gowalk-cicd 1.0.50 → 1.0.52

package/CLAUDE.md

@@ -110,7 +110,8 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Default-branch deploys continue through the separate backend workflow.
 - Domain-backed backend deploys fail closed on certificate issuance and the
   public HTTPS health probe. `select_certbot_account.sh` chooses one existing
-  ACME account deterministically so multi-account hosts stay non-interactive.
+  Let's Encrypt ACME v2 account deterministically so multi-account hosts stay
+  non-interactive; legacy v1 account directories are not valid candidates.
 - The Android action serves two build systems. `android_config.project_kind()`
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie

package/action/.daemux-version

@@ -1 +1 @@
-1.0.50
+1.0.52

package/action/scripts/keychain.py

@@ -8,6 +8,16 @@ into it, and prepends it to the user's keychain search list so
 keychain is purposely short-lived (default 6h auto-lock) and disposable
 — each CI run re-creates it from scratch.
 
+The user's *default* keychain is deliberately never pointed at the
+throwaway keychain: the search list (plus the partition list set at
+import) is what identity resolution actually uses. On a persistent
+runner (a self-hosted Mac), claiming the default meant every credential
+consumer on the host wrote into the throwaway keychain, and once its
+temp dir was reclaimed the dangling default made macOS pop a
+"Keychain ... cannot be found to store" dialog at every credential
+write. Setup instead prunes search-list entries whose backing file is
+gone and repoints a dangling default back at the login keychain.
+
 The keychain password (``"ci"``) is intentionally hardcoded: the
 keychain never leaves the runner (it lives in ``$RUNNER_TEMP`` which
 GitHub deletes when the job ends), so encrypting it with a sourced
@@ -77,15 +87,35 @@ def _prepend_to_user_search_list(keychain_path: str) -> None:
         for line in existing.splitlines()
         if line.strip()
     ]
+    # Prune entries whose file is gone: dangling throwaway keychains from
+    # earlier runs on a persistent Mac would otherwise accumulate forever.
     new_list = [keychain_path] + [
-        k for k in existing_list if k != keychain_path
+        k for k in existing_list
+        if k != keychain_path and os.path.exists(k)
     ]
     subprocess.check_call(
         ["security", "list-keychains", "-d", "user", "-s", *new_list]
     )
-    subprocess.check_call(
-        ["security", "default-keychain", "-s", keychain_path]
+    _repair_default_keychain()
+
+
+def _repair_default_keychain() -> None:
+    """Repoint an unset or dangling default keychain at the login keychain.
+
+    Heals hosts damaged by earlier releases (which made the throwaway CI
+    keychain the default) without ever claiming the default for this run.
+    A healthy default — whatever it points at — is left alone.
+    """
+    login = os.path.expanduser("~/Library/Keychains/login.keychain-db")
+    if not os.path.exists(login):
+        return
+    probe = subprocess.run(
+        ["security", "default-keychain"], capture_output=True, text=True
     )
+    current = probe.stdout.strip().strip('"') if probe.returncode == 0 else ""
+    if current and os.path.exists(current):
+        return
+    subprocess.check_call(["security", "default-keychain", "-s", login])
 
 
 def setup_keychain(p12_path: Path, p12_pass: str, runner_temp: str) -> str:

