gowalk-cicd 1.0.32 → 1.0.33

package/README.md

@@ -437,13 +437,6 @@ The iOS composite action runs on `macos-15` and:
 
 The iOS action requires only the p8. Everything else is derived.
 
-Feature-branch runs installed from the standard workflow still archive and
-upload to TestFlight, but pass `manage-app-store-version: 'false'`. This keeps
-branch validation independent of the editable App Store release slot, so a
-build can upload while the current release is locked in review. Default-branch
-runs retain version creation and metadata automation. Direct action callers
-keep the historical behavior because the new input defaults to `true`.
-
 ### App ID capabilities
 
 A provisioning profile carries only the capabilities enabled on its App ID.
@@ -572,11 +565,11 @@ common ones:
 | `bundle-id` | Override the auto-detected bundle identifier |
 | `team-id` | Override the auto-detected team ID |
 | `app-store-apple-id` | Numeric ASC app ID (override auto-lookup) |
+| `certificate-cap-policy` | Full-cap behavior: `fail` preserves identities; default `revoke-oldest` rotates. |
 | `run-tests` | `false` to skip the simulator test stage |
 | `uses-non-exempt-encryption` | Value for `ITSAppUsesNonExemptEncryption` |
 | `archive` | `false` to build-only (PR runs without secrets) |
 | `upload` | `false` to archive but not upload to TestFlight |
-| `manage-app-store-version` | `false` to upload without creating/editing the App Store release slot |
 | `app-store-whats-new` | Inline "What's New" text (overrides files) |
 | `ai-metadata` | `false` to disable AI auto-fill of empty ASC metadata |
 | `ai-metadata-model` | GitHub Models model id (default `openai/gpt-4o`) |
@@ -591,6 +584,12 @@ inside GitHub Actions.
 Once the app exists, all subsequent builds and uploads are fully automated via
 the ASC API key.
 
+For accounts where automatic certificate revocation is not acceptable, pass
+`certificate-cap-policy: 'fail'`. The action may add a certificate when Apple has a free
+slot, but a full-cap response aborts without listing or revoking existing identities. If
+signing preparation fails after creating a certificate, the default-branch workflow first
+commits any completed cache files, then re-raises the failure so the private key is not lost.
+
 ## Troubleshooting
 
 **"No app found for bundle ID"** — the app record doesn't exist yet. Run the

package/action/.daemux-version

@@ -1 +1 @@
-1.0.32
+1.0.33

package/action/action.yml

@@ -53,6 +53,13 @@ inputs:
       compatibility — passing a value emits a notice.
     required: false
     default: ""
+  certificate-cap-policy:
+    description: >
+      Behavior when Apple reports the two-certificate Distribution cap.
+      'revoke-oldest' preserves historical behavior; 'fail' aborts without
+      listing or revoking any existing certificate.
+    required: false
+    default: "revoke-oldest"
   upload:
     description: "Set to 'false' to stop after producing the IPA"
     required: false
@@ -64,13 +71,6 @@ inputs:
       secrets. When 'false', `upload` is ignored.
     required: false
     default: "true"
-  manage-app-store-version:
-    description: >
-      Set to 'false' to archive and upload a TestFlight build without creating
-      or editing an App Store version. App Store metadata automation is skipped.
-      This is useful for feature-branch validation while a release is in review.
-    required: false
-    default: "true"
   run-tests:
     description: "Set to 'false' to skip the simulator test stage"
     required: false
@@ -289,7 +289,7 @@ runs:
           | tee -a "$GITHUB_ENV"
 
     - name: Resolve App Store version slot (REUSE or CREATE)
-      if: ${{ inputs.archive == 'true' && inputs.manage-app-store-version == 'true' }}
+      if: ${{ inputs.archive == 'true' }}
       shell: bash
       env:
         APP_STORE_APPLE_ID: ${{ inputs.app-store-apple-id || env.CFG_APP_STORE_APPLE_ID }}
@@ -335,18 +335,6 @@ runs:
         echo "APP_STORE_VERSION_ID=$APP_STORE_VERSION_ID" >> "$GITHUB_ENV"
         echo "Using marketing version $MARKETING_VERSION build $BUILD_NUMBER (decision=$DECISION_JSON)"
 
-    - name: Resolve TestFlight build number
-      if: ${{ inputs.archive == 'true' && inputs.manage-app-store-version == 'false' }}
-      shell: bash
-      env:
-        APP_STORE_APPLE_ID: ${{ inputs.app-store-apple-id || env.CFG_APP_STORE_APPLE_ID }}
-      run: |
-        set -o pipefail
-        BUILD_NUMBER=$(python3 "${{ github.action_path }}/scripts/next_build_number.py")
-        echo "BUILD_NUMBER=$BUILD_NUMBER" >> "$GITHUB_ENV"
-        echo "APP_STORE_VERSION_ID=" >> "$GITHUB_ENV"
-        echo "Using marketing version $MARKETING_VERSION build $BUILD_NUMBER without an App Store version slot"
-
     - name: Notice on deprecated profile-name input
       if: ${{ inputs.archive == 'true' && inputs.profile-name != '' }}
       shell: bash
@@ -362,10 +350,19 @@ runs:
         WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
         TEAM_ID: ${{ inputs.team-id || env.CFG_TEAM_ID }}
         CREDS_DIR: ${{ github.workspace }}/creds
-      run: python3 "${{ github.action_path }}/scripts/prepare_signing.py"
+        CERTIFICATE_CAP_POLICY: ${{ inputs.certificate-cap-policy }}
+      run: |
+        set +e
+        python3 "${{ github.action_path }}/scripts/prepare_signing.py"
+        signing_exit=$?
+        set -e
+        echo "SIGNING_PREP_EXIT=$signing_exit" >> "$GITHUB_ENV"
+        if [ "$signing_exit" -ne 0 ]; then
+          echo "::error::Signing preparation failed; preserving any generated cache before failing."
+        fi
 
     # DESIGN DECISION (intentional, not a bug):
-    # The next four steps stage + commit-back the Apple Distribution
+    # The next five steps stage + commit-back the Apple Distribution
     # code-signing identity (.p12 + provisioning profiles) AND any
     # autoupdate of the vendored app-ci actions into the consumer
     # repo's default branch. This is a deliberate trade-off chosen over
@@ -386,7 +383,8 @@ runs:
     # alone without redundant retries: (1) copy bot scripts to RUNNER_TEMP
     # so autoupdate's `npx` cannot mid-run swap script bytes under us,
     # (2) stage cert files, (3) check for newer app-ci on npm and
-    # stage refreshed action files, (4) commit + push whatever is staged.
+    # stage refreshed action files, (4) commit + push whatever is staged,
+    # (5) re-raise a deferred prepare failure after preserving its cache.
 
     # Stage scripts to RUNNER_TEMP so the autoupdate step's `npx` (which
     # overwrites .github/actions/swift-app/ — the same dir as ${action_path}
@@ -494,6 +492,13 @@ runs:
         GITHUB_REF_NAME: ${{ github.ref_name }}
       run: bash "$BOT_SCRIPTS_DIR/commit_bot_changes.sh"
 
+    - name: Re-raise signing preparation failure
+      if: ${{ inputs.archive == 'true' && env.SIGNING_PREP_EXIT != '0' }}
+      shell: bash
+      run: |
+        echo "::error::Signing preparation failed with exit $SIGNING_PREP_EXIT."
+        exit "$SIGNING_PREP_EXIT"
+
     - name: Stamp Info.plist versions (CFBundleVersion + CFBundleShortVersionString)
       if: ${{ inputs.archive == 'true' }}
       shell: bash
@@ -709,9 +714,7 @@ runs:
 
     - name: Detect empty ASC metadata fields
       id: detect_metadata
-      if: >-
-        ${{ inputs.archive == 'true' && inputs.upload == 'true'
-            && inputs.manage-app-store-version == 'true' && inputs.ai-metadata != 'false' }}
+      if: ${{ inputs.archive == 'true' && inputs.upload == 'true' && inputs.ai-metadata != 'false' }}
       shell: bash
       env:
         APP_STORE_APPLE_ID: ${{ inputs.app-store-apple-id || env.CFG_APP_STORE_APPLE_ID }}
@@ -966,7 +969,6 @@ runs:
     # with the default (CFG_WHATS_NEW), preserving any AI-generated notes.
     - name: Set App Store "What's New"
       if: ${{ inputs.archive == 'true' && inputs.upload == 'true'
-            && inputs.manage-app-store-version == 'true'
             && (inputs.app-store-whats-new != '' || env.CFG_WHATS_NEW != '') }}
       shell: bash
       env:

package/action/scripts/cert_factory.py

@@ -3,7 +3,7 @@
 Cert-creation primitives for the iOS native TestFlight action.
 
