gowalk-cicd 1.0.56 → 1.0.58

package/CLAUDE.md

@@ -98,10 +98,16 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Detect and warn, tell the user to remove lines manually.
 - Store API calls belong in GitHub Actions. Local tests may build/sign but must
   never connect to App Store Connect or Google Play.
+- Every Apple/Google store API call, OAuth exchange and binary upload requires its
+  assigned `APPLE_STORE_PROXY_URL` / `GOOGLE_STORE_PROXY_URL` repository secret.
+  Python clients enforce explicit proxies; Play upload steps set the proxy for the
+  pinned Google client. Missing configuration must stop before a provider call.
+  Apple IPA uploads use `action/scripts/upload_build.py`, not native upload tools.
+  It retains provider IDs/checksums and verifies matching IPA identity before resume.
 - Signing material should use encrypted Actions secrets. `deploy.yml`
   materializes `ASC_KEY_P8` + its ID/issuer, the Apple distribution identity
-  (`IOS_DISTRIBUTION_P12_BASE64`, `IOS_DISTRIBUTION_CERT_META_JSON`,
-  `IOS_DISTRIBUTION_CERT_REGISTRY_JSON`), and the Android keystore, properties
+  (`IOS_DISTRIBUTION_P12_BASE64`, `IOS_DISTRIBUTION_CERT_META_BASE64`,
+  `IOS_DISTRIBUTION_CERT_REGISTRY_BASE64`), and the Android keystore, properties
   and Play service account into an ephemeral runner checkout.
   Tracked `creds/` files remain a backward-compatible fallback.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`

package/README.md

@@ -45,10 +45,12 @@ the reusable Apple Distribution identity:
 
 - `ASC_KEY_P8`, `ASC_KEY_ID`, `ASC_ISSUER_ID`
 - `IOS_DISTRIBUTION_P12_BASE64`
-- `IOS_DISTRIBUTION_CERT_META_JSON`
-- `IOS_DISTRIBUTION_CERT_REGISTRY_JSON`
+- `IOS_DISTRIBUTION_CERT_META_BASE64`
+- `IOS_DISTRIBUTION_CERT_REGISTRY_BASE64`
 
-The workflow materializes them with mode `0600` only in the ephemeral runner
+All three distribution-identity values are base64 so their exact bytes—and the
+registry digests over those bytes—survive the secret round trip. The workflow
+materializes them with mode `0600` only in the ephemeral runner
 checkout. Secret-backed signing files are never staged or committed by the
 composite action. The distribution identity files come from the signing
 registry provisioner; pass their paths to the secret tooling without printing
@@ -641,6 +643,14 @@ retains its own symbols precisely so that this half-updated state is safe.
 
 The iOS composite action runs on `macos-15` and:
 
+All Apple and Google store requests require an account-pinned proxy, including OAuth,
+metadata and binary transfer. Provision `APPLE_STORE_PROXY_URL` and
+`GOOGLE_STORE_PROXY_URL` as encrypted repository secrets before deployment. A missing
+proxy refuses provider calls; there is no direct fallback. Refresh existing workflow
+files with the released installer while preserving application-specific build inputs.
+The Apple uploader retains `apple-upload-<run>-<attempt>` receipts with IPA SHA-256,
+upload ID and processing readback, and resumes matching bytes after interruption.
+
 1. **Auto-detects** your `.xcodeproj` / `.xcworkspace`, scheme, bundle ID,
    and `team_id` (from the ASC API key). No `ci.config.yaml` required —
    override via action inputs only if auto-detection fails.
@@ -657,7 +667,7 @@ The iOS composite action runs on `macos-15` and:
    `CI-<bundle_id>`. Patches the `.pbxproj` to use Manual signing against those
    profiles.
 6. **Archives** with `xcodebuild archive`, exports the IPA, and uploads via
-   `xcrun altool`.
+   Apple's build-upload REST API through `APPLE_STORE_PROXY_URL`.
 7. **Sets "What's New"** on every declared localization (reads
    `fastlane/metadata/ios/<locale>/release_notes.txt` if present, or from the
    `app-store-whats-new` input).

package/action/.daemux-version

@@ -1 +1 @@
-1.0.56
+1.0.58

package/action/action.yml

@@ -345,7 +345,7 @@ runs:
             test
         fi
 
-    - name: Stage ASC API key for xcrun / altool
+    - name: Stage ASC API key for authenticated REST uploads
       if: ${{ inputs.archive == 'true' }}
       shell: bash
       run: |
@@ -353,7 +353,7 @@ runs:
         # prints env: blocks on step-group expansion, which leaks secrets.
         # read_config.py already validated creds/AuthKey_<KEY_ID>_Issuer_<UUID>.p8
         # exists and exported ASC_KEY_P8_PATH; we copy the file on disk and
-        # stage it where xcrun/altool expect it (~/.appstoreconnect/private_keys).
+        # stage it for the authenticated REST clients only.
         : "${ASC_KEY_ID:?ASC_KEY_ID env var is required}"
         : "${ASC_ISSUER_ID:?ASC_ISSUER_ID env var is required}"
         : "${ASC_KEY_P8_PATH:?ASC_KEY_P8_PATH env var is required (set by read_config.py)}"
@@ -364,9 +364,6 @@ runs:
         mkdir -p "$RUNNER_TEMP/asc"
         cp "$ASC_KEY_P8_PATH" "$RUNNER_TEMP/asc/AuthKey.p8"
         chmod 600 "$RUNNER_TEMP/asc/AuthKey.p8"
-        mkdir -p ~/.appstoreconnect/private_keys
-        cp "$RUNNER_TEMP/asc/AuthKey.p8" \
-          ~/.appstoreconnect/private_keys/AuthKey_${ASC_KEY_ID}.p8
         echo "ASC_KEY_PATH=$RUNNER_TEMP/asc/AuthKey.p8" >> "$GITHUB_ENV"
 
     - name: Resolve marketing version (project source of truth)
@@ -808,29 +805,20 @@ runs:
     - name: Upload to TestFlight
       if: ${{ inputs.archive == 'true' && inputs.upload == 'true' }}
       shell: bash
+      env:
+        APP_STORE_APPLE_ID: ${{ inputs.app-store-apple-id || env.CFG_APP_STORE_APPLE_ID }}
       run: |
         IPA=$(ls "$RUNNER_TEMP"/export/*.ipa | head -1)
-        echo "Uploading $IPA"
-        LOG="$RUNNER_TEMP/altool.log"
-        set +e
-        xcrun altool --upload-app \
-          --type ios \
-          --file "$IPA" \
-          --apiKey "$ASC_KEY_ID" \
-          --apiIssuer "$ASC_ISSUER_ID" \
-          --output-format normal 2>&1 | tee "$LOG"
-        ALTOOL_RC=${PIPESTATUS[0]}
-        set -e
-        # altool occasionally exits 0 even on failure; verify the final outcome marker.
-        # Apple's altool prints transient "ERROR:" lines for retried network blips
-        # before emitting "UPLOAD SUCCEEDED" — don't false-positive on those.
-        if [ "$ALTOOL_RC" -ne 0 ] \
-            || grep -qE '^Failed to upload|ERROR ITMS-' "$LOG" \
-            || ! grep -qE 'UPLOAD SUCCEEDED|No errors uploading archive' "$LOG"; then
-          echo "altool reported an upload failure (rc=$ALTOOL_RC)"
-          exit 1
-        fi
-        echo "Upload succeeded"
+        python3 "$SWIFT_APP_ACTION/scripts/upload_build.py" "$IPA" \
+          --report "$RUNNER_TEMP/apple-build-upload.json"
+
+    - name: Retain Apple upload receipt
+      if: ${{ always() && inputs.archive == 'true' && inputs.upload == 'true' }}
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      with:
+        name: apple-upload-${{ github.run_id }}-${{ github.run_attempt }}
+        path: ${{ runner.temp }}/apple-build-upload.json
+        if-no-files-found: ignore
 
     # Both App Store metadata writers are skipped while an App Store version
     # is locked (STORE_VERSION_LOCKED, the TESTFLIGHT_ONLY decision): there is

package/action/scripts/apple_store_proxy.py

@@ -0,0 +1,28 @@
+"""Explicit account-pinned transport for CI; missing proxy never means direct egress."""
+from __future__ import annotations
+
+import os
+from urllib.parse import urlsplit
+
+import requests
+
+
+def proxies() -> dict[str, str]:
+    value = os.environ.get("APPLE_STORE_PROXY_URL", "").strip()
+    try:
+        parsed = urlsplit(value)
+        valid = parsed.scheme in {"http", "https"} and parsed.hostname and parsed.port
+    except ValueError:
+        valid = False
+    if not valid:
+        raise SystemExit("APPLE_STORE_PROXY_URL must contain the account-pinned proxy; direct requests are refused")
+    return {"http": value, "https": value}
+
+
+def request(method: str, url: str, **kwargs) -> requests.Response:
+    # An explicit map also wins over NO_PROXY and any unrelated runner proxy.
+    try:
+        return requests.request(method, url, proxies=proxies(), **kwargs)
+    except requests.RequestException:
+        # Proxy errors can embed credentials and signed upload URLs.
+        raise RuntimeError("Apple request failed through the configured proxy") from None

package/action/scripts/asc_common.py

@@ -16,6 +16,8 @@ from typing import Any
 import jwt
 import requests
 
+from apple_store_proxy import proxies
+
 
 ASC_BASE = "https://api.appstoreconnect.apple.com/v1"
 
@@ -162,11 +164,11 @@ def _retry_network_error(
     if attempt >= total - 1:
         raise SystemExit(
             f"ASC {method} {path} network error after {total} "
-            f"attempts: {exc!r}"
+            "attempts through the configured proxy"
         )
     delay = backoffs[attempt]
     print(
-        f"ASC {method} {path} network error ({exc!r}); "
+        f"ASC {method} {path} network error through the configured proxy; "
         f"retrying in {delay}s ({attempt + 1}/{total - 1})",
         file=sys.stderr,
     )
@@ -222,7 +224,7 @@ def request(
         try:
             resp = requests.request(
                 method, url, headers=headers, params=params,
-                json=json_body, timeout=timeout,
+                json=json_body, timeout=timeout, proxies=proxies(),
             )
         except requests.RequestException as exc:
             _retry_network_error(method, path, attempt, total, backoffs, exc)

package/action/scripts/test_action_step_order.py

@@ -47,7 +47,7 @@ class TestActionStepOrder(unittest.TestCase):
                         order["Commit + push refreshed app-ci"])
         # ... and before every other step that talks to a store or signs.
         for later in ("Resolve credentials + auto-detect Xcode project",
-                      "Stage ASC API key for xcrun / altool",
+                      "Stage ASC API key for authenticated REST uploads",
                       "Prepare signing (cert + keychain + per-target profiles + pbxproj)",
                       "Archive"):
             self.assertLess(order["Commit + push refreshed app-ci"], order[later], later)

package/action/scripts/test_apple_store_proxy.py

@@ -0,0 +1,44 @@
+"""Apple API and upload bytes cannot bypass the configured proxy."""
+import os
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import apple_store_proxy
+import asc_common
+
+
+class AppleProxyTests(unittest.TestCase):
+    def test_missing_proxy_stops_before_any_request(self):
+        with mock.patch.dict(os.environ, {"APPLE_STORE_PROXY_URL": ""}), \
+                mock.patch.object(apple_store_proxy.requests, "request") as request:
+            with self.assertRaises(SystemExit):
+                apple_store_proxy.request("PUT", "https://upload.apple.com/part", data=b"ipa")
+            request.assert_not_called()
+
+    def test_explicit_proxy_is_used_despite_no_proxy_and_other_environment(self):
+        configured = "http://assigned.proxy.test:1234"
+        response = mock.Mock(status_code=200)
+        with mock.patch.dict(os.environ, {"APPLE_STORE_PROXY_URL": configured,
+                                         "HTTPS_PROXY": "http://wrong.proxy:9876", "NO_PROXY": "*"}), \
+                mock.patch.object(apple_store_proxy.requests, "request", return_value=response) as request:
+            asc_common.request("GET", "/apps/123", "test-token")
+            self.assertEqual(request.call_args.kwargs["proxies"], {"http": configured, "https": configured})
+            apple_store_proxy.request("PUT", "https://upload.apple.com/part", data=b"ipa")
+            self.assertEqual(request.call_args.kwargs["proxies"], {"http": configured, "https": configured})
+            self.assertNotIn("Authorization", request.call_args.kwargs.get("headers", {}))
+
+    def test_upload_transport_failure_does_not_print_proxy_or_signed_url(self):
+        with mock.patch.dict(os.environ, {"APPLE_STORE_PROXY_URL": "http://proxy.test:1234"}), \
+                mock.patch.object(apple_store_proxy.requests, "request", side_effect=
+                                  apple_store_proxy.requests.RequestException("private-password signed-url")):
+            with self.assertRaises(RuntimeError) as caught:
+                apple_store_proxy.request("PUT", "https://upload.apple.com/part")
+            self.assertNotIn("private-password", str(caught.exception))
+            self.assertNotIn("signed-url", str(caught.exception))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/test_asc_common_timeouts.py

@@ -38,6 +38,7 @@ class _OkResponse:
         return {"data": []}
 
 
+@mock.patch.dict(os.environ, {"APPLE_STORE_PROXY_URL": "http://proxy.test:1234"})
 class RequestTimeoutTests(unittest.TestCase):
     """``request()`` must pass an explicit ``(connect, read)`` timeout."""
 

