gowalk-cicd 1.0.47 → 1.0.49

package/action/scripts/test_crashlytics_dsyms.py

@@ -0,0 +1,214 @@
+#!/usr/bin/env python3
+"""Crashlytics dSYM upload: gating, tool discovery and failure semantics.
+
+The upload itself cannot run here (it needs the FirebaseCrashlytics pod and
+the network), so the command is captured through the injectable runner. The
+wiring into action.yml is pinned at the bottom.
+"""
+
+from __future__ import annotations
+
+import io
+import re
+import sys
+import tempfile
+import unittest
+from contextlib import redirect_stdout
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import crashlytics_dsyms as cd  # noqa: E402
+
+ANDROID = "1:123456789012:android:0123456789abcdef"
+IOS = "1:123456789012:ios:fedcba9876543210"
+
+
+class ParseAppIdsTest(unittest.TestCase):
+    def test_parse_and_select(self) -> None:
+        self.assertEqual(cd.parse_app_ids(f"{ANDROID}, {IOS}"), [("android", ANDROID), ("ios", IOS)])
+        self.assertEqual(cd.select_app_id(f"{ANDROID}\n{IOS}", "ios"), IOS)
+        self.assertIsNone(cd.select_app_id(ANDROID, "ios"))
+        self.assertEqual(cd.parse_app_ids(""), [])
+
+    def test_garbage_is_an_error(self) -> None:
+        with self.assertRaises(cd.AppIdError):
+            cd.parse_app_ids("1:123:tvos:abc")
+
+
+class FindUploadSymbolsTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self.tmp.name)
+        self.ios = self.root / "ios"
+        self.ios.mkdir()
+        self.home = self.root / "home"
+        self.home.mkdir()
+
+    def tearDown(self) -> None:
+        self.tmp.cleanup()
+
+    def touch(self, path: Path) -> Path:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text("#!/bin/sh\n")
+        return path
+
+    def test_cocoapods_location_wins(self) -> None:
+        tool = self.touch(self.ios / "Pods" / "FirebaseCrashlytics" / "upload-symbols")
+        self.assertEqual(cd.find_upload_symbols(self.ios, self.home), tool)
+
+    def test_a_crashlytics_tool_anywhere_under_the_root_is_found(self) -> None:
+        tool = self.touch(self.ios / "Vendor" / "Crashlytics" / "upload-symbols")
+        self.assertEqual(cd.find_upload_symbols(self.ios, self.home), tool)
+
+    def test_an_unrelated_upload_symbols_is_ignored(self) -> None:
+        self.touch(self.ios / "Pods" / "Sentry" / "upload-symbols")
+        self.assertIsNone(cd.find_upload_symbols(self.ios, self.home))
+
+    def test_swiftpm_checkout_is_found(self) -> None:
+        tool = self.touch(
+            self.home / "Library" / "Developer" / "Xcode" / "DerivedData" / "Runner-abc"
+            / "SourcePackages" / "checkouts" / "firebase-ios-sdk" / "Crashlytics" / "upload-symbols"
+        )
+        self.assertEqual(cd.find_upload_symbols(self.ios, self.home), tool)
+
+    def test_missing_root_is_not_an_exception(self) -> None:
+        self.assertIsNone(cd.find_upload_symbols(self.root / "nope", self.home))
+
+    def test_pruned_trees_are_never_searched(self) -> None:
+        # A project at the repo root makes the search root the whole checkout.
+        for tree in (".git", "build", ".dart_tool", "node_modules"):
+            self.touch(self.ios / tree / "FirebaseCrashlytics" / "upload-symbols")
+        self.assertIsNone(cd.find_upload_symbols(self.ios, self.home))
+
+
+class MainTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self.tmp.name)
+        self.ios = self.root / "ios"
+        self.tool = self.ios / "Pods" / "FirebaseCrashlytics" / "upload-symbols"
+        self.tool.parent.mkdir(parents=True)
+        self.tool.write_text("#!/bin/sh\n")
+        self.archive = self.root / "app.xcarchive"
+        self.dsyms = self.archive / "dSYMs"
+        for name in ("Runner.app.dSYM", "App.framework.dSYM", "Flutter.framework.dSYM"):
+            (self.dsyms / name / "Contents").mkdir(parents=True)
+        self.home = self.root / "home"
+        self.home.mkdir()
+        self.calls: list[list[str]] = []
+
+    def tearDown(self) -> None:
+        self.tmp.cleanup()
+
+    def run_main(self, env: dict[str, str], rc: int = 0, archive: Path | None = None,
+                 search_root: Path | None = None) -> tuple[int, str]:
+        def runner(cmd: list[str]) -> int:
+            self.calls.append(cmd)
+            return rc
+
+        out = io.StringIO()
+        with redirect_stdout(out):
+            code = cd.main(
+                ["--archive", str(archive or self.archive), "--search-root", str(search_root or self.ios)],
+                environ=env, run=runner, home=self.home,
+            )
+        return code, out.getvalue()
+
+    def test_unset_is_a_quiet_no_op(self) -> None:
+        code, out = self.run_main({})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [])
+        self.assertNotIn("::warning::", out)
+        self.assertNotIn("::error::", out)
+
+    def test_ids_without_an_ios_one_are_a_notice_not_a_failure(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": ANDROID})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::notice::", out)
+
+    def test_malformed_id_fails(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": "nope"})
+        self.assertEqual(code, 1)
+        self.assertIn("::error::", out)
+
+    def test_ios_id_uploads_the_whole_dsyms_directory(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": f"{ANDROID},{IOS}"})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [[str(self.tool), "-ai", IOS, "-p", "ios", "--", str(self.dsyms)]])
+        self.assertIn("App.framework.dSYM", out)
+        self.assertIn("Uploaded", out)
+
+    def test_missing_tool_warns_and_skips(self) -> None:
+        # No tool => the app does not link the Crashlytics SDK, so there is
+        # nothing to symbolicate; blocking the release would be pure harm.
+        self.tool.unlink()
+        code, out = self.run_main({"FIREBASE_APP_ID": IOS})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::warning::", out)
+        self.assertNotIn("::error::", out)
+        self.assertIn("upload-symbols", out)
+
+    def test_a_broken_tool_is_a_named_error_not_a_traceback(self) -> None:
+        out = io.StringIO()
+        with redirect_stdout(out):
+            rc = cd._default_run([str(self.root / "gowalk-cicd-no-such-binary")])
+        self.assertNotEqual(rc, 0)
+        self.assertIn("::error::", out.getvalue())
+
+    def test_missing_dsyms_fail_before_any_upload(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": IOS}, archive=self.root / "missing.xcarchive")
+        self.assertEqual(code, 1)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::error::", out)
+
+    def test_a_failed_upload_fails_the_step(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": IOS}, rc=3)
+        self.assertEqual(code, 1)
+        self.assertIn("::error::", out)
+        self.assertIn(f"-ai {IOS}", out)
+
+
+ACTION_YML = Path(__file__).resolve().parents[1] / "action.yml"
+
+
+def step(name: str) -> str:
+    text = ACTION_YML.read_text()
+    pattern = rf"    - name: {re.escape(name)}\n(?P<body>.*?)(?=\n    - name:|\Z)"
+    match = re.search(pattern, text, re.DOTALL)
+    if match is None:
+        raise AssertionError(f"missing action step: {name}")
+    return match.group("body")
+
+
+class CrashlyticsWiringTest(unittest.TestCase):
+    def test_the_action_takes_the_app_id_as_an_input(self) -> None:
+        # An input, not `vars.FIREBASE_APP_ID` read inside the action: the
+        # workflow passes the repository variable, and an unavailable context
+        # in a composite action would invalidate every consumer's workflow.
+        text = ACTION_YML.read_text()
+        self.assertRegex(text, r"(?m)^  firebase-app-id:\n(?:    .*\n)*?    default: \"\"$")
+        self.assertNotIn("vars.", text)
+
+    def test_dsyms_go_up_after_export_and_before_testflight(self) -> None:
+        upload = step("Upload dSYMs to Crashlytics")
+        self.assertIn("inputs.archive == 'true'", upload)
+        # Only builds that actually ship: an archive-only run (upload=false)
+        # must not be failed over a symbols upload.
+        self.assertIn("inputs.upload == 'true'", upload)
+        self.assertIn("inputs.firebase-app-id != ''", upload)
+        self.assertIn("FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}", upload)
+        self.assertIn("scripts/crashlytics_dsyms.py", upload)
+        self.assertIn('--archive "$RUNNER_TEMP/app.xcarchive"', upload)
+        text = ACTION_YML.read_text()
+        self.assertLess(text.index("- name: Export IPA"), text.index("- name: Upload dSYMs to Crashlytics"))
+        self.assertLess(text.index("- name: Upload dSYMs to Crashlytics"), text.index("- name: Upload to TestFlight"))
+
+    def test_the_script_ships_with_the_action(self) -> None:
+        self.assertTrue((ACTION_YML.parent / "scripts" / "crashlytics_dsyms.py").is_file())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.47
+1.0.49

package/android-action/action.yml

@@ -30,6 +30,16 @@ inputs:
       (flutter analyze + flutter test, or the Gradle module's unit tests)
     required: false
     default: "true"
+  firebase-app-id:
+    description: >-
+      Firebase App ID(s) for the Crashlytics symbol upload — the
+      `1:<project number>:android:<hash>` value (mobilesdk_app_id in
+      google-services.json, or Project settings → Your apps in the Firebase
+      console). Several ids may be listed, separated by commas or whitespace;
+      the Android one is used. Empty disables the upload. The package workflow
+      passes the FIREBASE_APP_ID repository variable.
+    required: false
+    default: ""
 
 outputs:
   package-name:
@@ -149,6 +159,26 @@ runs:
         path: ${{ steps.flutter_build.outputs.symbols_path }}
         if-no-files-found: error
 
+    # Crashlytics shows *** for every Dart frame of an obfuscated build until
+    # it has the symbol files, and on Android nothing uploads them by itself
+    # (the Crashlytics Gradle plugin handles native NDK symbols only). With
+    # firebase-app-id set — deploy.yml passes the FIREBASE_APP_ID repository
+    # variable — they go up here, before the workflow ships the bundle to
+    # Play, so a failed upload fails the deploy instead of shipping crashes
+    # nobody can read. Unset, the step only warns when the app depends on
+    # firebase_crashlytics. The Firebase CLI needs Node and Java, both already
+    # on this job, and no credentials. Logic and its tests live in
+    # scripts/crashlytics_symbols.py.
+    - name: Upload Dart symbols to Crashlytics
+      if: ${{ steps.config.outputs.project_kind == 'flutter' }}
+      shell: bash
+      env:
+        FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}
+        DART_SYMBOLS_DIR: ${{ steps.flutter_build.outputs.symbols_path }}
+      run: |
+        python3 "${{ github.action_path }}/scripts/crashlytics_symbols.py" \
+          --symbols-dir "$DART_SYMBOLS_DIR"
+
     # --- Native Gradle --------------------------------------------------
     # resolve_android.py rewrites versionCode/versionName in the module build
     # file when it can find a literal to rewrite, and the build step below

package/android-action/scripts/crashlytics_symbols.py

@@ -0,0 +1,177 @@
+#!/usr/bin/env python3
+"""Upload a Flutter app's Dart symbol files to Firebase Crashlytics.
+
+Every Flutter release build is obfuscated (see action.yml), so Crashlytics
+shows `***` for every Dart frame until it has the symbol files that
+--split-debug-info wrote. On Android nothing uploads them automatically — the
+Crashlytics Gradle plugin only handles native NDK symbols — so this script
+does, with the command Firebase documents for Flutter:
+
+    firebase crashlytics:symbols:upload --app=<FIREBASE_APP_ID> <symbols dir>
+
+It needs no credentials: that Firebase CLI command has no login requirement
+and authenticates by app id alone. It does need Node (npx) and Java (the CLI
+drives the Crashlytics buildtools jar), both of which the Android job has.
+
+Gating: the FIREBASE_APP_ID environment variable holds the app's Firebase App
+ID(s), `1:<project number>:<platform>:<hash>`, comma- or whitespace-separated
+when an app ships both platforms; the Android one is used. Unset, nothing is
+uploaded and the script only warns when the app depends on
+firebase_crashlytics. Set, an upload failure is a failure: the action runs
+before the workflow ships the bundle to Play, so a deploy never goes out with
+crashes nobody can read.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+# Exact pin, not a range: this job holds the upload keystore and the Play
+# service account, so no floating third-party code runs in it. Bump on purpose.
+FIREBASE_TOOLS = "firebase-tools@15.28.2"
+
+APP_ID_RE = re.compile(r"^(\d+):(\d+):(android|ios|web):([0-9A-Fa-f]+)$")
+
+
+class AppIdError(ValueError):
+    """FIREBASE_APP_ID contains something that is not a Firebase App ID."""
+
+
+def parse_app_ids(raw: str) -> list[tuple[str, str]]:
+    """Split FIREBASE_APP_ID into (platform, app id) pairs.
+
+    Accepts one id or several separated by commas and/or whitespace. Anything
+    that does not look like `1:<project number>:<android|ios|web>:<hash>` is
+    an error rather than a silent skip — a typo must not turn into a fleet
+    that quietly stops uploading symbols.
+    """
+    ids: list[tuple[str, str]] = []
+    for token in re.split(r"[,\s]+", raw.strip()):
+        if not token:
+            continue
+        match = APP_ID_RE.match(token)
+        if match is None:
+            raise AppIdError(
+                f"{token!r} is not a Firebase App ID "
+                "(expected 1:<project number>:<android|ios|web>:<hash>)"
+            )
+        ids.append((match.group(3), token))
+    return ids
+
+
+def _pick(ids: list[tuple[str, str]], platform: str) -> str | None:
+    return next((app_id for found_platform, app_id in ids if found_platform == platform), None)
+
+
+def select_app_id(raw: str, platform: str) -> str | None:
+    """The app id for *platform* out of FIREBASE_APP_ID, or None."""
+    return _pick(parse_app_ids(raw), platform)
+
+
+def uses_crashlytics(pubspec: Path) -> bool:
+    try:
+        text = pubspec.read_text(encoding="utf-8")
+    except OSError:
+        return False
+    return re.search(r"^\s*firebase_crashlytics\s*:", text, re.MULTILINE) is not None
+
+
+def upload_command(app_id: str, symbols_dir: Path, firebase_tools: str = FIREBASE_TOOLS) -> list[str]:
+    return [
+        "npx",
+        "--yes",
+        firebase_tools,
+        "crashlytics:symbols:upload",
+        f"--app={app_id}",
+        str(symbols_dir),
+    ]
+
+
+def _default_run(cmd: list[str]) -> int:
+    # A scratch cwd: the Crashlytics buildtools drop a .crashlytics/ directory
+    # (dump_syms.bin, ~4 MB) into the working directory, which must not be the
+    # consumer's checkout.
+    workdir = tempfile.mkdtemp(prefix="crashlytics-upload-")
+    try:
+        return subprocess.run(cmd, check=False, cwd=workdir).returncode
+    except FileNotFoundError:
+        print(
+            "::error::npx is not on PATH, so the Firebase CLI cannot run. "
+            "If a disk-cleanup step removes /usr/local/lib/node_modules, npm "
+            "and npx go with it — deploy.yml deliberately leaves that path alone."
+        )
+        return 127
+
+
+def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, run=None) -> int:
+    environ = os.environ if environ is None else environ
+    run = _default_run if run is None else run
+
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--symbols-dir", required=True, type=Path,
+                        help="the directory passed to flutter build --split-debug-info")
+    parser.add_argument("--pubspec", type=Path, default=Path("pubspec.yaml"),
+                        help="pubspec.yaml, used only to decide whether to warn when unset")
+    parser.add_argument("--firebase-tools", default=FIREBASE_TOOLS,
+                        help="npm spec of the Firebase CLI to run through npx")
+    args = parser.parse_args(argv)
+
+    raw = environ.get("FIREBASE_APP_ID", "")
+    try:
+        ids = parse_app_ids(raw)
+    except AppIdError as exc:
+        print(f"::error::FIREBASE_APP_ID: {exc}")
+        return 1
+
+    app_id = _pick(ids, "android")
+    if app_id is None:
+        if ids:
+            print(
+                "::warning::FIREBASE_APP_ID names no Android app "
+                "(1:<project number>:android:<hash>); the Dart symbols were not "
+                "uploaded to Crashlytics."
+            )
+        elif uses_crashlytics(args.pubspec):
+            # Two causes look identical from here: the variable is unset, or a
+            # deploy.yml that predates the firebase-app-id input never passed
+            # it. Name both — the action can only ever see the input.
+            print(
+                "::warning::This app depends on firebase_crashlytics but no "
+                "Firebase App ID reached this build, so every Dart frame in "
+                "Crashlytics will read as ***. Either the FIREBASE_APP_ID "
+                "repository variable is unset, or this repo's deploy.yml predates "
+                "the firebase-app-id input — a one-off `npx --yes gowalk-cicd` "
+                "refreshes it."
+            )
+        else:
+            print("FIREBASE_APP_ID unset; not uploading Dart symbols to Crashlytics.")
+        return 0
+
+    symbols = sorted(args.symbols_dir.glob("*.symbols")) if args.symbols_dir.is_dir() else []
+    if not symbols:
+        print(f"::error::no Dart symbol files in {args.symbols_dir}; nothing to upload to Crashlytics")
+        return 1
+
+    cmd = upload_command(app_id, args.symbols_dir, args.firebase_tools)
+    print(f"Uploading {len(symbols)} Dart symbol file(s) to Crashlytics app {app_id}:")
+    print("  " + " ".join(cmd))
+    rc = run(cmd)
+    if rc != 0:
+        print(
+            f"::error::Crashlytics symbol upload failed (exit {rc}). The symbols are "
+            "retained as the android-symbols artifact; after fixing the cause, upload "
+            f"them by hand with: firebase crashlytics:symbols:upload --app={app_id} <dir>"
+        )
+        return 1
+    print(f"Uploaded Dart symbols to Crashlytics app {app_id}.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/android-action/scripts/test_crashlytics_symbols.py

@@ -0,0 +1,210 @@
+#!/usr/bin/env python3
+"""Crashlytics symbol upload: gating, id selection and failure semantics.
+
+The upload itself cannot run here (it needs the Firebase CLI, Java and the
+network), so the command is captured through the injectable runner and the
+decision logic is exercised directly. The wiring into action.yml is pinned at
+the bottom, next to the other Flutter obfuscation wiring tests.
+"""
+
+from __future__ import annotations
+
+import io
+import re
+import sys
+import tempfile
+import unittest
+from contextlib import redirect_stdout
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import crashlytics_symbols as cs  # noqa: E402
+
+ANDROID = "1:123456789012:android:0123456789abcdef"
+IOS = "1:123456789012:ios:fedcba9876543210"
+
+
+class ParseAppIdsTest(unittest.TestCase):
+    def test_single_id(self) -> None:
+        self.assertEqual(cs.parse_app_ids(ANDROID), [("android", ANDROID)])
+
+    def test_several_ids_separated_by_commas_or_whitespace(self) -> None:
+        for raw in (f"{ANDROID},{IOS}", f"{ANDROID}, {IOS}", f"{ANDROID}\n{IOS}", f" {ANDROID}  {IOS} "):
+            with self.subTest(raw=raw):
+                self.assertEqual(cs.parse_app_ids(raw), [("android", ANDROID), ("ios", IOS)])
+
+    def test_empty_is_no_ids(self) -> None:
+        self.assertEqual(cs.parse_app_ids(""), [])
+        self.assertEqual(cs.parse_app_ids("  \n "), [])
+
+    def test_web_ids_parse_but_are_never_selected_here(self) -> None:
+        web = "1:123456789012:web:abcdef0123456789"
+        self.assertEqual(cs.parse_app_ids(web), [("web", web)])
+        self.assertIsNone(cs.select_app_id(web, "android"))
+
+    def test_garbage_is_an_error_not_a_skip(self) -> None:
+        for raw in ("my-app", "1:123:android", "1:123:desktop:abc", f"{ANDROID},oops"):
+            with self.subTest(raw=raw):
+                with self.assertRaises(cs.AppIdError):
+                    cs.parse_app_ids(raw)
+
+    def test_select_picks_the_platform(self) -> None:
+        self.assertEqual(cs.select_app_id(f"{IOS},{ANDROID}", "android"), ANDROID)
+        self.assertEqual(cs.select_app_id(f"{IOS},{ANDROID}", "ios"), IOS)
+        self.assertIsNone(cs.select_app_id(IOS, "android"))
+
+
+class MainTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = tempfile.TemporaryDirectory()
+        self.root = Path(self.tmp.name)
+        self.symbols = self.root / "symbols"
+        self.symbols.mkdir()
+        for arch in ("arm", "arm64", "x64"):
+            (self.symbols / f"app.android-{arch}.symbols").write_bytes(b"\x7fELF")
+        self.pubspec = self.root / "pubspec.yaml"
+        self.pubspec.write_text("name: app\ndependencies:\n  flutter:\n    sdk: flutter\n")
+        self.calls: list[list[str]] = []
+
+    def tearDown(self) -> None:
+        self.tmp.cleanup()
+
+    def run_main(self, env: dict[str, str], rc: int = 0, symbols_dir: Path | None = None) -> tuple[int, str]:
+        def runner(cmd: list[str]) -> int:
+            self.calls.append(cmd)
+            return rc
+
+        out = io.StringIO()
+        with redirect_stdout(out):
+            code = cs.main(
+                ["--symbols-dir", str(symbols_dir or self.symbols), "--pubspec", str(self.pubspec)],
+                environ=env,
+                run=runner,
+            )
+        return code, out.getvalue()
+
+    def test_unset_without_crashlytics_is_a_quiet_no_op(self) -> None:
+        code, out = self.run_main({})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [])
+        self.assertNotIn("::warning::", out)
+        self.assertNotIn("::error::", out)
+
+    def test_unset_with_crashlytics_warns_but_does_not_fail(self) -> None:
+        self.pubspec.write_text("dependencies:\n  firebase_crashlytics: ^5.0.0\n")
+        code, out = self.run_main({"FIREBASE_APP_ID": ""})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::warning::", out)
+        self.assertIn("FIREBASE_APP_ID", out)
+        self.assertIn("***", out)
+        # The action cannot tell an unset variable from a deploy.yml that never
+        # passes the input; the message must name both causes.
+        self.assertIn("gowalk-cicd", out)
+
+    def test_a_commented_out_dependency_does_not_count(self) -> None:
+        self.pubspec.write_text("dependencies:\n  # firebase_crashlytics: ^5.0.0\n")
+        code, out = self.run_main({})
+        self.assertEqual(code, 0)
+        self.assertNotIn("::warning::", out)
+
+    def test_ids_without_an_android_one_warn_and_skip(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": IOS})
+        self.assertEqual(code, 0)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::warning::", out)
+        self.assertIn("no Android app", out)
+
+    def test_malformed_id_fails(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": "not-an-id"})
+        self.assertEqual(code, 1)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::error::", out)
+
+    def test_android_id_uploads_the_symbol_directory(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": f"{IOS}, {ANDROID}"})
+        self.assertEqual(code, 0)
+        self.assertEqual(
+            self.calls,
+            [["npx", "--yes", cs.FIREBASE_TOOLS, "crashlytics:symbols:upload",
+              f"--app={ANDROID}", str(self.symbols)]],
+        )
+        self.assertIn("Uploaded", out)
+        self.assertNotIn("::error::", out)
+
+    def test_firebase_tools_is_pinned_exactly(self) -> None:
+        # This job holds the upload keystore and the Play service account;
+        # floating third-party code has no place in it.
+        self.assertRegex(cs.FIREBASE_TOOLS, r"^firebase-tools@\d+\.\d+\.\d+$")
+
+    def test_a_missing_npx_is_a_named_error_not_a_traceback(self) -> None:
+        out = io.StringIO()
+        with redirect_stdout(out):
+            rc = cs._default_run(["gowalk-cicd-no-such-binary-xyz"])
+        self.assertNotEqual(rc, 0)
+        self.assertIn("::error::", out.getvalue())
+
+    def test_a_failed_upload_fails_the_step(self) -> None:
+        code, out = self.run_main({"FIREBASE_APP_ID": ANDROID}, rc=2)
+        self.assertEqual(code, 1)
+        self.assertIn("::error::", out)
+        # The operator is told how to recover from the retained artifact.
+        self.assertIn("android-symbols", out)
+        self.assertIn(f"--app={ANDROID}", out)
+
+    def test_missing_symbols_fail_before_any_upload(self) -> None:
+        empty = self.root / "empty"
+        empty.mkdir()
+        code, out = self.run_main({"FIREBASE_APP_ID": ANDROID}, symbols_dir=empty)
+        self.assertEqual(code, 1)
+        self.assertEqual(self.calls, [])
+        self.assertIn("::error::", out)
+        code, out = self.run_main({"FIREBASE_APP_ID": ANDROID}, symbols_dir=self.root / "nope")
+        self.assertEqual(code, 1)
+        self.assertEqual(self.calls, [])
+
+
+ACTION_YML = Path(__file__).resolve().parent.parent / "action.yml"
+
+
+def step(name: str) -> str:
+    text = ACTION_YML.read_text()
+    pattern = rf"    - name: {re.escape(name)}\n(?P<body>.*?)(?=\n    - name:|\Z)"
+    match = re.search(pattern, text, re.DOTALL)
+    if match is None:
+        raise AssertionError(f"missing action step: {name}")
+    return match.group("body")
+
+
+class CrashlyticsWiringTest(unittest.TestCase):
+    def test_the_action_takes_the_app_id_as_an_input(self) -> None:
+        # An input, not `vars.FIREBASE_APP_ID` read inside the action: the
+        # workflow passes the repository variable, and an unavailable context
+        # in a composite action would invalidate every consumer's workflow.
+        text = ACTION_YML.read_text()
+        self.assertRegex(text, r"(?m)^  firebase-app-id:\n(?:    .*\n)*?    default: \"\"$")
+        self.assertNotIn("vars.", text)
+
+    def test_flutter_apps_upload_after_retaining_and_before_the_gradle_path(self) -> None:
+        upload = step("Upload Dart symbols to Crashlytics")
+        self.assertIn("project_kind == 'flutter'", upload)
+        self.assertIn("FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}", upload)
+        self.assertIn("DART_SYMBOLS_DIR: ${{ steps.flutter_build.outputs.symbols_path }}", upload)
+        self.assertIn("scripts/crashlytics_symbols.py", upload)
+        text = ACTION_YML.read_text()
+        self.assertLess(text.index("- name: Retain Dart symbol files"),
+                        text.index("- name: Upload Dart symbols to Crashlytics"))
+        self.assertLess(text.index("- name: Upload Dart symbols to Crashlytics"),
+                        text.index("# --- Native Gradle"))
+
+    def test_the_upload_runs_even_when_unset_so_it_can_warn(self) -> None:
+        upload = step("Upload Dart symbols to Crashlytics")
+        self.assertNotIn("firebase-app-id != ''", upload)
+
+    def test_the_script_ships_with_the_action(self) -> None:
+        self.assertTrue((ACTION_YML.parent / "scripts" / "crashlytics_symbols.py").is_file())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.47
+1.0.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.47",
+  "version": "1.0.49",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {