gowalk-cicd 1.0.34 → 1.0.36

package/README.md

@@ -21,6 +21,12 @@ Writes three things into your repo:
 
 Re-run the same command anytime to pull the latest version.
 
+Flutter map apps may also provide `GOOGLE_MAPS_IOS_KEY` and
+`GOOGLE_MAPS_ANDROID_KEY` as Actions secrets. When present, the workflow writes
+the iOS key to `ios/Flutter/MapsKeys.xcconfig` and the Android key to
+`android/app/src/main/res/values/google_maps_api.xml` as mode-restricted runner
+files. Apps without either secret are unchanged.
+
 ## iOS credentials
 
 1. Create an **App Store Connect API key** with the **App Manager** role
@@ -184,11 +190,11 @@ sent for review from the Google Play Console UI.
 ```
 
 That fails the whole upload, so the bundle you just built never reaches Play at
-all. The retry re-uploads with `changesNotSentForReview`, which lands the bundle
-and leaves it waiting, then emits a `::warning::` naming the package. Someone
-then presses **Send changes for review** on that app's Publishing overview page.
-There is no API for that press — it is the one step Google deliberately reserves
-for a human, and no amount of tooling removes it.
+all. After an ordinary fresh-edit retry, the final retry re-uploads with
+`changesNotSentForReview`, which lands the bundle and leaves it waiting, then
+emits a `::warning::` naming the package. The delivery system can then complete
+the console-only **Send changes for review** action through the app's leased
+AdsPower profile.
 
 In the ordinary case the first upload submits normally and the retry is skipped.
 
@@ -204,8 +210,10 @@ long enough outlives one:
 
 Neither says anything about the build, which is signed and retained by that
 point. The upload step therefore runs with `continue-on-error` and a second
-attempt follows when the first fails — a fresh edit succeeds. Both attempts
-failing still fails the job.
+ordinary attempt follows when the first fails. This preserves automatic review
+submission while opening a fresh edit. Only when that retry also fails does a
+third attempt use `changesNotSentForReview`; setting that flag on an ordinary
+app is itself a Play validation error.
 
 One caveat this makes explicit: **nothing else should hold an edit open on the
 same package while a deploy runs.** A script that polls `edits.insert` /

package/action/.daemux-version

@@ -1 +1 @@
-1.0.34
+1.0.36

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.34
+1.0.36

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.34
+1.0.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.34",
+  "version": "1.0.36",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -57,6 +57,14 @@ jobs:
           else
             echo "enabled=false" >> "$GITHUB_OUTPUT"
           fi
+      - name: Materialize restricted iOS Maps key
+        if: ${{ steps.flutter.outputs.enabled == 'true' && secrets.GOOGLE_MAPS_IOS_KEY != '' }}
+        shell: bash
+        env:
+          GOOGLE_MAPS_IOS_KEY: ${{ secrets.GOOGLE_MAPS_IOS_KEY }}
+        run: |
+          umask 077
+          printf 'GOOGLE_MAPS_IOS_KEY=%s\n' "$GOOGLE_MAPS_IOS_KEY" > ios/Flutter/MapsKeys.xcconfig
       - name: Set up Flutter
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
@@ -306,6 +314,21 @@ jobs:
             flutter pub get
             flutter gen-l10n
           fi
+      - name: Materialize restricted Android Maps key
+        if: >-
+          ${{ steps.mode.outputs.mode == 'local'
+              && steps.flutter.outputs.enabled == 'true'
+              && secrets.GOOGLE_MAPS_ANDROID_KEY != '' }}
+        shell: bash
+        env:
+          GOOGLE_MAPS_ANDROID_KEY: ${{ secrets.GOOGLE_MAPS_ANDROID_KEY }}
+        run: |
+          umask 077
+          mkdir -p android/app/src/main/res/values
+          printf '%s\n' '<?xml version="1.0" encoding="utf-8"?>' \
+            '<resources>' \
+            "    <string name=\"google_maps_key\" translatable=\"false\">$GOOGLE_MAPS_ANDROID_KEY</string>" \
+            '</resources>' > android/app/src/main/res/values/google_maps_api.xml
       - name: Build and sign Android release
         id: android
         if: ${{ steps.mode.outputs.mode == 'local' }}
@@ -363,20 +386,40 @@ jobs:
             ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
           whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
 
-      # The retry serves two different failures, and both need a fresh edit:
-      #   * the edit expired mid-upload (a large bundle on a slow runner), and
-      #   * Play refused to auto-submit: "Changes cannot be sent for review
-      #     automatically. Please set changesNotSentForReview to true." Play returns
-      #     this once an app has changes a human must submit — after a policy
-      #     rejection, for instance — and it fails the whole upload, so the built
-      #     bundle never lands at all.
-      - name: Retry Google Play upload without auto-submit
-        id: play-upload-retry
+      # A failed action does not expose a machine-readable Play error code. Retry once
+      # with the ordinary review mode first: that opens a fresh edit and repairs an edit
+      # that expired during a slow upload without changing submission semantics.
+      - name: Retry Google Play upload with a fresh edit
+        id: play-upload-fresh-retry
+        continue-on-error: true
         if: >-
           ${{ steps.mode.outputs.mode == 'local'
               && steps.play.outputs.ready == 'true'
               && steps.play-upload.outcome == 'failure' }}
         uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
+        with:
+          serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
+          packageName: ${{ steps.android.outputs.package-name }}
+          releaseFiles: ${{ steps.android.outputs.bundle-path }}
+          tracks: ${{ vars.GOOGLE_PLAY_TRACK || 'internal' }}
+          status: ${{ vars.GOOGLE_PLAY_STATUS || 'completed' }}
+          userFraction: >-
+            ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
+          whatsNewDirectory: >-
+            ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
+
+      # If the ordinary fresh-edit retry also fails, Play may be requiring the
+      # changesNotSentForReview mode used after a policy rejection. A third, fresh edit
+      # is intentionally reserved for that case. Setting the flag on the edit-expiry
+      # retry is invalid for apps whose changes are submitted automatically.
+      - name: Retry Google Play upload without auto-submit
+        id: play-upload-review-retry
+        if: >-
+          ${{ steps.mode.outputs.mode == 'local'
+              && steps.play.outputs.ready == 'true'
+              && steps.play-upload.outcome == 'failure'
+              && steps.play-upload-fresh-retry.outcome == 'failure' }}
+        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
           packageName: ${{ steps.android.outputs.package-name }}
@@ -390,7 +433,7 @@ jobs:
           changesNotSentForReview: true
 
       - name: Say what still needs a human
-        if: ${{ always() && steps.play-upload-retry.outcome == 'success' }}
+        if: ${{ always() && steps.play-upload-review-retry.outcome == 'success' }}
         shell: bash
         run: |
           echo "::warning::Play would not accept this release for review automatically, so it was \