gowalk-cicd 1.0.51 → 1.0.53

package/CLAUDE.md

@@ -178,6 +178,23 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   pinned exactly because the Android job holds the keystore and the Play
   service account; the CLI runs from a temp cwd so its `.crashlytics/` debris
   never lands in the checkout.
+- The iOS action reads every script and prompt from the snapshot it takes of
+  itself in its first step (`$SWIFT_APP_ACTION`, under `RUNNER_TEMP`), never
+  from `${{ github.action_path }}` after that step. The plugin self-update
+  (`autoupdate_check.sh`) runs right after the snapshot and commits on its own,
+  before the version/signing/archive steps, so a red deploy still receives the
+  release that fixes it; the snapshot is what keeps that run on one version.
+  `test_action_step_order.py` pins both. A new script reference in
+  `action/action.yml` therefore uses `"$SWIFT_APP_ACTION/scripts/..."`.
+- Two situations end a green job with work for the panel, and each is a typed
+  check-run annotation (`::notice title=<name>::<one-line JSON with a versioned
+  schema>`), never prose in a `::warning::`: `play_review_pending`
+  (`templates/deploy.yml`, Play refused auto-submit and the bundle landed
+  unsubmitted) and `store_version_locked` (`action/action.yml`, the
+  `TESTFLIGHT_ONLY` decision of `manage_marketing_version.py`: an App Store
+  version is under review, so the build shipped to TestFlight under that
+  version and metadata was skipped). The README table lists the schemas; add a
+  field by bumping the version.
 - The JDK is chosen by `scripts/select_jdk.py`, called from the workflow before
   `setup-java`. The `JAVA_VERSION` repo variable always wins; otherwise Flutter
   gets 17 and native Gradle gets 21, except that a positively-detected Kotlin

package/README.md

@@ -217,13 +217,72 @@ sent for review from the Google Play Console UI.
 
 That fails the whole upload, so the bundle you just built never reaches Play at
 all. The retry re-uploads with `changesNotSentForReview`, which lands the bundle
-and leaves it waiting, then emits a `::warning::` naming the package. Someone
-then presses **Send changes for review** on that app's Publishing overview page.
-There is no API for that press — it is the one step Google deliberately reserves
-for a human, and no amount of tooling removes it.
+and leaves it waiting, then records that fact as a typed check-run annotation on
+the job (see [Check-run annotations](#check-run-annotations-the-panel-reads)):
+
+```
+::notice title=play_review_pending::{"schema":"gowalk-cicd/play-review-pending.v1",
+  "package":"<applicationId>","track":"<track>","version_code":"<versionCode>"}
+```
+
+There is no API for the **Send changes for review** press — Google reserves it
+for the Play Console — so the panel that merged the commit reads the annotation
+and opens its own Play console step, which promotes the uploaded version code to
+the track Google named and presses it. Nobody is asked to notice a warning.
 
 In the ordinary case the first upload submits normally and the retry is skipped.
 
+### When an App Store version is in review
+
+While any App Store version of the app is `WAITING_FOR_REVIEW`, `IN_REVIEW` or
+`PENDING_DEVELOPER_RELEASE`, App Store Connect refuses to create or edit **any**
+version — every `POST /appStoreVersions` answers
+`409 ENTITY_ERROR.RELATIONSHIP.INVALID` ("You cannot create a new version of the
+App in the current state"), whatever version string is asked for. The version
+step used to see only rows at the project's own `MARKETING_VERSION`, so a sibling
+in review (1.6.3 under review, project at 1.6.4) went unnoticed, CREATE was
+attempted and the deploy failed on every push until the review ended.
+
+The decision is now `TESTFLIGHT_ONLY`: the build is stamped with the **locked**
+version string (so it joins that version's TestFlight train instead of opening a
+new marketing-version train), the build number still advances, the archive is
+uploaded to TestFlight, and the App Store metadata steps are skipped. The project
+file is never touched — `MARKETING_VERSION` stays the source of truth for the next
+release. The job records a typed annotation so the panel knows the build went to
+TestFlight only:
+
+```
+::notice title=store_version_locked::{"schema":"gowalk-cicd/store-version-locked.v1",
+  "version":"1.6.3","state":"WAITING_FOR_REVIEW","build_number":"239"}
+```
+
+### Check-run annotations the panel reads
+
+Two situations end a green job with work left for something other than this
+workflow. Each is recorded as a GitHub check-run annotation whose **title** names
+the situation and whose **message** is one line of JSON carrying a versioned
+`schema`. The panel that merged the commit reads them through the check-runs API
+— never by parsing log text — so the title and schema are a contract:
+
+| title | schema | fields |
+| --- | --- | --- |
+| `play_review_pending` | `gowalk-cicd/play-review-pending.v1` | `package`, `track`, `version_code` |
+| `store_version_locked` | `gowalk-cicd/store-version-locked.v1` | `version`, `state`, `build_number` |
+
+Add a field by bumping the schema version; never change the meaning of an
+existing one.
+
+### The plugin self-update runs first
+
+The vendored iOS action checks npm for a newer `gowalk-cicd` at the **start** of
+every default-branch run and commits the refreshed action directories in their
+own commit, before the version, signing and archive steps. A deploy that is red
+in one of those steps therefore still picks up the plugin release that fixes it,
+on the very run that fails, and the next push runs the fixed plugin. The run that
+performed the update keeps executing the version it started with: the action
+snapshots itself to `$RUNNER_TEMP` before anything mutates and reads every script
+and prompt from that copy.
+
 ### Google Play upload retry
 
 A Play edit is a short-lived server-side object, and an AAB upload that runs
@@ -604,8 +663,11 @@ Feature-branch runs installed from the standard workflow still archive and
 upload to TestFlight, but pass `manage-app-store-version: 'false'`. This keeps
 branch validation independent of the editable App Store release slot, so a
 build can upload while the current release is locked in review. Default-branch
-runs retain version creation and metadata automation. Direct action callers
-keep the historical behavior because the new input defaults to `true`.
+runs retain version creation and metadata automation — and while a version is
+locked in review they take the same TestFlight-only path on their own (see
+[When an App Store version is in review](#when-an-app-store-version-is-in-review)).
+Direct action callers keep the historical behavior because the new input
+defaults to `true`.
 
