gowalk-cicd 1.0.57 → 1.0.59

package/CLAUDE.md

@@ -98,6 +98,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Detect and warn, tell the user to remove lines manually.
 - Store API calls belong in GitHub Actions. Local tests may build/sign but must
   never connect to App Store Connect or Google Play.
+- Every Apple/Google store API call, OAuth exchange and binary upload requires its
+  assigned `APPLE_STORE_PROXY_URL` / `GOOGLE_STORE_PROXY_URL` repository secret.
+  Python clients enforce explicit proxies; Play upload steps set the proxy for the
+  pinned Google client. Missing configuration must stop before a provider call.
+  Apple IPA uploads use `action/scripts/upload_build.py`, not native upload tools.
+  It retains provider IDs/checksums and verifies matching IPA identity before resume.
 - Signing material should use encrypted Actions secrets. `deploy.yml`
   materializes `ASC_KEY_P8` + its ID/issuer, the Apple distribution identity
   (`IOS_DISTRIBUTION_P12_BASE64`, `IOS_DISTRIBUTION_CERT_META_BASE64`,
@@ -155,31 +161,19 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   must not discard the symbols of a build that is already live. Symbol
   artifacts carry no `retention-days` so the repository's setting governs and
   can be raised to cover a release's life.
-- Crashlytics symbol upload is gated on the `firebase-app-id` action input,
-  which `deploy.yml` feeds from the `FIREBASE_APP_ID` repository variable on
-  both actions. Actions never read `vars.*` themselves — an unavailable
-  context inside a composite action invalidates every consumer's workflow —
-  so the variable crosses the workflow/action boundary as an input and the
-  feature reaches consumers only after the one-off `npx gowalk-cicd` that
-  refreshes `deploy.yml`. The variable holds one id per platform
-  (`1:<n>:android:<hash>`, `1:<n>:ios:<hash>`, comma/whitespace-separated);
-  each action picks its own and fails on anything that is not an id. Android
-  runs `firebase crashlytics:symbols:upload` (the only Android path Firebase
-  documents; needs Node + Java, no credentials) on the `--split-debug-info`
-  directory — `android-action/scripts/crashlytics_symbols.py`. iOS runs the
-  FirebaseCrashlytics pod's `upload-symbols` on the archive's dSYMs —
-  `action/scripts/crashlytics_dsyms.py` — because Flutter's `.symbols` are
-  ELF debug info the Firebase CLI's generators reject for Apple targets, and
-  `App.framework.dSYM` is the documented Apple path. Both run before the
-  store upload and fail closed — except an iOS id on an app with no
-  FirebaseCrashlytics `upload-symbols` tool, which is a warn-and-skip: an app
-  that does not embed the SDK has nothing to symbolicate. Logic belongs in
-  those scripts, where it is unit-tested, not inline in YAML. Supporting
-  invariants: the workflow's disk-space step must never remove
-  `/usr/local/lib/node_modules` (npm and npx live there); `firebase-tools` is
-  pinned exactly because the Android job holds the keystore and the Play
-  service account; the CLI runs from a temp cwd so its `.crashlytics/` debris
-  never lands in the checkout.
+- Firebase Crashlytics traffic follows the Google account proxy. Android builds and
+  the pinned Firebase CLI receive the explicit proxy environment; Crashlytics Gradle
+  2.9.2+ and the pinned buildtools support it (generic JVM networking does not).
+  Native iOS upload-symbols uses NSURLSession, so it is never executed. Before
+  archiving, dedicated Crashlytics upload phases in the ephemeral Xcode projects
+  are deferred; mixed/unidentified upload phases refuse the archive for repair.
+  CI retains the archive's dSYMs as a ZIP with UUIDs, source SHA and SHA-256, then
+  emits `firebase_symbols_pending` (`gowalk-cicd/firebase-symbols-pending.v1`).
+  The app session downloads that exact artifact and uploads it through its
+  account-pinned Firebase console, reading processing back before completing the
+  delivery request. This requires no human handoff. A green CI run alone is not
+  evidence that the deferred symbols reached Firebase. Android retains its Dart
+  symbols and uploads them before the store bundle, using the configured proxy.
 - The iOS action reads every script and prompt from the snapshot it takes of
   itself in its first step (`$SWIFT_APP_ACTION`, under `RUNNER_TEMP`), never
   from `${{ github.action_path }}` after that step. The plugin self-update
@@ -188,14 +182,15 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   release that fixes it; the snapshot is what keeps that run on one version.
   `test_action_step_order.py` pins both. A new script reference in
   `action/action.yml` therefore uses `"$SWIFT_APP_ACTION/scripts/..."`.
-- Two situations end a green job with work for the panel, and each is a typed
+- Three situations end a green job with work for the panel, and each is a typed
   check-run annotation (`::notice title=<name>::<one-line JSON with a versioned
   schema>`), never prose in a `::warning::`: `play_review_pending`
   (`templates/deploy.yml`, Play refused auto-submit and the bundle landed
   unsubmitted) and `store_version_locked` (`action/action.yml`, the
   `TESTFLIGHT_ONLY` decision of `manage_marketing_version.py`: an App Store
   version is under review, so the build shipped to TestFlight under that
-  version and metadata was skipped). The README table lists the schemas; add a
+  version and metadata was skipped), and `firebase_symbols_pending` (the dSYM
+  archive awaits the session's proxied console upload). The README lists the schemas; add a
   field by bumping the version.
 - The JDK is chosen by `scripts/select_jdk.py`, called from the workflow before
   `setup-java`. The `JAVA_VERSION` repo variable always wins; otherwise Flutter

package/README.md

@@ -279,6 +279,7 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | --- | --- | --- |
 | `play_review_pending` | `gowalk-cicd/play-review-pending.v1` | `package`, `track`, `version_code` |
 | `store_version_locked` | `gowalk-cicd/store-version-locked.v1` | `version`, `state`, `build_number` |
+| `firebase_symbols_pending` | `gowalk-cicd/firebase-symbols-pending.v1` | `platform`, `app_id`, `source_sha`, `artifact`, `file`, `sha256`, `status` |
 
 Add a field by bumping the schema version; never change the meaning of an
 existing one.
@@ -329,7 +330,7 @@ The Android job removes the preinstalled toolchains a Flutter build never uses
 (.NET, the Android NDK, GHC, PowerShell, Swift, Chromium) and prunes Docker
 images, reclaiming roughly 25 GB in a few seconds. It prints `df -h /` before
 and after. Linux only; skipped in Bitrise mode. npm survives on purpose: the
-[Crashlytics symbol upload](#crashlytics-symbol-upload-firebase_app_id) runs
+[Crashlytics symbol upload](#crashlytics-symbol-delivery-firebase_app_id) runs
 the Firebase CLI through `npx`.
 
 ### Private git dependencies (Flutter)
@@ -572,77 +573,41 @@ the workflow uploads them itself once the repository variable
 **`FIREBASE_APP_ID`** is set — see below. Sentry or others: upload the same
 directory to that service from your own pipeline.
 
-#### Crashlytics symbol upload (`FIREBASE_APP_ID`)
+#### Crashlytics symbol delivery (`FIREBASE_APP_ID`)
 
-Set the repository variable `FIREBASE_APP_ID` to the app's Firebase App ID —
-`1:<project number>:<platform>:<hash>`. An app that ships both platforms has
-two ids (they differ in the third segment); list both, separated by a comma:
+Set the repository variable to the Firebase App IDs for the shipping platforms
+(`1:<project>:ios:<hash>` and/or `1:<project>:android:<hash>`). The workflow passes it
+as the `firebase-app-id` input. Configure the account's `GOOGLE_STORE_PROXY_URL`
+repository secret before any provider operation.
 
-```
-1:123456789012:android:0a1b2c3d4e5f6a7b,1:123456789012:ios:7b6a5f4e3d2c1b0a
-```
+Android builds and the pinned Firebase CLI receive the proxy explicitly, including
+Crashlytics mapping/native-symbol uploads. Crashlytics Gradle 2.9.2+ supports proxy
+environment variables; older versions must be updated before use. Dart symbols are
+retained as artifacts and uploaded through that transport before the bundle ships.
 
-Find them in `lib/firebase_options.dart` (`appId`), in
-`android/app/google-services.json` (`mobilesdk_app_id`) and
-`ios/Runner/GoogleService-Info.plist` (`GOOGLE_APP_ID`), or under *Project
-settings → Your apps* in the Firebase console. No credentials are needed:
-both upload tools authenticate by app id alone.
+Native iOS `upload-symbols` is refused because it does not use this environment
+transport. CI defers dedicated native upload phases in its ephemeral projects and
+retains `ios-crashlytics-symbols-<run>-<attempt>` with `ios-dsyms.zip` and a manifest
+containing UUIDs, source SHA and SHA-256. The typed `firebase_symbols_pending`
+annotation uses schema `gowalk-cicd/firebase-symbols-pending.v1` and names the exact
+artifact. The autonomous app session must upload it through the account-pinned
+Firebase console's Crashlytics dSYMs tab and read back processing; no human action
+is required. A completed CI run does not mean this deferred upload is complete.
+[Firebase documents the ZIP upload interface](https://firebase.google.com/docs/crashlytics/ios/get-deobfuscated-reports).
 
-The variable reaches the actions through `deploy.yml`, which
-[auto-update never touches](#deployyml-is-not-auto-updated) — an existing repo
-must run `npx --yes gowalk-cicd` once before setting it does anything.
-
-| | Android | iOS |
-|---|---|---|
-| What is uploaded | the `--split-debug-info` directory, with the command Firebase documents for Flutter: `firebase crashlytics:symbols:upload --app=<android id> <dir>` (Firebase CLI through `npx`, major-pinned) | every dSYM in the archive — `App.framework.dSYM` carries the Dart frames — with the `upload-symbols` tool from the FirebaseCrashlytics pod: `upload-symbols -ai <ios id> -p ios -- <archive>/dSYMs` |
-| When | in the Android action, right after the build and before the bundle goes to Play | in the iOS action, right after the IPA export and before the TestFlight upload |
-| If it fails | the deploy fails; nothing ships with crashes nobody can read. The symbols are still in the `android-symbols-*` artifact for a manual upload | same — the failure lands before the TestFlight upload, so nothing shipped; fix the cause and re-run the deploy |
-| Variable unset | a `::warning::` when the app depends on `firebase_crashlytics` (every Dart frame will be `***`) | nothing — the run-script phase that `flutterfire configure` adds already uploads `App.framework.dSYM`, and the workflow installs the flutterfire CLI it needs |
-| Variable set for the other platform only | a `::warning::`, no upload | a `::notice::`, no upload |
-
-Why the two platforms differ: Flutter's `.symbols` files are ELF debug info,
-which the Firebase CLI's symbol generators accept for Android and reject for
-Apple targets; Firebase documents dSYMs as the Apple path, and Flutter 3.12+
-puts the Dart debug info into `App.framework.dSYM`. On iOS the explicit
-upload is a belt-and-braces over the run-script phase — it also covers the
-native `Runner.app.dSYM` and every plugin framework — so a phase that is
-missing or failing can never leave a build unreadable.
-
-A value that is not a Firebase App ID fails the deploy rather than being
-skipped: a typo must not become a fleet that silently stops uploading symbols.
-An iOS id on an app that does not embed Crashlytics (no `upload-symbols` tool
-anywhere under the project) is a warning, not a failure — an app without the
-SDK has no Crashlytics crashes to symbolicate. Android apps delivered through
-Bitrise are built by Bitrise and are not covered.
-
-Obfuscation renames identifiers, so code that depends on their spelling breaks
-at runtime, not at build time. Do not rely on `runtimeType.toString()`,
-`Type.toString()`, or on matching class or function names in stack traces
-(`Foo` becomes `Lk`, and a raw trace is a row of `***`) — compare types with
-`is` instead. Enum values keep their names today (`Color.red.toString()` is
-still `Color.red`), but `flutter build --help` lists `Enum.toString()` among
-the methods that may return obfuscated results, so prefer `Enum.name` when the
-identifier matters.
-
-Where the flags are applied: Android passes them straight to
-`flutter build appbundle`. iOS is less obvious — `deploy.yml` runs
-`flutter build ios --config-only` with the flags, which writes
-`DART_OBFUSCATION=true` and `SPLIT_DEBUG_INFO=<dir>` into
-`ios/Flutter/Generated.xcconfig`, and the Flutter build phase inside the
-`xcodebuild archive` that follows compiles against those settings. The symbol
-directory lives under the runner's temp directory on both platforms, never in
-the checkout.
-
-Because the iOS half lives in `deploy.yml`, which
-[auto-update never touches](#deployyml-is-not-auto-updated), an existing
-Flutter repo gets Android obfuscation on its next auto-update but iOS
-obfuscation only after a one-off `npx --yes gowalk-cicd`. The Android action
-retains its own symbols precisely so that this half-updated state is safe.
 
