gowalk-cicd 1.0.45 → 1.0.47

package/CLAUDE.md

@@ -122,6 +122,33 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   number authoritative. Do NOT reach for `-Pandroid.injected.version.code`:
   those properties were removed in AGP 7.3 and are silently ignored by every
   AGP 8.x app in the fleet.
+- Dart obfuscation is mandatory for Flutter apps and has no opt-out — do not
+  add an input, repo variable or config key for it. Both Flutter release
+  builds carry `--obfuscate --split-debug-info`: `flutter build appbundle` in
+  `android-action/action.yml`, and the `flutter build ios --config-only` call
+  in `templates/deploy.yml`, which is where the iOS build is obfuscated
+  (`--config-only` writes `DART_OBFUSCATION` / `SPLIT_DEBUG_INFO` into
+  `ios/Flutter/Generated.xcconfig`; the Flutter build phase inside the
+  `xcodebuild archive` reads them). The flags are one feature: `--obfuscate`
+  refuses to run without `--split-debug-info`, and the symbol files it writes
+  are the only way to read a stack trace from that build, so they are always
+  retained as an artifact (`android-symbols-*`, `ios-symbols-*`) and a build
+  that wrote none fails. Symbols are written under `RUNNER_TEMP`, never into
+  the checkout, so nothing that commits the working tree can pick them up.
+  Native Gradle, Swift and Flutter web builds are untouched (web has no such
+  flag). Wiring is pinned by `android-action/scripts/test_flutter_obfuscation.py`
+  and `test/install.test.mjs`.
+- Whatever an obfuscation flag needs to be safe must travel in the same file
+  as the flag. The consumer-side autoupdate re-vendors the action directories
+  but can never push `deploy.yml`, so "new action + old workflow" is the
+  fleet's normal state. That is why the Android action uploads
+  `android-symbols-*` itself instead of leaving it to the workflow, and why
+  the iOS flags and the `ios-symbols-*` step sit together in `deploy.yml`.
+  The iOS retain step runs on `!cancelled()` because the swift-app action keeps
+  going after the TestFlight upload (metadata, "What's New"): a failure there
+  must not discard the symbols of a build that is already live. Symbol
+  artifacts carry no `retention-days` so the repository's setting governs and
+  can be raised to cover a release's life.
 - The JDK is chosen by `scripts/select_jdk.py`, called from the workflow before
   `setup-java`. The `JAVA_VERSION` repo variable always wins; otherwise Flutter
   gets 17 and native Gradle gets 21, except that a positively-detected Kotlin

package/README.md

@@ -385,7 +385,7 @@ configuration for either:
 | Detected by | `pubspec.yaml` at the repo root | `settings.gradle(.kts)` + `gradlew` at the root or under `android/` |
 | App module | `android/app` | the one module applying `com.android.application` (version-catalog aliases are resolved; a module named `app` wins a tie against a wear/automotive sibling) |
 | Tests (`run-tests`) | `flutter analyze` + `flutter test` | `gradlew test` (all variants, all modules) |
-| Build | `flutter build appbundle --release` | `<module>:bundleRelease` |
+| Build | `flutter build appbundle --release --obfuscate --split-debug-info` | `<module>:bundleRelease` |
 | Toolchain installed | Flutter + JDK 17 | JDK 21, or 17 on an old Kotlin — see [Choosing the JDK](#choosing-the-jdk) |
 
 A Flutter app also carries `android/settings.gradle`, so `pubspec.yaml` wins the
@@ -443,6 +443,89 @@ warnings.
 own naming is inconsistent across majors — `gradle-8.14-all.zip` but
 `gradle-9.0.0-all.zip`.)
 
+### Dart obfuscation (Flutter apps)
+
+**Obfuscation is mandatory for Flutter apps.** Every Flutter release build this
+package produces — the Android App Bundle and the iOS archive — is compiled with
+`--obfuscate --split-debug-info`, and there is no input, repository variable or
+config key that turns it off. Native Swift and Kotlin/Gradle apps are
+unaffected: the flag belongs to the Dart compiler and they have no Dart code.
+Flutter web builds are also untouched — `flutter build web` has no such flag;
+dart2js minifies release output instead. An Android app delivered through
+[Bitrise](#android-delivery-via-bitrise-alternative-mode) is built by Bitrise's
+workflow, not by this action; put the same two flags in that workflow.
+
+What it does: the Dart AOT compiler replaces class, function and library names
+with short random identifiers, so the app's Dart symbols cannot be read out of
+the binary. What it does not do: it is not encryption. String literals,
+`--dart-define` values, assets and everything in `pubspec.yaml` ship as they
+are, and the native halves of the app (Swift, Kotlin, plugins) are compiled by
+Xcode and Gradle exactly as before. Do not put secrets in the app.
+
+The two flags are one feature. `flutter build` refuses `--obfuscate` without
+`--split-debug-info`, and the symbol files the latter writes are the only way
+to read a stack trace from an obfuscated build. Every run therefore keeps them
+as a workflow artifact next to the build, and fails when they are missing:
+
+| Platform | Artifact | Contents | Retained by |
+|---|---|---|---|
+| Android | `android-symbols-<package>-<versionCode>` | `app.android-arm.symbols`, `app.android-arm64.symbols`, `app.android-x64.symbols` | the Android action, right after the build |
+| iOS | `ios-symbols-<repo>-<TestFlight build number>` | `app.ios-arm64.symbols` | `deploy.yml`, after the archive |
+
+The Android action fails the build before anything is signed if no symbol
+files were written. On iOS the archive, TestFlight upload and App Store
+metadata steps all run inside one composite action, so the check comes after
+it: the retain step runs even when that action failed (a metadata error after
+the upload must not discard the symbols of a build that is already live), and
+an action that succeeded without writing symbols fails the job.
+
+Artifacts follow the repository's retention setting — 90 days unless you
+change it under *Settings → Actions → Artifact and log retention* (private
+repositories allow up to 400). A production release usually outlives that, so
+either raise the setting or, better, upload the symbols to your crash reporter,
+which is where crashes arrive anyway.
+
+To read an obfuscated crash, download the artifact for that exact build and
+run `flutter symbolize` with the file matching the device's architecture:
+
+```bash
+flutter symbolize -i crash.txt -d app.android-arm64.symbols
+```
+
+A crash reporter never sees the artifact, and from the first obfuscated build
+every Dart frame it shows is `***` until it has the symbols. If the app uses
+Crashlytics, Sentry or similar, upload the same directory to that service — for
+Crashlytics, `firebase crashlytics:symbols:upload --app=<FIREBASE_APP_ID>
+<dir>` with Firebase CLI 11.9 or newer, once per platform with that platform's
+app id (`mobilesdk_app_id` in `google-services.json`, `GOOGLE_APP_ID` in
+`GoogleService-Info.plist`). This package does not do that upload for you: the
+existing Crashlytics run-script phase on iOS uploads only the native dSYMs, and
+App Store Connect's own symbol upload covers only those as well.
+
+Obfuscation renames identifiers, so code that depends on their spelling breaks
+at runtime, not at build time. Do not rely on `runtimeType.toString()`,
+`Type.toString()`, or on matching class or function names in stack traces
+(`Foo` becomes `Lk`, and a raw trace is a row of `***`) — compare types with
+`is` instead. Enum values keep their names today (`Color.red.toString()` is
+still `Color.red`), but `flutter build --help` lists `Enum.toString()` among
+the methods that may return obfuscated results, so prefer `Enum.name` when the
+identifier matters.
+
+Where the flags are applied: Android passes them straight to
+`flutter build appbundle`. iOS is less obvious — `deploy.yml` runs
+`flutter build ios --config-only` with the flags, which writes
+`DART_OBFUSCATION=true` and `SPLIT_DEBUG_INFO=<dir>` into
+`ios/Flutter/Generated.xcconfig`, and the Flutter build phase inside the
+`xcodebuild archive` that follows compiles against those settings. The symbol
+directory lives under the runner's temp directory on both platforms, never in
+the checkout.
+
+Because the iOS half lives in `deploy.yml`, which
+[auto-update never touches](#deployyml-is-not-auto-updated), an existing
+Flutter repo gets Android obfuscation on its next auto-update but iOS
+obfuscation only after a one-off `npx --yes gowalk-cicd`. The Android action
+retains its own symbols precisely so that this half-updated state is safe.
+
 ### iOS delivery
 