 Owns the cryptographic legwork (RSA key + CSR), Apple's per-team cert
-cap rotation (revoke OLDEST on 409), and PKCS12 serialisation. Split
+cap policy (fail closed or revoke OLDEST on 409), and PKCS12 serialisation. Split
 from ``prepare_signing.py`` so the orchestrator there stays focused on
 the load-or-regen control flow and the file count stays under the
 project's per-file limits.
@@ -36,6 +36,16 @@ CERT_REVOKE_PROPAGATION_DELAY_SEC = float(
 CERT_POST_RETRIES_AFTER_REVOKE = int(
     os.getenv("CERT_POST_RETRIES_AFTER_REVOKE", "2")
 )
+CERTIFICATE_CAP_POLICIES = frozenset({"revoke-oldest", "fail"})
+
+
+def certificate_cap_policy() -> str:
+    """Return the configured full-cap behavior before any provider call."""
+    policy = os.getenv("CERTIFICATE_CAP_POLICY", "revoke-oldest").strip().lower()
+    if policy not in CERTIFICATE_CAP_POLICIES:
+        allowed = ", ".join(sorted(CERTIFICATE_CAP_POLICIES))
+        raise SystemExit(f"invalid CERTIFICATE_CAP_POLICY {policy!r}; use {allowed}")
+    return policy
 
 
 def generate_key_and_csr() -> tuple[rsa.RSAPrivateKey, bytes]:
@@ -137,6 +147,7 @@ def create_distribution_cert(token: str, csr_b64: str) -> tuple[str, bytes]:
     backoff to absorb Apple's revoke -> create propagation lag (see
     :func:`_post_with_revoke_backoff`).
     """
+    cap_policy = certificate_cap_policy()
     body = {
         "data": {
             "type": "certificates",
@@ -150,6 +161,11 @@ def create_distribution_cert(token: str, csr_b64: str) -> tuple[str, bytes]:
         "POST", "/certificates", token, json_body=body, allow_status={409}
     )
     if resp.status_code == 409:
+        if cap_policy == "fail":
+            raise SystemExit(
+                "distribution certificate cap reached; policy=fail preserves all "
+                "existing certificates and refuses automatic revocation"
+            )
         # Revoke the OLDEST cert, NOT the newest. The newest cert signed
         # the previous build that may still be in ASC processing — revoking
         # it during processing yields ITMS-90035 on the prior build.

package/action/scripts/test_certificate_cap_policy.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Distribution-certificate cap policy and action wiring tests."""
+from __future__ import annotations
+
+import os
+import sys
+import unittest
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import cert_factory  # noqa: E402
+
+
+ACTION_YAML = Path(__file__).resolve().parents[1] / "action.yml"
+
+
+class CertificateCapPolicyTests(unittest.TestCase):
+    def test_invalid_policy_fails_before_provider_call(self):
+        with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "rotate-all"}, clear=True):
+            with mock.patch.object(cert_factory, "request") as request:
+                with self.assertRaisesRegex(SystemExit, "invalid CERTIFICATE_CAP_POLICY"):
+                    cert_factory.create_distribution_cert("token", "csr")
+        request.assert_not_called()
+
+    def test_fail_policy_preserves_every_certificate_on_cap(self):
+        response = mock.MagicMock(status_code=409)
+        with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "fail"}, clear=True):
+            with mock.patch.object(cert_factory, "request", return_value=response) as request:
+                with mock.patch.object(cert_factory, "oldest_distribution_cert_id") as oldest:
+                    with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
+                        cert_factory.create_distribution_cert("token", "csr")
+        request.assert_called_once()
+        oldest.assert_not_called()
+
+    def test_default_policy_keeps_backward_compatible_rotation(self):
+        capped = mock.MagicMock(status_code=409)
+        created = mock.MagicMock()
+        created.json.return_value = {
+            "data": {"id": "NEW", "attributes": {"certificateContent": "Y2VydA=="}}
+        }
+        with mock.patch.dict(os.environ, {}, clear=True):
+            with mock.patch.object(
+                cert_factory, "request", side_effect=[capped, mock.MagicMock()]
+            ) as request:
+                with mock.patch.object(cert_factory, "oldest_distribution_cert_id", return_value="OLD"):
+                    with mock.patch.object(cert_factory, "_post_with_revoke_backoff", return_value=created):
+                        cert_id, cert_der = cert_factory.create_distribution_cert("token", "csr")
+        self.assertEqual((cert_id, cert_der), ("NEW", b"cert"))
+        request.assert_any_call("DELETE", "/certificates/OLD", "token")
+
+
+class CertificateCapActionWiringTests(unittest.TestCase):
+    def test_action_exposes_policy_and_persists_partial_cache_before_failure(self):
+        source = ACTION_YAML.read_text(encoding="utf-8")
+        self.assertRegex(
+            source,
+            r"(?m)^  certificate-cap-policy:\n(?:    .*\n)*?    default: \"revoke-oldest\"$",
+        )
+        self.assertIn("CERTIFICATE_CAP_POLICY: ${{ inputs.certificate-cap-policy }}", source)
+        self.assertIn("SIGNING_PREP_EXIT=$signing_exit", source)
+        self.assertIn("env.SIGNING_PREP_EXIT != '0'", source)
+        commit_at = source.index("- name: Commit + push staged bot changes")
+        failure_at = source.index("- name: Re-raise signing preparation failure")
+        self.assertLess(commit_at, failure_at)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.32
+1.0.33