package/action/scripts/test_keychain.py

@@ -0,0 +1,145 @@
+"""Search-list and default-keychain behavior of the throwaway CI keychain.
+
+The regression these tests pin down: setup used to run
+``security default-keychain -s <ci keychain>``. On a persistent
+(self-hosted) Mac the throwaway keychain's temp dir is reclaimed after
+the run, the user default dangles, and macOS pops a
+"Keychain ... cannot be found to store" dialog at every credential
+write. Setup must never claim the default and must prune search-list
+entries whose file is gone.
+"""
+
+import unittest
+from unittest import mock
+
+import keychain
+
+
+class _SecurityHost:
+    """Record ``security`` invocations against a fake filesystem."""
+
+    def __init__(self, existing_files, search_list, default=""):
+        self.files = set(existing_files)
+        self.search_list = list(search_list)
+        self.default = default
+        self.calls = []
+
+    def exists(self, path):
+        return path in self.files
+
+    def check_output(self, cmd):
+        self.calls.append(cmd)
+        assert cmd == ["security", "list-keychains", "-d", "user"]
+        return "".join(f'    "{p}"\n' for p in self.search_list).encode()
+
+    def check_call(self, cmd):
+        self.calls.append(cmd)
+
+    def run(self, cmd, capture_output=False, text=False):
+        self.calls.append(cmd)
+        assert cmd == ["security", "default-keychain"]
+        if not self.default:
+            return mock.Mock(returncode=1, stdout="", stderr="no default set")
+        return mock.Mock(returncode=0, stdout=f'    "{self.default}"\n', stderr="")
+
+    def patches(self):
+        return (
+            mock.patch.object(keychain.subprocess, "check_output", self.check_output),
+            mock.patch.object(keychain.subprocess, "check_call", self.check_call),
+            mock.patch.object(keychain.subprocess, "run", self.run),
+            mock.patch.object(keychain.os.path, "exists", self.exists),
+            mock.patch.object(
+                keychain.os.path, "expanduser", lambda p: p.replace("~", "/Users/ci")
+            ),
+        )
+
+
+LOGIN = "/Users/ci/Library/Keychains/login.keychain-db"
+CI_KEYCHAIN = "/tmp/runner/ci.keychain-db"
+
+
+def _apply(host, fn, *args):
+    patches = host.patches()
+    for p in patches:
+        p.start()
+    try:
+        return fn(*args)
+    finally:
+        for p in patches:
+            p.stop()
+
+
+class PrependToUserSearchListTests(unittest.TestCase):
+    def test_never_claims_the_default_keychain(self):
+        host = _SecurityHost(
+            existing_files={LOGIN, CI_KEYCHAIN},
+            search_list=[LOGIN],
+            default=LOGIN,
+        )
+        _apply(host, keychain._prepend_to_user_search_list, CI_KEYCHAIN)
+        claimed = [c for c in host.calls if c[:2] == ["security", "default-keychain"] and "-s" in c]
+        self.assertEqual(claimed, [])
+        self.assertIn(
+            ["security", "list-keychains", "-d", "user", "-s", CI_KEYCHAIN, LOGIN],
+            host.calls,
+        )
+
+    def test_prunes_dangling_search_list_entries(self):
+        stale = "/private/var/tmp/app-robot-task-1/ci.keychain-db"
+        host = _SecurityHost(
+            existing_files={LOGIN, CI_KEYCHAIN},
+            search_list=[stale, LOGIN],
+            default=LOGIN,
+        )
+        _apply(host, keychain._prepend_to_user_search_list, CI_KEYCHAIN)
+        self.assertIn(
+            ["security", "list-keychains", "-d", "user", "-s", CI_KEYCHAIN, LOGIN],
+            host.calls,
+        )
+        for call in host.calls:
+            self.assertNotIn(stale, call)
+
+    def test_own_path_not_duplicated_when_already_listed(self):
+        host = _SecurityHost(
+            existing_files={LOGIN, CI_KEYCHAIN},
+            search_list=[CI_KEYCHAIN, LOGIN],
+            default=LOGIN,
+        )
+        _apply(host, keychain._prepend_to_user_search_list, CI_KEYCHAIN)
+        self.assertIn(
+            ["security", "list-keychains", "-d", "user", "-s", CI_KEYCHAIN, LOGIN],
+            host.calls,
+        )
+
+
+class RepairDefaultKeychainTests(unittest.TestCase):
+    def test_resets_a_dangling_default(self):
+        host = _SecurityHost(
+            existing_files={LOGIN},
+            search_list=[LOGIN],
+            default="/private/var/tmp/app-robot-task-1/ci.keychain-db",
+        )
+        _apply(host, keychain._repair_default_keychain)
+        self.assertIn(["security", "default-keychain", "-s", LOGIN], host.calls)
+
+    def test_sets_login_when_no_default_exists(self):
+        host = _SecurityHost(existing_files={LOGIN}, search_list=[LOGIN], default="")
+        _apply(host, keychain._repair_default_keychain)
+        self.assertIn(["security", "default-keychain", "-s", LOGIN], host.calls)
+
+    def test_leaves_a_healthy_default_alone(self):
+        other = "/Users/ci/Library/Keychains/custom.keychain-db"
+        host = _SecurityHost(
+            existing_files={LOGIN, other}, search_list=[LOGIN], default=other
+        )
+        _apply(host, keychain._repair_default_keychain)
+        self.assertNotIn(["security", "default-keychain", "-s", LOGIN], host.calls)
+
+    def test_noop_when_login_keychain_is_absent(self):
+        host = _SecurityHost(existing_files=set(), search_list=[], default="")
+        _apply(host, keychain._repair_default_keychain)
+        self.assertEqual(host.calls, [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.50
+1.0.52

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.50
+1.0.52

package/backend-action/select_certbot_account.sh

@@ -5,10 +5,11 @@
 # which account should authorize a new certificate.
 select_certbot_account() {
   local accounts_dir="${1:-/etc/letsencrypt/accounts}"
+  local server_dir="$accounts_dir/acme-v02.api.letsencrypt.org/directory"
   local registration
 
   registration="$(
-    find "$accounts_dir" -type f -name regr.json -print 2>/dev/null \
+    find "$server_dir" -type f -name regr.json -print 2>/dev/null \
       | LC_ALL=C sort \
       | head -1
   )"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.50",
+  "version": "1.0.52",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {