gowalk-cicd 1.0.48 → 1.0.50

package/CLAUDE.md

@@ -108,6 +108,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - The mobile workflow's feature-branch-only `backend-preview` job bootstraps a
   new app before GitHub registers `deploy-backend.yml` on the default branch.
   Default-branch deploys continue through the separate backend workflow.
+- Domain-backed backend deploys fail closed on certificate issuance and the
+  public HTTPS health probe. `select_certbot_account.sh` chooses one existing
+  ACME account deterministically so multi-account hosts stay non-interactive.
 - The Android action serves two build systems. `android_config.project_kind()`
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie

package/README.md

@@ -73,6 +73,8 @@ The backend workflow runs on a GitHub-hosted runner and, on a push touching
 it rsyncs the backend dir to `/opt/gowalk-backends/<app>/`, runs
 `docker compose up -d --build`, auto-detects the published `127.0.0.1:<port>`,
 wires an nginx vhost + Let's Encrypt cert for the API domain, and health-checks.
+Hosts with several existing Let's Encrypt accounts select one deterministically,
+and a domain deploy fails unless its public HTTPS certificate and health route validate.
 
 Requirements on the consumer repo:
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.48
+1.0.50

package/action/prompts/generate_descriptions.prompt.yml

@@ -12,8 +12,11 @@ messages:
       long description, generate ASO-optimized, guideline-compliant descriptions.
 
       STRICT RULES for description:
-      - description: 800-4000 chars. First 3 lines = hook + value prop (visible before Read More).
+      - description: 800-3800 chars. First 3 lines = hook + value prop (visible before Read More).
         Short paragraphs, line breaks, 3-5 bullet features, closing CTA.
+      - The delivery pipeline appends a two-line "Terms of Use: ... / Privacy Policy: ..."
+        footer after your text (that is why the ceiling is 3800, not 4000). Do NOT write
+        that footer, any legal link, or any URL yourself.
 
       CRITICAL:
       - You receive a JSON list of `locales_needing_description`. ONLY generate a

package/action/scripts/asc_metadata_applier.py

@@ -44,6 +44,15 @@ from metadata_constants import (
 APP_INFO_RESOURCE = "appInfoLocalizations"
 VERSION_RESOURCE = "appStoreVersionLocalizations"
 
+# Every App Store description ends with a functional Terms of Use link and the
+# app's own privacy-policy link (Apple's "no functional link to the Terms of
+# Use" metadata rejection). Terms is Apple's standard EULA; the privacy URL is
+# the locale's existing `privacyPolicyUrl`, which the panel sets and the
+# detector reads back into `state.localizations[locale].fields`.
+TERMS_URL = "https://www.apple.com/legal/internet-services/itunes/dev/stdeula/"
+DESCRIPTION_LIMIT = CHAR_LIMITS["description"]
+_FOOTER_SEPARATOR = "\n\n"
+
 # Collapses any run of ASCII whitespace (including the raw control chars AI
 # sometimes emits inside string literals: \n, \r, \t, and interior spaces)
 # into a single space. Applied after non-strict JSON load so field values
@@ -122,6 +131,60 @@ def _validate_field(field: str, value: Any) -> str | None:
     return trimmed
 
