gowalk-cicd 1.0.39 → 1.0.41

package/CLAUDE.md

@@ -2,12 +2,15 @@
 
 ## Purpose
 
-npm package that distributes iOS TestFlight and Android Google Play actions.
+npm package that distributes iOS TestFlight, Android Google Play, and Flutter
+web release workflows.
 Consumer runs `npx gowalk-cicd` and gets:
 
 - `.github/actions/swift-app/` — vendored composite action
 - `.github/actions/android-app/` — vendored Android action (Flutter or Gradle)
 - `.github/workflows/deploy.yml` — dual-platform workflow
+- `.github/workflows/deploy-web.yml` — Flutter web release artifact workflow
+  (only when `web/index.html` exists)
 
 Re-running the command is both install and update. No scope flag, no
 uninstall. Keep it simple.
@@ -25,6 +28,7 @@ gowalk-cicd/                     ← repo root IS the gowalk-cicd package
 ├── bin/cli.mjs                  ← CLI entrypoint (parses flags, calls runInstall)
 ├── src/install.mjs              ← copy logic, gitignore-check, summary print
 ├── templates/deploy.yml         ← dual-platform workflow copied verbatim
+├── templates/deploy-web.yml     ← Flutter web workflow copied conditionally
 ├── backend-action/              ← backend deploy action + remote host script
 ├── templates/deploy-backend.yml ← backend workflow copied when compose exists
 ├── scripts/auto-version.mjs     ← patch-bump-from-npm used by the publish workflow

package/README.md

@@ -1,9 +1,9 @@
 # gowalk-cicd
 
-One installer for iOS TestFlight and Android Google Play delivery. It supports
-native Swift/SwiftUI iOS projects, native Kotlin/Gradle Android projects, and
-Flutter apps. Put the platform keys under `creds/`, push to `main`, and both
-store builds run only on GitHub Actions.
+One installer for iOS TestFlight, Android Google Play, and Flutter web release
+artifacts. It supports native Swift/SwiftUI iOS projects, native Kotlin/Gradle
+Android projects, and Flutter apps. Put the platform keys under `creds/`, push
+to `main`, and the applicable builds run only on GitHub Actions.
 
 ## Install
 
@@ -13,14 +13,31 @@ From the root of your app repo:
 npx --yes gowalk-cicd
 ```
 
-Writes three things into your repo:
+Writes three core things into your repo:
 
 - `.github/actions/swift-app/` — the vendored composite action (action.yml + scripts)
 - `.github/actions/android-app/` — Android build/sign action (Flutter or Gradle)
 - `.github/workflows/deploy.yml` — workflow that builds and deploys both platforms
 
+Flutter projects that contain `web/index.html` also get
+`.github/workflows/deploy-web.yml`. It creates a version-stamped release build
+and retains `build/web` as a 30-day workflow artifact. Native-only repositories
+are unaffected.
+
 Re-run the same command anytime to pull the latest version.
 
+## Flutter web release
+
+The conditional `deploy-web.yml` workflow runs on changes to Flutter source,
+web assets, package metadata, localization config, or the workflow itself. It
+also supports manual dispatch. The build uses `GITHUB_RUN_NUMBER` as its build
+number and uploads the complete `build/web` directory as a release artifact.
+
+Private git dependencies use the same optional `GIT_PRIVATE_TOKEN` secret as
+the mobile workflow. No hosting provider is assumed: consumers can deploy the
+artifact to their chosen host without granting this package an unrelated cloud
+account or domain.
+
 ## iOS credentials
 
 1. Create an **App Store Connect API key** with the **App Manager** role
@@ -330,14 +347,21 @@ its cached cert already revoked by a sibling, mints a new one, and revokes
 another. The symptom is a "Your Certificate Has Been Revoked" email on nearly
 every deploy.
 
-Fix: apps in the same Apple team should **share one cert**. Commit the *same*
-`creds/cert.p12` + `creds/cert.meta.json` into every repo of that team (an Apple
-Distribution cert is team-scoped, not app-scoped, so one cert signs them all).
-Each app then gets a cache hit and no new cert is ever created. Provisioning
-profiles stay per-app (named `CI-<bundle_id>`) and regenerate against the shared
-cert on the next run. When onboarding a new app into an existing team, copy a
-sibling's `cert.p12` + `cert.meta.json` in rather than letting the first run
-create a fresh cert.