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.32
+1.0.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.32",
+  "version": "1.0.33",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -113,11 +113,6 @@ jobs:
           workspace: ${{ steps.flutter.outputs.enabled == 'true' && 'ios/Runner.xcworkspace' || '' }}
           scheme: ${{ steps.flutter.outputs.enabled == 'true' && 'Runner' || '' }}
           run-tests: 'false'  # tests belong to the CI gate, not the deploy path
-          # A feature-branch TestFlight build must not create or mutate a live
-          # App Store version. That also lets it upload while the current version
-          # is locked in review. Default-branch deploys retain metadata automation.
-          manage-app-store-version: >-
-            ${{ github.ref_name == github.event.repository.default_branch && 'true' || 'false' }}
 
   android:
     name: Android Google Play

package/action/scripts/test_testflight_version_slot_wiring.py

@@ -1,50 +0,0 @@
-import re
-import unittest
-from pathlib import Path
-
-
-ACTION_YAML = Path(__file__).resolve().parents[1] / "action.yml"
-
-
-def step_block(source: str, name: str) -> str:
-    pattern = rf"    - name: {re.escape(name)}\n(?P<body>.*?)(?=\n    - name:|\Z)"
-    match = re.search(pattern, source, re.DOTALL)
-    if match is None:
-        raise AssertionError(f"missing action step: {name}")
-    return match.group("body")
-
-
-class TestTestFlightVersionSlotWiring(unittest.TestCase):
-    @classmethod
-    def setUpClass(cls) -> None:
-        cls.source = ACTION_YAML.read_text(encoding="utf-8")
-
-    def test_opt_out_is_backward_compatible(self) -> None:
-        self.assertRegex(
-            self.source,
-            r"(?m)^  manage-app-store-version:\n(?:    .*\n)*?    default: \"true\"$",
-        )
-
-    def test_opt_out_skips_store_version_but_keeps_build_number(self) -> None:
-        store_slot = step_block(self.source, "Resolve App Store version slot (REUSE or CREATE)")
-        testflight = step_block(self.source, "Resolve TestFlight build number")
-
-        self.assertIn("inputs.manage-app-store-version == 'true'", store_slot)
-        self.assertIn("inputs.manage-app-store-version == 'false'", testflight)
-        self.assertIn(
-            "APP_STORE_APPLE_ID: ${{ inputs.app-store-apple-id || env.CFG_APP_STORE_APPLE_ID }}",
-            testflight,
-        )
-        self.assertIn("next_build_number.py", testflight)
-        self.assertNotIn("manage_marketing_version.py", testflight)
-
-    def test_metadata_requires_a_managed_store_version(self) -> None:
-        detector = step_block(self.source, "Detect empty ASC metadata fields")
-        whats_new = step_block(self.source, 'Set App Store "What\'s New"')
-
-        self.assertIn("inputs.manage-app-store-version == 'true'", detector)
-        self.assertIn("inputs.manage-app-store-version == 'true'", whats_new)
-
-
-if __name__ == "__main__":
-    unittest.main()