package/action/scripts/test_upload_build.py

@@ -0,0 +1,118 @@
+"""REST IPA upload identity, resume, complete byte coverage and proxy-only transfer."""
+import hashlib
+import os
+from pathlib import Path
+import plistlib
+import sys
+import tempfile
+import unittest
+from unittest import mock
+import zipfile
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import upload_build
+
+
+class BuildUploadTests(unittest.TestCase):
+    def test_ipa_identity_comes_from_the_archived_app(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            ipa = Path(temporary) / "app.ipa"
+            with zipfile.ZipFile(ipa, "w") as archive:
+                archive.writestr("Payload/App.app/Info.plist", plistlib.dumps({
+                    "CFBundleIdentifier": "com.example.app", "CFBundleVersion": "8",
+                    "CFBundleShortVersionString": "1.2.0"}))
+            info = upload_build.identity(ipa)
+            self.assertEqual(info["cfBundleVersion"], "8")
+            self.assertEqual(info["cfBundleShortVersionString"], "1.2.0")
+            self.assertEqual(info["sha256"], hashlib.sha256(ipa.read_bytes()).hexdigest())
+
+    def test_existing_upload_is_adopted_without_another_create(self):
+        info = {"cfBundleVersion": "8", "cfBundleShortVersionString": "1.2.0"}
+        with mock.patch.object(upload_build, "api", return_value={"data": [{"id": "existing"}]}) as api:
+            self.assertEqual(upload_build.upload_record("app", info)["id"], "existing")
+            self.assertEqual(api.call_count, 1)
+            self.assertEqual(api.call_args.args[0], "GET")
+
+    def test_existing_different_bytes_are_not_replaced(self):
+        existing = {"data": [{"id": "file", "attributes": {
+            "assetType": "ASSET", "fileName": "other.ipa", "fileSize": 10}}]}
+        with mock.patch.object(upload_build, "api", return_value=existing) as api:
+            with self.assertRaises(ValueError):
+                upload_build.upload_file({"id": "upload"}, {"fileName": "wanted.ipa", "fileSize": 10})
+            self.assertEqual(api.call_count, 1)
+
+    def test_part_transfer_uses_proxy_without_asc_bearer(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            ipa = Path(temporary) / "app.ipa"
+            ipa.write_bytes(b"abcde")
+            operation = {"url": "https://upload.apple.com/part", "method": "PUT", "offset": 1,
+                         "length": 3, "requestHeaders": [{"name": "Content-Type", "value": "application/octet-stream"}]}
+            response = mock.Mock(status_code=200)
+            with mock.patch.object(upload_build.store_proxy, "request", return_value=response) as request:
+                upload_build.transfer(ipa, operation)
+                self.assertEqual(request.call_args.kwargs["data"], b"bcd")
+                self.assertNotIn("Authorization", request.call_args.kwargs["headers"])
+                self.assertFalse(request.call_args.kwargs["allow_redirects"])
+
+    def test_missing_parts_never_mark_a_file_uploaded(self):
+        file = {"id": "file", "attributes": {"uploadOperations": [{"offset": 0, "length": 4}]}}
+        with mock.patch.object(upload_build, "api") as api, mock.patch.object(upload_build, "transfer") as transfer:
+            with self.assertRaises(ValueError):
+                upload_build.transfer_all(Path("unused"), file, {"fileSize": 5, "sha256": "hash"})
+            api.assert_not_called()
+            transfer.assert_not_called()
+
+    def test_parts_are_joined_before_committing_the_checksum(self):
+        file = {"id": "file", "attributes": {"uploadOperations": [{"offset": 0, "length": 2},
+                                                                        {"offset": 2, "length": 3}]}}
+        done = []
+        with mock.patch.object(upload_build, "transfer", side_effect=lambda path, op: done.append(op["offset"])), \
+                mock.patch.object(upload_build, "api") as api:
+            upload_build.transfer_all(Path("unused"), file, {"fileSize": 5, "sha256": "digest"})
+            self.assertEqual(sorted(done), [0, 2])
+            body = api.call_args.args[2]["data"]["attributes"]
+            self.assertEqual(body, {"uploaded": True, "sourceFileChecksums": {
+                "file": {"hash": "digest", "algorithm": "SHA_256"}}})
+
+    def test_failed_part_never_commits_the_file(self):
+        file = {"id": "file", "attributes": {"uploadOperations": [{"offset": 0, "length": 5}]}}
+        with mock.patch.object(upload_build, "transfer", side_effect=RuntimeError("transport")), \
+                mock.patch.object(upload_build, "api") as api:
+            with self.assertRaises(RuntimeError):
+                upload_build.transfer_all(Path("unused"), file, {"fileSize": 5, "sha256": "digest"})
+            api.assert_not_called()
+
+
+class BuildDeliveryTests(unittest.TestCase):
+    @mock.patch.dict(os.environ, {"APP_STORE_APPLE_ID": "app", "APPLE_STORE_PROXY_URL": "http://proxy.test:1234"})
+    def test_other_app_is_refused_before_creating_uploads(self):
+        with mock.patch.object(upload_build, "identity", return_value={"bundle_id": "com.expected.app"}), \
+                mock.patch.object(upload_build, "api", return_value={"data": {"attributes": {
+                    "bundleId": "com.other.app"}}}) as api, \
+                mock.patch.object(upload_build, "upload_record") as create:
+            with self.assertRaises(ValueError):
+                upload_build.deliver(Path("unused"), Path("unused-report"), 1)
+            self.assertEqual(api.call_count, 1)
+            create.assert_not_called()
+
+    @mock.patch.dict(os.environ, {"APP_STORE_APPLE_ID": "app", "APPLE_STORE_PROXY_URL": "http://proxy.test:1234"})
+    def test_completed_readback_retains_provider_build_identity(self):
+        reads = [{"data": {"attributes": {"bundleId": "com.expected.app"}}}, {"data": {
+            "attributes": {"state": {"state": "COMPLETE"}},
+            "relationships": {"build": {"data": {"id": "build-8"}}}}}]
+        with tempfile.TemporaryDirectory() as temporary, \
+                mock.patch.object(upload_build, "identity", return_value={"bundle_id": "com.expected.app"}), \
+                mock.patch.object(upload_build, "api", side_effect=reads) as api, \
+                mock.patch.object(upload_build, "upload_record", return_value={"id": "upload"}), \
+                mock.patch.object(upload_build, "upload_file", return_value={"id": "file"}), \
+                mock.patch.object(upload_build, "transfer_all"):
+            report = Path(temporary) / "receipt.json"
+            result = upload_build.deliver(Path("unused"), report, 1)
+            self.assertEqual(result["build_id"], "build-8")
+            self.assertEqual(result["state"], "COMPLETE")
+            self.assertIn('"build-8"', report.read_text())
+            self.assertEqual(api.call_args.kwargs["params"], {"include": "build"})
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/upload_build.py