+Fix: apps in the same Apple team should **share one cert**. A fleet registry can
+provision the same `creds/cert.p12` + `creds/cert.meta.json` into every repo of
+that team (an Apple Distribution cert is team-scoped, not app-scoped, so one
+cert signs them all). Registry provisioning must also write
+`creds/cert.registry.json` with `managed_by: app-robot`, `state: ready`, and
+SHA-256 commit digests for both `cert.p12` and `cert.meta.json`. It must include
+the same `managed_by` field plus the DER certificate digest in
+`cert.meta.json`.
+
+The marker is a fail-closed ownership boundary: the action may reuse the
+identity and create per-app provisioning profiles, but it never creates,
+replaces, or revokes a registry-managed distribution certificate. Missing,
+partially written, corrupt, expired, Apple-revoked, or resource-ID/P12-mismatched
+managed material aborts with a reconciliation error. Legacy repos without the
+marker keep the historical cache lifecycle.
 
 ## How it works
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.39
+1.0.41

package/action/action.yml

@@ -460,6 +460,7 @@ runs:
         # the source of truth for "is there anything to commit".
         git add -f -- creds/cert.p12 2>/dev/null || true
         git add -f -- creds/cert.meta.json 2>/dev/null || true
+        git add -f -- creds/cert.registry.json 2>/dev/null || true
         git add -f -- creds/profiles.manifest.json 2>/dev/null || true
         # The whole profiles/ directory is action-managed (one
         # .mobileprovision per signable bundle, GC'd when bundles are

package/action/scripts/creds_store.py

@@ -12,6 +12,7 @@ only sane long-term strategy. We keep:
     cert.p12                       PKCS12 with cert + private key
     cert.meta.json                 {cert_id, not_after, p12_password,
                                     created_at}
+    cert.registry.json             optional registry ownership marker
     profiles.manifest.json         {cert_id, profiles:[
                                       {bundle_id, name, uuid, filename,
                                        expiration}]}
@@ -37,16 +38,25 @@ stay private; the cert lives there for warm-cache reasons, not secrecy.
 
 from __future__ import annotations
 
+import base64
+import hashlib
 import json
 import os
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
-from typing import Any
 
 from asc_common import request
 from cryptography import x509
-from cryptography.hazmat.primitives.serialization import pkcs12
+from cryptography.hazmat.primitives.serialization import Encoding, pkcs12
+from profile_store import (
+    ProfileEntry,
+    find_reusable_profile,
+    load_profile_manifest,
+    profile_path,
+    write_cached_profile,
+    write_profile_manifest,
+)
 
 
 # Auto-renew when the cert (or any profile) is within this many days of
@@ -73,8 +83,10 @@ P12_PASSWORD = "ci"
 # their own paths and the layout stays a single fact in one place.
 _CERT_P12 = "cert.p12"
 _CERT_META = "cert.meta.json"
+_CERT_REGISTRY = "cert.registry.json"
 _MANIFEST = "profiles.manifest.json"
 _PROFILES_SUBDIR = "profiles"
+REGISTRY_MANAGER = "app-robot"
 
 
 @dataclass
@@ -83,15 +95,7 @@ class CachedCert:
     not_after: datetime
     p12_bytes: bytes
     password: str
-
-
-@dataclass
-class ProfileEntry:
-    bundle_id: str
-    name: str
-    uuid: str
-    filename: str
-    expiration: datetime
+    certificate_sha256: str
 
 
 # --------------------------------------------------------------------------- #
@@ -119,13 +123,43 @@ def _now_utc() -> datetime:
     return datetime.now(timezone.utc)
 
 
-# --------------------------------------------------------------------------- #
-# Path computations (pure)                                                    #
-# --------------------------------------------------------------------------- #
+def registry_managed(creds_dir: Path) -> bool:
+    """Return whether the identity is owned by the app-robot registry.
 
-def profile_path(creds_dir: Path, uuid: str) -> Path:
-    """Return the on-disk path for a cached profile by UUID (pure)."""
-    return creds_dir / _PROFILES_SUBDIR / f"{uuid}.mobileprovision"
+    The dedicated marker makes ownership detectable even when the P12 or
+    metadata is missing/corrupt. Ownership is intentionally marker-only: a
+    rollback removes this panel-owned file while keeping the working P12/meta
+    cache intact. Unknown managers fail closed instead of falling into legacy
+    rotation.
