by `flutter pub get` below. The runner has no
+      # SSH key, so an https url only resolves once this token rewrite is in
+      # place. No secret => no-op (the dep must then carry its own credentials).
+      - name: Authenticate private git dependencies
+        if: ${{ steps.flutter.outputs.enabled == 'true' }}
+        shell: bash
+        env:
+          GIT_PRIVATE_TOKEN: ${{ secrets.GIT_PRIVATE_TOKEN }}
+        run: |
+          if [ -z "${GIT_PRIVATE_TOKEN:-}" ]; then
+            echo "No GIT_PRIVATE_TOKEN secret; private git dependencies must carry their own credentials."
+            exit 0
+          fi
+          echo "::add-mask::$GIT_PRIVATE_TOKEN"
+          git config --global url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+          echo "Configured authenticated github.com remotes for pub."
       - name: Prepare Flutter iOS project
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
         shell: bash
@@ -146,12 +163,39 @@ jobs:
                       /usr/local/lib/node_modules 2>/dev/null || true
           sudo docker image prune --all --force >/dev/null 2>&1 || true
           echo "After:";  df -h / | tail -1
+      # The JDK used to be hardcoded here — 17 for Flutter, 21 for everything
+      # else — which assumes every native Gradle app is new enough for 21. An
+      # app on an old Kotlin is not: kapt reaches into javac internals that JDK
+      # 21 moved, and the build dies with "Internal compiler error" out of
+      # kaptGenerateStubsReleaseKotlin, naming neither Kotlin nor the JDK.
+      #
+      # Repository variable JAVA_VERSION pins the JDK for this repo and always
+      # wins — set it (e.g. '17') when an app needs a specific JDK and nothing
+      # should second-guess it. Left unset, select_jdk.py keeps today's choice
+      # and only drops a native Gradle app to 17 when it can positively read a
+      # Kotlin Gradle plugin older than 1.9.20, which is the release that added
+      # JDK 21 support. See android-action/scripts/select_jdk.py.
+      - name: Choose the JDK for this build
+        id: jdk
+        if: ${{ steps.mode.outputs.mode == 'local' }}
+        shell: bash
+        env:
+          JAVA_VERSION: ${{ vars.JAVA_VERSION }}
+          FLUTTER_ENABLED: ${{ steps.flutter.outputs.enabled }}
+        run: |
+          # Never let a chooser bug take down every Android job: fall back to the
+          # JDK this workflow used before the chooser existed.
+          if ! python3 .github/actions/android-app/scripts/select_jdk.py; then
+            echo "::warning::select_jdk.py failed; falling back"
+            if [ "${FLUTTER_ENABLED}" = "true" ]; then fallback=17; else fallback=21; fi
+            echo "version=${fallback}" >> "$GITHUB_OUTPUT"
+          fi
       - name: Set up Java
         if: ${{ steps.mode.outputs.mode == 'local' }}
         uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
         with:
           distribution: temurin
-          java-version: ${{ steps.flutter.outputs.enabled == 'true' && '17' || '21' }}
+          java-version: ${{ steps.jdk.outputs.version }}
           cache: gradle
       - name: Set up Flutter
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}