 
+def footer_for(privacy_url: str) -> str:
+    """The exact two-line footer appended to every generated description."""
+    return f"Terms of Use: {TERMS_URL}\nPrivacy Policy: {privacy_url}"
+
+
+def with_footer(body: str, privacy_url: str) -> str:
+    """Return ``body`` + one blank line + the footer, inside Apple's limit.
+
+    The body is shortened on a whitespace boundary when body + footer would
+    exceed the description limit; a hard cut happens only when the body has
+    no whitespace at or before the budget. The footer is never shortened.
+    """
+    footer = footer_for(privacy_url)
+    budget = DESCRIPTION_LIMIT - len(_FOOTER_SEPARATOR + footer)
+    text = body.rstrip()
+    if len(text) > budget:
+        cut = max(text.rfind(ch, 0, budget + 1) for ch in (" ", "\n", "\t"))
+        text = text[:cut] if cut > 0 else text[:budget]
+        text = text.rstrip()
+    return text + _FOOTER_SEPARATOR + footer
+
+
+def _describe_with_footer(
+    locale: str, loc_state: dict[str, Any], ver_writes: dict[str, str]
+) -> None:
+    """Attach the footer to a surviving generated description, in place.
+
+    Reads the locale's existing ``privacyPolicyUrl`` from the detector state.
+    An empty URL drops the description entirely (with a warning): a footer
+    with an empty privacy link would ship the exact defect this guards
+    against.
+    """
+    if "description" not in ver_writes:
+        return
+    privacy = ((loc_state.get("fields") or {}).get("privacyPolicyUrl") or "").strip()
+    if not privacy:
+        warn(
+            f"{locale}: privacyPolicyUrl is empty; skipping generated description "
+            "(footer requires it)"
+        )
+        del ver_writes["description"]
+        return
+    complete = with_footer(ver_writes["description"], privacy)
+    footer = footer_for(privacy)
+    if len(complete) > DESCRIPTION_LIMIT or not complete.endswith(footer):
+        warn(
+            f"{locale}: description with footer is invalid "
+            f"(length {len(complete)}); dropping"
+        )
+        del ver_writes["description"]
+        return
+    ver_writes["description"] = complete
+
+
 def _build_writes(
     ai_locale: dict[str, Any],
     empty_list: list[str],
@@ -248,6 +311,7 @@ def _apply_locale(
     """PATCH the writes for one locale. Returns count of fields written."""
     app_writes = _build_writes(ai_locale, empty_list, APP_LEVEL_FIELDS)
     ver_writes = _build_writes(ai_locale, empty_list, VERSION_LEVEL_FIELDS)
+    _describe_with_footer(locale, loc_state, ver_writes)
     return (
         _patch_group(token, APP_INFO_RESOURCE, locale,
                      loc_state.get("app_info_localization_id"), app_writes)

package/action/scripts/test_asc_metadata_applier.py

@@ -22,6 +22,10 @@ import asc_metadata_applier as mod  # noqa: E402
 
 
 TOKEN = "TEST_TOKEN"
+# Every real listing the detector reads back carries the panel-set privacy
+# URL; the applier appends the Terms/Privacy footer to generated descriptions
+# from it, and SKIPS the description when it is empty.
+PRIVACY = "https://docs.google.com/document/d/e/abc/pub"
 
 
 def _state(empty_fields, localizations=None):
@@ -34,14 +38,18 @@ def _state(empty_fields, localizations=None):
     }
 
 
-def _loc(app_id="app-en", ver_id="ver-en"):
+def _loc(app_id="app-en", ver_id="ver-en", privacy=PRIVACY):
     return {
         "app_info_localization_id": app_id,
         "version_localization_id": ver_id,
-        "fields": {},
+        "fields": {"privacyPolicyUrl": privacy},
     }
 
 
+def _desc(body):
+    return mod.with_footer(body, PRIVACY)
+
+
 class ValidateFieldTests(unittest.TestCase):
     def test_returns_trimmed_value_under_limit(self):
         self.assertEqual(mod._validate_field("name", "  MyApp  "), "MyApp")
@@ -268,7 +276,7 @@ class ApplyTests(unittest.TestCase):
         self.assertEqual(total, 1)
         self.assertEqual(mock_req.call_count, 1)
         attrs = mock_req.call_args.kwargs["json_body"]["data"]["attributes"]
-        self.assertEqual(attrs, {"description": "Nice app."})
+        self.assertEqual(attrs, {"description": _desc("Nice app.")})
 
     @mock.patch.object(mod, "request")
     def test_double_gate_drops_field_not_in_empty_list(self, mock_req):
@@ -351,7 +359,7 @@ class MainTests(unittest.TestCase):
             mock_req.call_args.args[1], "/appStoreVersionLocalizations/ver-en"
         )
         attrs = mock_req.call_args.kwargs["json_body"]["data"]["attributes"]
-        self.assertEqual(attrs, {"description": "Hi"})
+        self.assertEqual(attrs, {"description": _desc("Hi")})
 
     @mock.patch.dict("os.environ", ENV_FAKE)
     @mock.patch.object(mod, "make_jwt", return_value=TOKEN)
@@ -675,7 +683,7 @@ class ApplyWithFieldsFilterTests(unittest.TestCase):
         self.assertEqual(locales, 1)
         self.assertEqual(mock_req.call_count, 1)
         attrs = mock_req.call_args.kwargs["json_body"]["data"]["attributes"]
-        self.assertEqual(attrs, {"description": "Desc"})
+        self.assertEqual(attrs, {"description": _desc("Desc")})
 
