gowalk-cicd 1.0.56 → 1.0.57

package/CLAUDE.md

@@ -100,8 +100,8 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   never connect to App Store Connect or Google Play.
 - Signing material should use encrypted Actions secrets. `deploy.yml`
   materializes `ASC_KEY_P8` + its ID/issuer, the Apple distribution identity
-  (`IOS_DISTRIBUTION_P12_BASE64`, `IOS_DISTRIBUTION_CERT_META_JSON`,
-  `IOS_DISTRIBUTION_CERT_REGISTRY_JSON`), and the Android keystore, properties
+  (`IOS_DISTRIBUTION_P12_BASE64`, `IOS_DISTRIBUTION_CERT_META_BASE64`,
+  `IOS_DISTRIBUTION_CERT_REGISTRY_BASE64`), and the Android keystore, properties
   and Play service account into an ephemeral runner checkout.
   Tracked `creds/` files remain a backward-compatible fallback.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`

package/README.md

@@ -45,10 +45,12 @@ the reusable Apple Distribution identity:
 
 - `ASC_KEY_P8`, `ASC_KEY_ID`, `ASC_ISSUER_ID`
 - `IOS_DISTRIBUTION_P12_BASE64`
-- `IOS_DISTRIBUTION_CERT_META_JSON`
-- `IOS_DISTRIBUTION_CERT_REGISTRY_JSON`
+- `IOS_DISTRIBUTION_CERT_META_BASE64`
+- `IOS_DISTRIBUTION_CERT_REGISTRY_BASE64`
 
-The workflow materializes them with mode `0600` only in the ephemeral runner
+All three distribution-identity values are base64 so their exact bytes—and the
+registry digests over those bytes—survive the secret round trip. The workflow
+materializes them with mode `0600` only in the ephemeral runner
 checkout. Secret-backed signing files are never staged or committed by the
 composite action. The distribution identity files come from the signing
 registry provisioner; pass their paths to the secret tooling without printing

package/action/.daemux-version

@@ -1 +1 @@
-1.0.56
+1.0.57

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.56
+1.0.57

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.56
+1.0.57

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.56",
+  "version": "1.0.57",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/install.mjs

@@ -213,8 +213,8 @@ function printSummary() {
   console.log('Next steps:');
   console.log('  Recommended: configure encrypted Actions secrets:');
   console.log('    ASC_KEY_P8, ASC_KEY_ID, ASC_ISSUER_ID');
-  console.log('    IOS_DISTRIBUTION_P12_BASE64, IOS_DISTRIBUTION_CERT_META_JSON');
-  console.log('    IOS_DISTRIBUTION_CERT_REGISTRY_JSON');
+  console.log('    IOS_DISTRIBUTION_P12_BASE64, IOS_DISTRIBUTION_CERT_META_BASE64');
+  console.log('    IOS_DISTRIBUTION_CERT_REGISTRY_BASE64');
   console.log('    ANDROID_UPLOAD_KEY_BASE64, ANDROID_SIGNING_PROPERTIES');
   console.log('    GOOGLE_PLAY_SERVICE_ACCOUNT_JSON');
   console.log('  The workflow materializes them with mode 0600 only on its ephemeral runner.');

package/templates/deploy-web.yml

@@ -10,6 +10,7 @@ on:
       - 'pubspec.lock'
       - 'l10n.yaml'
       - 'analysis_options.yaml'
+      - '.github/actions/*/.daemux-version'
       - '.github/workflows/deploy-web.yml'
   workflow_dispatch:
 

package/templates/deploy.yml

@@ -43,8 +43,8 @@ jobs:
           CI_ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
           CI_ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
           CI_DISTRIBUTION_P12: ${{ secrets.IOS_DISTRIBUTION_P12_BASE64 }}
-          CI_DISTRIBUTION_META: ${{ secrets.IOS_DISTRIBUTION_CERT_META_JSON }}
-          CI_DISTRIBUTION_REGISTRY: ${{ secrets.IOS_DISTRIBUTION_CERT_REGISTRY_JSON }}
+          CI_DISTRIBUTION_META: ${{ secrets.IOS_DISTRIBUTION_CERT_META_BASE64 }}
+          CI_DISTRIBUTION_REGISTRY: ${{ secrets.IOS_DISTRIBUTION_CERT_REGISTRY_BASE64 }}
         run: |
           umask 077
           mkdir -p creds
@@ -59,11 +59,11 @@ jobs:
             exit 0
           fi
           : "${CI_DISTRIBUTION_P12:?IOS_DISTRIBUTION_P12_BASE64 secret is required}"
-          : "${CI_DISTRIBUTION_META:?IOS_DISTRIBUTION_CERT_META_JSON secret is required}"
-          : "${CI_DISTRIBUTION_REGISTRY:?IOS_DISTRIBUTION_CERT_REGISTRY_JSON secret is required}"
+          : "${CI_DISTRIBUTION_META:?IOS_DISTRIBUTION_CERT_META_BASE64 secret is required}"
+          : "${CI_DISTRIBUTION_REGISTRY:?IOS_DISTRIBUTION_CERT_REGISTRY_BASE64 secret is required}"
           printf '%s' "$CI_DISTRIBUTION_P12" | base64 -D > creds/cert.p12
-          printf '%s' "$CI_DISTRIBUTION_META" > creds/cert.meta.json
-          printf '%s' "$CI_DISTRIBUTION_REGISTRY" > creds/cert.registry.json
+          printf '%s' "$CI_DISTRIBUTION_META" | base64 -D > creds/cert.meta.json
+          printf '%s' "$CI_DISTRIBUTION_REGISTRY" | base64 -D > creds/cert.registry.json
           echo "source=encrypted" >> "$GITHUB_OUTPUT"
       - name: Detect Flutter
         id: flutter