 The iOS composite action runs on `macos-15` and:
@@ -761,6 +844,12 @@ and you must run `npx --yes gowalk-cicd` manually once to
 sync your `deploy.yml`. Existing deploy.yml stays untouched on every
 auto-update cycle until you do.
 
+Changes that need that manual run:
+
+- **Flutter iOS obfuscation** — the `--obfuscate --split-debug-info` flags on
+  the iOS `flutter build ios --config-only` call and the step that retains
+  `ios-symbols-*`. See [Dart obfuscation](#dart-obfuscation-flutter-apps).
+
 ### Opt out
 
 Pin the vendored copy by passing `auto-update: 'false'` to the action:

package/action/.daemux-version

@@ -1 +1 @@
-1.0.45
+1.0.47

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.45
+1.0.47

package/android-action/action.yml

@@ -1,7 +1,8 @@
 name: Android build and signing
 description: >
-  Auto-detect an Android app — Flutter or native Gradle — build a release AAB,
-  and sign it with the upload key stored under creds/. Google Play upload is
+  Auto-detect an Android app — Flutter or native Gradle — build a release AAB
+  (Flutter apps are compiled with Dart obfuscation, which is mandatory), and
+  sign it with the upload key stored under creds/. Google Play upload is
   handled by the package workflow so the signed artifact is always retained
   first.
 
@@ -46,6 +47,12 @@ outputs:
   project-kind:
     description: Detected build system — `flutter` or `gradle`
     value: ${{ steps.config.outputs.project_kind }}
+  symbols-path:
+    description: >-
+      Directory holding the Dart symbol files (app.android-*.symbols) that
+      `flutter symbolize` needs to read a stack trace from this obfuscated
+      build. Empty for native Gradle apps, which have no Dart code.
+    value: ${{ steps.flutter_build.outputs.symbols_path }}
 
 runs:
   using: composite
@@ -89,21 +96,58 @@ runs:
           echo "No test/ directory; skipping flutter test."
         fi
 
+    # Dart obfuscation is mandatory for Flutter apps: every release build is
+    # compiled with --obfuscate, and there is deliberately no input or repo
+    # variable that switches it off. --split-debug-info is not optional
+    # either — `flutter build` refuses --obfuscate without it — and the symbol
+    # files it writes are the only way to read a stack trace from this build,
+    # so the build fails when they are missing. The directory lives under
+    # RUNNER_TEMP rather than in the checkout so nothing that inspects or
+    # commits the working tree can ever see it.
     - name: Build release Android App Bundle
+      id: flutter_build
       if: ${{ steps.config.outputs.project_kind == 'flutter' }}
       shell: bash
       env:
         BUILD_NAME: ${{ inputs.build-name }}
+        DART_SYMBOLS_DIR: ${{ runner.temp }}/dart-symbols/android
       run: |
         args=(
           build appbundle
           --release
           --build-number "$ANDROID_BUILD_NUMBER"
+          --obfuscate
+          --split-debug-info "$DART_SYMBOLS_DIR"
         )
         if [ -n "$BUILD_NAME" ]; then
           args+=(--build-name "$BUILD_NAME")
         fi
         flutter "${args[@]}"
+        if ! ls "$DART_SYMBOLS_DIR"/*.symbols >/dev/null 2>&1; then
+          echo "::error::flutter build wrote no Dart symbol files to $DART_SYMBOLS_DIR;" \
+               "a crash from this obfuscated build could never be read. Refusing to ship it."
+          exit 1
+        fi
+        ls -la "$DART_SYMBOLS_DIR"
+        echo "symbols_path=$DART_SYMBOLS_DIR" >> "$GITHUB_OUTPUT"
+
+    # The symbols are retained HERE, not in the workflow, on purpose. The
+    # consumer-side autoupdate re-vendors this action but can never touch
+    # deploy.yml (GITHUB_TOKEN cannot push workflow files), so an updated
+    # action paired with an older workflow is the normal state of the fleet.
+    # If the flag lived here and the safety net lived in the workflow, that
+    # pairing would ship obfuscated bundles and destroy the only copy of their
+    # symbols with the runner. Whatever obfuscation needs to be safe must
+    # travel in the same file as the flag. No retention-days: the repository's
+    # own artifact retention setting governs, and unlike a fixed number it can
+    # be raised to cover the life of a release.
+    - name: Retain Dart symbol files
+      if: ${{ steps.config.outputs.project_kind == 'flutter' }}
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      with:
+        name: android-symbols-${{ steps.config.outputs.package_name }}-${{ steps.config.outputs.build_number }}
+        path: ${{ steps.flutter_build.outputs.symbols_path }}
+        if-no-files-found: error
 
     # --- Native Gradle --------------------------------------------------
     # resolve_android.py rewrites versionCode/versionName in the module build

package/android-action/scripts/test_flutter_obfuscation.py

@@ -0,0 +1,115 @@
+#!/usr/bin/env python3
+"""Dart obfuscation is mandatory for Flutter apps — pin the wiring.
+
+Nothing in this suite can run `flutter build`, so these tests read the action
+text the way test_version_override.py does and check that
+
+  * the Flutter release build passes --obfuscate together with
+    --split-debug-info (the tool refuses one without the other),
+  * the symbol directory is written outside the checkout,
+  * the build refuses to ship when no symbol files were produced,
+  * the action itself retains the symbols as an artifact — the consumer-side
+    autoupdate re-vendors this action but never deploy.yml, so the flag and
+    its safety net must not be split across that boundary — and
+  * the native Gradle path — which has no Dart code — is left alone.
+"""
+
+from __future__ import annotations
+
+import re
+import unittest
+from pathlib import Path
+
+ACTION_DIR = Path(__file__).resolve().parent.parent
+ACTION_YML = ACTION_DIR / "action.yml"
+
+
+def step(name: str) -> str:
+    """One composite step, as raw text, from its `- name:` line to the next."""
+    text = ACTION_YML.read_text()
+    pattern = rf"    - name: {re.escape(name)}\n(?P<body>.*?)(?=\n    - name:|\Z)"
+    match = re.search(pattern, text, re.DOTALL)
+    if match is None:
+        raise AssertionError(f"missing action step: {name}")
+    return match.group("body")
+
+
+def outputs_block() -> str:
+    text = ACTION_YML.read_text()
+    return text[text.index("\noutputs:\n") : text.index("\nruns:\n")]
+
+
+class FlutterObfuscationWiringTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.flutter = step("Build release Android App Bundle")
+        self.gradle = step("Build release Android App Bundle with Gradle")
+
+    def test_the_flutter_release_build_is_obfuscated(self) -> None:
+        self.assertIn("--release", self.flutter)
+        self.assertIn("--obfuscate", self.flutter)
+        # --obfuscate is rejected by the tool without --split-debug-info.
+        self.assertIn("--split-debug-info", self.flutter)
+
+    def test_both_flags_are_unconditional(self) -> None:
+        # Not inside an `if [ -n ... ]` like --build-name: obfuscation is
+        # mandatory, so the flags sit in the base argument list.
+        start = self.flutter.index("args=(")
+        base_args = self.flutter[start : self.flutter.index("\n        )", start)]
+        self.assertIn("--obfuscate", base_args)
+        self.assertIn("--split-debug-info", base_args)
+
+    def test_there_is_no_opt_out(self) -> None:
+        text = ACTION_YML.read_text()
+        self.assertNotIn("--no-obfuscate", text)
+        self.assertNotRegex(text, r"inputs\.[a-z-]*obfusc")
+        self.assertNotRegex(text, r"vars\.[A-Z_]*OBFUSC")
+
+    def test_symbols_are_written_outside_the_checkout(self) -> None:
+        # The iOS action commits bot changes back to the repo; keeping the
+        # symbols under RUNNER_TEMP means no step can ever stage them.
+        self.assertIn("DART_SYMBOLS_DIR: ${{ runner.temp }}/", self.flutter)
+        self.assertIn('--split-debug-info "$DART_SYMBOLS_DIR"', self.flutter)
+
+    def test_the_build_fails_when_no_symbol_files_were_written(self) -> None:
+        guard = self.flutter[self.flutter.index('"$DART_SYMBOLS_DIR"/*.symbols') :]
+        self.assertIn("::error::", guard[: guard.index("fi\n")])
+        self.assertIn("exit 1", guard[: guard.index("fi\n")])
+        # ... and the check happens after the build, not before it.
+        self.assertLess(
+            self.flutter.index('flutter "${args[@]}"'),
+            self.flutter.index("*.symbols"),
+        )
+
+    def test_the_symbol_directory_reaches_the_workflow(self) -> None:
+        self.assertIn("id: flutter_build", self.flutter)
+        self.assertIn('echo "symbols_path=$DART_SYMBOLS_DIR" >> "$GITHUB_OUTPUT"', self.flutter)
+        outputs = outputs_block()
+        self.assertIn("  symbols-path:\n", outputs)
+        self.assertIn("${{ steps.flutter_build.outputs.symbols_path }}", outputs)
+
+    def test_the_action_retains_the_symbols_itself(self) -> None:
+        retain = step("Retain Dart symbol files")
+        self.assertIn("project_kind == 'flutter'", retain)
+        self.assertRegex(retain, r"uses: actions/upload-artifact@[0-9a-f]{40}")
+        self.assertIn("path: ${{ steps.flutter_build.outputs.symbols_path }}", retain)
+        self.assertIn("name: android-symbols-${{ steps.config.outputs.package_name }}", retain)
+        self.assertIn("if-no-files-found: error", retain)
+        # The repository's retention setting governs; a fixed number cannot be
+        # raised to cover the life of a release.
+        self.assertNotIn("retention-days", retain)
+        # ... after the build that writes them.
+        text = ACTION_YML.read_text()
+        self.assertLess(
+            text.index("- name: Build release Android App Bundle\n"),
+            text.index("- name: Retain Dart symbol files"),
+        )
+
+    def test_the_gradle_build_is_left_alone(self) -> None:
+        # A native app has no Dart code to obfuscate; the flag would be an
+        # unknown Gradle argument.
+        self.assertNotIn("obfuscate", self.gradle)
+        self.assertNotIn("split-debug-info", self.gradle)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.45
+1.0.47