+    """
+    marker = creds_dir / _CERT_REGISTRY
+    return _registry_payload_managed(marker) if marker.exists() else False
+
+
+def _registry_payload_managed(path: Path) -> bool:
+    try:
+        payload = json.loads(path.read_text())
+    except (OSError, ValueError) as exc:
+        raise SystemExit(f"registry marker is unreadable: {exc}") from exc
+    manager = payload.get("managed_by")
+    if not manager:
+        raise SystemExit("registry marker is missing managed_by")
+    if manager != REGISTRY_MANAGER:
+        raise SystemExit(f"unsupported signing registry manager: {manager}")
+    if payload.get("state") != "ready":
+        raise SystemExit("registry-managed signing bundle is not committed and ready")
+    files = (("p12_sha256", _CERT_P12), ("metadata_sha256", _CERT_META))
+    for field, filename in files:
+        expected = str(payload.get(field) or "").lower()
+        if len(expected) != 64 or any(char not in "0123456789abcdef" for char in expected):
+            raise SystemExit(f"registry marker has invalid {field}")
+        try:
+            actual = hashlib.sha256((path.parent / filename).read_bytes()).hexdigest()
+        except OSError as exc:
+            raise SystemExit(f"registry signing bundle is incomplete: {filename}") from exc
+        if actual != expected:
+            raise SystemExit(f"registry signing bundle digest mismatch: {filename}")
+    return True
 
 
 # --------------------------------------------------------------------------- #
@@ -133,18 +167,7 @@ def profile_path(creds_dir: Path, uuid: str) -> Path:
 # --------------------------------------------------------------------------- #
 
 def load_cached_cert(creds_dir: Path) -> CachedCert | None:
-    """Return the cached cert iff p12 + meta exist and decrypt cleanly.
-
-    Returns ``None`` (and logs a ``::warning::``) on any of:
-      * missing p12 or meta file
-      * meta JSON corrupt / missing required keys
-      * p12 fails to decrypt with the stored password
-      * cert NotAfter is within RENEW_THRESHOLD_DAYS
-
-    A returned :class:`CachedCert` is NOT yet validated against Apple —
-    the caller must still confirm the cert id is alive via
-    :func:`verify_cert_alive`.
-    """
+    """Load a locally valid cache; the caller still verifies it with Apple."""
     p12 = creds_dir / _CERT_P12
     meta = creds_dir / _CERT_META
     if not p12.exists() or not meta.exists():
@@ -156,21 +179,30 @@ def load_cached_cert(creds_dir: Path) -> CachedCert | None:
         not_after = _parse_iso(meta_raw["not_after"])
         password = meta_raw.get("p12_password") or P12_PASSWORD
     except (OSError, ValueError, KeyError) as exc:
-        print(f"::warning::cert.meta.json unreadable ({exc}); regenerating cert")
+        print(f"::warning::cert.meta.json unreadable ({exc}); identity cannot be reused")
         return None
 
     p12_bytes = p12.read_bytes()
     try:
-        pkcs12.load_key_and_certificates(p12_bytes, password.encode())
+        _, certificate, _ = pkcs12.load_key_and_certificates(p12_bytes, password.encode())
     except (ValueError, TypeError) as exc:
-        print(f"::warning::cert.p12 decrypt failed ({exc}); regenerating cert")
+        print(f"::warning::cert.p12 decrypt failed ({exc}); identity cannot be reused")
+        return None
+    if certificate is None:
+        print("::warning::cert.p12 has no certificate; identity cannot be reused")
+        return None
+    certificate_sha256 = hashlib.sha256(
+        certificate.public_bytes(Encoding.DER)).hexdigest()
+    declared_digest = str(meta_raw.get("certificate_sha256") or "").lower()
+    if declared_digest and declared_digest != certificate_sha256:
+        print("::warning::cert.meta.json certificate digest does not match cert.p12")
         return None
 
     deadline = _now_utc() + timedelta(days=RENEW_THRESHOLD_DAYS)
     if not_after <= deadline:
         print(
             f"::warning::Cached cert {cert_id} expires {not_after.isoformat()} "
-            f"(within {RENEW_THRESHOLD_DAYS}d); regenerating"
+            f"(within {RENEW_THRESHOLD_DAYS}d); identity requires replacement"
         )
         return None
 
@@ -179,10 +211,12 @@ def load_cached_cert(creds_dir: Path) -> CachedCert | None:
         not_after=not_after,
         p12_bytes=p12_bytes,
         password=password,
+        certificate_sha256=certificate_sha256,
     )
 
 
-def verify_cert_alive(token: str, cert_id: str) -> bool:
+def verify_cert_alive(token: str, cert_id: str,
+                      expected_certificate_sha256: str | None = None) -> bool:
     """Return True iff GET /certificates/{cert_id} returns 200.
 
     A 404 means Apple revoked it (manually or via the cap-rotation done
@@ -195,7 +229,16 @@ def verify_cert_alive(token: str, cert_id: str) -> bool:
         token,
         allow_status={404},
     )
-    return resp.status_code == 200
+    if resp.status_code != 200:
+        return False
+    if expected_certificate_sha256 is None:
+        return True
+    try:
+        encoded = resp.json()["data"]["attributes"]["certificateContent"]
+        certificate_der = base64.b64decode(encoded, validate=True)
+    except (KeyError, TypeError, ValueError):
+        return False
+    return hashlib.sha256(certificate_der).hexdigest() == expected_certificate_sha256
 
 
 def write_cert_bundle(
@@ -221,77 +264,6 @@ def write_cert_bundle(
     _atomic_write(creds_dir / _CERT_META, json.dumps(meta, indent=2).encode())
 
 
-# --------------------------------------------------------------------------- #
-# Profile manifest                                                            #
-# --------------------------------------------------------------------------- #
-
-def load_profile_manifest(creds_dir: Path) -> dict:
-    """Return the parsed manifest, or an empty skeleton if missing/corrupt."""
-    path = creds_dir / _MANIFEST
-    if not path.exists():
-        return {"cert_id": None, "profiles": []}
-    try:
-        data = json.loads(path.read_text())
-    except (OSError, ValueError) as exc:
-        print(f"::warning::profiles.manifest.json unreadable ({exc}); resetting")
-        return {"cert_id": None, "profiles": []}
-    data.setdefault("cert_id", None)
-    data.setdefault("profiles", [])
-    return data
-
-
-def write_profile_manifest(creds_dir: Path, manifest: dict) -> None:
-    """Persist the manifest atomically with profiles sorted by bundle_id."""
-    sorted_profiles = sorted(
-        manifest.get("profiles", []),
-        key=lambda entry: entry.get("bundle_id", ""),
-    )
-    payload = {
-        "cert_id": manifest.get("cert_id"),
-        "profiles": sorted_profiles,
-    }
-    _atomic_write(
-        creds_dir / _MANIFEST, json.dumps(payload, indent=2).encode()
-    )
-
-
-def find_reusable_profile(
-    manifest: dict,
-    bundle_id: str,
-    cert_id: str,
-    creds_dir: Path,
-) -> ProfileEntry | None:
-    """Return a reusable :class:`ProfileEntry` for ``bundle_id`` or None.
-
-    Reusable requires: manifest cert_id matches current cert_id, an
-    entry exists for the bundle, expiration is past the renew
-    threshold, and the .mobileprovision file is on disk.
-    """
-    if manifest.get("cert_id") != cert_id:
-        return None
-    deadline = _now_utc() + timedelta(days=RENEW_THRESHOLD_DAYS)
-    for raw in manifest.get("profiles", []):
-        if raw.get("bundle_id") != bundle_id:
-            continue
-        try:
-            expiration = _parse_iso(raw["expiration"])
-            uuid = raw["uuid"]
-        except (KeyError, ValueError):
-            return None
-        if expiration <= deadline:
-            return None
-        if not profile_path(creds_dir, uuid).exists():
-            return None
-        return ProfileEntry(
-            bundle_id=bundle_id,
-            name=raw.get("name", ""),
-            uuid=uuid,
-            filename=raw.get("filename", f"{uuid}.mobileprovision"),
-            expiration=expiration,
-        )
-    return None
-
-
 # --------------------------------------------------------------------------- #
 # Cache invalidation + cross-module utilities                                 #
 # --------------------------------------------------------------------------- #
@@ -308,11 +280,6 @@ def invalidate_cache(creds_dir: Path) -> None:
     print(f"Invalidated signing cache under {creds_dir}")
 
 
-def write_cached_profile(creds_dir: Path, uuid: str, profile_der: bytes) -> None:
-    """Persist a fresh .mobileprovision atomically under ``profiles/``."""
-    _atomic_write(profile_path(creds_dir, uuid), profile_der)
-
-
 def cert_not_after_from_der(cert_der: bytes) -> datetime:
     """Extract NotAfter from a DER-encoded certificate, normalised to UTC.
 

package/action/scripts/prepare_signing.py

@@ -9,9 +9,9 @@ This script orchestrates the load-or-regen flow:
 
   1. Try to reuse the cached cert (decrypts + NotAfter > 30d +
      ``GET /certificates/{cert_id}`` = 200).
-  2. On miss, invalidate the cache and create a fresh cert via
-     ``cert_factory`` (handling Apple's per-team cap of 2 by revoking
-     the OLDEST existing one).
+  2. On a legacy cache miss, invalidate the cache and create a fresh cert via
+     ``cert_factory``. A registry-managed identity instead fails closed: this
+     action never creates, replaces, or revokes centrally owned certificates.
   3. Hand the cert id + cache_hit flag to ``provision_all_bundles``,
      which decides per-bundle whether to reuse a cached profile or
      create a new one and updates the manifest.
@@ -59,35 +59,43 @@ def optional_env(name: str) -> str:
     return os.environ.get(name, "")
 
 
+def _warn_if_renewal_near(cached: creds_store.CachedCert) -> None:
+    now = datetime.now(timezone.utc)
+    renew_at = now + timedelta(days=creds_store.RENEW_THRESHOLD_DAYS)
+    warn_at = now + timedelta(days=creds_store.WARN_THRESHOLD_DAYS)
+    if renew_at < cached.not_after <= warn_at:
+        print(
+            f"::warning::Cert {cached.cert_id} expires in "
+            f"{(cached.not_after - now).days}d; auto-renew fires at "
+            f"{creds_store.RENEW_THRESHOLD_DAYS}d remaining."
+        )
+
+
 def _load_or_create_cert(
     token: str, creds_dir: Path
 ) -> tuple[str, bytes, str, bool]:
-    """Return ``(cert_id, p12_bytes, password, cache_hit)``.
-
-    Cache hit when the on-disk cert decrypts, NotAfter > 30d away, and
-    Apple confirms the cert id is still alive. On miss the cache is
-    invalidated, a new cert is created (handling Apple's per-team cap),
-    and the cache is repopulated atomically.
-    """
+    """Load a usable identity or create one only for an unmanaged legacy repo."""
+    managed = creds_store.registry_managed(creds_dir)
     cached = creds_store.load_cached_cert(creds_dir)
-    if cached and creds_store.verify_cert_alive(token, cached.cert_id):
+    expected_digest = cached.certificate_sha256 if cached and managed else None
+    if cached and creds_store.verify_cert_alive(token, cached.cert_id, expected_digest):
         print(
             f"Reusing cached distribution cert {cached.cert_id} "
             f"(NotAfter {cached.not_after.isoformat()})"
         )
-        # Warn when inside T-60d..T-30d so operators see renewal is pending
-        # but auto-renew has not yet fired.
-        now = datetime.now(timezone.utc)
-        renew_at = now + timedelta(days=creds_store.RENEW_THRESHOLD_DAYS)
-        warn_at = now + timedelta(days=creds_store.WARN_THRESHOLD_DAYS)
-        if renew_at < cached.not_after <= warn_at:
-            print(
-                f"::warning::Cert {cached.cert_id} expires in "
-                f"{(cached.not_after - now).days}d; auto-renew fires at "
-                f"{creds_store.RENEW_THRESHOLD_DAYS}d remaining."
-            )
+        _warn_if_renewal_near(cached)
         return cached.cert_id, cached.p12_bytes, cached.password, True
 
+    if managed:
+        detail = "missing, corrupt, or within the renewal window"
+        if cached:
+            detail = f"certificate {cached.cert_id} is not active on Apple or does not match cert.p12"
+        raise SystemExit(
+            "registry-managed distribution identity is unusable "
+            f"({detail}); refusing certificate creation or revocation. "
+            "Reconcile and replace the account identity in app-robot."
+        )
+
     if cached:
         print(
             f"Cached cert {cached.cert_id} no longer alive on Apple; "

package/action/scripts/profile_store.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Persistent provisioning-profile cache under an app's creds directory."""
+from __future__ import annotations
+
+import json
+import os
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+RENEW_THRESHOLD_DAYS = 30
+_MANIFEST = "profiles.manifest.json"
+_PROFILES_SUBDIR = "profiles"
+
+
+@dataclass
+class ProfileEntry:
+    bundle_id: str
+    name: str
+    uuid: str
+    filename: str
+    expiration: datetime
+
+
+def _atomic_write(path: Path, data: bytes) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    temp = path.with_suffix(path.suffix + ".tmp")
+    temp.write_bytes(data)
+    os.replace(temp, path)
+
+
+def _parse_iso(value: str) -> datetime:
+    if value.endswith("Z"):
+        value = value[:-1] + "+00:00"
+    parsed = datetime.fromisoformat(value)
+    return parsed if parsed.tzinfo else parsed.replace(tzinfo=timezone.utc)
+
+
+def profile_path(creds_dir: Path, uuid: str) -> Path:
+    return creds_dir / _PROFILES_SUBDIR / f"{uuid}.mobileprovision"
+
+
+def load_profile_manifest(creds_dir: Path) -> dict:
+    path = creds_dir / _MANIFEST
+    if not path.exists():
+        return {"cert_id": None, "profiles": []}
+    try:
+        data = json.loads(path.read_text())
+    except (OSError, ValueError) as exc:
+        print(f"::warning::profiles.manifest.json unreadable ({exc}); resetting")
+        return {"cert_id": None, "profiles": []}
+    data.setdefault("cert_id", None)
+    data.setdefault("profiles", [])
+    return data
+
+
+def write_profile_manifest(creds_dir: Path, manifest: dict) -> None:
+    profiles = sorted(manifest.get("profiles", []),
+                      key=lambda entry: entry.get("bundle_id", ""))
+    payload = {"cert_id": manifest.get("cert_id"), "profiles": profiles}
+    _atomic_write(creds_dir / _MANIFEST, json.dumps(payload, indent=2).encode())
+
+
+def find_reusable_profile(manifest: dict, bundle_id: str, cert_id: str,
+                          creds_dir: Path) -> ProfileEntry | None:
+    if manifest.get("cert_id") != cert_id:
+        return None
+    deadline = datetime.now(timezone.utc) + timedelta(days=RENEW_THRESHOLD_DAYS)
+    for raw in manifest.get("profiles", []):
+        if raw.get("bundle_id") != bundle_id:
+            continue
+        try:
+            expiration, uuid = _parse_iso(raw["expiration"]), raw["uuid"]
+        except (KeyError, ValueError):
+            return None
+        if expiration <= deadline or not profile_path(creds_dir, uuid).exists():
+            return None
+        return ProfileEntry(
+            bundle_id=bundle_id, name=raw.get("name", ""), uuid=uuid,
+            filename=raw.get("filename", f"{uuid}.mobileprovision"),
+            expiration=expiration,
+        )
+    return None
+
+
+def write_cached_profile(creds_dir: Path, uuid: str, profile_der: bytes) -> None:
+    _atomic_write(profile_path(creds_dir, uuid), profile_der)

package/action/scripts/test_registry_managed_signing.py

@@ -0,0 +1,115 @@
+#!/usr/bin/env python3
+"""Fail-closed behavior for centrally managed distribution identities."""
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import sys
+import tempfile
+import unittest
+from datetime import datetime, timezone
+from pathlib import Path
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import creds_store  # noqa: E402
+import prepare_signing  # noqa: E402
+
+
+class RegistryManagedSigningTests(unittest.TestCase):
+    def _managed_dir(self, state: str = "ready") -> tempfile.TemporaryDirectory:
+        temp = tempfile.TemporaryDirectory()
+        root = Path(temp.name)
+        p12, metadata = b"p12", b"metadata"
+        (root / "cert.p12").write_bytes(p12)
+        (root / "cert.meta.json").write_bytes(metadata)
+        marker = root / "cert.registry.json"
+        marker.write_text(json.dumps({
+            "schema_version": 1,
+            "managed_by": "app-robot",
+            "state": state,
+            "p12_sha256": hashlib.sha256(p12).hexdigest(),
+            "metadata_sha256": hashlib.sha256(metadata).hexdigest(),
+        }))
+        return temp
+
+    def test_missing_managed_identity_never_enters_creation_path(self):
+        with self._managed_dir() as raw:
+            creds_dir = Path(raw)
+            (creds_dir / "cert.p12").unlink()
+            with mock.patch.object(prepare_signing.cert_factory, "generate_key_and_csr") as generate:
+                with mock.patch.object(prepare_signing.cert_factory, "create_distribution_cert") as create:
+                    with mock.patch.object(prepare_signing.creds_store, "invalidate_cache") as invalidate:
+                        with self.assertRaisesRegex(SystemExit, "bundle is incomplete"):
+                            prepare_signing._load_or_create_cert("token", creds_dir)
+        generate.assert_not_called()
+        create.assert_not_called()
+        invalidate.assert_not_called()
+
+    def test_revoked_managed_identity_is_not_deleted_or_replaced(self):
+        cached = creds_store.CachedCert(
+            cert_id="CERT1",
+            not_after=datetime(2027, 8, 1, tzinfo=timezone.utc),
+            p12_bytes=b"p12",
+            password="secret",
+            certificate_sha256="a" * 64,
+        )
+        with self._managed_dir() as raw:
+            with mock.patch.object(prepare_signing.creds_store, "load_cached_cert", return_value=cached):
+                with mock.patch.object(prepare_signing.creds_store, "verify_cert_alive", return_value=False):
+                    with mock.patch.object(prepare_signing.cert_factory, "create_distribution_cert") as create:
+                        with self.assertRaisesRegex(SystemExit, "not active on Apple or does not match"):
+                            prepare_signing._load_or_create_cert("token", Path(raw))
+        create.assert_not_called()
+
+    def test_active_managed_identity_is_reused(self):
+        cached = creds_store.CachedCert(
+            cert_id="CERT1",
+            not_after=datetime(2027, 8, 1, tzinfo=timezone.utc),
+            p12_bytes=b"p12",
+            password="secret",
+            certificate_sha256="a" * 64,
+        )
+        with self._managed_dir() as raw:
+            with mock.patch.object(prepare_signing.creds_store, "load_cached_cert", return_value=cached):
+                with mock.patch.object(prepare_signing.creds_store, "verify_cert_alive", return_value=True):
+                    with mock.patch.object(prepare_signing.cert_factory, "create_distribution_cert") as create:
+                        result = prepare_signing._load_or_create_cert("token", Path(raw))
+        self.assertEqual(result, ("CERT1", b"p12", "secret", True))
+        create.assert_not_called()
+
+    def test_managed_liveness_binds_resource_id_to_certificate_bytes(self):
+        remote_der = b"apple-certificate-der"
+        response = mock.Mock(status_code=200)
+        response.json.return_value = {"data": {"attributes": {
+            "certificateContent": base64.b64encode(remote_der).decode(),
+        }}}
+        with mock.patch.object(creds_store, "request", return_value=response):
+            digest = hashlib.sha256(remote_der).hexdigest()
+            self.assertTrue(creds_store.verify_cert_alive("token", "CERT1", digest))
+            self.assertFalse(creds_store.verify_cert_alive("token", "CERT1", "b" * 64))
+
+    def test_updating_managed_bundle_fails_before_reading_identity(self):
+        with self._managed_dir(state="updating") as raw:
+            with mock.patch.object(prepare_signing.creds_store, "load_cached_cert") as load:
+                with self.assertRaisesRegex(SystemExit, "not committed and ready"):
+                    prepare_signing._load_or_create_cert("token", Path(raw))
+        load.assert_not_called()
+
+    def test_ready_marker_rejects_tampered_bundle(self):
+        with self._managed_dir() as raw:
+            (Path(raw) / "cert.p12").write_bytes(b"tampered")
+            with self.assertRaisesRegex(SystemExit, "digest mismatch"):
+                prepare_signing._load_or_create_cert("token", Path(raw))
+
+    def test_metadata_without_ownership_marker_remains_legacy(self):
+        with tempfile.TemporaryDirectory() as raw:
+            meta = Path(raw) / "cert.meta.json"
+            meta.write_text(json.dumps({"managed_by": "app-robot"}))
+            self.assertFalse(creds_store.registry_managed(Path(raw)))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.39
+1.0.41

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.39
+1.0.41

package/bin/cli.mjs

@@ -33,13 +33,15 @@ for (const arg of args) {
     case '--help':
       console.log(`Usage: npx gowalk-cicd [options]
 
-Installs iOS TestFlight and Android Google Play actions plus one deploy
-workflow into the current app project. Re-run anytime to update them.
+Installs iOS TestFlight and Android Google Play actions plus their deploy
+workflow into the current app project. Flutter web apps also get a release
+artifact workflow. Re-run anytime to update them.
 
 What it writes:
   .github/actions/swift-app/   - vendored composite action (action.yml + scripts/)
   .github/actions/android-app/ - Flutter Android build/sign action
   .github/workflows/deploy.yml - dual-platform workflow
+  .github/workflows/deploy-web.yml - Flutter web release workflow when web/ exists
 
 Options:
   --dry-run        Print what would happen without writing files

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.39",
+  "version": "1.0.41",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/install.mjs

@@ -28,6 +28,7 @@ const ACTION_SRC = join(PACKAGE_DIR, 'action');
 const ANDROID_ACTION_SRC = join(PACKAGE_DIR, 'android-action');
 const BACKEND_ACTION_SRC = join(PACKAGE_DIR, 'backend-action');
 const WORKFLOW_TEMPLATE = join(PACKAGE_DIR, 'templates', 'deploy.yml');
+const WEB_WORKFLOW_TEMPLATE = join(PACKAGE_DIR, 'templates', 'deploy-web.yml');
 const BACKEND_WORKFLOW_TEMPLATE = join(PACKAGE_DIR, 'templates', 'deploy-backend.yml');
 const PACKAGE_JSON = join(PACKAGE_DIR, 'package.json');
 
@@ -37,6 +38,7 @@ const ACTION_DEST_REL = join('.github', 'actions', 'swift-app');
 const ANDROID_ACTION_DEST_REL = join('.github', 'actions', 'android-app');
 const BACKEND_ACTION_DEST_REL = join('.github', 'actions', 'backend-app');
 const WORKFLOW_DEST_REL = join('.github', 'workflows', 'deploy.yml');
+const WEB_WORKFLOW_DEST_REL = join('.github', 'workflows', 'deploy-web.yml');
 const BACKEND_WORKFLOW_DEST_REL = join('.github', 'workflows', 'deploy-backend.yml');
 const VERSION_MARKER_REL = join('.github', 'actions', 'swift-app', '.daemux-version');
 const ANDROID_VERSION_MARKER_REL = join('.github', 'actions', 'android-app', '.daemux-version');
@@ -219,6 +221,20 @@ export async function runInstall({ dryRun = false } = {}) {
   writeVersionMarkers(repoRoot, dryRun);
   copyWorkflow(repoRoot, dryRun);
 
+  if (existsSync(join(repoRoot, 'pubspec.yaml'))
+      && existsSync(join(repoRoot, 'web', 'index.html'))) {
+    console.log('  Flutter web detected (web/index.html) — installing web release workflow');
+    const webWorkflowDest = join(repoRoot, WEB_WORKFLOW_DEST_REL);
+    const webWorkflowExisted = existsSync(webWorkflowDest);
+    if (dryRun) {
+      console.log(`  [dry-run] ${webWorkflowExisted ? 'overwrite' : 'create'} ${WEB_WORKFLOW_DEST_REL}`);
+    } else {
+      ensureDir(dirname(webWorkflowDest));
+      cpSync(WEB_WORKFLOW_TEMPLATE, webWorkflowDest, { force: true });
+      console.log(`  ${webWorkflowExisted ? 'Overwrote' : 'Created'} ${WEB_WORKFLOW_DEST_REL}`);
+    }
+  }
+
   // Backend deploy path — installed only when the repo has a Dockerized
   // backend (backend/ or server/ with a docker-compose.yml). Mobile-only
   // repos are unaffected, so this is backward compatible.

package/templates/deploy-web.yml

@@ -0,0 +1,58 @@
+name: Web Release
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'lib/**'
+      - 'web/**'
+      - 'assets/**'
+      - 'pubspec.yaml'
+      - 'pubspec.lock'
+      - 'l10n.yaml'
+      - 'analysis_options.yaml'
+      - '.github/workflows/deploy-web.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: web-release-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  web:
+    name: Flutter Web Artifact
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        with:
+          channel: stable
+          cache: true
+      - name: Authenticate private git dependencies
+        shell: bash
+        env:
+          GIT_PRIVATE_TOKEN: ${{ secrets.GIT_PRIVATE_TOKEN }}
+        run: |
+          if [ -z "${GIT_PRIVATE_TOKEN:-}" ]; then
+            echo "No GIT_PRIVATE_TOKEN secret; private git dependencies must carry their own credentials."
+            exit 0
+          fi
+          echo "::add-mask::$GIT_PRIVATE_TOKEN"
+          git config --global \
+            url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+      - name: Build Flutter web release
+        shell: bash
+        run: |
+          flutter pub get
+          if [ -f l10n.yaml ]; then flutter gen-l10n; fi
+          flutter build web --release --build-number="${GITHUB_RUN_NUMBER}"
+      - name: Retain Flutter web release
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: web-${{ github.event.repository.name }}-${{ github.run_number }}
+          path: build/web
+          if-no-files-found: error
+          retention-days: 30