@@ -0,0 +1,164 @@
+#!/usr/bin/env python3
+"""Upload an IPA through Apple's build-upload REST API and the account-pinned proxy."""
+from __future__ import annotations
+
+import argparse
+from concurrent.futures import ThreadPoolExecutor
+import hashlib
+import json
+import os
+from pathlib import Path
+import plistlib
+import time
+from urllib.parse import urlsplit
+import zipfile
+
+import asc_common
+import apple_store_proxy as store_proxy
+
+
+def api(method: str, path: str, body=None, params=None) -> dict:
+    token = asc_common.make_jwt(os.environ["ASC_KEY_ID"], os.environ["ASC_ISSUER_ID"],
+                                os.environ["ASC_KEY_PATH"])
+    # An uncertain create is discovered from the provider on the next invocation,
+    # never repeated automatically under a second upload identity.
+    return asc_common.request(method, path, token, json_body=body, params=params,
+                              max_attempts=3 if method == "GET" else 1).json()
+
+
+def identity(ipa: Path) -> dict:
+    with zipfile.ZipFile(ipa) as archive:
+        names = [name for name in archive.namelist()
+                 if name.startswith("Payload/") and name.endswith(".app/Info.plist") and name.count("/") == 2]
+        if len(names) != 1:
+            raise ValueError("IPA must contain one top-level app Info.plist")
+        info = plistlib.loads(archive.read(names[0]))
+    with ipa.open("rb") as stream:
+        digest = hashlib.file_digest(stream, "sha256").hexdigest()
+    return {"bundle_id": str(info["CFBundleIdentifier"]),
+            "cfBundleVersion": str(info["CFBundleVersion"]),
+            "cfBundleShortVersionString": str(info["CFBundleShortVersionString"]),
+            "sha256": digest, "fileName": digest + ".ipa", "fileSize": ipa.stat().st_size}
+
+
+def upload_record(app_id: str, info: dict) -> dict:
+    params = {"filter[cfBundleVersion]": info["cfBundleVersion"],
+              "filter[cfBundleShortVersionString]": info["cfBundleShortVersionString"],
+              "filter[platform]": "IOS", "limit": 200}
+    rows = api("GET", f"/apps/{app_id}/buildUploads", params=params).get("data") or []
+    rows = [row for row in rows if ((row.get("attributes") or {}).get("state") or {}).get("state") != "FAILED"]
+    if len(rows) > 1:
+        raise ValueError("multiple matching Apple build uploads; resolve their provider state before retrying")
+    if rows:
+        return rows[0]
+    return api("POST", "/buildUploads", {"data": {
+        "type": "buildUploads", "attributes": {"platform": "IOS", **{
+            key: info[key] for key in ("cfBundleVersion", "cfBundleShortVersionString")}},
+        "relationships": {"app": {"data": {"type": "apps", "id": app_id}}},
+    }})["data"]
+
+
+def upload_file(record: dict, info: dict) -> dict:
+    rows = api("GET", f"/buildUploads/{record['id']}/buildUploadFiles").get("data") or []
+    assets = [row for row in rows if (row.get("attributes") or {}).get("assetType") == "ASSET"]
+    if assets:
+        if len(assets) != 1 or any(assets[0]["attributes"].get(key) != info[key]
+                                  for key in ("fileName", "fileSize")):
+            raise ValueError("existing Apple build upload belongs to different IPA bytes; do not overwrite it")
+        return assets[0]
+    return api("POST", "/buildUploadFiles", {"data": {
+        "type": "buildUploadFiles", "attributes": {
+            "assetType": "ASSET", "uti": "com.apple.ipa", "fileName": info["fileName"], "fileSize": info["fileSize"]},
+        "relationships": {"buildUpload": {"data": {"type": "buildUploads", "id": record["id"]}}},
+    }})["data"]
+
+
+def transfer(ipa: Path, operation: dict) -> None:
+    parsed = urlsplit(operation["url"])
+    hosts = (".apple.com", ".icloud.com", ".amazonaws.com")
+    if parsed.scheme != "https" or not any((parsed.hostname or "").endswith(host) for host in hosts):
+        raise ValueError("Apple returned an unsupported upload destination")
+    if operation.get("method") != "PUT":
+        raise ValueError("Apple returned an unsupported upload method")
+    with ipa.open("rb") as stream:
+        stream.seek(operation["offset"])