 ### App ID capabilities
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.51
+1.0.53

package/action/action.yml

@@ -187,6 +187,79 @@ inputs:
 runs:
   using: composite
   steps:
+    # Every later step reads this action's scripts and prompts from the
+    # snapshot, never from ${action_path}. The autoupdate below re-vendors
+    # .github/actions/swift-app/ — the same directory as ${action_path} for
+    # local-action consumers — while this run is still executing the
+    # action.yml the runner loaded at job start. Reading scripts from the
+    # refreshed tree under the old step definitions is a mid-run version
+    # mix; one copy taken before anything mutates keeps the whole run on
+    # one version of the plugin.
+    - name: Snapshot this action for the whole run
+      shell: bash
+      run: |
+        set -euo pipefail
+        rm -rf "$RUNNER_TEMP/swift-app-action"
+        mkdir -p "$RUNNER_TEMP/swift-app-action"
+        cp -R "${{ github.action_path }}/." "$RUNNER_TEMP/swift-app-action/"
+        echo "SWIFT_APP_ACTION=$RUNNER_TEMP/swift-app-action" >> "$GITHUB_ENV"
+
+    # The plugin self-update runs BEFORE the version, signing and archive
+    # steps and lands in its own commit. It used to run after them, so a
+    # deploy that was red in the version step (App Store Connect refusing a
+    # new version while one is in review, GoVolt run 33743284641) never
+    # reached the self-update, and the plugin release that fixed exactly
+    # that failure could not arrive in the repository that needed it.
+    # Committing here rather than with the cert refresh below is the same
+    # point: a red step later in this run must not take the update with it.
+    - name: Stage bot-side scripts to runner temp
+      if: ${{ (inputs.archive == 'true' || inputs.auto-update == 'true')
+            && github.event_name == 'push'
+            && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        mkdir -p "$RUNNER_TEMP/swift-app-bot-scripts"
+        cp "$SWIFT_APP_ACTION/scripts/autoupdate_check.sh" \
+          "$RUNNER_TEMP/swift-app-bot-scripts/"
+        cp "$SWIFT_APP_ACTION/scripts/commit_bot_changes.sh" \
+          "$RUNNER_TEMP/swift-app-bot-scripts/"
+        chmod +x "$RUNNER_TEMP/swift-app-bot-scripts/"*.sh
+        echo "BOT_SCRIPTS_DIR=$RUNNER_TEMP/swift-app-bot-scripts" >> "$GITHUB_ENV"
+
+    - name: Check for app-ci update
+      # Default branch + push event only. `auto-update` is on by default;
+      # consumers can pin via `false`. Runs from $BOT_SCRIPTS_DIR
+      # (RUNNER_TEMP) so its own `npx` overwriting ${action_path} cannot
+      # swap the script under us.
+      if: ${{ inputs.auto-update == 'true'
+            && github.event_name == 'push'
+            && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+      shell: bash
+      working-directory: ${{ github.workspace }}
+      run: bash "$BOT_SCRIPTS_DIR/autoupdate_check.sh"
+
+    - name: Commit + push refreshed app-ci
+      # Its own commit, immediately: the refreshed action files must reach
+      # the default branch even when the version or signing steps of this
+      # very run fail. deploy.yml is deliberately not staged (GITHUB_TOKEN
+      # cannot push workflow files). No-op when the plugin was current.
+      if: ${{ inputs.auto-update == 'true'
+            && github.event_name == 'push'
+            && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+      shell: bash
+      working-directory: ${{ github.workspace }}
+      env:
+        GITHUB_REF_NAME: ${{ github.ref_name }}
+      run: |
+        set -euo pipefail
+        # A shallow checkout (fetch-depth 1 for direct action callers) must
+        # be able to rebase on a moved default branch inside the push retry.
+        git fetch --unshallow 2>/dev/null \
+          || git fetch --depth=2147483647 2>/dev/null \
+          || true
+        bash "$BOT_SCRIPTS_DIR/commit_bot_changes.sh"
+
     - name: Resolve credentials + auto-detect Xcode project
       shell: bash
       env:
@@ -217,7 +290,7 @@ runs:
           echo "Installing xcodegen (project.yml present, binary missing)…"
           brew install xcodegen >/dev/null 2>&1 || HOMEBREW_NO_AUTO_UPDATE=1 brew install xcodegen
         fi
-        python3 "${{ github.action_path }}/scripts/read_config.py"
+        python3 "$SWIFT_APP_ACTION/scripts/read_config.py"
 
     - name: Select latest Xcode
       shell: bash
@@ -303,10 +376,12 @@ runs:
         CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
       run: |
         set -o pipefail
-        python3 "${{ github.action_path }}/scripts/resolve_marketing_version.py" \
+        python3 "$SWIFT_APP_ACTION/scripts/resolve_marketing_version.py" \
           | tee -a "$GITHUB_ENV"
 
     - name: Resolve App Store version slot (REUSE or CREATE)
+      # A third answer, TESTFLIGHT_ONLY, is handled inside: see the
+      # STORE_VERSION_LOCKED branch of the script.
       if: ${{ inputs.archive == 'true' && inputs.manage-app-store-version == 'true' }}
       shell: bash
       env:
@@ -332,19 +407,40 @@ runs:
         CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
       run: |
         set -o pipefail
-        BUILD_NUMBER=$(python3 "${{ github.action_path }}/scripts/next_build_number.py")
-        DECISION_JSON=$(python3 "${{ github.action_path }}/scripts/manage_marketing_version.py")
+        BUILD_NUMBER=$(python3 "$SWIFT_APP_ACTION/scripts/next_build_number.py")
+        DECISION_JSON=$(python3 "$SWIFT_APP_ACTION/scripts/manage_marketing_version.py")
         APP_STORE_VERSION_ID=$(python3 -c \
           "import json,sys; d=json.loads(sys.argv[1]); print(d.get('appStoreVersionId',''))" \
           "$DECISION_JSON")
+        DECISION=$(python3 -c \
+          "import json,sys; d=json.loads(sys.argv[1]); print(d.get('decision',''))" \
+          "$DECISION_JSON")
         # The decision's versionString is authoritative: it reflects any
         # auto-bump that mmv applied to MARKETING_VERSION when the project
-        # was below the ASC combined floor. Re-export so subsequent steps
-        # (Stamp Info.plist, Archive) see the bumped value.
+        # was below the ASC combined floor — or, for TESTFLIGHT_ONLY, the
+        # App Store version Apple is holding, which is the train this build
+        # joins. Re-export so subsequent steps (Stamp Info.plist, Archive)
+        # see that value.
         EFFECTIVE_MV=$(python3 -c \
           "import json,sys; d=json.loads(sys.argv[1]); print(d.get('versionString',''))" \
           "$DECISION_JSON")
-        if [ -n "$EFFECTIVE_MV" ] && [ "$EFFECTIVE_MV" != "$MARKETING_VERSION" ]; then
+        if [ "$DECISION" = "TESTFLIGHT_ONLY" ]; then
+          # An App Store version is under review or awaiting the developer's
+          # release: App Store Connect refuses to create or edit ANY version
+          # (409 ENTITY_ERROR.RELATIONSHIP.INVALID). The build still ships to
+          # TestFlight, stamped with the locked version so it lands in that
+          # version's train; App Store metadata below is skipped
+          # (STORE_VERSION_LOCKED), and the typed check-run annotation tells
+          # the panel that merged this commit exactly what happened.
+          LOCKED_STATE=$(python3 -c \
+            "import json,sys; d=json.loads(sys.argv[1]); print(d.get('state',''))" \
+            "$DECISION_JSON")
+          echo "::notice::App Store version $EFFECTIVE_MV is $LOCKED_STATE; uploading build $BUILD_NUMBER to TestFlight under $EFFECTIVE_MV and skipping App Store metadata"
+          echo "STORE_VERSION_LOCKED=$EFFECTIVE_MV" >> "$GITHUB_ENV"
+          echo "::notice title=store_version_locked::{\"schema\":\"gowalk-cicd/store-version-locked.v1\",\"version\":\"$EFFECTIVE_MV\",\"state\":\"$LOCKED_STATE\",\"build_number\":\"$BUILD_NUMBER\"}"
+          echo "MARKETING_VERSION=$EFFECTIVE_MV" >> "$GITHUB_ENV"
+          MARKETING_VERSION="$EFFECTIVE_MV"
+        elif [ -n "$EFFECTIVE_MV" ] && [ "$EFFECTIVE_MV" != "$MARKETING_VERSION" ]; then
           echo "::notice::auto-bump rewrote MARKETING_VERSION $MARKETING_VERSION -> $EFFECTIVE_MV"
           echo "MARKETING_VERSION=$EFFECTIVE_MV" >> "$GITHUB_ENV"
           MARKETING_VERSION="$EFFECTIVE_MV"
@@ -360,7 +456,7 @@ runs:
         APP_STORE_APPLE_ID: ${{ inputs.app-store-apple-id || env.CFG_APP_STORE_APPLE_ID }}
       run: |
         set -o pipefail
-        BUILD_NUMBER=$(python3 "${{ github.action_path }}/scripts/next_build_number.py")
+        BUILD_NUMBER=$(python3 "$SWIFT_APP_ACTION/scripts/next_build_number.py")
         echo "BUILD_NUMBER=$BUILD_NUMBER" >> "$GITHUB_ENV"
         echo "APP_STORE_VERSION_ID=" >> "$GITHUB_ENV"
         echo "Using marketing version $MARKETING_VERSION build $BUILD_NUMBER without an App Store version slot"
@@ -383,7 +479,7 @@ runs:
         CERTIFICATE_CAP_POLICY: ${{ inputs.certificate-cap-policy }}
       run: |
         set +e
-        python3 "${{ github.action_path }}/scripts/prepare_signing.py"
+        python3 "$SWIFT_APP_ACTION/scripts/prepare_signing.py"
         signing_exit=$?
         set -e
         echo "SIGNING_PREP_EXIT=$signing_exit" >> "$GITHUB_ENV"
@@ -408,36 +504,13 @@ runs:
     #     of any compromised step in the workflow — keep workflow minimal.
     #   - .gitignore must NOT block the new creds/ files (see setup doc).
     #
-    # Split into four steps so cert refresh and autoupdate can both fire
-    # in a single combined commit when they coincide, but either can fire
-    # alone without redundant retries: (1) copy bot scripts to RUNNER_TEMP
-    # so autoupdate's `npx` cannot mid-run swap script bytes under us,
-    # (2) stage cert files, (3) check for newer app-ci on npm and
-    # stage refreshed action files, (4) commit + push whatever is staged,
-    # (5) re-raise a deferred prepare failure after preserving its cache.
+    # The autoupdate half runs FIRST in this action (see the top of the
+    # step list) and lands in its own commit, so a fixed plugin reaches a
+    # repository whose deploy is failing in the version or signing steps
+    # below. What remains here: (1) stage cert files, (2) commit + push
+    # whatever is staged, (3) re-raise a deferred prepare failure after
+    # preserving its cache.
 
-    # Stage scripts to RUNNER_TEMP so the autoupdate step's `npx` (which
-    # overwrites .github/actions/swift-app/ — the same dir as ${action_path}
-    # for local-action consumers) cannot mid-run swap the script bytes
-    # under us. action.yml step definitions are already loaded by the
-    # runner at job start, but the shell scripts are read fresh per step,
-    # so without this stage we'd risk loading commit_bot_changes.sh from
-    # the post-`npx` (newer) tree while the surrounding step definitions
-    # came from the pre-`npx` (older) action.yml — a mid-run version mix.
-    - name: Stage bot-side scripts to runner temp
-      if: ${{ (inputs.archive == 'true' || inputs.auto-update == 'true')
-            && github.event_name == 'push'
-            && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
-      shell: bash
-      run: |
-        set -euo pipefail
-        mkdir -p "$RUNNER_TEMP/swift-app-bot-scripts"
-        cp "${{ github.action_path }}/scripts/autoupdate_check.sh" \
-          "$RUNNER_TEMP/swift-app-bot-scripts/"
-        cp "${{ github.action_path }}/scripts/commit_bot_changes.sh" \
-          "$RUNNER_TEMP/swift-app-bot-scripts/"
-        chmod +x "$RUNNER_TEMP/swift-app-bot-scripts/"*.sh
-        echo "BOT_SCRIPTS_DIR=$RUNNER_TEMP/swift-app-bot-scripts" >> "$GITHUB_ENV"
 
     - name: Stage refreshed signing identity
       # Only stage on push to the default branch — PR runs and feature
@@ -495,25 +568,14 @@ runs:
           sed 's/^/  /' "$bump_marker"
         fi
 
-    - name: Check for app-ci update
-      # Same gate as cert staging: default branch + push event only.
-      # `auto-update` is on by default; consumers can pin via `false`.
-      # Runs from $BOT_SCRIPTS_DIR (RUNNER_TEMP) so its own `npx`
-      # overwriting ${action_path} mid-run can't swap the script under us.
-      if: ${{ inputs.auto-update == 'true'
-            && github.event_name == 'push'
-            && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
-      shell: bash
-      working-directory: ${{ github.workspace }}
-      run: bash "$BOT_SCRIPTS_DIR/autoupdate_check.sh"
-
     - name: Commit + push staged bot changes
-      # Fires when EITHER cert staging OR autoupdate could have produced
-      # diffs. The script itself is a no-op when nothing is staged, so a
+      # The cert refresh (and any marketing-version auto-bump the version
+      # step staged). The autoupdate landed in its own commit at the top of
+      # this action; this script is a no-op when nothing is staged, so a
       # PR / feature-branch run that somehow reaches this step does no
       # harm — but we still gate on default-branch push for clarity.
-      # Runs from $BOT_SCRIPTS_DIR (RUNNER_TEMP) — see step above for why
-      # we don't read directly from ${action_path} after autoupdate.
+      # Runs from $BOT_SCRIPTS_DIR (RUNNER_TEMP): the autoupdate re-vendored
+      # ${action_path} earlier in this run and must not swap scripts under us.
       if: ${{ (inputs.archive == 'true' || inputs.auto-update == 'true')
             && github.event_name == 'push'
             && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
@@ -735,7 +797,7 @@ runs:
         PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
         WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
       run: |
-        python3 "${{ github.action_path }}/scripts/crashlytics_dsyms.py" \
+        python3 "$SWIFT_APP_ACTION/scripts/crashlytics_dsyms.py" \
           --archive "$RUNNER_TEMP/app.xcarchive" \
           --search-root "$(dirname "${WORKSPACE:-$PROJECT}")"
 
@@ -766,18 +828,22 @@ runs:
         fi
         echo "Upload succeeded"
 
+    # Both App Store metadata writers are skipped while an App Store version
+    # is locked (STORE_VERSION_LOCKED, the TESTFLIGHT_ONLY decision): there is
+    # no editable version id to write to, and each script requires one.
     - name: Detect empty ASC metadata fields
       id: detect_metadata
       if: >-
         ${{ inputs.archive == 'true' && inputs.upload == 'true'
-            && inputs.manage-app-store-version == 'true' && inputs.ai-metadata != 'false' }}
+            && inputs.manage-app-store-version == 'true' && inputs.ai-metadata != 'false'
+            && env.STORE_VERSION_LOCKED == '' }}
       shell: bash
       env:
         APP_STORE_APPLE_ID: ${{ inputs.app-store-apple-id || env.CFG_APP_STORE_APPLE_ID }}
         APP_STORE_VERSION_ID: ${{ env.APP_STORE_VERSION_ID }}
       run: |
         set -o pipefail
-        python3 "${{ github.action_path }}/scripts/asc_metadata_detector.py" \
+        python3 "$SWIFT_APP_ACTION/scripts/asc_metadata_detector.py" \
           > "$RUNNER_TEMP/asc_empty_metadata.json" || {
             echo "::warning::metadata detector failed; skipping AI step"
             echo "has_empty=false" >> "$GITHUB_OUTPUT"
@@ -800,7 +866,7 @@ runs:
         BUNDLE_ID: ${{ inputs.bundle-id || env.CFG_BUNDLE_ID }}
         SCHEME: ${{ inputs.scheme || env.CFG_SCHEME }}
       run: |
-        python3 "${{ github.action_path }}/scripts/app_context_scanner.py" \
+        python3 "$SWIFT_APP_ACTION/scripts/app_context_scanner.py" \
           > "$RUNNER_TEMP/app_context.txt"
         wc -c "$RUNNER_TEMP/app_context.txt"
 
@@ -834,7 +900,7 @@ runs:
       if: ${{ steps.derive_phases.outputs.needs_phase1 == 'true' }}
       shell: bash
       env:
-        TEMPLATE_PATH: ${{ github.action_path }}/prompts/generate_descriptions.prompt.yml
+        TEMPLATE_PATH: ${{ env.SWIFT_APP_ACTION }}/prompts/generate_descriptions.prompt.yml
       run: |
         # Pre-render via PyYAML so multi-line app_context stays a block scalar
         # and doesn't break ai-inference@v1's naive string substitution.
@@ -905,7 +971,7 @@ runs:
           echo "phase1_ok=false" >> "$GITHUB_OUTPUT"
           exit 0
         fi
-        python3 "${{ github.action_path }}/scripts/asc_metadata_applier.py" \
+        python3 "$SWIFT_APP_ACTION/scripts/asc_metadata_applier.py" \
           --state "$RUNNER_TEMP/asc_empty_metadata.json" \
           --response "$OUT" \
           --fields-filter description
@@ -917,7 +983,7 @@ runs:
                 || steps.phase1_apply.outputs.phase1_ok == 'true') }}
       shell: bash
       env:
-        TEMPLATE_PATH: ${{ github.action_path }}/prompts/generate_dependent_fields.prompt.yml
+        TEMPLATE_PATH: ${{ env.SWIFT_APP_ACTION }}/prompts/generate_dependent_fields.prompt.yml
       run: |
         # Merge existing_fields.{locale}.description with Phase-1 outputs to
         # produce authoritative per-locale description context, then render
@@ -1010,7 +1076,7 @@ runs:
           head -c 500 "$OUT" || true
           echo
         fi
-        python3 "${{ github.action_path }}/scripts/asc_metadata_applier.py" \
+        python3 "$SWIFT_APP_ACTION/scripts/asc_metadata_applier.py" \
           --state "$RUNNER_TEMP/asc_empty_metadata.json" \
           --response "$OUT" \
           --fields-filter name,subtitle,keywords,promotionalText,whatsNew
@@ -1026,6 +1092,7 @@ runs:
     - name: Set App Store "What's New"
       if: ${{ inputs.archive == 'true' && inputs.upload == 'true'
             && inputs.manage-app-store-version == 'true'
+            && env.STORE_VERSION_LOCKED == ''
             && (inputs.app-store-whats-new != '' || env.CFG_WHATS_NEW != '') }}
       shell: bash
       env:
@@ -1051,4 +1118,4 @@ runs:
           WHATS_NEW_ONLY_IF_EMPTY=false
         fi
         export APP_STORE_WHATS_NEW_FILE WHATS_NEW_ONLY_IF_EMPTY
-        python3 "${{ github.action_path }}/scripts/set_app_store_whats_new.py"
+        python3 "$SWIFT_APP_ACTION/scripts/set_app_store_whats_new.py"

package/action/scripts/keychain.py

@@ -8,6 +8,16 @@ into it, and prepends it to the user's keychain search list so
 keychain is purposely short-lived (default 6h auto-lock) and disposable
 — each CI run re-creates it from scratch.
 
+The user's *default* keychain is deliberately never pointed at the
+throwaway keychain: the search list (plus the partition list set at
+import) is what identity resolution actually uses. On a persistent
+runner (a self-hosted Mac), claiming the default meant every credential
+consumer on the host wrote into the throwaway keychain, and once its
+temp dir was reclaimed the dangling default made macOS pop a
+"Keychain ... cannot be found to store" dialog at every credential
+write. Setup instead prunes search-list entries whose backing file is
+gone and repoints a dangling default back at the login keychain.
+
 The keychain password (``"ci"``) is intentionally hardcoded: the
 keychain never leaves the runner (it lives in ``$RUNNER_TEMP`` which
 GitHub deletes when the job ends), so encrypting it with a sourced
@@ -77,15 +87,35 @@ def _prepend_to_user_search_list(keychain_path: str) -> None:
         for line in existing.splitlines()
         if line.strip()
     ]
+    # Prune entries whose file is gone: dangling throwaway keychains from
+    # earlier runs on a persistent Mac would otherwise accumulate forever.
     new_list = [keychain_path] + [
-        k for k in existing_list if k != keychain_path
+        k for k in existing_list
+        if k != keychain_path and os.path.exists(k)
     ]
     subprocess.check_call(
         ["security", "list-keychains", "-d", "user", "-s", *new_list]
     )
-    subprocess.check_call(
-        ["security", "default-keychain", "-s", keychain_path]
+    _repair_default_keychain()
+
+
+def _repair_default_keychain() -> None:
+    """Repoint an unset or dangling default keychain at the login keychain.
+
+    Heals hosts damaged by earlier releases (which made the throwaway CI
+    keychain the default) without ever claiming the default for this run.
+    A healthy default — whatever it points at — is left alone.
+    """
+    login = os.path.expanduser("~/Library/Keychains/login.keychain-db")
+    if not os.path.exists(login):
+        return
+    probe = subprocess.run(
+        ["security", "default-keychain"], capture_output=True, text=True
     )
+    current = probe.stdout.strip().strip('"') if probe.returncode == 0 else ""
+    if current and os.path.exists(current):
+        return
+    subprocess.check_call(["security", "default-keychain", "-s", login])
 
 
 def setup_keychain(p12_path: Path, p12_pass: str, runner_temp: str) -> str: