gowalk-cicd 1.0.32 → 1.0.34

package/README.md

@@ -572,6 +572,7 @@ common ones:
 | `bundle-id` | Override the auto-detected bundle identifier |
 | `team-id` | Override the auto-detected team ID |
 | `app-store-apple-id` | Numeric ASC app ID (override auto-lookup) |
+| `certificate-cap-policy` | Full-cap behavior: `fail` preserves identities; default `revoke-oldest` rotates. |
 | `run-tests` | `false` to skip the simulator test stage |
 | `uses-non-exempt-encryption` | Value for `ITSAppUsesNonExemptEncryption` |
 | `archive` | `false` to build-only (PR runs without secrets) |
@@ -591,6 +592,12 @@ inside GitHub Actions.
 Once the app exists, all subsequent builds and uploads are fully automated via
 the ASC API key.
 
+For accounts where automatic certificate revocation is not acceptable, pass
+`certificate-cap-policy: 'fail'`. The action may add a certificate when Apple has a free
+slot, but a full-cap response aborts without listing or revoking existing identities. If
+signing preparation fails after creating a certificate, the default-branch workflow first
+commits any completed cache files, then re-raises the failure so the private key is not lost.
+
 ## Troubleshooting
 
 **"No app found for bundle ID"** — the app record doesn't exist yet. Run the

package/action/.daemux-version

@@ -1 +1 @@
-1.0.32
+1.0.34

package/action/action.yml

@@ -53,6 +53,13 @@ inputs:
       compatibility — passing a value emits a notice.
     required: false
     default: ""
+  certificate-cap-policy:
+    description: >
+      Behavior when Apple reports the two-certificate Distribution cap.
+      'revoke-oldest' preserves historical behavior; 'fail' aborts without
+      listing or revoking any existing certificate.
+    required: false
+    default: "revoke-oldest"
   upload:
     description: "Set to 'false' to stop after producing the IPA"
     required: false
@@ -362,10 +369,19 @@ runs:
         WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
         TEAM_ID: ${{ inputs.team-id || env.CFG_TEAM_ID }}
         CREDS_DIR: ${{ github.workspace }}/creds
-      run: python3 "${{ github.action_path }}/scripts/prepare_signing.py"
+        CERTIFICATE_CAP_POLICY: ${{ inputs.certificate-cap-policy }}
+      run: |
+        set +e
+        python3 "${{ github.action_path }}/scripts/prepare_signing.py"
+        signing_exit=$?
+        set -e
+        echo "SIGNING_PREP_EXIT=$signing_exit" >> "$GITHUB_ENV"
+        if [ "$signing_exit" -ne 0 ]; then
+          echo "::error::Signing preparation failed; preserving any generated cache before failing."
+        fi
 
     # DESIGN DECISION (intentional, not a bug):
-    # The next four steps stage + commit-back the Apple Distribution
+    # The next five steps stage + commit-back the Apple Distribution
     # code-signing identity (.p12 + provisioning profiles) AND any
     # autoupdate of the vendored app-ci actions into the consumer
     # repo's default branch. This is a deliberate trade-off chosen over
@@ -386,7 +402,8 @@ runs:
     # alone without redundant retries: (1) copy bot scripts to RUNNER_TEMP
     # so autoupdate's `npx` cannot mid-run swap script bytes under us,
     # (2) stage cert files, (3) check for newer app-ci on npm and
-    # stage refreshed action files, (4) commit + push whatever is staged.
+    # stage refreshed action files, (4) commit + push whatever is staged,
+    # (5) re-raise a deferred prepare failure after preserving its cache.
 
     # Stage scripts to RUNNER_TEMP so the autoupdate step's `npx` (which
     # overwrites .github/actions/swift-app/ — the same dir as ${action_path}
@@ -494,6 +511,13 @@ runs:
         GITHUB_REF_NAME: ${{ github.ref_name }}
       run: bash "$BOT_SCRIPTS_DIR/commit_bot_changes.sh"
 
+    - name: Re-raise signing preparation failure
+      if: ${{ inputs.archive == 'true' && env.SIGNING_PREP_EXIT != '0' }}
+      shell: bash
+      run: |
+        echo "::error::Signing preparation failed with exit $SIGNING_PREP_EXIT."
+        exit "$SIGNING_PREP_EXIT"
+
     - name: Stamp Info.plist versions (CFBundleVersion + CFBundleShortVersionString)
       if: ${{ inputs.archive == 'true' }}
       shell: bash

package/action/scripts/cert_factory.py

@@ -3,7 +3,7 @@
 Cert-creation primitives for the iOS native TestFlight action.
 
 Owns the cryptographic legwork (RSA key + CSR), Apple's per-team cert
-cap rotation (revoke OLDEST on 409), and PKCS12 serialisation. Split
+cap policy (fail closed or revoke OLDEST on 409), and PKCS12 serialisation. Split
 from ``prepare_signing.py`` so the orchestrator there stays focused on
 the load-or-regen control flow and the file count stays under the
 project's per-file limits.
@@ -36,6 +36,16 @@ CERT_REVOKE_PROPAGATION_DELAY_SEC = float(
 CERT_POST_RETRIES_AFTER_REVOKE = int(
     os.getenv("CERT_POST_RETRIES_AFTER_REVOKE", "2")
 )
+CERTIFICATE_CAP_POLICIES = frozenset({"revoke-oldest", "fail"})
+
+
+def certificate_cap_policy() -> str:
+    """Return the configured full-cap behavior before any provider call."""
+    policy = os.getenv("CERTIFICATE_CAP_POLICY", "revoke-oldest").strip().lower()
+    if policy not in CERTIFICATE_CAP_POLICIES:
+        allowed = ", ".join(sorted(CERTIFICATE_CAP_POLICIES))
+        raise SystemExit(f"invalid CERTIFICATE_CAP_POLICY {policy!r}; use {allowed}")
+    return policy
 
 
 def generate_key_and_csr() -> tuple[rsa.RSAPrivateKey, bytes]:
@@ -137,6 +147,7 @@ def create_distribution_cert(token: str, csr_b64: str) -> tuple[str, bytes]:
     backoff to absorb Apple's revoke -> create propagation lag (see
     :func:`_post_with_revoke_backoff`).
     """
+    cap_policy = certificate_cap_policy()
     body = {
         "data": {
             "type": "certificates",
@@ -150,6 +161,11 @@ def create_distribution_cert(token: str, csr_b64: str) -> tuple[str, bytes]:
         "POST", "/certificates", token, json_body=body, allow_status={409}
     )
     if resp.status_code == 409:
+        if cap_policy == "fail":
+            raise SystemExit(
+                "distribution certificate cap reached; policy=fail preserves all "
+                "existing certificates and refuses automatic revocation"
+            )
         # Revoke the OLDEST cert, NOT the newest. The newest cert signed
         # the previous build that may still be in ASC processing — revoking
         # it during processing yields ITMS-90035 on the prior build.

package/action/scripts/test_certificate_cap_policy.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Distribution-certificate cap policy and action wiring tests."""
+from __future__ import annotations
+
+import os
+import sys
+import unittest
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import cert_factory  # noqa: E402
+
+
+ACTION_YAML = Path(__file__).resolve().parents[1] / "action.yml"
+
+
+class CertificateCapPolicyTests(unittest.TestCase):
+    def test_invalid_policy_fails_before_provider_call(self):
+        with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "rotate-all"}, clear=True):
+            with mock.patch.object(cert_factory, "request") as request:
+                with self.assertRaisesRegex(SystemExit, "invalid CERTIFICATE_CAP_POLICY"):
+                    cert_factory.create_distribution_cert("token", "csr")
+        request.assert_not_called()
+
+    def test_fail_policy_preserves_every_certificate_on_cap(self):
+        response = mock.MagicMock(status_code=409)
+        with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "fail"}, clear=True):
+            with mock.patch.object(cert_factory, "request", return_value=response) as request:
+                with mock.patch.object(cert_factory, "oldest_distribution_cert_id") as oldest:
+                    with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
+                        cert_factory.create_distribution_cert("token", "csr")
+        request.assert_called_once()
+        oldest.assert_not_called()
+
+    def test_default_policy_keeps_backward_compatible_rotation(self):
+        capped = mock.MagicMock(status_code=409)
+        created = mock.MagicMock()
+        created.json.return_value = {
+            "data": {"id": "NEW", "attributes": {"certificateContent": "Y2VydA=="}}
+        }
+        with mock.patch.dict(os.environ, {}, clear=True):
+            with mock.patch.object(
+                cert_factory, "request", side_effect=[capped, mock.MagicMock()]
+            ) as request:
+                with mock.patch.object(cert_factory, "oldest_distribution_cert_id", return_value="OLD"):
+                    with mock.patch.object(cert_factory, "_post_with_revoke_backoff", return_value=created):
+                        cert_id, cert_der = cert_factory.create_distribution_cert("token", "csr")
+        self.assertEqual((cert_id, cert_der), ("NEW", b"cert"))
+        request.assert_any_call("DELETE", "/certificates/OLD", "token")
+
+
+class CertificateCapActionWiringTests(unittest.TestCase):
+    def test_action_exposes_policy_and_persists_partial_cache_before_failure(self):
+        source = ACTION_YAML.read_text(encoding="utf-8")
+        self.assertRegex(
+            source,
+            r"(?m)^  certificate-cap-policy:\n(?:    .*\n)*?    default: \"revoke-oldest\"$",
+        )
+        self.assertIn("CERTIFICATE_CAP_POLICY: ${{ inputs.certificate-cap-policy }}", source)
+        self.assertIn("SIGNING_PREP_EXIT=$signing_exit", source)
+        self.assertIn("env.SIGNING_PREP_EXIT != '0'", source)
+        commit_at = source.index("- name: Commit + push staged bot changes")
+        failure_at = source.index("- name: Re-raise signing preparation failure")
+        self.assertLess(commit_at, failure_at)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.32
+1.0.34

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.32
+1.0.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.32",
+  "version": "1.0.34",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {