gowalk-cicd 1.0.47 → 1.0.48

package/CLAUDE.md

@@ -149,6 +149,31 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   must not discard the symbols of a build that is already live. Symbol
   artifacts carry no `retention-days` so the repository's setting governs and
   can be raised to cover a release's life.
+- Crashlytics symbol upload is gated on the `firebase-app-id` action input,
+  which `deploy.yml` feeds from the `FIREBASE_APP_ID` repository variable on
+  both actions. Actions never read `vars.*` themselves — an unavailable
+  context inside a composite action invalidates every consumer's workflow —
+  so the variable crosses the workflow/action boundary as an input and the
+  feature reaches consumers only after the one-off `npx gowalk-cicd` that
+  refreshes `deploy.yml`. The variable holds one id per platform
+  (`1:<n>:android:<hash>`, `1:<n>:ios:<hash>`, comma/whitespace-separated);
+  each action picks its own and fails on anything that is not an id. Android
+  runs `firebase crashlytics:symbols:upload` (the only Android path Firebase
+  documents; needs Node + Java, no credentials) on the `--split-debug-info`
+  directory — `android-action/scripts/crashlytics_symbols.py`. iOS runs the
+  FirebaseCrashlytics pod's `upload-symbols` on the archive's dSYMs —
+  `action/scripts/crashlytics_dsyms.py` — because Flutter's `.symbols` are
+  ELF debug info the Firebase CLI's generators reject for Apple targets, and
+  `App.framework.dSYM` is the documented Apple path. Both run before the
+  store upload and fail closed — except an iOS id on an app with no
+  FirebaseCrashlytics `upload-symbols` tool, which is a warn-and-skip: an app
+  that does not embed the SDK has nothing to symbolicate. Logic belongs in
+  those scripts, where it is unit-tested, not inline in YAML. Supporting
+  invariants: the workflow's disk-space step must never remove
+  `/usr/local/lib/node_modules` (npm and npx live there); `firebase-tools` is
+  pinned exactly because the Android job holds the keystore and the Play
+  service account; the CLI runs from a temp cwd so its `.crashlytics/` debris
+  never lands in the checkout.
 - The JDK is chosen by `scripts/select_jdk.py`, called from the workflow before
   `setup-java`. The `JAVA_VERSION` repo variable always wins; otherwise Flutter
   gets 17 and native Gradle gets 21, except that a positively-detected Kotlin

package/README.md

@@ -254,9 +254,11 @@ zip I/O error: No space left on device
 ```
 
 The Android job removes the preinstalled toolchains a Flutter build never uses
-(.NET, the Android NDK, GHC, PowerShell, Swift, Chromium, global node modules)
-and prunes Docker images, reclaiming roughly 25 GB in a few seconds. It prints
-`df -h /` before and after. Linux only; skipped in Bitrise mode.
+(.NET, the Android NDK, GHC, PowerShell, Swift, Chromium) and prunes Docker
+images, reclaiming roughly 25 GB in a few seconds. It prints `df -h /` before
+and after. Linux only; skipped in Bitrise mode. npm survives on purpose: the
+[Crashlytics symbol upload](#crashlytics-symbol-upload-firebase_app_id) runs
+the Firebase CLI through `npx`.
 
 ### Private git dependencies (Flutter)
 
@@ -493,14 +495,53 @@ flutter symbolize -i crash.txt -d app.android-arm64.symbols
 ```
 
 A crash reporter never sees the artifact, and from the first obfuscated build
-every Dart frame it shows is `***` until it has the symbols. If the app uses
-Crashlytics, Sentry or similar, upload the same directory to that service — for
-Crashlytics, `firebase crashlytics:symbols:upload --app=<FIREBASE_APP_ID>
-<dir>` with Firebase CLI 11.9 or newer, once per platform with that platform's
-app id (`mobilesdk_app_id` in `google-services.json`, `GOOGLE_APP_ID` in
-`GoogleService-Info.plist`). This package does not do that upload for you: the
-existing Crashlytics run-script phase on iOS uploads only the native dSYMs, and
-App Store Connect's own symbol upload covers only those as well.
+every Dart frame it shows is `***` until it has the symbols. For Crashlytics
+the workflow uploads them itself once the repository variable
+**`FIREBASE_APP_ID`** is set — see below. Sentry or others: upload the same
+directory to that service from your own pipeline.
+
+#### Crashlytics symbol upload (`FIREBASE_APP_ID`)
+
+Set the repository variable `FIREBASE_APP_ID` to the app's Firebase App ID —
+`1:<project number>:<platform>:<hash>`. An app that ships both platforms has
+two ids (they differ in the third segment); list both, separated by a comma:
+
+```
+1:123456789012:android:0a1b2c3d4e5f6a7b,1:123456789012:ios:7b6a5f4e3d2c1b0a
+```
+
+Find them in `lib/firebase_options.dart` (`appId`), in
+`android/app/google-services.json` (`mobilesdk_app_id`) and
+`ios/Runner/GoogleService-Info.plist` (`GOOGLE_APP_ID`), or under *Project
+settings → Your apps* in the Firebase console. No credentials are needed:
+both upload tools authenticate by app id alone.
+
+The variable reaches the actions through `deploy.yml`, which
+[auto-update never touches](#deployyml-is-not-auto-updated) — an existing repo
+must run `npx --yes gowalk-cicd` once before setting it does anything.
+
+| | Android | iOS |
+|---|---|---|
+| What is uploaded | the `--split-debug-info` directory, with the command Firebase documents for Flutter: `firebase crashlytics:symbols:upload --app=<android id> <dir>` (Firebase CLI through `npx`, major-pinned) | every dSYM in the archive — `App.framework.dSYM` carries the Dart frames — with the `upload-symbols` tool from the FirebaseCrashlytics pod: `upload-symbols -ai <ios id> -p ios -- <archive>/dSYMs` |
+| When | in the Android action, right after the build and before the bundle goes to Play | in the iOS action, right after the IPA export and before the TestFlight upload |
+| If it fails | the deploy fails; nothing ships with crashes nobody can read. The symbols are still in the `android-symbols-*` artifact for a manual upload | same — the failure lands before the TestFlight upload, so nothing shipped; fix the cause and re-run the deploy |
+| Variable unset | a `::warning::` when the app depends on `firebase_crashlytics` (every Dart frame will be `***`) | nothing — the run-script phase that `flutterfire configure` adds already uploads `App.framework.dSYM`, and the workflow installs the flutterfire CLI it needs |
+| Variable set for the other platform only | a `::warning::`, no upload | a `::notice::`, no upload |
+
+Why the two platforms differ: Flutter's `.symbols` files are ELF debug info,
+which the Firebase CLI's symbol generators accept for Android and reject for
+Apple targets; Firebase documents dSYMs as the Apple path, and Flutter 3.12+
+puts the Dart debug info into `App.framework.dSYM`. On iOS the explicit
+upload is a belt-and-braces over the run-script phase — it also covers the
+native `Runner.app.dSYM` and every plugin framework — so a phase that is
+missing or failing can never leave a build unreadable.
+
+A value that is not a Firebase App ID fails the deploy rather than being
+skipped: a typo must not become a fleet that silently stops uploading symbols.
+An iOS id on an app that does not embed Crashlytics (no `upload-symbols` tool
+anywhere under the project) is a warning, not a failure — an app without the
+SDK has no Crashlytics crashes to symbolicate. Android apps delivered through
+Bitrise are built by Bitrise and are not covered.
 
 Obfuscation renames identifiers, so code that depends on their spelling breaks
 at runtime, not at build time. Do not rely on `runtimeType.toString()`,
@@ -849,6 +890,9 @@ Changes that need that manual run:
 - **Flutter iOS obfuscation** — the `--obfuscate --split-debug-info` flags on
   the iOS `flutter build ios --config-only` call and the step that retains
   `ios-symbols-*`. See [Dart obfuscation](#dart-obfuscation-flutter-apps).
+- **Crashlytics symbol upload** — `firebase-app-id: ${{ vars.FIREBASE_APP_ID }}`
+  passed to both actions. Until it is, setting the variable does nothing.
+  See [Crashlytics symbol upload](#crashlytics-symbol-upload-firebase_app_id).
 
 ### Opt out
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.47
+1.0.48

package/action/action.yml

@@ -121,6 +121,17 @@ inputs:
     description: "GitHub Models model id for AI metadata generation."
     required: false
     default: "openai/gpt-4o"
+  firebase-app-id:
+    description: >-
+      Firebase App ID(s) for the Crashlytics dSYM upload — the
+      `1:<project number>:ios:<hash>` value (GOOGLE_APP_ID in
+      GoogleService-Info.plist, or Project settings → Your apps in the Firebase
+      console). Several ids may be listed, separated by commas or whitespace;
+      the iOS one is used. Empty leaves dSYM upload to the app's own
+      Crashlytics run-script phase. The package workflow passes the
+      FIREBASE_APP_ID repository variable.
+    required: false
+    default: ""
   # DESIGN DECISION: marketing-version-auto-bump trades unattended-CI
   # smoothness against silent-semver-decisions visibility. Default
   # 'rollover' lets CI keep the build moving when ASC's combined floor
@@ -705,6 +716,29 @@ runs:
           -exportPath "$RUNNER_TEMP/export"
         ls -la "$RUNNER_TEMP/export"
 
+    # Crashlytics symbolicates from the dSYMs in the archive — for a Flutter
+    # app that includes App.framework.dSYM, where the Dart frames of an
+    # obfuscated build come from, and the only Apple-platform path Firebase
+    # documents for such builds. The run-script phase `flutterfire configure`
+    # adds already uploads that dSYM during the archive; with firebase-app-id
+    # set (deploy.yml passes the FIREBASE_APP_ID repository variable) every
+    # dSYM in the archive is uploaded here as well, with the upload-symbols
+    # tool from the FirebaseCrashlytics pod, so a missing or broken phase
+    # cannot leave a build unreadable. Before the TestFlight upload on
+    # purpose: a failed upload fails the deploy instead of shipping crashes
+    # nobody can read. Logic and its tests live in scripts/crashlytics_dsyms.py.
+    - name: Upload dSYMs to Crashlytics
+      if: ${{ inputs.archive == 'true' && inputs.upload == 'true' && inputs.firebase-app-id != '' }}
+      shell: bash
+      env:
+        FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}
+        PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
+        WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
+      run: |
+        python3 "${{ github.action_path }}/scripts/crashlytics_dsyms.py" \
+          --archive "$RUNNER_TEMP/app.xcarchive" \
+          --search-root "$(dirname "${WORKSPACE:-$PROJECT}")"
+
     - name: Upload to TestFlight
       if: ${{ inputs.archive == 'true' && inputs.upload == 'true' }}
       shell: bash

package/action/scripts/crashlytics_dsyms.py

@@ -0,0 +1,182 @@
+#!/usr/bin/env python3
+"""Upload every dSYM in the archive to Firebase Crashlytics.
+
+Crashlytics symbolicates Apple crashes from dSYMs. For a Flutter app that
+includes App.framework.dSYM, which is where the Dart frames come from — and
+the only Apple-platform path Firebase documents for Flutter's obfuscated,
+--split-debug-info builds (the .symbols files those flags write are ELF
+debug info that the Firebase CLI's symbol generators reject). The run-script
+phase `flutterfire configure` adds already uploads that one dSYM during the
+archive; this script uploads all of them (App.framework, the app binary,
+plugin frameworks) with the `upload-symbols` tool that ships in the
+FirebaseCrashlytics pod, so a missing or broken phase cannot leave a build
+unreadable, and native frames get their symbols too.
+
+    upload-symbols -ai <FIREBASE_APP_ID> -p ios -- <archive>/dSYMs
+
+No credentials: the tool authenticates by app id alone.
+
+Gating: FIREBASE_APP_ID holds the app's Firebase App ID(s),
+`1:<project number>:<platform>:<hash>`, comma- or whitespace-separated when an
+app ships both platforms; the iOS one is used and its absence is a notice, not
+a failure (the run-script phase is the documented default). With an iOS id
+present, a missing tool or a failed upload fails the step — the action runs it
+before the TestFlight upload, so a deploy never goes out with crashes nobody
+can read.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+APP_ID_RE = re.compile(r"^(\d+):(\d+):(android|ios|web):([0-9A-Fa-f]+)$")
+
+
+class AppIdError(ValueError):
+    """FIREBASE_APP_ID contains something that is not a Firebase App ID."""
+
+
+def parse_app_ids(raw: str) -> list[tuple[str, str]]:
+    """Split FIREBASE_APP_ID into (platform, app id) pairs; garbage is an error."""
+    ids: list[tuple[str, str]] = []
+    for token in re.split(r"[,\s]+", raw.strip()):
+        if not token:
+            continue
+        match = APP_ID_RE.match(token)
+        if match is None:
+            raise AppIdError(
+                f"{token!r} is not a Firebase App ID "
+                "(expected 1:<project number>:<android|ios|web>:<hash>)"
+            )
+        ids.append((match.group(3), token))
+    return ids
+
+
+def _pick(ids: list[tuple[str, str]], platform: str) -> str | None:
+    return next((app_id for found_platform, app_id in ids if found_platform == platform), None)
+
+
+def select_app_id(raw: str, platform: str) -> str | None:
+    return _pick(parse_app_ids(raw), platform)
+
+
+def find_upload_symbols(search_root: Path, home: Path | None = None) -> Path | None:
+    """Locate the FirebaseCrashlytics `upload-symbols` tool.
+
+    CocoaPods puts it at <ios dir>/Pods/FirebaseCrashlytics/upload-symbols; a
+    Swift Package Manager checkout keeps it under Xcode's DerivedData. Only a
+    tool whose parent directory names Crashlytics counts — the name alone is
+    too generic.
+    """
+    direct = search_root / "Pods" / "FirebaseCrashlytics" / "upload-symbols"
+    if direct.is_file():
+        return direct
+    if search_root.is_dir():
+        # A project at the repo root makes search_root the whole checkout, so
+        # prune the trees that are big and can never hold the tool.
+        prune = {".git", "build", ".dart_tool", "node_modules"}
+        hits: list[Path] = []
+        for dirpath, dirnames, filenames in os.walk(search_root):
+            dirnames[:] = [d for d in dirnames if d not in prune]
+            if "upload-symbols" in filenames and Path(dirpath).name in ("FirebaseCrashlytics", "Crashlytics"):
+                candidate = Path(dirpath) / "upload-symbols"
+                if candidate.is_file():
+                    hits.append(candidate)
+        if hits:
+            return sorted(hits)[0]
+    home = Path.home() if home is None else home
+    derived = home / "Library" / "Developer" / "Xcode" / "DerivedData"
+    for candidate in sorted(
+        derived.glob("*/SourcePackages/checkouts/firebase-ios-sdk/Crashlytics/upload-symbols")
+    ):
+        if candidate.is_file():
+            return candidate
+    return None
+
+
+def upload_command(tool: Path, app_id: str, dsyms_dir: Path) -> list[str]:
+    return [str(tool), "-ai", app_id, "-p", "ios", "--", str(dsyms_dir)]
+
+
+def _default_run(cmd: list[str]) -> int:
+    try:
+        return subprocess.run(cmd, check=False).returncode
+    except OSError as exc:
+        print(f"::error::could not run {cmd[0]}: {exc}")
+        return 126
+
+
+def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, run=None,
+         home: Path | None = None) -> int:
+    environ = os.environ if environ is None else environ
+    run = _default_run if run is None else run
+
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--archive", required=True, type=Path, help="the .xcarchive that was exported")
+    parser.add_argument("--search-root", required=True, type=Path,
+                        help="directory holding the Xcode project/workspace (where Pods/ lives)")
+    args = parser.parse_args(argv)
+
+    raw = environ.get("FIREBASE_APP_ID", "")
+    try:
+        ids = parse_app_ids(raw)
+    except AppIdError as exc:
+        print(f"::error::FIREBASE_APP_ID: {exc}")
+        return 1
+
+    app_id = _pick(ids, "ios")
+    if app_id is None:
+        if ids:
+            print(
+                "::notice::FIREBASE_APP_ID names no iOS app (1:<project number>:ios:<hash>); "
+                "relying on the Crashlytics run-script phase for dSYM upload."
+            )
+        else:
+            print("FIREBASE_APP_ID unset; relying on the Crashlytics run-script phase for dSYM upload.")
+        return 0
+
+    dsyms_dir = args.archive / "dSYMs"
+    dsyms = sorted(dsyms_dir.glob("*.dSYM")) if dsyms_dir.is_dir() else []
+    if not dsyms:
+        print(f"::error::no dSYMs in {dsyms_dir}; nothing to upload to Crashlytics")
+        return 1
+
+    tool = find_upload_symbols(args.search_root, home)
+    if tool is None:
+        # No tool means the app does not link the Crashlytics SDK, so there are
+        # no Crashlytics crash reports to symbolicate — skipping loses nothing,
+        # while failing would block every release of a non-Crashlytics app
+        # whose FIREBASE_APP_ID happens to carry an iOS id.
+        print(
+            "::warning::FIREBASE_APP_ID names an iOS app but no FirebaseCrashlytics "
+            f"upload-symbols tool exists under {args.search_root} or Xcode's "
+            "DerivedData, so the app does not appear to embed Crashlytics; "
+            "skipping the dSYM upload. (`flutterfire configure` adds the "
+            "dependency and the run-script phase.)"
+        )
+        return 0
+
+    cmd = upload_command(tool, app_id, dsyms_dir)
+    print(f"Uploading {len(dsyms)} dSYM(s) to Crashlytics app {app_id}:")
+    for dsym in dsyms:
+        print(f"  {dsym.name}")
+    print("  " + " ".join(cmd))
+    rc = run(cmd)
+    if rc != 0:
+        print(
+            f"::error::Crashlytics dSYM upload failed (exit {rc}). This step runs "
+            "before the TestFlight upload, so nothing shipped — fix the cause and "
+            "re-run the deploy."
+        )
+        return 1
+    print(f"Uploaded dSYMs to Crashlytics app {app_id}.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/action/scripts/test_crashlytics_dsyms.py

@@ -0,0 +1,214 @@
+#!/usr/bin/env python3
+"""Crashlytics dSYM upload: gating, tool discovery and failure semantics.
+
+The upload itself cannot run here (it needs the FirebaseCrashlytics pod and
+the network), so the command is captured through the injectable runner. The
+wiring into action.yml is pinned at the bottom.
+"""
+
+from __future__ import annotations
+
+import io
+import re
+import sys
+import tempfile
+import unittest
+from contextlib import redirect_stdout
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import crashlytics_dsyms as cd  # noqa: E402
+
+ANDROID = "1:123456789012:android:0123456789abcdef"
+IOS = "1:123456789012:ios:fedcba9876543210"
+
+
+class ParseAppIdsTest(unittest.TestCase):
+    def test_parse_and_select(self) -> None:
+        self.assertEqual(cd.parse_app_ids(f"{ANDROID}, {IOS}"), [("android", ANDROID), ("ios", IOS)])
+        self.assertEqual(cd.select_app_id(f"{ANDROID}\n{IOS}", "ios"), IOS)
+        self.assertIsNone(cd.select_app_id(ANDROID, "ios"))
+        self.assertEqual(cd.parse_app_ids(""), [])
+
+    def test_garbage_is_an_error(self) -> None:
+        with self.assertRaises(cd.AppIdError):
+            cd.parse_app_ids("1:123:tvos:abc")
+
+
+class FindUploadSymbolsTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self.tmp.name)
+        self.ios = self.root / "ios"
+        self.ios.mkdir()
+        self.home = self.root / "home"
+        self.home.mkdir()
+
+    def tearDown(self) -> None:
+        self.tmp.cleanup()
+
+    def touch(self, path: Path) -> Path:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text("#!/bin/sh\n")
+        return path
+
+    def test_cocoapods_location_wins(self) -> None:
+        tool = self.touch(self.ios / "Pods" / "FirebaseCrashlytics" / "upload-symbols")
+        self.assertEqual(cd.find_upload_symbols(self.ios, self.home), tool)
+
+    def test_a_crashlytics_tool_anywhere_under_the_root_is_found(self) -> None:
+        tool = self.touch(self.ios / "Vendor" / "Crashlytics" / "upload-symbols")
+        self.assertEqual(cd.find_upload_symbols(self.ios, self.home), tool)
+
+    def test_an_unrelated_upload_symbols_is_ignored(self) -> None:
+        self.touch(self.ios / "Pods" / "Sentry" / "upload-symbols")
+        self.assertIsNone(cd.find_upload_symbols(self.ios, self.home))
+
+    def test_swiftpm_checkout_is_found(self) -> None:
+        tool = self.touch(
+            self.home / "Library" / "Developer" / "Xcode" / "DerivedData" / "Runner-abc"
+            / "SourcePackages" / "checkouts" / "firebase-ios-sdk" / "Crashlytics" / "upload-symbols"
+        )
+        self.assertEqual(cd.find_upload_symbols(self.ios, self.home), tool)
+
+    def test_missing_root_is_not_an_exception(self) -> None:
+        self.assertIsNone(cd.find_upload_symbols(self.root / "nope", self.home))
+
+    def test_pruned_trees_are_never_searched(self) -> None:
+        # A project at the repo root makes the search root the whole checkout.
+        for tree in (".git", "build", ".dart_tool", "node_modules"):
+            self.touch(self.ios / tree / "FirebaseCrashlytics" / "upload-symbols")
+        self.assertIsNone(cd.find_upload_symbols(self.ios, self.home))
+
+
+class MainTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self.tmp.name)
+        self.ios = self.root / "ios"
+        self.tool = self.ios / "Pods" / "FirebaseCrashlytics" / "upload-symbols"
+        self.tool.parent.mkdir(parents=True)
+        self.tool.write_text("#!/bin/sh\n")
+        self.archive = self.root / "app.xcarchive"
+        self.dsyms = self.archive / "dSYMs"
+        for name in ("Runner.app.dSYM", "App.framework.dSYM", "Flutter.framework.dSYM"):
+            (self.dsyms / name / "Contents").mkdir(parents=True)
+        self.home = self.root / "home"
+        self.home.mkdir()
+        self.calls: list[list[str]] = []
+
+    def tearDown(self) -> None:
+        self.tmp.cleanup()
+
+    def run_main(self, env: dict[str, str], rc: int = 0, archive: Path | None = None,
+                 search_root: Path | None = None) -> tuple[int, str]:
+        def runner(cmd: list[str]) -> int:
+            self.calls.append(cmd)
+            return rc
+
+        out = io.StringIO()
+        with redirect_stdout(out):
+            code = cd.main(
+                ["--archive", str(archive or self.archive), "--search-root", str(search_root or self.ios)],
+                environ=env, run=runner, home=self.home,
+            )
+        return code, out.getvalue()
+
+    def test_unset_is_a_quiet_no_op(self) -> None:
+        code, out = self.run_main({})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [])
+        self.assertNotIn("::warning::", out)
+        self.assertNotIn("::error::", out)
+
+    def test_ids_without_an_ios_one_are_a_notice_not_a_failure(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": ANDROID})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::notice::", out)
+
+    def test_malformed_id_fails(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": "nope"})
+        self.assertEqual(code, 1)
+        self.assertIn("::error::", out)
+
+    def test_ios_id_uploads_the_whole_dsyms_directory(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": f"{ANDROID},{IOS}"})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [[str(self.tool), "-ai", IOS, "-p", "ios", "--", str(self.dsyms)]])
+        self.assertIn("App.framework.dSYM", out)
+        self.assertIn("Uploaded", out)
+
+    def test_missing_tool_warns_and_skips(self) -> None:
+        # No tool => the app does not link the Crashlytics SDK, so there is
+        # nothing to symbolicate; blocking the release would be pure harm.
+        self.tool.unlink()
+        code, out = self.run_main({"FIREBASE_APP_ID": IOS})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::warning::", out)
+        self.assertNotIn("::error::", out)
+        self.assertIn("upload-symbols", out)
+
+    def test_a_broken_tool_is_a_named_error_not_a_traceback(self) -> None:
+        out = io.StringIO()
+        with redirect_stdout(out):
+            rc = cd._default_run([str(self.root / "gowalk-cicd-no-such-binary")])
+        self.assertNotEqual(rc, 0)
+        self.assertIn("::error::", out.getvalue())
+
+    def test_missing_dsyms_fail_before_any_upload(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": IOS}, archive=self.root / "missing.xcarchive")
+        self.assertEqual(code, 1)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::error::", out)
+
+    def test_a_failed_upload_fails_the_step(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": IOS}, rc=3)
+        self.assertEqual(code, 1)
+        self.assertIn("::error::", out)
+        self.assertIn(f"-ai {IOS}", out)
+
+
+ACTION_YML = Path(__file__).resolve().parents[1] / "action.yml"
+
+
+def step(name: str) -> str:
+    text = ACTION_YML.read_text()
+    pattern = rf"    - name: {re.escape(name)}\n(?P<body>.*?)(?=\n    - name:|\Z)"
+    match = re.search(pattern, text, re.DOTALL)
+    if match is None:
+        raise AssertionError(f"missing action step: {name}")
+    return match.group("body")
+
+
+class CrashlyticsWiringTest(unittest.TestCase):
+    def test_the_action_takes_the_app_id_as_an_input(self) -> None:
+        # An input, not `vars.FIREBASE_APP_ID` read inside the action: the
+        # workflow passes the repository variable, and an unavailable context
+        # in a composite action would invalidate every consumer's workflow.
+        text = ACTION_YML.read_text()
+        self.assertRegex(text, r"(?m)^  firebase-app-id:\n(?:    .*\n)*?    default: \"\"$")
+        self.assertNotIn("vars.", text)
+
+    def test_dsyms_go_up_after_export_and_before_testflight(self) -> None:
+        upload = step("Upload dSYMs to Crashlytics")
+        self.assertIn("inputs.archive == 'true'", upload)
+        # Only builds that actually ship: an archive-only run (upload=false)
+        # must not be failed over a symbols upload.
+        self.assertIn("inputs.upload == 'true'", upload)
+        self.assertIn("inputs.firebase-app-id != ''", upload)
+        self.assertIn("FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}", upload)
+        self.assertIn("scripts/crashlytics_dsyms.py", upload)
+        self.assertIn('--archive "$RUNNER_TEMP/app.xcarchive"', upload)
+        text = ACTION_YML.read_text()
+        self.assertLess(text.index("- name: Export IPA"), text.index("- name: Upload dSYMs to Crashlytics"))
+        self.assertLess(text.index("- name: Upload dSYMs to Crashlytics"), text.index("- name: Upload to TestFlight"))
+
+    def test_the_script_ships_with_the_action(self) -> None:
+        self.assertTrue((ACTION_YML.parent / "scripts" / "crashlytics_dsyms.py").is_file())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.47
+1.0.48

package/android-action/action.yml

@@ -30,6 +30,16 @@ inputs:
       (flutter analyze + flutter test, or the Gradle module's unit tests)
     required: false
     default: "true"
+  firebase-app-id:
+    description: >-
+      Firebase App ID(s) for the Crashlytics symbol upload — the
+      `1:<project number>:android:<hash>` value (mobilesdk_app_id in
+      google-services.json, or Project settings → Your apps in the Firebase
+      console). Several ids may be listed, separated by commas or whitespace;
+      the Android one is used. Empty disables the upload. The package workflow
+      passes the FIREBASE_APP_ID repository variable.
+    required: false
+    default: ""
 
 outputs:
   package-name:
@@ -149,6 +159,26 @@ runs:
         path: ${{ steps.flutter_build.outputs.symbols_path }}
         if-no-files-found: error
 
+    # Crashlytics shows *** for every Dart frame of an obfuscated build until
+    # it has the symbol files, and on Android nothing uploads them by itself
+    # (the Crashlytics Gradle plugin handles native NDK symbols only). With
+    # firebase-app-id set — deploy.yml passes the FIREBASE_APP_ID repository
+    # variable — they go up here, before the workflow ships the bundle to
+    # Play, so a failed upload fails the deploy instead of shipping crashes
+    # nobody can read. Unset, the step only warns when the app depends on
+    # firebase_crashlytics. The Firebase CLI needs Node and Java, both already
+    # on this job, and no credentials. Logic and its tests live in
+    # scripts/crashlytics_symbols.py.
+    - name: Upload Dart symbols to Crashlytics
+      if: ${{ steps.config.outputs.project_kind == 'flutter' }}
+      shell: bash
+      env:
+        FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}
+        DART_SYMBOLS_DIR: ${{ steps.flutter_build.outputs.symbols_path }}
+      run: |
+        python3 "${{ github.action_path }}/scripts/crashlytics_symbols.py" \
+          --symbols-dir "$DART_SYMBOLS_DIR"
+
     # --- Native Gradle --------------------------------------------------
     # resolve_android.py rewrites versionCode/versionName in the module build
     # file when it can find a literal to rewrite, and the build step below

package/android-action/scripts/crashlytics_symbols.py

@@ -0,0 +1,177 @@
+#!/usr/bin/env python3
+"""Upload a Flutter app's Dart symbol files to Firebase Crashlytics.
+
+Every Flutter release build is obfuscated (see action.yml), so Crashlytics
+shows `***` for every Dart frame until it has the symbol files that
+--split-debug-info wrote. On Android nothing uploads them automatically — the
+Crashlytics Gradle plugin only handles native NDK symbols — so this script
+does, with the command Firebase documents for Flutter:
+
+    firebase crashlytics:symbols:upload --app=<FIREBASE_APP_ID> <symbols dir>
+
+It needs no credentials: that Firebase CLI command has no login requirement
+and authenticates by app id alone. It does need Node (npx) and Java (the CLI
+drives the Crashlytics buildtools jar), both of which the Android job has.
+
+Gating: the FIREBASE_APP_ID environment variable holds the app's Firebase App
+ID(s), `1:<project number>:<platform>:<hash>`, comma- or whitespace-separated
+when an app ships both platforms; the Android one is used. Unset, nothing is
+uploaded and the script only warns when the app depends on
+firebase_crashlytics. Set, an upload failure is a failure: the action runs
+before the workflow ships the bundle to Play, so a deploy never goes out with
+crashes nobody can read.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+# Exact pin, not a range: this job holds the upload keystore and the Play
+# service account, so no floating third-party code runs in it. Bump on purpose.
+FIREBASE_TOOLS = "firebase-tools@15.28.2"
+
+APP_ID_RE = re.compile(r"^(\d+):(\d+):(android|ios|web):([0-9A-Fa-f]+)$")
+
+
+class AppIdError(ValueError):
+    """FIREBASE_APP_ID contains something that is not a Firebase App ID."""
+
+
+def parse_app_ids(raw: str) -> list[tuple[str, str]]:
+    """Split FIREBASE_APP_ID into (platform, app id) pairs.
+
+    Accepts one id or several separated by commas and/or whitespace. Anything
+    that does not look like `1:<project number>:<android|ios|web>:<hash>` is
+    an error rather than a silent skip — a typo must not turn into a fleet
+    that quietly stops uploading symbols.
+    """
+    ids: list[tuple[str, str]] = []
+    for token in re.split(r"[,\s]+", raw.strip()):
+        if not token:
+            continue
+        match = APP_ID_RE.match(token)
+        if match is None:
+            raise AppIdError(
+                f"{token!r} is not a Firebase App ID "
+                "(expected 1:<project number>:<android|ios|web>:<hash>)"
+            )
+        ids.append((match.group(3), token))
+    return ids
+
+
+def _pick(ids: list[tuple[str, str]], platform: str) -> str | None:
+    return next((app_id for found_platform, app_id in ids if found_platform == platform), None)
+
+
+def select_app_id(raw: str, platform: str) -> str | None:
+    """The app id for *platform* out of FIREBASE_APP_ID, or None."""
+    return _pick(parse_app_ids(raw), platform)
+
+
+def uses_crashlytics(pubspec: Path) -> bool:
+    try:
+        text = pubspec.read_text(encoding="utf-8")
+    except OSError:
+        return False
+    return re.search(r"^\s*firebase_crashlytics\s*:", text, re.MULTILINE) is not None
+
+
+def upload_command(app_id: str, symbols_dir: Path, firebase_tools: str = FIREBASE_TOOLS) -> list[str]:
+    return [
+        "npx",
+        "--yes",
+        firebase_tools,
+        "crashlytics:symbols:upload",
+        f"--app={app_id}",
+        str(symbols_dir),
+    ]
+
+
+def _default_run(cmd: list[str]) -> int:
+    # A scratch cwd: the Crashlytics buildtools drop a .crashlytics/ directory
+    # (dump_syms.bin, ~4 MB) into the working directory, which must not be the
+    # consumer's checkout.
+    workdir = tempfile.mkdtemp(prefix="crashlytics-upload-")
+    try:
+        return subprocess.run(cmd, check=False, cwd=workdir).returncode
+    except FileNotFoundError:
+        print(
+            "::error::npx is not on PATH, so the Firebase CLI cannot run. "
+            "If a disk-cleanup step removes /usr/local/lib/node_modules, npm "
+            "and npx go with it — deploy.yml deliberately leaves that path alone."
+        )
+        return 127
+
+
+def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, run=None) -> int:
+    environ = os.environ if environ is None else environ
+    run = _default_run if run is None else run
+
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--symbols-dir", required=True, type=Path,
+                        help="the directory passed to flutter build --split-debug-info")
+    parser.add_argument("--pubspec", type=Path, default=Path("pubspec.yaml"),
+                        help="pubspec.yaml, used only to decide whether to warn when unset")
+    parser.add_argument("--firebase-tools", default=FIREBASE_TOOLS,
+                        help="npm spec of the Firebase CLI to run through npx")
+    args = parser.parse_args(argv)
+
+    raw = environ.get("FIREBASE_APP_ID", "")
+    try:
+        ids = parse_app_ids(raw)
+    except AppIdError as exc:
+        print(f"::error::FIREBASE_APP_ID: {exc}")
+        return 1
+
+    app_id = _pick(ids, "android")
+    if app_id is None:
+        if ids:
+            print(
+                "::warning::FIREBASE_APP_ID names no Android app "
+                "(1:<project number>:android:<hash>); the Dart symbols were not "
+                "uploaded to Crashlytics."
+            )
+        elif uses_crashlytics(args.pubspec):
+            # Two causes look identical from here: the variable is unset, or a
+            # deploy.yml that predates the firebase-app-id input never passed
+            # it. Name both — the action can only ever see the input.
+            print(
+                "::warning::This app depends on firebase_crashlytics but no "
+                "Firebase App ID reached this build, so every Dart frame in "
+                "Crashlytics will read as ***. Either the FIREBASE_APP_ID "
+                "repository variable is unset, or this repo's deploy.yml predates "
+                "the firebase-app-id input — a one-off `npx --yes gowalk-cicd` "
+                "refreshes it."
+            )
+        else:
+            print("FIREBASE_APP_ID unset; not uploading Dart symbols to Crashlytics.")
+        return 0
+
+    symbols = sorted(args.symbols_dir.glob("*.symbols")) if args.symbols_dir.is_dir() else []
+    if not symbols:
+        print(f"::error::no Dart symbol files in {args.symbols_dir}; nothing to upload to Crashlytics")
+        return 1
+
+    cmd = upload_command(app_id, args.symbols_dir, args.firebase_tools)
+    print(f"Uploading {len(symbols)} Dart symbol file(s) to Crashlytics app {app_id}:")
+    print("  " + " ".join(cmd))
+    rc = run(cmd)
+    if rc != 0:
+        print(
+            f"::error::Crashlytics symbol upload failed (exit {rc}). The symbols are "
+            "retained as the android-symbols artifact; after fixing the cause, upload "
+            f"them by hand with: firebase crashlytics:symbols:upload --app={app_id} <dir>"
+        )
+        return 1
+    print(f"Uploaded Dart symbols to Crashlytics app {app_id}.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/android-action/scripts/test_crashlytics_symbols.py

@@ -0,0 +1,210 @@
+#!/usr/bin/env python3
+"""Crashlytics symbol upload: gating, id selection and failure semantics.
+
+The upload itself cannot run here (it needs the Firebase CLI, Java and the
+network), so the command is captured through the injectable runner and the
+decision logic is exercised directly. The wiring into action.yml is pinned at
+the bottom, next to the other Flutter obfuscation wiring tests.
+"""
+
+from __future__ import annotations
+
+import io
+import re
+import sys
+import tempfile
+import unittest
+from contextlib import redirect_stdout
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import crashlytics_symbols as cs  # noqa: E402
+
+ANDROID = "1:123456789012:android:0123456789abcdef"
+IOS = "1:123456789012:ios:fedcba9876543210"
+
+
+class ParseAppIdsTest(unittest.TestCase):
+    def test_single_id(self) -> None:
+        self.assertEqual(cs.parse_app_ids(ANDROID), [("android", ANDROID)])
+
+    def test_several_ids_separated_by_commas_or_whitespace(self) -> None:
+        for raw in (f"{ANDROID},{IOS}", f"{ANDROID}, {IOS}", f"{ANDROID}\n{IOS}", f" {ANDROID}  {IOS} "):
+            with self.subTest(raw=raw):
+                self.assertEqual(cs.parse_app_ids(raw), [("android", ANDROID), ("ios", IOS)])
+
+    def test_empty_is_no_ids(self) -> None:
+        self.assertEqual(cs.parse_app_ids(""), [])
+        self.assertEqual(cs.parse_app_ids("  \n "), [])
+
+    def test_web_ids_parse_but_are_never_selected_here(self) -> None:
+        web = "1:123456789012:web:abcdef0123456789"
+        self.assertEqual(cs.parse_app_ids(web), [("web", web)])
+        self.assertIsNone(cs.select_app_id(web, "android"))
+
+    def test_garbage_is_an_error_not_a_skip(self) -> None:
+        for raw in ("my-app", "1:123:android", "1:123:desktop:abc", f"{ANDROID},oops"):
+            with self.subTest(raw=raw):
+                with self.assertRaises(cs.AppIdError):
+                    cs.parse_app_ids(raw)
+
+    def test_select_picks_the_platform(self) -> None:
+        self.assertEqual(cs.select_app_id(f"{IOS},{ANDROID}", "android"), ANDROID)
+        self.assertEqual(cs.select_app_id(f"{IOS},{ANDROID}", "ios"), IOS)
+        self.assertIsNone(cs.select_app_id(IOS, "android"))
+
+
+class MainTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self.tmp.name)
+        self.symbols = self.root / "symbols"
+        self.symbols.mkdir()
+        for arch in ("arm", "arm64", "x64"):
+            (self.symbols / f"app.android-{arch}.symbols").write_bytes(b"\x7fELF")
+        self.pubspec = self.root / "pubspec.yaml"
+        self.pubspec.write_text("name: app\ndependencies:\n  flutter:\n    sdk: flutter\n")
+        self.calls: list[list[str]] = []
+
+    def tearDown(self) -> None:
+        self.tmp.cleanup()
+
+    def run_main(self, env: dict[str, str], rc: int = 0, symbols_dir: Path | None = None) -> tuple[int, str]:
+        def runner(cmd: list[str]) -> int:
+            self.calls.append(cmd)
+            return rc
+
+        out = io.StringIO()
+        with redirect_stdout(out):
+            code = cs.main(
+                ["--symbols-dir", str(symbols_dir or self.symbols), "--pubspec", str(self.pubspec)],
+                environ=env,
+                run=runner,
+            )
+        return code, out.getvalue()
+
+    def test_unset_without_crashlytics_is_a_quiet_no_op(self) -> None:
+        code, out = self.run_main({})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [])
+        self.assertNotIn("::warning::", out)
+        self.assertNotIn("::error::", out)
+
+    def test_unset_with_crashlytics_warns_but_does_not_fail(self) -> None:
+        self.pubspec.write_text("dependencies:\n  firebase_crashlytics: ^5.0.0\n")
+        code, out = self.run_main({"FIREBASE_APP_ID": ""})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::warning::", out)
+        self.assertIn("FIREBASE_APP_ID", out)
+        self.assertIn("***", out)
+        # The action cannot tell an unset variable from a deploy.yml that never
+        # passes the input; the message must name both causes.
+        self.assertIn("gowalk-cicd", out)
+
+    def test_a_commented_out_dependency_does_not_count(self) -> None:
+        self.pubspec.write_text("dependencies:\n  # firebase_crashlytics: ^5.0.0\n")
+        code, out = self.run_main({})
+        self.assertEqual(code, 0)
+        self.assertNotIn("::warning::", out)
+
+    def test_ids_without_an_android_one_warn_and_skip(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": IOS})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::warning::", out)
+        self.assertIn("no Android app", out)
+
+    def test_malformed_id_fails(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": "not-an-id"})
+        self.assertEqual(code, 1)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::error::", out)
+
+    def test_android_id_uploads_the_symbol_directory(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": f"{IOS}, {ANDROID}"})
+        self.assertEqual(code, 0)
+        self.assertEqual(
+            self.calls,
+            [["npx", "--yes", cs.FIREBASE_TOOLS, "crashlytics:symbols:upload",
+              f"--app={ANDROID}", str(self.symbols)]],
+        )
+        self.assertIn("Uploaded", out)
+        self.assertNotIn("::error::", out)
+
+    def test_firebase_tools_is_pinned_exactly(self) -> None:
+        # This job holds the upload keystore and the Play service account;
+        # floating third-party code has no place in it.
+        self.assertRegex(cs.FIREBASE_TOOLS, r"^firebase-tools@\d+\.\d+\.\d+$")
+
+    def test_a_missing_npx_is_a_named_error_not_a_traceback(self) -> None:
+        out = io.StringIO()
+        with redirect_stdout(out):
+            rc = cs._default_run(["gowalk-cicd-no-such-binary-xyz"])
+        self.assertNotEqual(rc, 0)
+        self.assertIn("::error::", out.getvalue())
+
+    def test_a_failed_upload_fails_the_step(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": ANDROID}, rc=2)
+        self.assertEqual(code, 1)
+        self.assertIn("::error::", out)
+        # The operator is told how to recover from the retained artifact.
+        self.assertIn("android-symbols", out)
+        self.assertIn(f"--app={ANDROID}", out)
+
+    def test_missing_symbols_fail_before_any_upload(self) -> None:
+        empty = self.root / "empty"
+        empty.mkdir()
+        code, out = self.run_main({"FIREBASE_APP_ID": ANDROID}, symbols_dir=empty)
+        self.assertEqual(code, 1)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::error::", out)
+        code, out = self.run_main({"FIREBASE_APP_ID": ANDROID}, symbols_dir=self.root / "nope")
+        self.assertEqual(code, 1)
+        self.assertEqual(self.calls, [])
+
+
+ACTION_YML = Path(__file__).resolve().parent.parent / "action.yml"
+
+
+def step(name: str) -> str:
+    text = ACTION_YML.read_text()
+    pattern = rf"    - name: {re.escape(name)}\n(?P<body>.*?)(?=\n    - name:|\Z)"
+    match = re.search(pattern, text, re.DOTALL)
+    if match is None:
+        raise AssertionError(f"missing action step: {name}")
+    return match.group("body")
+
+
+class CrashlyticsWiringTest(unittest.TestCase):
+    def test_the_action_takes_the_app_id_as_an_input(self) -> None:
+        # An input, not `vars.FIREBASE_APP_ID` read inside the action: the
+        # workflow passes the repository variable, and an unavailable context
+        # in a composite action would invalidate every consumer's workflow.
+        text = ACTION_YML.read_text()
+        self.assertRegex(text, r"(?m)^  firebase-app-id:\n(?:    .*\n)*?    default: \"\"$")
+        self.assertNotIn("vars.", text)
+
+    def test_flutter_apps_upload_after_retaining_and_before_the_gradle_path(self) -> None:
+        upload = step("Upload Dart symbols to Crashlytics")
+        self.assertIn("project_kind == 'flutter'", upload)
+        self.assertIn("FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}", upload)
+        self.assertIn("DART_SYMBOLS_DIR: ${{ steps.flutter_build.outputs.symbols_path }}", upload)
+        self.assertIn("scripts/crashlytics_symbols.py", upload)
+        text = ACTION_YML.read_text()
+        self.assertLess(text.index("- name: Retain Dart symbol files"),
+                        text.index("- name: Upload Dart symbols to Crashlytics"))
+        self.assertLess(text.index("- name: Upload Dart symbols to Crashlytics"),
+                        text.index("# --- Native Gradle"))
+
+    def test_the_upload_runs_even_when_unset_so_it_can_warn(self) -> None:
+        upload = step("Upload Dart symbols to Crashlytics")
+        self.assertNotIn("firebase-app-id != ''", upload)
+
+    def test_the_script_ships_with_the_action(self) -> None:
+        self.assertTrue((ACTION_YML.parent / "scripts" / "crashlytics_symbols.py").is_file())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.47
+1.0.48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.47",
+  "version": "1.0.48",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -129,6 +129,10 @@ jobs:
           # is locked in review. Default-branch deploys retain metadata automation.
           manage-app-store-version: >-
             ${{ github.ref_name == github.event.repository.default_branch && 'true' || 'false' }}
+          # Repository variable FIREBASE_APP_ID: the app's Firebase App ID(s),
+          # comma-separated when it ships both platforms. With an iOS id the
+          # action uploads the archive's dSYMs to Crashlytics before TestFlight.
+          firebase-app-id: ${{ vars.FIREBASE_APP_ID }}
       # `flutter symbolize` with app.ios-arm64.symbols is the only way to read a
       # stack trace from the build that just went to TestFlight (App Store
       # Connect receives native dSYMs only), and this runner holds the only
@@ -244,10 +248,11 @@ jobs:
         shell: bash
         run: |
           echo "Before:"; df -h / | tail -1
+          # NOT /usr/local/lib/node_modules: npm and npx live there, and the
+          # Android action's Crashlytics symbol upload shells out to npx.
           sudo rm -rf /usr/share/dotnet /usr/local/lib/android/sdk/ndk \
                       /opt/ghc /usr/local/.ghcup /usr/local/share/powershell \
-                      /usr/share/swift /usr/local/share/chromium \
-                      /usr/local/lib/node_modules 2>/dev/null || true
+                      /usr/share/swift /usr/local/share/chromium 2>/dev/null || true
           sudo docker image prune --all --force >/dev/null 2>&1 || true
           echo "After:";  df -h / | tail -1
       # The JDK used to be hardcoded here — 17 for Flutter, 21 for everything
@@ -367,6 +372,10 @@ jobs:
           # the day a new stable Flutter adds a warning-level lint, even when
           # the app's own CI gate is green.
           run-tests: 'false'
+          # Same variable as the iOS job. With an Android id the action uploads
+          # the Dart symbol files to Crashlytics before the bundle goes to Play;
+          # unset, it warns when the app depends on firebase_crashlytics.
+          firebase-app-id: ${{ vars.FIREBASE_APP_ID }}
       - name: Retain signed Android App Bundle
         if: ${{ steps.mode.outputs.mode == 'local' }}
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5