gowalk-cicd 1.0.40 → 1.0.42

package/CLAUDE.md

@@ -2,12 +2,15 @@
 
 ## Purpose
 
-npm package that distributes iOS TestFlight and Android Google Play actions.
+npm package that distributes iOS TestFlight, Android Google Play, and Flutter
+web release workflows.
 Consumer runs `npx gowalk-cicd` and gets:
 
 - `.github/actions/swift-app/` — vendored composite action
 - `.github/actions/android-app/` — vendored Android action (Flutter or Gradle)
 - `.github/workflows/deploy.yml` — dual-platform workflow
+- `.github/workflows/deploy-web.yml` — Flutter web release artifact workflow
+  (only when `web/index.html` exists)
 
 Re-running the command is both install and update. No scope flag, no
 uninstall. Keep it simple.
@@ -25,6 +28,7 @@ gowalk-cicd/                     ← repo root IS the gowalk-cicd package
 ├── bin/cli.mjs                  ← CLI entrypoint (parses flags, calls runInstall)
 ├── src/install.mjs              ← copy logic, gitignore-check, summary print
 ├── templates/deploy.yml         ← dual-platform workflow copied verbatim
+├── templates/deploy-web.yml     ← Flutter web workflow copied conditionally
 ├── backend-action/              ← backend deploy action + remote host script
 ├── templates/deploy-backend.yml ← backend workflow copied when compose exists
 ├── scripts/auto-version.mjs     ← patch-bump-from-npm used by the publish workflow
@@ -60,6 +64,11 @@ workflow (`.github/workflows/publish.yml`):
    attach the `publish.yml` trusted-publisher relationship; the workflow
    supplies that token as a fallback and uses OIDC after trust is configured.
 
+An explicitly dispatched run may publish a tested feature ref by setting its
+`release` boolean input. The input defaults to false, so ordinary manual runs
+remain test-only. Use this path when a deploy repair must ship without pushing
+the feature branch directly to `main`.
+
 Manual publish (from repo root):
 
 ```bash

package/README.md

@@ -1,9 +1,9 @@
 # gowalk-cicd
 
-One installer for iOS TestFlight and Android Google Play delivery. It supports
-native Swift/SwiftUI iOS projects, native Kotlin/Gradle Android projects, and
-Flutter apps. Put the platform keys under `creds/`, push to `main`, and both
-store builds run only on GitHub Actions.
+One installer for iOS TestFlight, Android Google Play, and Flutter web release
+artifacts. It supports native Swift/SwiftUI iOS projects, native Kotlin/Gradle
+Android projects, and Flutter apps. Put the platform keys under `creds/`, push
+to `main`, and the applicable builds run only on GitHub Actions.
 
 ## Install
 
@@ -13,14 +13,31 @@ From the root of your app repo:
 npx --yes gowalk-cicd
 ```
 
-Writes three things into your repo:
+Writes three core things into your repo:
 
 - `.github/actions/swift-app/` — the vendored composite action (action.yml + scripts)
 - `.github/actions/android-app/` — Android build/sign action (Flutter or Gradle)
 - `.github/workflows/deploy.yml` — workflow that builds and deploys both platforms
 
+Flutter projects that contain `web/index.html` also get
+`.github/workflows/deploy-web.yml`. It creates a version-stamped release build
+and retains `build/web` as a 30-day workflow artifact. Native-only repositories
+are unaffected.
+
 Re-run the same command anytime to pull the latest version.
 
+## Flutter web release
+
+The conditional `deploy-web.yml` workflow runs on changes to Flutter source,
+web assets, package metadata, localization config, or the workflow itself. It
+also supports manual dispatch. The build uses `GITHUB_RUN_NUMBER` as its build
+number and uploads the complete `build/web` directory as a release artifact.
+
+Private git dependencies use the same optional `GIT_PRIVATE_TOKEN` secret as
+the mobile workflow. No hosting provider is assumed: consumers can deploy the
+artifact to their chosen host without granting this package an unrelated cloud
+account or domain.
+
 ## iOS credentials
 
 1. Create an **App Store Connect API key** with the **App Manager** role
@@ -51,6 +68,8 @@ The backend workflow runs on a GitHub-hosted runner and, on a push touching
 it rsyncs the backend dir to `/opt/gowalk-backends/<app>/`, runs
 `docker compose up -d --build`, auto-detects the published `127.0.0.1:<port>`,
 wires an nginx vhost + Let's Encrypt cert for the API domain, and health-checks.
+Certificate issuance and the public health check are strict: a deploy fails if
+the hostname cannot present a trusted matching certificate and reach the API.
 
