gowalk-cicd 1.0.4 → 1.0.6

package/README.md

@@ -147,7 +147,7 @@ configuration for either:
 |---|---|---|
 | Detected by | `pubspec.yaml` at the repo root | `settings.gradle(.kts)` + `gradlew` at the root or under `android/` |
 | App module | `android/app` | the one module applying `com.android.application` (version-catalog aliases are resolved; a module named `app` wins a tie against a wear/automotive sibling) |
-| Tests (`run-tests`) | `flutter analyze` + `flutter test` | `<module>:testReleaseUnitTest` |
+| Tests (`run-tests`) | `flutter analyze` + `flutter test` | `gradlew test` (all variants, all modules) |
 | Build | `flutter build appbundle --release` | `<module>:bundleRelease` |
 | Toolchain installed | Flutter + JDK 17 | JDK 21 only |
 
@@ -176,9 +176,11 @@ The iOS composite action runs on `macos-15` and:
    declared version is already live.
 4. **Computes the next build number** by querying ASC for the latest uploaded
    build and incrementing.
-5. **Provisions signing** at runtime: generates a throwaway Apple Distribution
-   cert + a per-target App Store provisioning profile named `CI-<bundle_id>`.
-   Patches the `.pbxproj` to use Manual signing against those profiles.
+5. **Provisions signing** at runtime: reconciles the App ID's capabilities with
+   the target's entitlements (see below), then generates a throwaway Apple
+   Distribution cert + a per-target App Store provisioning profile named
+   `CI-<bundle_id>`. Patches the `.pbxproj` to use Manual signing against those
+   profiles.
 6. **Archives** with `xcodebuild archive`, exports the IPA, and uploads via
    `xcrun altool`.
 7. **Sets "What's New"** on every declared localization (reads
@@ -191,6 +193,29 @@ The iOS composite action runs on `macos-15` and:
 
 The iOS action requires only the p8. Everything else is derived.
 
+### App ID capabilities
+
+A provisioning profile carries only the capabilities enabled on its App ID.
+Xcode's automatic signing hides this by turning them on as you edit
+entitlements; the ASC API does not, so a CI-issued profile omits them and the
+archive fails with
+
+```
+Provisioning profile "CI-com.example.app" doesn't include the App Attest capability.
+```
+
+Before creating a profile, the action reads the target's
+`CODE_SIGN_ENTITLEMENTS` plist and enables the matching capabilities on the App
+ID — Push Notifications, App Attest, Associated Domains, Sign in with Apple,
+HealthKit, SiriKit, NFC, HomeKit, network extensions and the other plain
+on/off toggles. If it had to turn anything on, it regenerates the profile
+rather than reusing the cached one, which predates the change.
+
+Capabilities that carry values an entitlements file cannot supply — App Groups,
+iCloud containers, Apple Pay merchant IDs, Wallet pass types, Data Protection —
+are **not** enabled automatically. The action emits a `::warning::` naming what
+it saw and leaves those for you to configure in the Apple Developer portal.
+
 ## AI metadata auto-fill
 
 On every run, after the TestFlight upload succeeds, the action:
@@ -319,6 +344,12 @@ pending agreements, retry.
 **Upload fails with provisioning errors** — delete any stale profiles named
 `CI-<bundle_id>` on developer.apple.com and re-run; the action will regenerate.
 
+**"Provisioning profile doesn't include the &lt;X&gt; capability"** — the App ID
+lacks a capability the entitlements declare. The action enables the simple
+toggles itself (see [App ID capabilities](#app-id-capabilities)); if the
+warning names App Groups, iCloud, Apple Pay, Wallet or Data Protection, enable
+and configure that one in the Apple Developer portal, then re-run.
+
 ## Auto-bumping MARKETING_VERSION
 
 When the ASC combined floor (max of pending review, `preReleaseVersions`,

package/action/.daemux-version

@@ -1 +1 @@
-1.0.4
+1.0.6

package/action/scripts/auto_detect.py

@@ -52,8 +52,15 @@ from cfg_io import log, notice
 APP_PRODUCT_TYPE = "com.apple.product-type.application"
 # Timeouts (seconds) — xcodebuild can hang on missing toolchains or
 # package resolution. CI should fail fast rather than spin forever.
-LIST_TIMEOUT = 60
-SETTINGS_TIMEOUT = 120
+#
+# The first xcodebuild invocation on a cold runner also resolves the Swift
+# Package Manager graph, and a project that depends on firebase-ios-sdk spends
+# minutes cloning before it prints a single scheme. That is legitimate work,
+# not a hang, so `-list` gets a budget that survives it and a one-shot
+# pre-resolution retry (see _list_schemes) rather than a tighter deadline.
+LIST_TIMEOUT = 180
+SETTINGS_TIMEOUT = 300
+RESOLVE_TIMEOUT = 900
 
 # Process-local caches keyed by (project, workspace_file) or
 # (project, workspace_file, scheme, configuration). Cleared between test
@@ -221,6 +228,39 @@ def _pick_by_basename(matches: list[Path], workspace: Path, label: str) -> Path:
     return matches[0]
 
 
+def _resolve_package_dependencies(
+    workspace: Path, project: str, workspace_file: str
+) -> bool:
+    """Resolve the SPM graph once so later xcodebuild calls are cheap.
+
+    Returns True when resolution finished (regardless of exit status — a
+    project with no packages still exits cleanly and a partial resolve may
+    be enough for ``-list``), False when it could not be run at all.
+    """
+    cmd = ["xcodebuild", "-resolvePackageDependencies"]
+    if workspace_file:
+        cmd += ["-workspace", workspace_file]
+    elif project:
+        cmd += ["-project", project]
+    else:
+        return False
+    log("auto-detect: pre-resolving Swift package dependencies")
+    try:
+        result = subprocess.run(
+            cmd, cwd=str(workspace), capture_output=True, text=True,
+            timeout=RESOLVE_TIMEOUT,
+        )
+    except (OSError, subprocess.TimeoutExpired) as exc:
+        log(f"auto-detect: xcodebuild -resolvePackageDependencies failed: {exc!r}")
+        return False
+    if result.returncode != 0:
+        log(
+            f"auto-detect: xcodebuild -resolvePackageDependencies returned "
+            f"{result.returncode}: {result.stderr.strip()[:500]}"
+        )
+    return True
+
+
 def _list_schemes(
     workspace: Path, project: str, workspace_file: str
 ) -> Optional[list[str]]:
@@ -243,7 +283,27 @@ def _list_schemes(
             cmd, cwd=str(workspace), capture_output=True, text=True,
             timeout=LIST_TIMEOUT,
         )
-    except (OSError, subprocess.TimeoutExpired) as exc:
+    except subprocess.TimeoutExpired as exc:
+        # Almost always SPM resolution rather than a hang: `-list` implicitly
+        # resolves the package graph, and a cold Firebase/GoogleSignIn clone
+        # outlasts any deadline short enough to still catch a real hang. Pay
+        # for the resolve once, explicitly, then retry. Swallowing this is what
+        # produced the downstream "MARKETING_VERSION for scheme=" failure --
+        # an empty scheme reads as "project has none", not "we never asked".
+        log(f"auto-detect: xcodebuild -list timed out: {exc!r}")
+        if not _resolve_package_dependencies(workspace, project, workspace_file):
+            _list_cache[key] = None
+            return None
+        try:
+            result = subprocess.run(
+                cmd, cwd=str(workspace), capture_output=True, text=True,
+                timeout=LIST_TIMEOUT,
+            )
+        except (OSError, subprocess.TimeoutExpired) as retry_exc:
+            log(f"auto-detect: xcodebuild -list failed after resolve: {retry_exc!r}")
+            _list_cache[key] = None
+            return None
+    except OSError as exc:
         log(f"auto-detect: xcodebuild -list failed: {exc!r}")
         _list_cache[key] = None
         return None

package/action/scripts/capabilities.py

@@ -0,0 +1,166 @@
+#!/usr/bin/env python3
+"""Reconcile an App ID's capabilities with what the app's entitlements need.
+
+A provisioning profile only carries the capabilities enabled on its App ID.
+Xcode's automatic signing hides this by enabling them for you as you edit
+entitlements; the ASC API does not, so a CI-generated profile silently omits
+them and `xcodebuild archive` fails with
+
+    Provisioning profile "CI-<bundle>" doesn't include the App Attest
+    capability.
+
+This module reads the entitlement keys the project actually declares and turns
+on the matching capabilities before the profile is created.
+
+Deliberately narrow: only capabilities that are a plain on/off switch are
+enabled automatically. App Groups, iCloud containers, Apple Pay merchant IDs
+and friends carry settings that cannot be guessed from an entitlements file, so
+they are reported and left to a human. Everything here is best-effort — a
+capability we cannot enable produces a ``::warning::`` and lets the archive
+deliver Apple's own (more specific) error rather than failing the build here.
+"""
+
+from __future__ import annotations
+
+import plistlib
+from pathlib import Path
+
+from asc_common import get_json, request
+
+
+# Entitlement key -> App Store Connect capabilityType, for capabilities that
+# are a bare toggle. An entitlement absent from this map is not an error: most
+# entitlements (keychain-access-groups, get-task-allow, ...) need no App ID
+# capability at all.
+CAPABILITY_BY_ENTITLEMENT = {
+    "aps-environment": "PUSH_NOTIFICATIONS",
+    "com.apple.developer.devicecheck.appattest-environment": "APP_ATTEST",
+    "com.apple.developer.associated-domains": "ASSOCIATED_DOMAINS",
+    "com.apple.developer.applesignin": "APPLE_ID_AUTH",
+    "com.apple.developer.networking.wifi-info": "ACCESS_WIFI_INFORMATION",
+    "com.apple.developer.networking.networkextension": "NETWORK_EXTENSIONS",
+    "com.apple.developer.networking.vpn.api": "PERSONAL_VPN",
+    "com.apple.developer.networking.multipath": "MULTIPATH",
+    "com.apple.developer.networking.HotspotConfiguration": "HOT_SPOT",
+    "com.apple.developer.nfc.readersession.formats": "NFC_TAG_READING",
+    "com.apple.developer.homekit": "HOMEKIT",
+    "com.apple.developer.healthkit": "HEALTHKIT",
+    "com.apple.developer.siri": "SIRIKIT",
+    "com.apple.developer.ClassKit-environment": "CLASSKIT",
+    "com.apple.developer.authentication-services.autofill-credential-provider":
+        "AUTOFILL_CREDENTIAL_PROVIDER",
+    "com.apple.external-accessory.wireless-configuration":
+        "WIRELESS_ACCESSORY_CONFIGURATION",
+    "inter-app-audio": "INTER_APP_AUDIO",
+}
+
+# Capabilities whose App ID configuration carries values (container ids,
+# merchant ids, protection level) that an entitlements file cannot supply
+# unambiguously. Enabling these blind would create a half-configured App ID,
+# so we say what is missing and stop.
+MANUAL_ENTITLEMENTS = {
+    "com.apple.security.application-groups": "App Groups",
+    "com.apple.developer.icloud-container-identifiers": "iCloud",
+    "com.apple.developer.icloud-services": "iCloud",
+    "com.apple.developer.ubiquity-kvstore-identifier": "iCloud",
+    "com.apple.developer.in-app-payments": "Apple Pay",
+    "com.apple.developer.pass-type-identifiers": "Wallet",
+    "com.apple.developer.default-data-protection": "Data Protection",
+}
+
+
+def read_entitlement_keys(path: Path) -> set[str]:
+    """Top-level keys of an entitlements plist; empty when unreadable."""