 ### iOS delivery
 
 The iOS composite action runs on `macos-15` and:
 
+All Apple and Google store requests require an account-pinned proxy, including OAuth,
+metadata and binary transfer. Provision `APPLE_STORE_PROXY_URL` and
+`GOOGLE_STORE_PROXY_URL` as encrypted repository secrets before deployment. A missing
+proxy refuses provider calls; there is no direct fallback. Refresh existing workflow
+files with the released installer while preserving application-specific build inputs.
+The Apple uploader retains `apple-upload-<run>-<attempt>` receipts with IPA SHA-256,
+upload ID and processing readback, and resumes matching bytes after interruption.
+
 1. **Auto-detects** your `.xcodeproj` / `.xcworkspace`, scheme, bundle ID,
    and `team_id` (from the ASC API key). No `ci.config.yaml` required —
    override via action inputs only if auto-detection fails.
@@ -659,7 +624,7 @@ The iOS composite action runs on `macos-15` and:
    `CI-<bundle_id>`. Patches the `.pbxproj` to use Manual signing against those
    profiles.
 6. **Archives** with `xcodebuild archive`, exports the IPA, and uploads via
-   `xcrun altool`.
+   Apple's build-upload REST API through `APPLE_STORE_PROXY_URL`.
 7. **Sets "What's New"** on every declared localization (reads
    `fastlane/metadata/ios/<locale>/release_notes.txt` if present, or from the
    `app-store-whats-new` input).
@@ -967,7 +932,7 @@ Changes that need that manual run:
   `ios-symbols-*`. See [Dart obfuscation](#dart-obfuscation-flutter-apps).
 - **Crashlytics symbol upload** — `firebase-app-id: ${{ vars.FIREBASE_APP_ID }}`
   passed to both actions. Until it is, setting the variable does nothing.
-  See [Crashlytics symbol upload](#crashlytics-symbol-upload-firebase_app_id).
+  See [Crashlytics symbol upload](#crashlytics-symbol-delivery-firebase_app_id).
 
 ### Opt out
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.57
+1.0.59

package/action/action.yml

@@ -345,7 +345,7 @@ runs:
             test
         fi
 
-    - name: Stage ASC API key for xcrun / altool
+    - name: Stage ASC API key for authenticated REST uploads
       if: ${{ inputs.archive == 'true' }}
       shell: bash
       run: |
@@ -353,7 +353,7 @@ runs:
         # prints env: blocks on step-group expansion, which leaks secrets.
         # read_config.py already validated creds/AuthKey_<KEY_ID>_Issuer_<UUID>.p8
         # exists and exported ASC_KEY_P8_PATH; we copy the file on disk and
-        # stage it where xcrun/altool expect it (~/.appstoreconnect/private_keys).
+        # stage it for the authenticated REST clients only.
         : "${ASC_KEY_ID:?ASC_KEY_ID env var is required}"
         : "${ASC_ISSUER_ID:?ASC_ISSUER_ID env var is required}"
         : "${ASC_KEY_P8_PATH:?ASC_KEY_P8_PATH env var is required (set by read_config.py)}"
@@ -364,9 +364,6 @@ runs:
         mkdir -p "$RUNNER_TEMP/asc"
         cp "$ASC_KEY_P8_PATH" "$RUNNER_TEMP/asc/AuthKey.p8"
         chmod 600 "$RUNNER_TEMP/asc/AuthKey.p8"
-        mkdir -p ~/.appstoreconnect/private_keys
-        cp "$RUNNER_TEMP/asc/AuthKey.p8" \
-          ~/.appstoreconnect/private_keys/AuthKey_${ASC_KEY_ID}.p8
         echo "ASC_KEY_PATH=$RUNNER_TEMP/asc/AuthKey.p8" >> "$GITHUB_ENV"
 
