gowalk-cicd 1.0.41 → 1.0.42

package/CLAUDE.md

@@ -64,6 +64,11 @@ workflow (`.github/workflows/publish.yml`):
    attach the `publish.yml` trusted-publisher relationship; the workflow
    supplies that token as a fallback and uses OIDC after trust is configured.
 
+An explicitly dispatched run may publish a tested feature ref by setting its
+`release` boolean input. The input defaults to false, so ordinary manual runs
+remain test-only. Use this path when a deploy repair must ship without pushing
+the feature branch directly to `main`.
+
 Manual publish (from repo root):
 
 ```bash

package/README.md

@@ -68,6 +68,8 @@ The backend workflow runs on a GitHub-hosted runner and, on a push touching
 it rsyncs the backend dir to `/opt/gowalk-backends/<app>/`, runs
 `docker compose up -d --build`, auto-detects the published `127.0.0.1:<port>`,
 wires an nginx vhost + Let's Encrypt cert for the API domain, and health-checks.
+Certificate issuance and the public health check are strict: a deploy fails if
+the hostname cannot present a trusted matching certificate and reach the API.
 
 Requirements on the consumer repo:
 
@@ -84,7 +86,9 @@ Requirements on the consumer repo:
 - Repo **variables** (optional): `BACKEND_API_DOMAIN` (its DNS A record must point
   at the host for the cert; empty = deploy the container only, skip nginx/cert),
   `BACKEND_APP_NAME` (defaults to the repo name), `BACKEND_HEALTH_PATH`
-  (default `/health`), `BACKEND_DEPLOY_HOST` (default `138.197.36.107`).
+  (default `/health`), `BACKEND_DEPLOY_HOST` (default `138.197.36.107`), and
+  `BACKEND_CERTBOT_ACCOUNT` (optional account ID for hosts with multiple ACME
+  accounts; otherwise the sole or host-created account is selected).
 
 The action directory is canonical here (like the iOS/Android actions): edit it in
 `backend-action/`, never in a consumer's vendored copy.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.41
+1.0.42

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.41
+1.0.42

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.41
+1.0.42

package/backend-action/action.yml

@@ -39,6 +39,12 @@ inputs:
     description: Email for the Let's Encrypt registration.
     required: false
     default: "admin@gowalk.com"
+  certbot-account:
+    description: >
+      Optional Certbot account ID. When omitted, the deploy selects the sole
+      account or the account created on the current host.
+    required: false
+    default: ""
   runtime-env:
     description: >
       Optional newline-delimited KEY=value secrets written to a mode-0600
@@ -104,7 +110,8 @@ runs:
         $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" \
           "bash '$DEST/.remote_deploy.sh' \
              '${{ inputs.app-name }}' '${{ inputs.api-domain }}' \
-             '${{ inputs.health-path }}' '${{ inputs.cert-email }}'"
+             '${{ inputs.health-path }}' '${{ inputs.cert-email }}' \
+             '${{ inputs.certbot-account }}'"
 
     - name: Cleanup key
       if: always()

package/backend-action/remote_deploy.sh

@@ -8,11 +8,37 @@ APP="$1"           # slug — compose project + dir name
 DOMAIN="${2:-}"    # api.<app>.gowalk.com, or empty to skip nginx/cert
 HEALTH="${3:-/health}"
 CERT_EMAIL="${4:-admin@gowalk.com}"
+CERT_ACCOUNT="${5:-}"
 DIR="/opt/gowalk-backends/$APP"
 cd "$DIR"
 
 log() { echo "[deploy $APP] $*"; }
 
+select_certbot_account() {
+  [ -n "$CERT_ACCOUNT" ] && return
+  local accounts_root host account_dir creation_host
+  local -a accounts=()
+  accounts_root="/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory"
+  [ -d "$accounts_root" ] || return
+  host="$(hostname)"
+  while IFS= read -r account_dir; do
+    accounts+=("$(basename "$account_dir")")
+    creation_host="$(sed -nE \
+      's/.*"creation_host"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/p' \
+      "$account_dir/meta.json" 2>/dev/null | head -1)"
+    if [ "$creation_host" = "$host" ]; then
+      CERT_ACCOUNT="$(basename "$account_dir")"
+    fi
+  done < <(find "$accounts_root" -mindepth 1 -maxdepth 1 -type d | sort)
+  if [ -z "$CERT_ACCOUNT" ] && [ "${#accounts[@]}" -eq 1 ]; then
+    CERT_ACCOUNT="${accounts[0]}"
+  fi
+  if [ -z "$CERT_ACCOUNT" ] && [ "${#accounts[@]}" -gt 1 ]; then
+    log "ERROR: multiple Certbot accounts; set BACKEND_CERTBOT_ACCOUNT"
+    return 1
+  fi
+}
+
 # ── secrets: generate a per-app .env once, then preserve it (rsync excludes it)
 if [ ! -f .env ]; then
   log "first deploy — generating .env (POSTGRES_PASSWORD)"
@@ -95,16 +121,20 @@ fi
 # ── Let's Encrypt cert (idempotent; certbot skips if current)
 if ! certbot certificates 2>/dev/null | grep -q "Domains: $DOMAIN\b"; then
   log "requesting LE cert for $DOMAIN"
+  select_certbot_account
+  CERTBOT_ARGS=()
+  if [ -n "$CERT_ACCOUNT" ]; then
+    log "using Certbot account ${CERT_ACCOUNT:0:4}…"
+    CERTBOT_ARGS+=(--account "$CERT_ACCOUNT")
+  fi
   certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
-    --email "$CERT_EMAIL" --redirect || log "warn: certbot failed (DNS not pointed yet?)"
+    --email "$CERT_EMAIL" --redirect "${CERTBOT_ARGS[@]}"
 else
   log "cert for $DOMAIN already present"
 fi
 
-# ── public health-check (best effort — cert/DNS may still be propagating)
-if curl -fsSk "https://$DOMAIN$HEALTH" >/dev/null 2>&1; then
-  log "public https://$DOMAIN$HEALTH healthy"
-else
-  log "warn: public URL not answering yet (DNS/cert propagation) — container is up on :$PORT"
-fi
+# ── public health-check: validates DNS, certificate/SNI, routing and service.
+curl -fsS --retry 6 --retry-all-errors --retry-delay 2 \
+  "https://$DOMAIN$HEALTH" >/dev/null
+log "public https://$DOMAIN$HEALTH healthy with verified TLS"
 log "done"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.41",
+  "version": "1.0.42",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-backend.yml

@@ -39,4 +39,5 @@ jobs:
           api-domain: ${{ vars.BACKEND_API_DOMAIN }}
           backend-dir: ${{ steps.dir.outputs.path }}
           health-path: ${{ vars.BACKEND_HEALTH_PATH || '/health' }}
+          certbot-account: ${{ vars.BACKEND_CERTBOT_ACCOUNT }}
           runtime-env: ${{ secrets.BACKEND_RUNTIME_ENV }}

package/templates/deploy.yml

@@ -428,4 +428,5 @@ jobs:
           api-domain: ${{ vars.BACKEND_API_DOMAIN }}
           backend-dir: ${{ steps.dir.outputs.path }}
           health-path: ${{ vars.BACKEND_HEALTH_PATH || '/health' }}
+          certbot-account: ${{ vars.BACKEND_CERTBOT_ACCOUNT }}
           runtime-env: ${{ secrets.BACKEND_RUNTIME_ENV }}