     @mock.patch.object(mod, "request")
     def test_filter_excludes_description(self, mock_req):
@@ -777,7 +785,7 @@ class MainFieldsFilterTests(unittest.TestCase):
         self.assertEqual(rc, 0)
         self.assertEqual(mock_req.call_count, 1)
         attrs = mock_req.call_args.kwargs["json_body"]["data"]["attributes"]
-        self.assertEqual(attrs, {"description": "Desc"})
+        self.assertEqual(attrs, {"description": _desc("Desc")})
 
     @mock.patch.dict("os.environ", ENV_FAKE)
     @mock.patch.object(mod, "make_jwt", return_value=TOKEN)
@@ -831,6 +839,138 @@ class MainFieldsFilterTests(unittest.TestCase):
         self.assertEqual(mock_req.call_count, 2)
 
 
+class DescriptionFooterTests(unittest.TestCase):
+    """Every generated description ends with the two-line Terms/Privacy footer
+    taken from the locale's existing privacyPolicyUrl; no URL, no description."""
+
+    def test_footer_text_is_exact(self):
+        self.assertEqual(
+            mod.footer_for("https://p.example/privacy"),
+            "Terms of Use: https://www.apple.com/legal/internet-services/itunes/dev/stdeula/"
+            "\nPrivacy Policy: https://p.example/privacy",
+        )
+
+    def test_footer_is_appended_verbatim_as_the_last_two_lines(self):
+        out = mod.with_footer("Great app.\n\n- fast\n- small", PRIVACY)
+        lines = out.split("\n")
+        self.assertEqual(lines[-3], "")  # one blank line separates body and footer
+        self.assertEqual(lines[-2], f"Terms of Use: {mod.TERMS_URL}")
+        self.assertEqual(lines[-1], f"Privacy Policy: {PRIVACY}")
+        self.assertTrue(out.startswith("Great app.\n\n- fast\n- small"))
+
+    def test_short_body_is_not_shortened(self):
+        self.assertEqual(mod.with_footer("Hello", PRIVACY),
+                         "Hello\n\n" + mod.footer_for(PRIVACY))
+
+    def test_long_body_is_shortened_on_a_whitespace_boundary(self):
+        body = " ".join(["word"] * 1200)  # 5999 chars, spaces every 5th char
+        out = mod.with_footer(body, PRIVACY)
+        footer = mod.footer_for(PRIVACY)
+        self.assertLessEqual(len(out), mod.DESCRIPTION_LIMIT)
+        self.assertTrue(out.endswith("\n\n" + footer))
+        kept = out[: -len("\n\n" + footer)]
+        self.assertTrue(kept.endswith("word"))       # cut between words, not inside
+        self.assertFalse(kept.endswith(" "))          # trailing whitespace stripped
+        # the budget is used, not wasted: at most one word's width short
+        self.assertGreater(len(out), mod.DESCRIPTION_LIMIT - 6)
+
+    def test_body_exactly_at_budget_keeps_every_character(self):
+        footer = mod.footer_for(PRIVACY)
+        budget = mod.DESCRIPTION_LIMIT - len("\n\n" + footer)
+        body = ("ab " * budget)[:budget].rstrip()
+        out = mod.with_footer(body, PRIVACY)
+        self.assertEqual(out, body + "\n\n" + footer)
+        self.assertLessEqual(len(out), mod.DESCRIPTION_LIMIT)
+
+    def test_body_without_whitespace_is_hard_cut(self):
+        out = mod.with_footer("x" * 5000, PRIVACY)
+        self.assertEqual(len(out), mod.DESCRIPTION_LIMIT)
+        self.assertTrue(out.endswith("\n\n" + mod.footer_for(PRIVACY)))
+
+    @mock.patch.object(mod, "request")
+    def test_locale_with_privacy_url_patches_description_with_footer(self, mock_req):
+        written = mod._apply_locale(
+            TOKEN, "en-US", _loc("app-en", "ver-en"),
+            {"description": "Hello"}, ["description"],
+        )
+        self.assertEqual(written, 1)
+        attrs = mock_req.call_args.kwargs["json_body"]["data"]["attributes"]
+        self.assertEqual(attrs, {"description": "Hello\n\n" + mod.footer_for(PRIVACY)})
+
+    @mock.patch.object(mod, "warn")
+    @mock.patch.object(mod, "request")
+    def test_empty_privacy_url_skips_description_but_not_other_fields(
+            self, mock_req, mock_warn):
+        written = mod._apply_locale(
+            TOKEN, "en-US", _loc("app-en", "ver-en", privacy=""),
+            {"name": "MyApp", "description": "Hello", "keywords": "k1,k2"},
+            ["name", "description", "keywords"],
+        )
+        self.assertEqual(written, 2)
+        patched = [next(iter(c.kwargs["json_body"]["data"]["attributes"]))
+                   for c in mock_req.call_args_list]
+        self.assertEqual(sorted(patched), ["keywords", "name"])
+        self.assertTrue(any("privacyPolicyUrl is empty" in c.args[0]
+                            for c in mock_warn.call_args_list))
+        for call in mock_req.call_args_list:
+            self.assertNotIn("Terms of Use", json.dumps(call.kwargs["json_body"]))
+
+    @mock.patch.object(mod, "warn")
+    @mock.patch.object(mod, "request")
+    def test_missing_fields_block_skips_description(self, mock_req, mock_warn):
+        loc = {"app_info_localization_id": "app-en", "version_localization_id": "ver-en"}
+        written = mod._apply_locale(
+            TOKEN, "en-US", loc, {"description": "Hello"}, ["description"])
+        self.assertEqual(written, 0)
+        mock_req.assert_not_called()
+        self.assertEqual(mock_warn.call_count, 1)
+
+    @mock.patch.object(mod, "request")
+    def test_whitespace_only_privacy_url_counts_as_empty(self, mock_req):
+        written = mod._apply_locale(
+            TOKEN, "en-US", _loc("app-en", "ver-en", privacy="   "),
+            {"description": "Hello"}, ["description"])
+        self.assertEqual(written, 0)
+        mock_req.assert_not_called()
+
+    @mock.patch.object(mod, "request")
+    def test_run_without_description_is_unaffected(self, mock_req):
+        written = mod._apply_locale(
+            TOKEN, "en-US", _loc("app-en", "ver-en", privacy=""),
+            {"name": "MyApp", "keywords": "k1,k2"}, ["name", "keywords"])
+        self.assertEqual(written, 2)
+        self.assertEqual(mock_req.call_count, 2)
+
+    @mock.patch.object(mod, "request")
+    def test_generated_description_over_budget_ships_inside_the_limit(self, mock_req):
+        body = " ".join(["benefit"] * 480)  # under 4000 on its own, over with footer
+        self.assertLessEqual(len(body), mod.DESCRIPTION_LIMIT)
+        written = mod._apply_locale(
+            TOKEN, "en-US", _loc("app-en", "ver-en"),
+            {"description": body}, ["description"])
+        self.assertEqual(written, 1)
+        value = mock_req.call_args.kwargs["json_body"]["data"]["attributes"]["description"]
+        self.assertLessEqual(len(value), mod.DESCRIPTION_LIMIT)
+        self.assertTrue(value.endswith(mod.footer_for(PRIVACY)))
+
+    @mock.patch.object(mod, "request")
+    def test_apply_end_to_end_carries_the_footer_per_locale(self, mock_req):
+        state = _state(
+            empty_fields={"en-US": ["description"], "ja": ["description"]},
+            localizations={
+                "en-US": _loc("app-en", "ver-en", privacy="https://p.example/en"),
+                "ja": _loc("app-ja", "ver-ja", privacy=""),
+            },
+        )
+        ai = {"localizations": {"en-US": {"description": "Hi"},
+                                "ja": {"description": "こんにちは"}}}
+        total, locales = mod.apply(state, ai, TOKEN, fields_filter={"description"})
+        self.assertEqual((total, locales), (1, 1))
+        attrs = mock_req.call_args.kwargs["json_body"]["data"]["attributes"]
+        self.assertEqual(attrs["description"],
+                         "Hi\n\n" + mod.footer_for("https://p.example/en"))
+
+
 class NormalizeWhitespaceTests(unittest.TestCase):
     def test_collapses_embedded_newlines(self):
         self.assertEqual(mod._normalize_whitespace("a\nb"), "a b")

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.48
+1.0.50

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.48
+1.0.50

package/backend-action/action.yml

@@ -122,9 +122,12 @@ runs:
           rsync -az -e "$SSH" "$COMPOSE_FILE" \
             "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/docker-compose.yml"
         fi
-        # ship the remote deploy script (kept out of the app checkout)
-        rsync -az -e "$SSH" "${{ github.action_path }}/remote_deploy.sh" \
-          "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/.remote_deploy.sh"
+        # Ship remote helpers after the application mirror. Both are package
+        # owned and kept out of the consumer's source tree.
+        rsync -az -e "$SSH" \
+          "${{ github.action_path }}/remote_deploy.sh" \
+          "${{ github.action_path }}/select_certbot_account.sh" \
+          "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
 
     - name: Deploy on the host
       shell: bash
@@ -140,7 +143,7 @@ runs:
             "umask 077; cat > '$DEST/.runtime.env'"
         fi
         $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" \
-          "bash '$DEST/.remote_deploy.sh' \
+          "bash '$DEST/remote_deploy.sh' \
              '${{ inputs.app-name }}' '${{ inputs.api-domain }}' \
              '${{ inputs.health-path }}' '${{ inputs.cert-email }}'"
 

package/backend-action/remote_deploy.sh

@@ -10,6 +10,7 @@ HEALTH="${3:-/health}"
 CERT_EMAIL="${4:-admin@gowalk.com}"
 DIR="/opt/gowalk-backends/$APP"
 cd "$DIR"
+source "$DIR/select_certbot_account.sh"
 
 log() { echo "[deploy $APP] $*"; }
 
@@ -95,16 +96,34 @@ fi
 # ── Let's Encrypt cert (idempotent; certbot skips if current)
 if ! certbot certificates 2>/dev/null | grep -q "Domains: $DOMAIN\b"; then
   log "requesting LE cert for $DOMAIN"
-  certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
-    --email "$CERT_EMAIL" --redirect || log "warn: certbot failed (DNS not pointed yet?)"
+  CERTBOT_ACCOUNT="$(select_certbot_account)"
+  CERTBOT_ARGS=()
+  if [ -n "$CERTBOT_ACCOUNT" ]; then
+    log "using an existing Let's Encrypt account"
+    CERTBOT_ARGS+=(--account "$CERTBOT_ACCOUNT")
+  fi
+  if ! certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
+    --email "$CERT_EMAIL" --redirect "${CERTBOT_ARGS[@]}"; then
+    log "ERROR: certbot failed for $DOMAIN"
+    exit 1
+  fi
 else
   log "cert for $DOMAIN already present"
 fi
 
-# ── public health-check (best effort — cert/DNS may still be propagating)
-if curl -fsSk "https://$DOMAIN$HEALTH" >/dev/null 2>&1; then
-  log "public https://$DOMAIN$HEALTH healthy"
-else
-  log "warn: public URL not answering yet (DNS/cert propagation) — container is up on :$PORT"
+# ── public health-check. This validates DNS, the certificate, nginx routing,
+# and the application together; a green deploy must mean the public API works.
+PUBLIC_HEALTHY=""
+for i in $(seq 1 15); do
+  if curl -fsS "https://$DOMAIN$HEALTH" >/dev/null 2>&1; then
+    log "public https://$DOMAIN$HEALTH healthy (after ${i}x2s)"
+    PUBLIC_HEALTHY=1
+    break
+  fi
+  sleep 2
+done
+if [ -z "$PUBLIC_HEALTHY" ]; then
+  log "ERROR: public https://$DOMAIN$HEALTH failed TLS or health validation"
+  exit 1
 fi
 log "done"

package/backend-action/select_certbot_account.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+# Print the stable id of one existing Certbot account. Hosts may contain more
+# than one registered account; non-interactive Certbot otherwise stops to ask
+# which account should authorize a new certificate.
+select_certbot_account() {
+  local accounts_dir="${1:-/etc/letsencrypt/accounts}"
+  local registration
+
+  registration="$(
+    find "$accounts_dir" -type f -name regr.json -print 2>/dev/null \
+      | LC_ALL=C sort \
+      | head -1
+  )"
+  [ -n "$registration" ] || return 0
+  basename "$(dirname "$registration")"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.48",
+  "version": "1.0.50",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {