gowalk-cicd 1.0.37 → 1.0.38

package/CLAUDE.md

@@ -25,6 +25,8 @@ gowalk-cicd/                     ← repo root IS the gowalk-cicd package
 ├── bin/cli.mjs                  ← CLI entrypoint (parses flags, calls runInstall)
 ├── src/install.mjs              ← copy logic, gitignore-check, summary print
 ├── templates/deploy.yml         ← dual-platform workflow copied verbatim
+├── backend-action/              ← backend deploy action + remote host script
+├── templates/deploy-backend.yml ← backend workflow copied when compose exists
 ├── scripts/auto-version.mjs     ← patch-bump-from-npm used by the publish workflow
 ├── .github/workflows/publish.yml ← auto-publish to npm on push to main
 ├── README.md                    ← consumer docs
@@ -96,6 +98,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   materializes `ASC_KEY_P8` + its ID/issuer and the Android keystore,
   properties and Play service account into an ephemeral runner checkout.
   Tracked `creds/` files remain a backward-compatible fallback.
+- Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
+  secret. The action writes it to host-side `.runtime.env` with mode 0600 and
+  supplies it to Compose after the generated `.env`; never print its content.
 - The Android action serves two build systems. `android_config.project_kind()`
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie

package/README.md

@@ -21,12 +21,6 @@ Writes three things into your repo:
 
 Re-run the same command anytime to pull the latest version.
 
-Flutter map apps may also provide `GOOGLE_MAPS_IOS_KEY` and
-`GOOGLE_MAPS_ANDROID_KEY` as Actions secrets. When present, the workflow writes
-the iOS key to `ios/Flutter/MapsKeys.xcconfig` and the Android key to
-`android/app/src/main/res/values/google_maps_api.xml` as mode-restricted runner
-files. Apps without either secret are unchanged.
-
 ## iOS credentials
 
 1. Create an **App Store Connect API key** with the **App Manager** role
@@ -67,6 +61,9 @@ Requirements on the consumer repo:
   never bake secrets in. A generated `.env` (with `POSTGRES_PASSWORD`) is created
   on the host on first deploy and preserved across deploys (rsync excludes it).
 - Repo **secret** `BACKEND_DEPLOY_SSH_KEY` (a private key with access to the host).
+- Repo **secret** `BACKEND_RUNTIME_ENV` (optional): newline-delimited `KEY=value`
+  runtime secrets. The action writes it as mode 0600 on the host and passes it
+  to Compose without copying values into the repository or action log.
 - Repo **variables** (optional): `BACKEND_API_DOMAIN` (its DNS A record must point
   at the host for the cert; empty = deploy the container only, skip nginx/cert),
   `BACKEND_APP_NAME` (defaults to the repo name), `BACKEND_HEALTH_PATH`
@@ -190,11 +187,11 @@ sent for review from the Google Play Console UI.
 ```
 
 That fails the whole upload, so the bundle you just built never reaches Play at
-all. After an ordinary fresh-edit retry, the final retry re-uploads with
-`changesNotSentForReview`, which lands the bundle and leaves it waiting, then
-emits a `::warning::` naming the package. The delivery system can then complete
-the console-only **Send changes for review** action through the app's leased
-AdsPower profile.
+all. The retry re-uploads with `changesNotSentForReview`, which lands the bundle
+and leaves it waiting, then emits a `::warning::` naming the package. Someone
+then presses **Send changes for review** on that app's Publishing overview page.
+There is no API for that press — it is the one step Google deliberately reserves
+for a human, and no amount of tooling removes it.
 
 In the ordinary case the first upload submits normally and the retry is skipped.
 
@@ -210,10 +207,8 @@ long enough outlives one:
 
 Neither says anything about the build, which is signed and retained by that
 point. The upload step therefore runs with `continue-on-error` and a second
-ordinary attempt follows when the first fails. This preserves automatic review
-submission while opening a fresh edit. Only when that retry also fails does a
-third attempt use `changesNotSentForReview`; setting that flag on an ordinary
-app is itself a Play validation error.
+attempt follows when the first fails — a fresh edit succeeds. Both attempts
+failing still fails the job.
 
 One caveat this makes explicit: **nothing else should hold an edit open on the
 same package while a deploy runs.** A script that polls `edits.insert` /

package/action/.daemux-version

@@ -1 +1 @@
-1.0.37
+1.0.38

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.37
+1.0.38

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.37
+1.0.38

package/backend-action/action.yml

@@ -39,6 +39,13 @@ inputs:
     description: Email for the Let's Encrypt registration.
     required: false
     default: "admin@gowalk.com"
+  runtime-env:
+    description: >
+      Optional newline-delimited KEY=value secrets written to a mode-0600
+      host-side env file and supplied to Docker Compose. Pass from one
+      encrypted secret such as BACKEND_RUNTIME_ENV; never commit the values.
+    required: false
+    default: ""
 
 runs:
   using: composite
@@ -83,10 +90,17 @@ runs:
 
     - name: Deploy on the host
       shell: bash
+      env:
+        RUNTIME_ENV: ${{ inputs.runtime-env }}
       run: |
         set -euo pipefail
         SSH="ssh -i ~/.ssh/backend_deploy -o IdentitiesOnly=yes"
         DEST="/opt/gowalk-backends/${{ inputs.app-name }}"
+        if [ -n "${RUNTIME_ENV:-}" ]; then
+          printf '%s\n' "$RUNTIME_ENV" | $SSH \
+            "${{ inputs.ssh-user }}@${{ inputs.host }}" \
+            "umask 077; cat > '$DEST/.runtime.env'"
+        fi
         $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" \
           "bash '$DEST/.remote_deploy.sh' \
              '${{ inputs.app-name }}' '${{ inputs.api-domain }}' \

package/backend-action/remote_deploy.sh

@@ -23,15 +23,22 @@ if [ ! -f .env ]; then
   chmod 600 .env
 fi
 
+COMPOSE_ENV=(--env-file .env)
+if [ -s .runtime.env ]; then
+  chmod 600 .runtime.env
+  COMPOSE_ENV+=(--env-file .runtime.env)
+fi
+
 # ── bring the stack up
 log "docker compose up -d --build"
-docker compose --project-name "$APP" up -d --build --remove-orphans
+docker compose "${COMPOSE_ENV[@]}" --project-name "$APP" \
+  up -d --build --remove-orphans
 
 # ── discover the host port the service published on 127.0.0.1.
 # The text `ps` PORTS column reliably shows `127.0.0.1:<port>-><target>/tcp`.
 detect_port() {
   # Capture ONLY the published port after 127.0.0.1: (not the IP's own digits).
-  docker compose --project-name "$APP" ps 2>/dev/null \
+  docker compose "${COMPOSE_ENV[@]}" --project-name "$APP" ps 2>/dev/null \
     | sed -nE 's/.*127\.0\.0\.1:([0-9]+)->.*/\1/p' | head -1
 }
 PORT="$(detect_port || true)"
@@ -51,8 +58,8 @@ for i in $(seq 1 90); do
 done
 if [ -z "$HEALTHY" ]; then
   log "ERROR: container never became healthy on :$PORT$HEALTH"
-  docker compose --project-name "$APP" ps
-  docker compose --project-name "$APP" logs --tail 60
+  docker compose "${COMPOSE_ENV[@]}" --project-name "$APP" ps
+  docker compose "${COMPOSE_ENV[@]}" --project-name "$APP" logs --tail 60
   exit 1
 fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.37",
+  "version": "1.0.38",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-backend.yml

@@ -39,3 +39,4 @@ jobs:
           api-domain: ${{ vars.BACKEND_API_DOMAIN }}
           backend-dir: ${{ steps.dir.outputs.path }}
           health-path: ${{ vars.BACKEND_HEALTH_PATH || '/health' }}
+          runtime-env: ${{ secrets.BACKEND_RUNTIME_ENV }}

package/templates/deploy.yml

@@ -57,15 +57,6 @@ jobs:
           else
             echo "enabled=false" >> "$GITHUB_OUTPUT"
           fi
-      - name: Materialize restricted iOS Maps key
-        if: ${{ steps.flutter.outputs.enabled == 'true' }}
-        shell: bash
-        env:
-          GOOGLE_MAPS_IOS_KEY: ${{ secrets.GOOGLE_MAPS_IOS_KEY }}
-        run: |
-          [ -n "${GOOGLE_MAPS_IOS_KEY:-}" ] || exit 0
-          umask 077
-          printf 'GOOGLE_MAPS_IOS_KEY=%s\n' "$GOOGLE_MAPS_IOS_KEY" > ios/Flutter/MapsKeys.xcconfig
       - name: Set up Flutter
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
@@ -315,21 +306,6 @@ jobs:
             flutter pub get
             flutter gen-l10n
           fi
-      - name: Materialize restricted Android Maps key
-        if: >-
-          ${{ steps.mode.outputs.mode == 'local'
-              && steps.flutter.outputs.enabled == 'true' }}
-        shell: bash
-        env:
-          GOOGLE_MAPS_ANDROID_KEY: ${{ secrets.GOOGLE_MAPS_ANDROID_KEY }}
-        run: |
-          [ -n "${GOOGLE_MAPS_ANDROID_KEY:-}" ] || exit 0
-          umask 077
-          mkdir -p android/app/src/main/res/values
-          printf '%s\n' '<?xml version="1.0" encoding="utf-8"?>' \
-            '<resources>' \
-            "    <string name=\"google_maps_key\" translatable=\"false\">$GOOGLE_MAPS_ANDROID_KEY</string>" \
-            '</resources>' > android/app/src/main/res/values/google_maps_api.xml
       - name: Build and sign Android release
         id: android
         if: ${{ steps.mode.outputs.mode == 'local' }}
@@ -387,39 +363,19 @@ jobs:
             ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
           whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
 
-      # A failed action does not expose a machine-readable Play error code. Retry once
-      # with the ordinary review mode first: that opens a fresh edit and repairs an edit
-      # that expired during a slow upload without changing submission semantics.
-      - name: Retry Google Play upload with a fresh edit
-        id: play-upload-fresh-retry
-        continue-on-error: true
-        if: >-
-          ${{ steps.mode.outputs.mode == 'local'
-              && steps.play.outputs.ready == 'true'
-              && steps.play-upload.outcome == 'failure' }}
-        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
-        with:
-          serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
-          packageName: ${{ steps.android.outputs.package-name }}
-          releaseFiles: ${{ steps.android.outputs.bundle-path }}
-          tracks: ${{ vars.GOOGLE_PLAY_TRACK || 'internal' }}
-          status: ${{ vars.GOOGLE_PLAY_STATUS || 'completed' }}
-          userFraction: >-
-            ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
-          whatsNewDirectory: >-
-            ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
-
-      # If the ordinary fresh-edit retry also fails, Play may be requiring the
-      # changesNotSentForReview mode used after a policy rejection. A third, fresh edit
-      # is intentionally reserved for that case. Setting the flag on the edit-expiry
-      # retry is invalid for apps whose changes are submitted automatically.
+      # The retry serves two different failures, and both need a fresh edit:
+      #   * the edit expired mid-upload (a large bundle on a slow runner), and
+      #   * Play refused to auto-submit: "Changes cannot be sent for review
+      #     automatically. Please set changesNotSentForReview to true." Play returns
+      #     this once an app has changes a human must submit — after a policy
+      #     rejection, for instance — and it fails the whole upload, so the built
+      #     bundle never lands at all.
       - name: Retry Google Play upload without auto-submit
-        id: play-upload-review-retry
+        id: play-upload-retry
         if: >-
           ${{ steps.mode.outputs.mode == 'local'
               && steps.play.outputs.ready == 'true'
-              && steps.play-upload.outcome == 'failure'
-              && steps.play-upload-fresh-retry.outcome == 'failure' }}
+              && steps.play-upload.outcome == 'failure' }}
         uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
@@ -434,7 +390,7 @@ jobs:
           changesNotSentForReview: true
 
       - name: Say what still needs a human
-        if: ${{ always() && steps.play-upload-review-retry.outcome == 'success' }}
+        if: ${{ always() && steps.play-upload-retry.outcome == 'success' }}
         shell: bash
         run: |
           echo "::warning::Play would not accept this release for review automatically, so it was \