+        data = stream.read(operation["length"])
+    if len(data) != operation["length"]:
+        raise ValueError("IPA changed during upload")
+    headers = {row["name"]: row["value"] for row in operation.get("requestHeaders") or []}
+    response = store_proxy.request("PUT", operation["url"], headers=headers, data=data,
+                                   timeout=(20, 300), allow_redirects=False)
+    if not 200 <= response.status_code < 300:
+        raise RuntimeError(f"Apple upload part refused ({response.status_code}); read upload state before retrying")
+
+
+def transfer_all(ipa: Path, file: dict, info: dict) -> None:
+    attributes = file.get("attributes") or {}
+    state = (attributes.get("assetDeliveryState") or {}).get("state")
+    if state == "COMPLETE":
+        expected = {"hash": info["sha256"], "algorithm": "SHA_256"}
+        if (attributes.get("sourceFileChecksums") or {}).get("file") != expected:
+            raise ValueError("Apple's completed file checksum does not match this IPA")
+        return
+    operations = sorted(attributes.get("uploadOperations") or [], key=lambda row: row["offset"])
+    offset = 0
+    for operation in operations:
+        if operation.get("offset") != offset or operation.get("length", 0) <= 0:
+            raise ValueError("Apple upload operations do not cover the IPA exactly")
+        offset += operation["length"]
+    if offset != info["fileSize"]:
+        raise ValueError("Apple upload operations do not cover the IPA exactly")
+    with ThreadPoolExecutor(max_workers=3) as executor:
+        results = [executor.submit(transfer, ipa, operation) for operation in operations]
+        for result in results:
+            result.result()
+    api("PATCH", f"/buildUploadFiles/{file['id']}", {"data": {
+        "type": "buildUploadFiles", "id": file["id"], "attributes": {"uploaded": True,
+        "sourceFileChecksums": {"file": {"hash": info["sha256"], "algorithm": "SHA_256"}}},
+    }})
+
+
+def deliver(ipa: Path, report: Path, timeout: int) -> dict:
+    store_proxy.proxies()  # Refuse before any identity or provider request.
+    info = identity(ipa)
+    app_id = os.environ["APP_STORE_APPLE_ID"]
+    app = api("GET", f"/apps/{app_id}")["data"]
+    if (app.get("attributes") or {}).get("bundleId") != info["bundle_id"]:
+        raise ValueError("IPA bundle identity does not match the selected App Store app")
+    record = upload_record(app_id, info)
+    file = upload_file(record, info)
+    receipt = {**info, "upload_id": record["id"], "file_id": file["id"], "proxy_required": True}
+    report.write_text(json.dumps(receipt, indent=2))
+    transfer_all(ipa, file, info)
+    deadline = time.monotonic() + timeout
+    while True:
+        current = api("GET", f"/buildUploads/{record['id']}", params={"include": "build"})["data"]
+        state = ((current.get("attributes") or {}).get("state") or {}).get("state")
+        receipt["state"] = state
+        receipt["build_id"] = (((current.get("relationships") or {}).get("build") or {}).get("data") or {}).get("id")
+        report.write_text(json.dumps(receipt, indent=2))
+        if state == "COMPLETE":
+            return receipt
+        if state == "FAILED":
+            raise RuntimeError("Apple build upload failed processing; inspect the upload ID's provider errors")
+        if time.monotonic() >= deadline:
+            raise RuntimeError("Apple build processing is pending; reuse this upload ID on continuation")
+        time.sleep(10)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("ipa", type=Path)
+    parser.add_argument("--report", required=True, type=Path)
+    parser.add_argument("--timeout", type=int, default=900)
+    args = parser.parse_args()
+    try:
+        receipt = deliver(args.ipa, args.report, args.timeout)
+    except (OSError, ValueError, KeyError, RuntimeError):
+        message = "Apple REST upload did not complete; retain its receipt and resolve the provider state"
+        raise SystemExit(message) from None
+    print(json.dumps(receipt))
+
+
+if __name__ == "__main__":
+    main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.56
+1.0.58

package/android-action/scripts/play_preflight.py

@@ -12,6 +12,8 @@ import google.auth.transport.requests
 import requests
 from google.oauth2 import service_account
 
+from play_store_proxy import session
+
 
 SCOPE = "https://www.googleapis.com/auth/androidpublisher"
 BASE_URL = "https://androidpublisher.googleapis.com/androidpublisher/v3"
@@ -36,13 +38,14 @@ def main() -> None:
     parser.add_argument("--service-account", required=True, type=Path)
     args = parser.parse_args()
 
+    client = session()
     credentials = service_account.Credentials.from_service_account_file(
         args.service_account, scopes=[SCOPE]
     )
-    credentials.refresh(google.auth.transport.requests.Request())
+    credentials.refresh(google.auth.transport.requests.Request(session=client))
     headers = {"Authorization": f"Bearer {credentials.token}"}
     url = f"{BASE_URL}/applications/{args.package}/edits"
-    response = requests.post(url, headers=headers, json={}, timeout=30)
+    response = client.post(url, headers=headers, json={}, timeout=30)
     if response.status_code == 404:
         write_ready(False)
         print(
@@ -57,7 +60,7 @@ def main() -> None:
 
     edit_id = json.loads(response.text)["id"]
     delete_url = f"{url}/{edit_id}"
-    deleted = requests.delete(delete_url, headers=headers, timeout=30)
+    deleted = client.delete(delete_url, headers=headers, timeout=30)
     if deleted.status_code not in (200, 204):
         message = response_message(deleted)
         raise SystemExit(f"cannot close Google Play preflight edit: {message}")
@@ -66,4 +69,7 @@ def main() -> None:
 
 
 if __name__ == "__main__":
-    main()
+    try:
+        main()
+    except requests.RequestException:
+        raise SystemExit("Google Play preflight failed through the assigned proxy") from None

package/android-action/scripts/play_store_proxy.py

@@ -0,0 +1,22 @@
+"""Google CI transport uses only the account-pinned proxy, including OAuth exchanges."""
+from __future__ import annotations
+
+import os
+from urllib.parse import urlsplit
+
+import requests
+
+
+def session() -> requests.Session:
+    value = os.environ.get("GOOGLE_STORE_PROXY_URL", "").strip()
+    try:
+        parsed = urlsplit(value)
+        valid = parsed.scheme in {"http", "https"} and parsed.hostname and parsed.port
+    except ValueError:
+        valid = False
+    if not valid:
+        raise SystemExit("GOOGLE_STORE_PROXY_URL must contain the account-pinned proxy; direct requests are refused")
+    client = requests.Session()
+    client.trust_env = False
+    client.proxies = {"http": value, "https": value}
+    return client

package/android-action/scripts/resolve_android.py

@@ -9,6 +9,7 @@ import sys
 from pathlib import Path
 
 import gradle_wrapper
+from play_store_proxy import session
 from android_config import (
     ConfigError,
     detect_package_name,
@@ -41,6 +42,7 @@ def highest_play_version_code(package_name: str, service_account: Path) -> int |
     Best-effort: any failure (offline, no permission, app not yet created) returns
     None so the caller falls back to GITHUB_RUN_NUMBER.
     """
+    client = session()
     try:
         import google.auth.transport.requests  # noqa: PLC0415
         import requests  # noqa: PLC0415
@@ -50,17 +52,17 @@ def highest_play_version_code(package_name: str, service_account: Path) -> int |
             str(service_account),
             scopes=["https://www.googleapis.com/auth/androidpublisher"],
         )
-        creds.refresh(google.auth.transport.requests.Request())
+        creds.refresh(google.auth.transport.requests.Request(session=client))
         base = "https://androidpublisher.googleapis.com/androidpublisher/v3"
         headers = {"Authorization": f"Bearer {creds.token}"}
 
-        edit = requests.post(
+        edit = client.post(
             f"{base}/applications/{package_name}/edits", headers=headers, timeout=60
         )
         edit.raise_for_status()
         edit_id = edit.json()["id"]
         try:
-            listed = requests.get(
+            listed = client.get(
                 f"{base}/applications/{package_name}/edits/{edit_id}/bundles",
                 headers=headers,
                 timeout=60,
@@ -72,14 +74,14 @@ def highest_play_version_code(package_name: str, service_account: Path) -> int |
                 if b.get("versionCode") is not None
             ]
         finally:
-            requests.delete(
+            client.delete(
                 f"{base}/applications/{package_name}/edits/{edit_id}",
                 headers=headers,
                 timeout=60,
             )
         return max(codes) if codes else None
     except Exception as exc:  # noqa: BLE001 - never fail the build over this
-        print(f"::warning::Could not read existing Play versionCodes ({exc}); "
+        print("::warning::Could not read existing Play versionCodes through the configured proxy; "
               f"falling back to GITHUB_RUN_NUMBER")
         return None
 

package/android-action/scripts/test_play_store_proxy.py

@@ -0,0 +1,30 @@
+"""Google OAuth and API requests use an explicit, non-fallback session."""
+import os
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_store_proxy
+
+
+class PlayProxyTests(unittest.TestCase):
+    def test_missing_proxy_never_constructs_a_direct_session(self):
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": ""}), \
+                mock.patch.object(play_store_proxy.requests, "Session") as session:
+            with self.assertRaises(SystemExit):
+                play_store_proxy.session()
+            session.assert_not_called()
+
+    def test_ambient_proxy_and_no_proxy_cannot_override_account_exit(self):
+        value = "http://assigned.proxy.test:1234"
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": value,
+                                         "HTTPS_PROXY": "http://other.proxy:9876", "NO_PROXY": "*"}):
+            with play_store_proxy.session() as client:
+                self.assertFalse(client.trust_env)
+                self.assertEqual(client.proxies, {"http": value, "https": value})
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.56
+1.0.58

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.56",
+  "version": "1.0.58",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/install.mjs

@@ -213,8 +213,8 @@ function printSummary() {
   console.log('Next steps:');
   console.log('  Recommended: configure encrypted Actions secrets:');
   console.log('    ASC_KEY_P8, ASC_KEY_ID, ASC_ISSUER_ID');
-  console.log('    IOS_DISTRIBUTION_P12_BASE64, IOS_DISTRIBUTION_CERT_META_JSON');
-  console.log('    IOS_DISTRIBUTION_CERT_REGISTRY_JSON');
+  console.log('    IOS_DISTRIBUTION_P12_BASE64, IOS_DISTRIBUTION_CERT_META_BASE64');
+  console.log('    IOS_DISTRIBUTION_CERT_REGISTRY_BASE64');
   console.log('    ANDROID_UPLOAD_KEY_BASE64, ANDROID_SIGNING_PROPERTIES');
   console.log('    GOOGLE_PLAY_SERVICE_ACCOUNT_JSON');
   console.log('  The workflow materializes them with mode 0600 only on its ephemeral runner.');

package/templates/deploy-web.yml

@@ -10,6 +10,7 @@ on:
       - 'pubspec.lock'
       - 'l10n.yaml'
       - 'analysis_options.yaml'
+      - '.github/actions/*/.daemux-version'
       - '.github/workflows/deploy-web.yml'
   workflow_dispatch:
 

package/templates/deploy.yml

@@ -27,6 +27,9 @@ jobs:
   # unrelated failure on the other platform cannot block the release you want.
   ios:
     name: iOS TestFlight
+    env:
+      APPLE_STORE_PROXY_URL: ${{ secrets.APPLE_STORE_PROXY_URL }}
+      GOOGLE_STORE_PROXY_URL: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
     if: ${{ vars.DEPLOY_PLATFORMS != 'android' }}
     runs-on: macos-15
     timeout-minutes: 60
@@ -43,8 +46,8 @@ jobs:
           CI_ASC_KEY_ID: ${{ secrets.ASC_KEY_ID }}
           CI_ASC_ISSUER_ID: ${{ secrets.ASC_ISSUER_ID }}
           CI_DISTRIBUTION_P12: ${{ secrets.IOS_DISTRIBUTION_P12_BASE64 }}
-          CI_DISTRIBUTION_META: ${{ secrets.IOS_DISTRIBUTION_CERT_META_JSON }}
-          CI_DISTRIBUTION_REGISTRY: ${{ secrets.IOS_DISTRIBUTION_CERT_REGISTRY_JSON }}
+          CI_DISTRIBUTION_META: ${{ secrets.IOS_DISTRIBUTION_CERT_META_BASE64 }}
+          CI_DISTRIBUTION_REGISTRY: ${{ secrets.IOS_DISTRIBUTION_CERT_REGISTRY_BASE64 }}
         run: |
           umask 077
           mkdir -p creds
@@ -59,11 +62,11 @@ jobs:
             exit 0
           fi
           : "${CI_DISTRIBUTION_P12:?IOS_DISTRIBUTION_P12_BASE64 secret is required}"
-          : "${CI_DISTRIBUTION_META:?IOS_DISTRIBUTION_CERT_META_JSON secret is required}"
-          : "${CI_DISTRIBUTION_REGISTRY:?IOS_DISTRIBUTION_CERT_REGISTRY_JSON secret is required}"
+          : "${CI_DISTRIBUTION_META:?IOS_DISTRIBUTION_CERT_META_BASE64 secret is required}"
+          : "${CI_DISTRIBUTION_REGISTRY:?IOS_DISTRIBUTION_CERT_REGISTRY_BASE64 secret is required}"
           printf '%s' "$CI_DISTRIBUTION_P12" | base64 -D > creds/cert.p12
-          printf '%s' "$CI_DISTRIBUTION_META" > creds/cert.meta.json
-          printf '%s' "$CI_DISTRIBUTION_REGISTRY" > creds/cert.registry.json
+          printf '%s' "$CI_DISTRIBUTION_META" | base64 -D > creds/cert.meta.json
+          printf '%s' "$CI_DISTRIBUTION_REGISTRY" | base64 -D > creds/cert.registry.json
           echo "source=encrypted" >> "$GITHUB_OUTPUT"
       - name: Detect Flutter
         id: flutter
@@ -207,6 +210,8 @@ jobs:
 
   android:
     name: Android Google Play
+    env:
+      GOOGLE_STORE_PROXY_URL: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
     if: ${{ vars.DEPLOY_PLATFORMS != 'ios' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 45
@@ -453,6 +458,11 @@ jobs:
         continue-on-error: true
         if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' }}
         uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
+        env:
+          HTTPS_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
+          HTTP_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
+          NO_PROXY: ''
+          no_proxy: ''
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
           packageName: ${{ steps.android.outputs.package-name }}
@@ -477,6 +487,11 @@ jobs:
               && steps.play.outputs.ready == 'true'
               && steps.play-upload.outcome == 'failure' }}
         uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
+        env:
+          HTTPS_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
+          HTTP_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
+          NO_PROXY: ''
+          no_proxy: ''
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
           packageName: ${{ steps.android.outputs.package-name }}