gowalk-cicd 1.0.28 → 1.0.30

package/CLAUDE.md

@@ -92,6 +92,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Detect and warn, tell the user to remove lines manually.
 - Store API calls belong in GitHub Actions. Local tests may build/sign but must
   never connect to App Store Connect or Google Play.
+- Signing material should use encrypted Actions secrets. `deploy.yml`
+  materializes `ASC_KEY_P8` + its ID/issuer and the Android keystore,
+  properties and Play service account into an ephemeral runner checkout.
+  Tracked `creds/` files remain a backward-compatible fallback.
 - The Android action serves two build systems. `android_config.project_kind()`
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie

package/action/.daemux-version

@@ -1 +1 @@
-1.0.28
+1.0.30

package/action/scripts/mmv_decide_create.py

@@ -139,7 +139,21 @@ def _stale_editable_id(versions: list[dict], target: str) -> str | None:
         vid = v.get("id")
         if not vid:
             continue
-        if semver_tuple(version_string) >= target_t:
+        # STRICTLY greater, not >=. The skip above is a STRING compare while
+        # this is a TUPLE compare, so a version that is the SAME but written
+        # differently — "1.0" against a target of "1.0.0" — slipped past the
+        # skip and then tripped this guard, refusing the whole deploy.
+        #
+        # That is precisely what App Store Connect hands a brand-new app: it
+        # auto-creates version "1.0" when the record is made, while a Flutter
+        # project ships MARKETING_VERSION "1.0.0". Every first release hit it.
+        #
+        # Renaming an editable to an EQUAL version downgrades nothing — it
+        # normalises the string — so it falls through to the PATCH-rename
+        # candidates below. The guard's real target is unaffected: an editable
+        # genuinely AHEAD of the project (draft 1.2 vs target 1.1) still
+        # refuses, because renaming that one WOULD lose an in-progress draft.
+        if semver_tuple(version_string) > target_t:
             _refuse_downgrade(target, version_string, vid, state)
         # In-review rows (WAITING_FOR_REVIEW / IN_REVIEW) are editable
         # but not safe to rename — leave them alone and POST a fresh row.

package/action/scripts/test_mmv_decide_create.py

@@ -117,3 +117,36 @@ class StaleEditableSelectionTests(unittest.TestCase):
 
 if __name__ == "__main__":
     unittest.main()
+
+
+class EqualVersionWrittenDifferently(unittest.TestCase):
+    """ASC auto-creates "1.0" with a new app record; Flutter ships "1.0.0".
+
+    The skip above the guard is a STRING compare while the guard itself is a
+    TUPLE compare, so this pair slipped past the skip and then tripped the
+    guard — refusing the very FIRST deploy of every newly created app.
+    "1.0" and "1.0.0" are the same version: renaming the editable normalises
+    the string and downgrades nothing.
+    """
+
+    def test_equal_version_is_patch_renamed_not_refused(self):
+        editable = _v("1.0", "PREPARE_FOR_SUBMISSION", vid="ed-10")
+        result, stderr, calls = _run_decide_for_version(
+            "1.0.0", versions=[editable], ground_truth=None,
+        )
+        self.assertEqual(result["decision"], "CREATE")
+        self.assertEqual(result["versionString"], "1.0.0")
+        self.assertEqual(calls[0].kwargs.get("stale_editable_id"), "ed-10")
+
+    def test_a_genuinely_higher_draft_still_refuses(self):
+        """The guard's real purpose must survive: renaming a draft AHEAD of
+        the project would lose in-progress work."""
+        editable = _v("1.2.0", "PREPARE_FOR_SUBMISSION", vid="ed-120")
+        stderr = _assert_decide_exits(
+            self, "1.1.0", versions=[editable], ground_truth=None,
+        )
+        self.assertIn("downgrade", stderr.lower())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.28
+1.0.30

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.28
+1.0.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.28",
+  "version": "1.0.30",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/install.mjs

@@ -16,7 +16,7 @@ import {
   statSync,
   writeFileSync,
 } from 'node:fs';
-import { join, relative, resolve } from 'node:path';
+import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { dirname } from 'node:path';
 
@@ -182,29 +182,28 @@ function checkGitignore(repoRoot) {
 function printGitignoreWarning(result) {
   if (!result.exists || result.offenders.length === 0) return;
   console.log('');
-  console.log('WARNING: .gitignore excludes required CI credentials.');
+  console.log('NOTICE: .gitignore excludes checkout credentials.');
   console.log(`  File: ${result.path}`);
   for (const { lineNumber, text } of result.offenders) {
     console.log(`  Line ${lineNumber}: ${text}`);
   }
   console.log('');
-  console.log('  The actions read Apple and Android keys from creds/ in the checkout.');
-  console.log('  Remove those lines from .gitignore manually, then commit the .p8 file.');
-  console.log('  (Your repo MUST be private — never do this in a public repo.)');
+  console.log('  Keep the ignore when using encrypted Actions secrets (recommended).');
+  console.log('  Otherwise the actions still support credentials already tracked in creds/.');
 }
 
-function printSummary(repoRoot) {
+function printSummary() {
   console.log('');
   console.log('Done.');
   console.log('');
   console.log('Next steps:');
-  console.log(`  1. Place your ASC API key:`);
-  console.log(`       ${join(relative(process.cwd(), repoRoot) || '.', 'creds', 'AuthKey_<KEY_ID>_Issuer_<UUID>.p8')}`);
-  console.log(`     (filename must include the 10-char KEY_ID and the issuer UUID)`);
-  console.log(`  2. Add creds/android-upload-key.jks and creds/android-signing.properties.`);
-  console.log(`  3. Add a Google Play service-account JSON anywhere under creds/.`);
-  console.log(`  4. Ensure the repo is PRIVATE; these long-lived credentials must remain private.`);
-  console.log(`  5. Commit and push to main. GitHub Actions builds both platforms.`);
+  console.log('  Recommended: configure encrypted Actions secrets:');
+  console.log('    ASC_KEY_P8, ASC_KEY_ID, ASC_ISSUER_ID');
+  console.log('    ANDROID_UPLOAD_KEY_BASE64, ANDROID_SIGNING_PROPERTIES');
+  console.log('    GOOGLE_PLAY_SERVICE_ACCOUNT_JSON');
+  console.log('  The workflow materializes them with mode 0600 only on its ephemeral runner.');
+  console.log('  Existing checkout credentials remain a backward-compatible fallback.');
+  console.log('  Push to main after configuring the secrets; GitHub Actions builds both platforms.');
   console.log('');
   console.log('Re-run this installer anytime to update the vendored action:');
   console.log('  npx --yes gowalk-cicd');
@@ -242,5 +241,5 @@ export async function runInstall({ dryRun = false } = {}) {
     return;
   }
 
-  printSummary(repoRoot);
+  printSummary();
 }

package/templates/deploy.yml

@@ -35,6 +35,19 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: true
+      - name: Materialize encrypted iOS credentials
+        shell: bash
+        env:
+          CI_ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+          CI_ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          CI_ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+        run: |
+          [ -n "${CI_ASC_KEY_P8:-}" ] || exit 0
+          : "${CI_ASC_KEY_ID:?ASC_KEY_ID secret is required with ASC_KEY_P8}"
+          : "${CI_ASC_ISSUER_ID:?ASC_ISSUER_ID secret is required with ASC_KEY_P8}"
+          umask 077
+          mkdir -p creds
+          printf '%s' "$CI_ASC_KEY_P8" > "creds/AuthKey_${CI_ASC_KEY_ID}_Issuer_${CI_ASC_ISSUER_ID}.p8"
       - name: Detect Flutter
         id: flutter
         shell: bash
@@ -74,7 +87,8 @@ jobs:
             exit 0
           fi
           echo "::add-mask::$GIT_PRIVATE_TOKEN"
-          git config --global url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+          git config --global \
+            url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
           echo "Configured authenticated github.com remotes for pub."
       - name: Prepare Flutter iOS project
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
@@ -107,6 +121,22 @@ jobs:
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Materialize encrypted Android credentials
+        shell: bash
+        env:
+          CI_ANDROID_KEYSTORE: ${{ secrets.ANDROID_UPLOAD_KEY_BASE64 }}
+          CI_ANDROID_PROPERTIES: ${{ secrets.ANDROID_SIGNING_PROPERTIES }}
+          CI_PLAY_ACCOUNT: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
+        run: |
+          [ -n "${CI_ANDROID_KEYSTORE:-}${CI_ANDROID_PROPERTIES:-}${CI_PLAY_ACCOUNT:-}" ] || exit 0
+          : "${CI_ANDROID_KEYSTORE:?ANDROID_UPLOAD_KEY_BASE64 secret is required}"
+          : "${CI_ANDROID_PROPERTIES:?ANDROID_SIGNING_PROPERTIES secret is required}"
+          : "${CI_PLAY_ACCOUNT:?GOOGLE_PLAY_SERVICE_ACCOUNT_JSON secret is required}"
+          umask 077
+          mkdir -p creds
+          printf '%s' "$CI_ANDROID_KEYSTORE" | base64 --decode > creds/android-upload-key.jks
+          printf '%s' "$CI_ANDROID_PROPERTIES" > creds/android-signing.properties
+          printf '%s' "$CI_PLAY_ACCOUNT" > creds/play-service-account.json
       # Two Android delivery modes:
       #   * bitrise — the upload key + Play service account live in Bitrise,
       #     not the repo, so the GitHub runner cannot sign. Drop a
@@ -119,8 +149,9 @@ jobs:
         id: mode
         shell: bash
         run: |
-          if [ -f creds/bitrise.json ] && \
-             [ "$(python3 -c "import json,sys;print(json.load(open('creds/bitrise.json')).get('enabled',False))" 2>/dev/null)" = "True" ]; then
+          bitrise_enabled=$(python3 -c \
+            "import json;print(json.load(open('creds/bitrise.json')).get('enabled',False))" 2>/dev/null || true)
+          if [ -f creds/bitrise.json ] && [ "$bitrise_enabled" = "True" ]; then
             echo "mode=bitrise" >> "$GITHUB_OUTPUT"
           else
             echo "mode=local" >> "$GITHUB_OUTPUT"
@@ -225,7 +256,8 @@ jobs:
             exit 0
           fi
           echo "::add-mask::$GIT_PRIVATE_TOKEN"
-          git config --global url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+          git config --global \
+            url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
           echo "Configured authenticated github.com remotes for pub."
       # A Gradle daemon sized for a workstation does not fit a CI runner. Asking
       # for -Xmx8G with a 4G metaspace reserves 12 GB before the Kotlin compile
@@ -322,13 +354,8 @@ jobs:
           releaseFiles: ${{ steps.android.outputs.bundle-path }}
           tracks: ${{ vars.GOOGLE_PLAY_TRACK || 'internal' }}
           status: ${{ vars.GOOGLE_PLAY_STATUS || 'completed' }}
-          # Play rejects an 'inProgress' release that does not declare how much of
-          # the audience it reaches. Only send the fraction in that mode: passing it
-          # alongside status 'completed' is an error rather than a no-op.
-          userFraction: ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
-          # Localized release notes: commit distribution/whatsnew/whatsnew-<bcp47>
-          # files (e.g. whatsnew-en-US, whatsnew-de-DE) and they ship with every
-          # release. Empty when the directory is absent — the action skips it.
+          userFraction: >-
+            ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
           whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
 
       # The retry serves two different failures, and both need a fresh edit:
@@ -338,14 +365,12 @@ jobs:
       #     this once an app has changes a human must submit — after a policy
       #     rejection, for instance — and it fails the whole upload, so the built
       #     bundle never lands at all.
-      # Retrying with changesNotSentForReview gets the bundle onto Play either way.
-      # In the ordinary case the first attempt already submitted it and this is
-      # skipped; in the refused case the bundle is uploaded and waits for someone to
-      # press "Send changes for review" in Play Console, which is the only thing
-      # Google will not let a tool do.
       - name: Retry Google Play upload without auto-submit
         id: play-upload-retry
-        if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' && steps.play-upload.outcome == 'failure' }}
+        if: >-
+          ${{ steps.mode.outputs.mode == 'local'
+              && steps.play.outputs.ready == 'true'
+              && steps.play-upload.outcome == 'failure' }}
         uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
@@ -353,8 +378,10 @@ jobs:
           releaseFiles: ${{ steps.android.outputs.bundle-path }}
           tracks: ${{ vars.GOOGLE_PLAY_TRACK || 'internal' }}
           status: ${{ vars.GOOGLE_PLAY_STATUS || 'completed' }}
-          userFraction: ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
-          whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
+          userFraction: >-
+            ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
+          whatsNewDirectory: >-
+            ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
           changesNotSentForReview: true
 
       - name: Say what still needs a human