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.45",
+  "version": "1.0.47",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -72,10 +72,11 @@ jobs:
             ~/Library/Caches/CocoaPods
           key: pods-${{ runner.os }}-${{ hashFiles('ios/Podfile.lock', 'pubspec.lock') }}
           restore-keys: pods-${{ runner.os }}-
-      # Same as the android job: a private git dependency (e.g. the pomogator
-      # onboarding SDK) is cloned by `flutter pub get` below. The runner has no
+      # Same as the android job: an app that deliberately carries a private git
+      # dependency has it cloned by `flutter pub get` below. The runner has no
       # SSH key, so an https url only resolves once this token rewrite is in
-      # place. No secret => no-op (the dep must then carry its own credentials).
+      # place. No secret => no-op (panel-built apps depend on pub.dev only; a
+      # private dep must otherwise carry its own credentials).
       - name: Authenticate private git dependencies
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
         shell: bash
@@ -106,8 +107,18 @@ jobs:
             dart pub global activate flutterfire_cli >/dev/null 2>&1 || true
             echo "$HOME/.pub-cache/bin" >> "$GITHUB_PATH"
           fi
-          flutter build ios --release --no-codesign --config-only
+          # Dart obfuscation is mandatory for Flutter apps, and this is where
+          # the iOS build gets it even though xcodebuild does the compiling:
+          # --config-only writes DART_OBFUSCATION=true and SPLIT_DEBUG_INFO=<dir>
+          # into ios/Flutter/Generated.xcconfig, and the Flutter build phase
+          # inside the archive below compiles against those settings. The
+          # symbol files land under RUNNER_TEMP (never in the checkout) and are
+          # retained after the archive — without them an obfuscated crash log
+          # cannot be read.
+          flutter build ios --release --no-codesign --config-only \
+            --obfuscate --split-debug-info="$RUNNER_TEMP/dart-symbols/ios"
       - uses: ./.github/actions/swift-app
+        id: ios
         with:
           project: ${{ steps.flutter.outputs.enabled == 'true' && 'ios/Runner.xcodeproj' || '' }}
           workspace: ${{ steps.flutter.outputs.enabled == 'true' && 'ios/Runner.xcworkspace' || '' }}
@@ -118,6 +129,46 @@ jobs:
           # is locked in review. Default-branch deploys retain metadata automation.
           manage-app-store-version: >-
             ${{ github.ref_name == github.event.repository.default_branch && 'true' || 'false' }}
+      # `flutter symbolize` with app.ios-arm64.symbols is the only way to read a
+      # stack trace from the build that just went to TestFlight (App Store
+      # Connect receives native dSYMs only), and this runner holds the only
+      # copy. The archive writes the symbols well before the upload, and the
+      # action keeps working after the upload (App Store metadata, "What's
+      # New"), so these two steps run on `!cancelled()`: a failure there must
+      # not discard the symbols of a build that is already live. An action that
+      # succeeded without writing symbols is a broken obfuscation setup and
+      # fails here rather than shipping crashes nobody can read; an action that
+      # failed earlier simply has nothing to retain and adds no second error.
+      - name: Locate Dart symbol files
+        id: ios_symbols
+        if: ${{ !cancelled() && steps.flutter.outputs.enabled == 'true' }}
+        shell: bash
+        env:
+          ACTION_OUTCOME: ${{ steps.ios.outcome }}
+        run: |
+          dir="$RUNNER_TEMP/dart-symbols/ios"
+          if ls "$dir"/*.symbols >/dev/null 2>&1; then
+            ls -la "$dir"
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          elif [ "$ACTION_OUTCOME" = "success" ]; then
+            echo "::error::the archive wrote no Dart symbol files to $dir;" \
+                 "a crash from this obfuscated build could never be read."
+            exit 1
+          else
+            echo "No Dart symbol files (the build did not get as far as the archive)."
+            echo "present=false" >> "$GITHUB_OUTPUT"
+          fi
+      # BUILD_NUMBER comes from the action through GITHUB_ENV, so the artifact
+      # is named after the TestFlight build it belongs to. No retention-days:
+      # the repository's artifact retention setting governs (90 days unless
+      # raised), and a crash reporter needs its own copy — see the README.
+      - name: Retain Dart symbol files
+        if: ${{ !cancelled() && steps.ios_symbols.outputs.present == 'true' }}
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: ios-symbols-${{ github.event.repository.name }}-${{ env.BUILD_NUMBER || github.run_number }}
+          path: ${{ runner.temp }}/dart-symbols/ios
+          if-no-files-found: error
 
   android:
     name: Android Google Play
@@ -324,6 +375,10 @@ jobs:
           path: ${{ steps.android.outputs.bundle-path }}
           if-no-files-found: error
           retention-days: 30
+      # A Flutter app's Dart symbol files (android-symbols-<package>-<code>)
+      # are retained by the action itself, right after the obfuscated build —
+      # the action autoupdates on consumers while this file does not, and the
+      # flag and its safety net must never be split across that boundary.
       - name: Install Google Play preflight dependencies
         if: ${{ steps.mode.outputs.mode == 'local' }}
         shell: bash