 Requirements on the consumer repo:
 
@@ -67,7 +86,9 @@ Requirements on the consumer repo:
 - Repo **variables** (optional): `BACKEND_API_DOMAIN` (its DNS A record must point
   at the host for the cert; empty = deploy the container only, skip nginx/cert),
   `BACKEND_APP_NAME` (defaults to the repo name), `BACKEND_HEALTH_PATH`
-  (default `/health`), `BACKEND_DEPLOY_HOST` (default `138.197.36.107`).
+  (default `/health`), `BACKEND_DEPLOY_HOST` (default `138.197.36.107`), and
+  `BACKEND_CERTBOT_ACCOUNT` (optional account ID for hosts with multiple ACME
+  accounts; otherwise the sole or host-created account is selected).
 
 The action directory is canonical here (like the iOS/Android actions): edit it in
 `backend-action/`, never in a consumer's vendored copy.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.40
+1.0.42

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.40
+1.0.42

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.40
+1.0.42

package/backend-action/action.yml

@@ -39,6 +39,12 @@ inputs:
     description: Email for the Let's Encrypt registration.
     required: false
     default: "admin@gowalk.com"
+  certbot-account:
+    description: >
+      Optional Certbot account ID. When omitted, the deploy selects the sole
+      account or the account created on the current host.
+    required: false
+    default: ""
   runtime-env:
     description: >
       Optional newline-delimited KEY=value secrets written to a mode-0600
@@ -104,7 +110,8 @@ runs:
         $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" \
           "bash '$DEST/.remote_deploy.sh' \
              '${{ inputs.app-name }}' '${{ inputs.api-domain }}' \
-             '${{ inputs.health-path }}' '${{ inputs.cert-email }}'"
+             '${{ inputs.health-path }}' '${{ inputs.cert-email }}' \
+             '${{ inputs.certbot-account }}'"
 
     - name: Cleanup key
       if: always()

package/backend-action/remote_deploy.sh

@@ -8,11 +8,37 @@ APP="$1"           # slug — compose project + dir name
 DOMAIN="${2:-}"    # api.<app>.gowalk.com, or empty to skip nginx/cert
 HEALTH="${3:-/health}"
 CERT_EMAIL="${4:-admin@gowalk.com}"
+CERT_ACCOUNT="${5:-}"
 DIR="/opt/gowalk-backends/$APP"
 cd "$DIR"
 
 log() { echo "[deploy $APP] $*"; }
 
+select_certbot_account() {
+  [ -n "$CERT_ACCOUNT" ] && return
+  local accounts_root host account_dir creation_host
+  local -a accounts=()
+  accounts_root="/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory"
+  [ -d "$accounts_root" ] || return
+  host="$(hostname)"
+  while IFS= read -r account_dir; do
+    accounts+=("$(basename "$account_dir")")
+    creation_host="$(sed -nE \
+      's/.*"creation_host"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/p' \
+      "$account_dir/meta.json" 2>/dev/null | head -1)"
+    if [ "$creation_host" = "$host" ]; then
+      CERT_ACCOUNT="$(basename "$account_dir")"
+    fi
+  done < <(find "$accounts_root" -mindepth 1 -maxdepth 1 -type d | sort)
+  if [ -z "$CERT_ACCOUNT" ] && [ "${#accounts[@]}" -eq 1 ]; then
+    CERT_ACCOUNT="${accounts[0]}"
+  fi
+  if [ -z "$CERT_ACCOUNT" ] && [ "${#accounts[@]}" -gt 1 ]; then
+    log "ERROR: multiple Certbot accounts; set BACKEND_CERTBOT_ACCOUNT"
+    return 1
+  fi
+}
+
 # ── secrets: generate a per-app .env once, then preserve it (rsync excludes it)
 if [ ! -f .env ]; then
   log "first deploy — generating .env (POSTGRES_PASSWORD)"
@@ -95,16 +121,20 @@ fi
 # ── Let's Encrypt cert (idempotent; certbot skips if current)
 if ! certbot certificates 2>/dev/null | grep -q "Domains: $DOMAIN\b"; then
   log "requesting LE cert for $DOMAIN"
+  select_certbot_account
+  CERTBOT_ARGS=()
+  if [ -n "$CERT_ACCOUNT" ]; then
+    log "using Certbot account ${CERT_ACCOUNT:0:4}…"
+    CERTBOT_ARGS+=(--account "$CERT_ACCOUNT")
+  fi
   certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
-    --email "$CERT_EMAIL" --redirect || log "warn: certbot failed (DNS not pointed yet?)"
+    --email "$CERT_EMAIL" --redirect "${CERTBOT_ARGS[@]}"
 else
   log "cert for $DOMAIN already present"
 fi
 
-# ── public health-check (best effort — cert/DNS may still be propagating)
-if curl -fsSk "https://$DOMAIN$HEALTH" >/dev/null 2>&1; then
-  log "public https://$DOMAIN$HEALTH healthy"
-else
-  log "warn: public URL not answering yet (DNS/cert propagation) — container is up on :$PORT"
-fi
+# ── public health-check: validates DNS, certificate/SNI, routing and service.
+curl -fsS --retry 6 --retry-all-errors --retry-delay 2 \
+  "https://$DOMAIN$HEALTH" >/dev/null
+log "public https://$DOMAIN$HEALTH healthy with verified TLS"
 log "done"

package/bin/cli.mjs

@@ -33,13 +33,15 @@ for (const arg of args) {
     case '--help':
       console.log(`Usage: npx gowalk-cicd [options]
 
-Installs iOS TestFlight and Android Google Play actions plus one deploy
-workflow into the current app project. Re-run anytime to update them.
+Installs iOS TestFlight and Android Google Play actions plus their deploy
+workflow into the current app project. Flutter web apps also get a release
+artifact workflow. Re-run anytime to update them.
 
 What it writes:
   .github/actions/swift-app/   - vendored composite action (action.yml + scripts/)
   .github/actions/android-app/ - Flutter Android build/sign action
   .github/workflows/deploy.yml - dual-platform workflow
+  .github/workflows/deploy-web.yml - Flutter web release workflow when web/ exists
 
 Options:
   --dry-run        Print what would happen without writing files

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.40",
+  "version": "1.0.42",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/install.mjs

@@ -28,6 +28,7 @@ const ACTION_SRC = join(PACKAGE_DIR, 'action');
 const ANDROID_ACTION_SRC = join(PACKAGE_DIR, 'android-action');
 const BACKEND_ACTION_SRC = join(PACKAGE_DIR, 'backend-action');
 const WORKFLOW_TEMPLATE = join(PACKAGE_DIR, 'templates', 'deploy.yml');
+const WEB_WORKFLOW_TEMPLATE = join(PACKAGE_DIR, 'templates', 'deploy-web.yml');
 const BACKEND_WORKFLOW_TEMPLATE = join(PACKAGE_DIR, 'templates', 'deploy-backend.yml');
 const PACKAGE_JSON = join(PACKAGE_DIR, 'package.json');
 
@@ -37,6 +38,7 @@ const ACTION_DEST_REL = join('.github', 'actions', 'swift-app');
 const ANDROID_ACTION_DEST_REL = join('.github', 'actions', 'android-app');
 const BACKEND_ACTION_DEST_REL = join('.github', 'actions', 'backend-app');
 const WORKFLOW_DEST_REL = join('.github', 'workflows', 'deploy.yml');
+const WEB_WORKFLOW_DEST_REL = join('.github', 'workflows', 'deploy-web.yml');
 const BACKEND_WORKFLOW_DEST_REL = join('.github', 'workflows', 'deploy-backend.yml');
 const VERSION_MARKER_REL = join('.github', 'actions', 'swift-app', '.daemux-version');
 const ANDROID_VERSION_MARKER_REL = join('.github', 'actions', 'android-app', '.daemux-version');
@@ -219,6 +221,20 @@ export async function runInstall({ dryRun = false } = {}) {
   writeVersionMarkers(repoRoot, dryRun);
   copyWorkflow(repoRoot, dryRun);
 
+  if (existsSync(join(repoRoot, 'pubspec.yaml'))
+      && existsSync(join(repoRoot, 'web', 'index.html'))) {
+    console.log('  Flutter web detected (web/index.html) — installing web release workflow');
+    const webWorkflowDest = join(repoRoot, WEB_WORKFLOW_DEST_REL);
+    const webWorkflowExisted = existsSync(webWorkflowDest);
+    if (dryRun) {
+      console.log(`  [dry-run] ${webWorkflowExisted ? 'overwrite' : 'create'} ${WEB_WORKFLOW_DEST_REL}`);
+    } else {
+      ensureDir(dirname(webWorkflowDest));
+      cpSync(WEB_WORKFLOW_TEMPLATE, webWorkflowDest, { force: true });
+      console.log(`  ${webWorkflowExisted ? 'Overwrote' : 'Created'} ${WEB_WORKFLOW_DEST_REL}`);
+    }
+  }
+
   // Backend deploy path — installed only when the repo has a Dockerized
   // backend (backend/ or server/ with a docker-compose.yml). Mobile-only
   // repos are unaffected, so this is backward compatible.

package/templates/deploy-backend.yml

@@ -39,4 +39,5 @@ jobs:
           api-domain: ${{ vars.BACKEND_API_DOMAIN }}
           backend-dir: ${{ steps.dir.outputs.path }}
           health-path: ${{ vars.BACKEND_HEALTH_PATH || '/health' }}
+          certbot-account: ${{ vars.BACKEND_CERTBOT_ACCOUNT }}
           runtime-env: ${{ secrets.BACKEND_RUNTIME_ENV }}

package/templates/deploy-web.yml

@@ -0,0 +1,58 @@
+name: Web Release
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'lib/**'
+      - 'web/**'
+      - 'assets/**'
+      - 'pubspec.yaml'
+      - 'pubspec.lock'
+      - 'l10n.yaml'
+      - 'analysis_options.yaml'
+      - '.github/workflows/deploy-web.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: web-release-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  web:
+    name: Flutter Web Artifact
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        with:
+          channel: stable
+          cache: true
+      - name: Authenticate private git dependencies
+        shell: bash
+        env:
+          GIT_PRIVATE_TOKEN: ${{ secrets.GIT_PRIVATE_TOKEN }}
+        run: |
+          if [ -z "${GIT_PRIVATE_TOKEN:-}" ]; then
+            echo "No GIT_PRIVATE_TOKEN secret; private git dependencies must carry their own credentials."
+            exit 0
+          fi
+          echo "::add-mask::$GIT_PRIVATE_TOKEN"
+          git config --global \
+            url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+      - name: Build Flutter web release
+        shell: bash
+        run: |
+          flutter pub get
+          if [ -f l10n.yaml ]; then flutter gen-l10n; fi
+          flutter build web --release --build-number="${GITHUB_RUN_NUMBER}"
+      - name: Retain Flutter web release
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: web-${{ github.event.repository.name }}-${{ github.run_number }}
+          path: build/web
+          if-no-files-found: error
+          retention-days: 30

package/templates/deploy.yml

@@ -428,4 +428,5 @@ jobs:
           api-domain: ${{ vars.BACKEND_API_DOMAIN }}
           backend-dir: ${{ steps.dir.outputs.path }}
           health-path: ${{ vars.BACKEND_HEALTH_PATH || '/health' }}
+          certbot-account: ${{ vars.BACKEND_CERTBOT_ACCOUNT }}
           runtime-env: ${{ secrets.BACKEND_RUNTIME_ENV }}