+    try:
+        with path.open("rb") as handle:
+            data = plistlib.load(handle)
+    except (OSError, plistlib.InvalidFileException, ValueError) as exc:
+        print(f"::warning::could not read entitlements {path}: {exc!r}")
+        return set()
+    return set(data) if isinstance(data, dict) else set()
+
+
+def required_capabilities(entitlement_keys: set[str]) -> set[str]:
+    return {
+        CAPABILITY_BY_ENTITLEMENT[key]
+        for key in entitlement_keys
+        if key in CAPABILITY_BY_ENTITLEMENT
+    }
+
+
+def warn_about_manual_entitlements(entitlement_keys: set[str], bundle_id: str) -> None:
+    for key in sorted(entitlement_keys & set(MANUAL_ENTITLEMENTS)):
+        print(
+            f"::warning::{bundle_id} declares {key}, which needs "
+            f"{MANUAL_ENTITLEMENTS[key]} configured on the App ID with values "
+            f"this action cannot infer. Enable it in the Apple Developer "
+            f"portal if the archive complains."
+        )
+
+
+def enabled_capabilities(token: str, bundle_pk: str) -> set[str]:
+    try:
+        data = get_json(
+            f"/bundleIds/{bundle_pk}/bundleIdCapabilities", token,
+            params={"limit": "200"},
+        )
+    except Exception as exc:  # noqa: BLE001 - never fail signing over a read
+        print(f"::warning::could not list capabilities for {bundle_pk}: {exc!r}")
+        return set()
+    found = set()
+    for item in data.get("data", []):
+        capability = (item.get("attributes") or {}).get("capabilityType")
+        if capability:
+            found.add(capability)
+    return found
+
+
+def enable_capability(token: str, bundle_pk: str, capability: str) -> bool:
+    body = {
+        "data": {
+            "type": "bundleIdCapabilities",
+            "attributes": {"capabilityType": capability},
+            "relationships": {
+                "bundleId": {"data": {"type": "bundleIds", "id": bundle_pk}}
+            },
+        }
+    }
+    try:
+        # 409 means another writer got there first — the desired end state.
+        response = request(
+            "POST", "/bundleIdCapabilities", token,
+            json_body=body, allow_status={200, 201, 409},
+        )
+    except Exception as exc:  # noqa: BLE001 - Apple's archive error is clearer
+        print(f"::warning::could not enable {capability}: {exc!r}")
+        return False
+    if response.status_code == 409:
+        return False
+    print(f"Enabled {capability} on the App ID")
+    return True
+
+
+def reconcile(token: str, bundle_pk: str, bundle_id: str, entitlement_keys: set[str]) -> bool:
+    """Enable every simple capability the entitlements imply.
+
+    Returns True when something was actually turned on — the caller must then
+    regenerate the profile, because a cached one predates the change and still
+    lacks the capability.
+    """
+    warn_about_manual_entitlements(entitlement_keys, bundle_id)
+    wanted = required_capabilities(entitlement_keys)
+    if not wanted:
+        return False
+    missing = wanted - enabled_capabilities(token, bundle_pk)
+    if not missing:
+        return False
+    print(
+        f"{bundle_id}: entitlements require {', '.join(sorted(missing))} "
+        f"but the App ID does not have them; enabling"
+    )
+    # List, not a generator: `any` short-circuits, and every missing capability
+    # must be attempted, not just up to the first success.
+    return any([
+        enable_capability(token, bundle_pk, capability)
+        for capability in sorted(missing)
+    ])

package/action/scripts/pbxproj_editor.py

@@ -72,12 +72,33 @@ def _bundle_id_from_configs(objects: dict, config_ids: list[str]) -> str:
     return ""
 
 
+def _entitlements_from_configs(objects: dict, config_ids: list[str]) -> str:
+    """First CODE_SIGN_ENTITLEMENTS path across the given configs.
+
+    Needed to reconcile the App ID's capabilities with what the app declares —
+    a profile only carries capabilities enabled on its App ID. Build-setting
+    references are skipped rather than half-expanded; a missed entitlements
+    file costs a clearer error, a wrong one costs a wrong App ID edit.
+    """
+    for cid in config_ids:
+        cfg = objects.get(cid) or {}
+        settings = cfg.get("buildSettings") or {}
+        value = (settings.get("CODE_SIGN_ENTITLEMENTS") or "").strip().strip('"')
+        if value and "$(" not in value and "${" not in value:
+            return value
+    return ""
+
+
 def discover_signable_targets(project_path: str) -> list[dict]:
     """Return one entry per signable native target.
 
-    Each entry: ``{"name": str, "bundle_id": str, "config_ids": [str,...]}``
-    where ``config_ids`` is the list of XCBuildConfiguration UUIDs whose
-    ``buildSettings`` dict we need to patch (typically Debug + Release).
+    Each entry:
+    ``{"name": str, "bundle_id": str, "config_ids": [str,...],
+    "entitlements": str}`` where ``config_ids`` is the list of
+    XCBuildConfiguration UUIDs whose ``buildSettings`` dict we need to patch
+    (typically Debug + Release) and ``entitlements`` is the target's
+    CODE_SIGN_ENTITLEMENTS path relative to the project directory ("" when the
+    target declares none).
     """
     pbx = _load_pbxproj(project_path)
     objects = pbx["objects"]
@@ -95,7 +116,12 @@ def discover_signable_targets(project_path: str) -> list[dict]:
             print(f"skip target {name!r}: no PRODUCT_BUNDLE_IDENTIFIER")
             continue
         targets.append(
-            {"name": name, "bundle_id": bundle_id, "config_ids": config_ids}
+            {
+                "name": name,
+                "bundle_id": bundle_id,
+                "config_ids": config_ids,
+                "entitlements": _entitlements_from_configs(objects, config_ids),
+            }
         )
     if not targets:
         raise SystemExit(

package/action/scripts/prepare_signing.py

@@ -39,6 +39,7 @@ import os
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
+import capabilities
 import cert_factory
 import creds_store
 from asc_common import make_jwt
@@ -180,6 +181,29 @@ def _resolve_project_path() -> str:
     return project
 
 
+def _entitlement_keys_by_bundle(project: str, targets: list[dict]) -> dict[str, set[str]]:
+    """bundle_id -> entitlement keys declared by the targets that ship it.
+
+    CODE_SIGN_ENTITLEMENTS is relative to the project directory. Targets
+    sharing a bundle id (an app and its test host, say) contribute a union —
+    a capability any of them needs must be on the App ID.
+    """
+    base = Path(project).parent
+    by_bundle: dict[str, set[str]] = {}
+    for target in targets:
+        relative = target.get("entitlements") or ""
+        if not relative:
+            continue
+        path = base / relative
+        if not path.is_file():
+            print(f"::warning::{target['name']}: entitlements not found at {path}")
+            continue
+        keys = capabilities.read_entitlement_keys(path)
+        if keys:
+            by_bundle.setdefault(target["bundle_id"], set()).update(keys)
+    return by_bundle
+
+
 def main() -> None:
     runner_temp = env("RUNNER_TEMP")
     # TEAM_ID is optional — provision_all_bundles returns the effective
@@ -202,7 +226,8 @@ def main() -> None:
         token, creds_dir
     )
     mappings, effective_team = provision_all_bundles(
-        token, bundle_ids, cert_id, creds_dir=creds_dir, cache_hit=cache_hit
+        token, bundle_ids, cert_id, creds_dir=creds_dir, cache_hit=cache_hit,
+        entitlements_by_bundle=_entitlement_keys_by_bundle(project, targets),
     )
     print("Profile map:")
     for bid, pname, uuid in mappings:

package/action/scripts/profile_manager.py

@@ -43,6 +43,7 @@ import subprocess
 from datetime import datetime
 from pathlib import Path
 
+import capabilities
 import creds_store
 from asc_common import get_json, request
 from pbxproj_editor import PROFILE_PREFIX
@@ -219,16 +220,26 @@ def _provision_bundle(
     creds_dir: Path,
     manifest: dict,
     can_reuse: bool,
+    entitlement_keys: set[str] | None = None,
 ) -> tuple[str, str, str, dict]:
     """Provision one bundle; return ``(name, uuid, team, manifest_entry)``."""
     name = profile_name_for(bid)
+    # Reconcile capabilities BEFORE deciding to reuse. A profile carries only
+    # the capabilities its App ID had when it was issued, so a cached profile
+    # that predates an entitlement being added stays broken forever otherwise
+    # — the archive keeps failing on a capability the App ID now has.
+    bundle_pk = ""
+    if entitlement_keys:
+        bundle_pk = ensure_bundle_id(token, bid)
+        if capabilities.reconcile(token, bundle_pk, bid, entitlement_keys):
+            can_reuse = False
     if can_reuse:
         reused = _try_reuse_cached(bid, name, cert_id, creds_dir, manifest)
         if reused is not None:
             uuid, team_id, entry = reused
             return name, uuid, team_id, entry
 
-    bundle_pk = ensure_bundle_id(token, bid)
+    bundle_pk = bundle_pk or ensure_bundle_id(token, bid)
     delete_profile_by_name(token, name)
     profile_der = create_profile(token, name, bundle_pk, cert_id)
     uuid, team_id, expiration = install_profile(profile_der)
@@ -266,6 +277,7 @@ def provision_all_bundles(
     *,
     creds_dir: Path,
     cache_hit: bool,
+    entitlements_by_bundle: dict[str, set[str]] | None = None,
 ) -> tuple[list[tuple[str, str, str]], str]:
     """Create + install a CI profile for each bundle id, with caching.
 
@@ -291,9 +303,11 @@ def provision_all_bundles(
     results: list[tuple[str, str, str]] = []
     new_entries: list[dict] = []
     effective_team = ""
+    entitlements_by_bundle = entitlements_by_bundle or {}
     for bid in bundle_ids:
         name, uuid, team_id, entry = _provision_bundle(
-            token, bid, cert_id, creds_dir, manifest, can_reuse
+            token, bid, cert_id, creds_dir, manifest, can_reuse,
+            entitlements_by_bundle.get(bid),
         )
         if team_id:
             effective_team = team_id

package/action/scripts/test_auto_detect.py

@@ -9,6 +9,7 @@ All tests run offline. xcodebuild invocations are stubbed through
 from __future__ import annotations
 
 import json
+import subprocess
 import sys
 import tempfile
 import unittest
@@ -318,6 +319,54 @@ class AutoDetectSchemeTests(unittest.TestCase):
             scheme = auto_detect.auto_detect_scheme(root, "Proj.xcodeproj", "")
         self.assertIsNone(scheme)
 
+    def test_resolves_packages_and_retries_when_list_times_out(self):
+        # `-list` implicitly resolves the SPM graph, so a cold runner cloning
+        # firebase-ios-sdk blows the deadline on the first call. Treating that
+        # as "no schemes" is what left SCHEME empty and failed the build much
+        # later, on an unrelated-looking MARKETING_VERSION error.
+        calls: list[str] = []
+
+        def fake_run(cmd, **kw):
+            if "-resolvePackageDependencies" in cmd:
+                calls.append("resolve")
+                result = mock.MagicMock()
+                result.returncode = 0
+                result.stdout = ""
+                return result
+            if "-list" in cmd:
+                calls.append("list")
+                if calls.count("list") == 1:
+                    raise subprocess.TimeoutExpired(cmd, auto_detect.LIST_TIMEOUT)
+                result = mock.MagicMock()
+                result.returncode = 0
+                result.stdout = self._list_output(["MyApp"])
+                return result
+            result = mock.MagicMock()
+            result.returncode = 0
+            result.stdout = self._show_settings(APP_TYPE)
+            return result
+
+        root = Path("/tmp/repo")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            scheme = auto_detect.auto_detect_scheme(root, "Proj.xcodeproj", "")
+
+        self.assertEqual(scheme, "MyApp")
+        self.assertEqual(calls[:3], ["list", "resolve", "list"])
+
+    def test_gives_up_when_list_times_out_again_after_resolving(self):
+        def fake_run(cmd, **kw):
+            if "-resolvePackageDependencies" in cmd:
+                result = mock.MagicMock()
+                result.returncode = 0
+                result.stdout = ""
+                return result
+            raise subprocess.TimeoutExpired(cmd, auto_detect.LIST_TIMEOUT)
+
+        root = Path("/tmp/repo")
+        with mock.patch.object(auto_detect.subprocess, "run", side_effect=fake_run):
+            scheme = auto_detect.auto_detect_scheme(root, "Proj.xcodeproj", "")
+        self.assertIsNone(scheme)
+
 
 class AutoDetectBundleIdTests(unittest.TestCase):
     """auto_detect_bundle_id: extract PRODUCT_BUNDLE_IDENTIFIER from showBuildSettings."""

package/action/scripts/test_capabilities.py

@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+"""App ID capability reconciliation.
+
+A profile only carries the capabilities its App ID had when Apple issued it,
+so an entitlement the App ID does not know about fails the archive with
+"Provisioning profile ... doesn't include the App Attest capability".
+"""
+
+from __future__ import annotations
+
+import plistlib
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import capabilities
+
+
+ENTITLEMENTS = {
+    "aps-environment": "production",
+    "com.apple.developer.devicecheck.appattest-environment": "production",
+    "keychain-access-groups": ["$(AppIdentifierPrefix)com.gowalk.form"],
+}
+
+
+class ReadEntitlementsTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temp = tempfile.TemporaryDirectory()
+        self.path = Path(self.temp.name) / "App.entitlements"
+
+    def tearDown(self) -> None:
+        self.temp.cleanup()
+
+    def test_reads_top_level_keys(self) -> None:
+        with self.path.open("wb") as handle:
+            plistlib.dump(ENTITLEMENTS, handle)
+
+        self.assertEqual(capabilities.read_entitlement_keys(self.path), set(ENTITLEMENTS))
+
+    def test_unreadable_file_is_not_fatal(self) -> None:
+        self.path.write_text("not a plist")
+
+        self.assertEqual(capabilities.read_entitlement_keys(self.path), set())
+
+
+class RequiredCapabilitiesTest(unittest.TestCase):
+    def test_maps_only_known_toggles(self) -> None:
+        # keychain-access-groups needs no App ID capability at all.
+        self.assertEqual(
+            capabilities.required_capabilities(set(ENTITLEMENTS)),
+            {"PUSH_NOTIFICATIONS", "APP_ATTEST"},
+        )
+
+    def test_ignores_entitlements_with_no_capability(self) -> None:
+        self.assertEqual(
+            capabilities.required_capabilities({"get-task-allow", "com.apple.security.get-task-allow"}),
+            set(),
+        )
+
+
+class ReconcileTest(unittest.TestCase):
+    def _response(self, status: int):
+        response = mock.MagicMock()
+        response.status_code = status
+        return response
+
+    def test_enables_only_the_missing_capability(self) -> None:
+        posted: list[str] = []
+
+        def fake_request(method, path, token, **kw):
+            posted.append(kw["json_body"]["data"]["attributes"]["capabilityType"])
+            return self._response(201)
+
+        listed = {"data": [{"attributes": {"capabilityType": "PUSH_NOTIFICATIONS"}}]}
+        with mock.patch.object(capabilities, "get_json", return_value=listed), \
+                mock.patch.object(capabilities, "request", side_effect=fake_request):
+            changed = capabilities.reconcile("tok", "PK", "com.gowalk.form", set(ENTITLEMENTS))
+
+        self.assertTrue(changed)
+        self.assertEqual(posted, ["APP_ATTEST"])
+
+    def test_no_op_when_the_app_id_already_has_everything(self) -> None:
+        listed = {
+            "data": [
+                {"attributes": {"capabilityType": "PUSH_NOTIFICATIONS"}},
+                {"attributes": {"capabilityType": "APP_ATTEST"}},
+            ]
+        }
+        with mock.patch.object(capabilities, "get_json", return_value=listed), \
+                mock.patch.object(capabilities, "request") as post:
+            changed = capabilities.reconcile("tok", "PK", "com.gowalk.form", set(ENTITLEMENTS))
+
+        self.assertFalse(changed)
+        post.assert_not_called()
+
+    def test_attempts_every_missing_capability(self) -> None:
+        # `any()` over a generator would stop at the first success and leave
+        # the rest of the capabilities off the App ID.
+        posted: list[str] = []
+
+        def fake_request(method, path, token, **kw):
+            posted.append(kw["json_body"]["data"]["attributes"]["capabilityType"])
+            return self._response(201)
+
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
+                mock.patch.object(capabilities, "request", side_effect=fake_request):
+            capabilities.reconcile("tok", "PK", "com.gowalk.form", set(ENTITLEMENTS))
+
+        self.assertEqual(sorted(posted), ["APP_ATTEST", "PUSH_NOTIFICATIONS"])
+
+    def test_existing_capability_race_is_not_a_change(self) -> None:
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
+                mock.patch.object(capabilities, "request", return_value=self._response(409)):
+            changed = capabilities.reconcile(
+                "tok", "PK", "com.gowalk.form",
+                {"com.apple.developer.devicecheck.appattest-environment"},
+            )
+
+        self.assertFalse(changed)
+
+    def test_api_failure_does_not_raise(self) -> None:
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
+                mock.patch.object(capabilities, "request", side_effect=RuntimeError("boom")):
+            changed = capabilities.reconcile(
+                "tok", "PK", "com.gowalk.form",
+                {"com.apple.developer.devicecheck.appattest-environment"},
+            )
+
+        self.assertFalse(changed)
+
+    def test_warns_about_capabilities_it_will_not_guess(self) -> None:
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
+                mock.patch("builtins.print") as printed:
+            capabilities.reconcile(
+                "tok", "PK", "com.gowalk.form",
+                {"com.apple.security.application-groups"},
+            )
+
+        warnings = [c.args[0] for c in printed.call_args_list if c.args]
+        self.assertTrue(any("App Groups" in w for w in warnings), warnings)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.4
+1.0.6

package/android-action/action.yml

@@ -109,13 +109,19 @@ runs:
     # resolve_android.py has already rewritten versionCode/versionName in the
     # module build file, so these are plain Gradle invocations with no extra
     # properties for the project to have to opt into reading.
+    # `test` is the aggregate task ("Run unit tests for all variants") and is the
+    # only one guaranteed to exist: AGP only creates testXUnitTest tasks for the
+    # variants it enables, and AGP 9 disables the release unit test variant by
+    # default, so `:app:testReleaseUnitTest` is simply absent in many projects.
+    # Running it unqualified also mirrors `flutter test`, which covers the whole
+    # package rather than one module.
     - name: Test Android app
       if: ${{ steps.config.outputs.project_kind == 'gradle' && inputs.run-tests == 'true' }}
       shell: bash
       working-directory: ${{ steps.config.outputs.gradle_root || '.' }}
       run: |
         chmod +x ./gradlew
-        ./gradlew "${ANDROID_GRADLE_MODULE}:testReleaseUnitTest" --console=plain --stacktrace
+        ./gradlew test --console=plain --stacktrace
 
     - name: Build release Android App Bundle with Gradle
       if: ${{ steps.config.outputs.project_kind == 'gradle' }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {