gowalk-cicd 1.0.29 → 1.0.31

package/CLAUDE.md

@@ -92,6 +92,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Detect and warn, tell the user to remove lines manually.
 - Store API calls belong in GitHub Actions. Local tests may build/sign but must
   never connect to App Store Connect or Google Play.
+- Signing material should use encrypted Actions secrets. `deploy.yml`
+  materializes `ASC_KEY_P8` + its ID/issuer and the Android keystore,
+  properties and Play service account into an ephemeral runner checkout.
+  Tracked `creds/` files remain a backward-compatible fallback.
 - The Android action serves two build systems. `android_config.project_kind()`
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie

package/README.md

@@ -437,6 +437,13 @@ The iOS composite action runs on `macos-15` and:
 
 The iOS action requires only the p8. Everything else is derived.
 
+Feature-branch runs installed from the standard workflow still archive and
+upload to TestFlight, but pass `manage-app-store-version: 'false'`. This keeps
+branch validation independent of the editable App Store release slot, so a
+build can upload while the current release is locked in review. Default-branch
+runs retain version creation and metadata automation. Direct action callers
+keep the historical behavior because the new input defaults to `true`.
+
 ### App ID capabilities
 
 A provisioning profile carries only the capabilities enabled on its App ID.
@@ -569,6 +576,7 @@ common ones:
 | `uses-non-exempt-encryption` | Value for `ITSAppUsesNonExemptEncryption` |
 | `archive` | `false` to build-only (PR runs without secrets) |
 | `upload` | `false` to archive but not upload to TestFlight |
+| `manage-app-store-version` | `false` to upload without creating/editing the App Store release slot |
 | `app-store-whats-new` | Inline "What's New" text (overrides files) |
 | `ai-metadata` | `false` to disable AI auto-fill of empty ASC metadata |
 | `ai-metadata-model` | GitHub Models model id (default `openai/gpt-4o`) |

package/action/.daemux-version

@@ -1 +1 @@
-1.0.29
+1.0.31

package/action/action.yml

@@ -64,6 +64,13 @@ inputs:
       secrets. When 'false', `upload` is ignored.
     required: false
     default: "true"
+  manage-app-store-version:
+    description: >
+      Set to 'false' to archive and upload a TestFlight build without creating
+      or editing an App Store version. App Store metadata automation is skipped.
+      This is useful for feature-branch validation while a release is in review.
+    required: false
+    default: "true"
   run-tests:
     description: "Set to 'false' to skip the simulator test stage"
     required: false
@@ -282,7 +289,7 @@ runs:
           | tee -a "$GITHUB_ENV"
 
     - name: Resolve App Store version slot (REUSE or CREATE)
-      if: ${{ inputs.archive == 'true' }}
+      if: ${{ inputs.archive == 'true' && inputs.manage-app-store-version == 'true' }}
       shell: bash
       env:
         APP_STORE_APPLE_ID: ${{ inputs.app-store-apple-id || env.CFG_APP_STORE_APPLE_ID }}
@@ -328,6 +335,16 @@ runs:
         echo "APP_STORE_VERSION_ID=$APP_STORE_VERSION_ID" >> "$GITHUB_ENV"
         echo "Using marketing version $MARKETING_VERSION build $BUILD_NUMBER (decision=$DECISION_JSON)"
 
+    - name: Resolve TestFlight build number
+      if: ${{ inputs.archive == 'true' && inputs.manage-app-store-version == 'false' }}
+      shell: bash
+      run: |
+        set -o pipefail
+        BUILD_NUMBER=$(python3 "${{ github.action_path }}/scripts/next_build_number.py")
+        echo "BUILD_NUMBER=$BUILD_NUMBER" >> "$GITHUB_ENV"
+        echo "APP_STORE_VERSION_ID=" >> "$GITHUB_ENV"
+        echo "Using marketing version $MARKETING_VERSION build $BUILD_NUMBER without an App Store version slot"
+
     - name: Notice on deprecated profile-name input
       if: ${{ inputs.archive == 'true' && inputs.profile-name != '' }}
       shell: bash
@@ -690,7 +707,9 @@ runs:
 
     - name: Detect empty ASC metadata fields
       id: detect_metadata
-      if: ${{ inputs.archive == 'true' && inputs.upload == 'true' && inputs.ai-metadata != 'false' }}
+      if: >-
+        ${{ inputs.archive == 'true' && inputs.upload == 'true'
+            && inputs.manage-app-store-version == 'true' && inputs.ai-metadata != 'false' }}
       shell: bash
       env:
         APP_STORE_APPLE_ID: ${{ inputs.app-store-apple-id || env.CFG_APP_STORE_APPLE_ID }}
@@ -945,6 +964,7 @@ runs:
     # with the default (CFG_WHATS_NEW), preserving any AI-generated notes.
     - name: Set App Store "What's New"
       if: ${{ inputs.archive == 'true' && inputs.upload == 'true'
+            && inputs.manage-app-store-version == 'true'
             && (inputs.app-store-whats-new != '' || env.CFG_WHATS_NEW != '') }}
       shell: bash
       env:

package/action/scripts/test_testflight_version_slot_wiring.py

@@ -0,0 +1,46 @@
+import re
+import unittest
+from pathlib import Path
+
+
+ACTION_YAML = Path(__file__).resolve().parents[1] / "action.yml"
+
+
+def step_block(source: str, name: str) -> str:
+    pattern = rf"    - name: {re.escape(name)}\n(?P<body>.*?)(?=\n    - name:|\Z)"
+    match = re.search(pattern, source, re.DOTALL)
+    if match is None:
+        raise AssertionError(f"missing action step: {name}")
+    return match.group("body")
+
+
+class TestTestFlightVersionSlotWiring(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.source = ACTION_YAML.read_text(encoding="utf-8")
+
+    def test_opt_out_is_backward_compatible(self) -> None:
+        self.assertRegex(
+            self.source,
+            r"(?m)^  manage-app-store-version:\n(?:    .*\n)*?    default: \"true\"$",
+        )
+
+    def test_opt_out_skips_store_version_but_keeps_build_number(self) -> None:
+        store_slot = step_block(self.source, "Resolve App Store version slot (REUSE or CREATE)")
+        testflight = step_block(self.source, "Resolve TestFlight build number")
+
+        self.assertIn("inputs.manage-app-store-version == 'true'", store_slot)
+        self.assertIn("inputs.manage-app-store-version == 'false'", testflight)
+        self.assertIn("next_build_number.py", testflight)
+        self.assertNotIn("manage_marketing_version.py", testflight)
+
+    def test_metadata_requires_a_managed_store_version(self) -> None:
+        detector = step_block(self.source, "Detect empty ASC metadata fields")
+        whats_new = step_block(self.source, 'Set App Store "What\'s New"')
+
+        self.assertIn("inputs.manage-app-store-version == 'true'", detector)
+        self.assertIn("inputs.manage-app-store-version == 'true'", whats_new)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.29
+1.0.31

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.29
+1.0.31

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.29",
+  "version": "1.0.31",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/install.mjs

@@ -16,7 +16,7 @@ import {
   statSync,
   writeFileSync,
 } from 'node:fs';
-import { join, relative, resolve } from 'node:path';
+import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { dirname } from 'node:path';
 
@@ -182,29 +182,28 @@ function checkGitignore(repoRoot) {
 function printGitignoreWarning(result) {
   if (!result.exists || result.offenders.length === 0) return;
   console.log('');
-  console.log('WARNING: .gitignore excludes required CI credentials.');
+  console.log('NOTICE: .gitignore excludes checkout credentials.');
   console.log(`  File: ${result.path}`);
   for (const { lineNumber, text } of result.offenders) {
     console.log(`  Line ${lineNumber}: ${text}`);
   }
   console.log('');
-  console.log('  The actions read Apple and Android keys from creds/ in the checkout.');
-  console.log('  Remove those lines from .gitignore manually, then commit the .p8 file.');
-  console.log('  (Your repo MUST be private — never do this in a public repo.)');
+  console.log('  Keep the ignore when using encrypted Actions secrets (recommended).');
+  console.log('  Otherwise the actions still support credentials already tracked in creds/.');
 }
 
-function printSummary(repoRoot) {
+function printSummary() {
   console.log('');
   console.log('Done.');
   console.log('');
   console.log('Next steps:');
-  console.log(`  1. Place your ASC API key:`);
-  console.log(`       ${join(relative(process.cwd(), repoRoot) || '.', 'creds', 'AuthKey_<KEY_ID>_Issuer_<UUID>.p8')}`);
-  console.log(`     (filename must include the 10-char KEY_ID and the issuer UUID)`);
-  console.log(`  2. Add creds/android-upload-key.jks and creds/android-signing.properties.`);
-  console.log(`  3. Add a Google Play service-account JSON anywhere under creds/.`);
-  console.log(`  4. Ensure the repo is PRIVATE; these long-lived credentials must remain private.`);
-  console.log(`  5. Commit and push to main. GitHub Actions builds both platforms.`);
+  console.log('  Recommended: configure encrypted Actions secrets:');
+  console.log('    ASC_KEY_P8, ASC_KEY_ID, ASC_ISSUER_ID');
+  console.log('    ANDROID_UPLOAD_KEY_BASE64, ANDROID_SIGNING_PROPERTIES');
+  console.log('    GOOGLE_PLAY_SERVICE_ACCOUNT_JSON');
+  console.log('  The workflow materializes them with mode 0600 only on its ephemeral runner.');
+  console.log('  Existing checkout credentials remain a backward-compatible fallback.');
+  console.log('  Push to main after configuring the secrets; GitHub Actions builds both platforms.');
   console.log('');
   console.log('Re-run this installer anytime to update the vendored action:');
   console.log('  npx --yes gowalk-cicd');
@@ -242,5 +241,5 @@ export async function runInstall({ dryRun = false } = {}) {
     return;
   }
 
-  printSummary(repoRoot);
+  printSummary();
 }

package/templates/deploy.yml

@@ -35,6 +35,19 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: true
+      - name: Materialize encrypted iOS credentials
+        shell: bash
+        env:
+          CI_ASC_KEY_P8: ${{ secrets.ASC_KEY_P8 }}
+          CI_ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
+          CI_ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
+        run: |
+          [ -n "${CI_ASC_KEY_P8:-}" ] || exit 0
+          : "${CI_ASC_KEY_ID:?ASC_KEY_ID secret is required with ASC_KEY_P8}"
+          : "${CI_ASC_ISSUER_ID:?ASC_ISSUER_ID secret is required with ASC_KEY_P8}"
+          umask 077
+          mkdir -p creds
+          printf '%s' "$CI_ASC_KEY_P8" > "creds/AuthKey_${CI_ASC_KEY_ID}_Issuer_${CI_ASC_ISSUER_ID}.p8"
       - name: Detect Flutter
         id: flutter
         shell: bash
@@ -74,7 +87,8 @@ jobs:
             exit 0
           fi
           echo "::add-mask::$GIT_PRIVATE_TOKEN"
-          git config --global url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+          git config --global \
+            url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
           echo "Configured authenticated github.com remotes for pub."
       - name: Prepare Flutter iOS project
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
@@ -99,6 +113,11 @@ jobs:
           workspace: ${{ steps.flutter.outputs.enabled == 'true' && 'ios/Runner.xcworkspace' || '' }}
           scheme: ${{ steps.flutter.outputs.enabled == 'true' && 'Runner' || '' }}
           run-tests: 'false'  # tests belong to the CI gate, not the deploy path
+          # A feature-branch TestFlight build must not create or mutate a live
+          # App Store version. That also lets it upload while the current version
+          # is locked in review. Default-branch deploys retain metadata automation.
+          manage-app-store-version: >-
+            ${{ github.ref_name == github.event.repository.default_branch && 'true' || 'false' }}
 
   android:
     name: Android Google Play
@@ -107,6 +126,22 @@ jobs:
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Materialize encrypted Android credentials
+        shell: bash
+        env:
+          CI_ANDROID_KEYSTORE: ${{ secrets.ANDROID_UPLOAD_KEY_BASE64 }}
+          CI_ANDROID_PROPERTIES: ${{ secrets.ANDROID_SIGNING_PROPERTIES }}
+          CI_PLAY_ACCOUNT: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
+        run: |
+          [ -n "${CI_ANDROID_KEYSTORE:-}${CI_ANDROID_PROPERTIES:-}${CI_PLAY_ACCOUNT:-}" ] || exit 0
+          : "${CI_ANDROID_KEYSTORE:?ANDROID_UPLOAD_KEY_BASE64 secret is required}"
+          : "${CI_ANDROID_PROPERTIES:?ANDROID_SIGNING_PROPERTIES secret is required}"
+          : "${CI_PLAY_ACCOUNT:?GOOGLE_PLAY_SERVICE_ACCOUNT_JSON secret is required}"
+          umask 077
+          mkdir -p creds
+          printf '%s' "$CI_ANDROID_KEYSTORE" | base64 --decode > creds/android-upload-key.jks
+          printf '%s' "$CI_ANDROID_PROPERTIES" > creds/android-signing.properties
+          printf '%s' "$CI_PLAY_ACCOUNT" > creds/play-service-account.json
       # Two Android delivery modes:
       #   * bitrise — the upload key + Play service account live in Bitrise,
       #     not the repo, so the GitHub runner cannot sign. Drop a
@@ -119,8 +154,9 @@ jobs:
         id: mode
         shell: bash
         run: |
-          if [ -f creds/bitrise.json ] && \
-             [ "$(python3 -c "import json,sys;print(json.load(open('creds/bitrise.json')).get('enabled',False))" 2>/dev/null)" = "True" ]; then
+          bitrise_enabled=$(python3 -c \
+            "import json;print(json.load(open('creds/bitrise.json')).get('enabled',False))" 2>/dev/null || true)
+          if [ -f creds/bitrise.json ] && [ "$bitrise_enabled" = "True" ]; then
             echo "mode=bitrise" >> "$GITHUB_OUTPUT"
           else
             echo "mode=local" >> "$GITHUB_OUTPUT"
@@ -225,7 +261,8 @@ jobs:
             exit 0
           fi
           echo "::add-mask::$GIT_PRIVATE_TOKEN"
-          git config --global url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+          git config --global \
+            url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
           echo "Configured authenticated github.com remotes for pub."
       # A Gradle daemon sized for a workstation does not fit a CI runner. Asking
       # for -Xmx8G with a 4G metaspace reserves 12 GB before the Kotlin compile
@@ -322,13 +359,8 @@ jobs:
           releaseFiles: ${{ steps.android.outputs.bundle-path }}
           tracks: ${{ vars.GOOGLE_PLAY_TRACK || 'internal' }}
           status: ${{ vars.GOOGLE_PLAY_STATUS || 'completed' }}
-          # Play rejects an 'inProgress' release that does not declare how much of
-          # the audience it reaches. Only send the fraction in that mode: passing it
-          # alongside status 'completed' is an error rather than a no-op.
-          userFraction: ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
-          # Localized release notes: commit distribution/whatsnew/whatsnew-<bcp47>
-          # files (e.g. whatsnew-en-US, whatsnew-de-DE) and they ship with every
-          # release. Empty when the directory is absent — the action skips it.
+          userFraction: >-
+            ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
           whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
 
       # The retry serves two different failures, and both need a fresh edit:
@@ -338,14 +370,12 @@ jobs:
       #     this once an app has changes a human must submit — after a policy
       #     rejection, for instance — and it fails the whole upload, so the built
       #     bundle never lands at all.
-      # Retrying with changesNotSentForReview gets the bundle onto Play either way.
-      # In the ordinary case the first attempt already submitted it and this is
-      # skipped; in the refused case the bundle is uploaded and waits for someone to
-      # press "Send changes for review" in Play Console, which is the only thing
-      # Google will not let a tool do.
       - name: Retry Google Play upload without auto-submit
         id: play-upload-retry
-        if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' && steps.play-upload.outcome == 'failure' }}
+        if: >-
+          ${{ steps.mode.outputs.mode == 'local'
+              && steps.play.outputs.ready == 'true'
+              && steps.play-upload.outcome == 'failure' }}
         uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
@@ -353,8 +383,10 @@ jobs:
           releaseFiles: ${{ steps.android.outputs.bundle-path }}
           tracks: ${{ vars.GOOGLE_PLAY_TRACK || 'internal' }}
           status: ${{ vars.GOOGLE_PLAY_STATUS || 'completed' }}
-          userFraction: ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
-          whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
+          userFraction: >-
+            ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
+          whatsNewDirectory: >-
+            ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
           changesNotSentForReview: true
 
       - name: Say what still needs a human