     - name: Resolve marketing version (project source of truth)
@@ -696,6 +693,16 @@ runs:
           || /usr/libexec/PlistBuddy -c "Add :ITSAppUsesNonExemptEncryption bool $VALUE" "$INFOPLIST_PATH"
         echo "Set ITSAppUsesNonExemptEncryption=$VALUE in $INFOPLIST_PATH"
 
+    - name: Defer native Firebase upload phases to the proxied console
+      if: ${{ inputs.archive == 'true' }}
+      shell: bash
+      env:
+        PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
+        WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
+      run: |
+        python3 "$SWIFT_APP_ACTION/scripts/prepare_crashlytics_build.py" \
+          --search-root "$(dirname "${WORKSPACE:-$PROJECT}")"
+
     - name: Archive
       if: ${{ inputs.archive == 'true' }}
       shell: bash
@@ -790,47 +797,46 @@ runs:
     # set (deploy.yml passes the FIREBASE_APP_ID repository variable) every
     # dSYM in the archive is uploaded here as well, with the upload-symbols
     # tool from the FirebaseCrashlytics pod, so a missing or broken phase
-    # cannot leave a build unreadable. Before the TestFlight upload on
-    # purpose: a failed upload fails the deploy instead of shipping crashes
-    # nobody can read. Logic and its tests live in scripts/crashlytics_dsyms.py.
-    - name: Upload dSYMs to Crashlytics
-      if: ${{ inputs.archive == 'true' && inputs.upload == 'true' && inputs.firebase-app-id != '' }}
+    # cannot lose the exact build's symbols. The autonomous session completes
+    # the upload through the proxied Firebase console from this typed artifact.
+    - name: Retain dSYMs for the proxied Firebase console
+      if: ${{ inputs.archive == 'true' && inputs.upload == 'true' }}
       shell: bash
       env:
         FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}
         PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
         WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
       run: |
-        python3 "$SWIFT_APP_ACTION/scripts/crashlytics_dsyms.py" \
+        python3 "$SWIFT_APP_ACTION/scripts/prepare_crashlytics_dsyms.py" \
           --archive "$RUNNER_TEMP/app.xcarchive" \
-          --search-root "$(dirname "${WORKSPACE:-$PROJECT}")"
+          --search-root "$(dirname "${WORKSPACE:-$PROJECT}")" \
+          --output "$RUNNER_TEMP/firebase-symbols"
+
+    - name: Preserve the Firebase console upload artifact
+      if: ${{ always() && inputs.archive == 'true' }}
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      with:
+        name: ios-crashlytics-symbols-${{ github.run_id }}-${{ github.run_attempt }}
+        path: ${{ runner.temp }}/firebase-symbols/
+        if-no-files-found: ignore
 
     - name: Upload to TestFlight
       if: ${{ inputs.archive == 'true' && inputs.upload == 'true' }}
       shell: bash
+      env:
+        APP_STORE_APPLE_ID: ${{ inputs.app-store-apple-id || env.CFG_APP_STORE_APPLE_ID }}
       run: |
         IPA=$(ls "$RUNNER_TEMP"/export/*.ipa | head -1)
-        echo "Uploading $IPA"
-        LOG="$RUNNER_TEMP/altool.log"
-        set +e
-        xcrun altool --upload-app \
-          --type ios \
-          --file "$IPA" \
-          --apiKey "$ASC_KEY_ID" \
-          --apiIssuer "$ASC_ISSUER_ID" \
-          --output-format normal 2>&1 | tee "$LOG"
-        ALTOOL_RC=${PIPESTATUS[0]}
-        set -e
-        # altool occasionally exits 0 even on failure; verify the final outcome marker.
-        # Apple's altool prints transient "ERROR:" lines for retried network blips
-        # before emitting "UPLOAD SUCCEEDED" — don't false-positive on those.
-        if [ "$ALTOOL_RC" -ne 0 ] \
-            || grep -qE '^Failed to upload|ERROR ITMS-' "$LOG" \
-            || ! grep -qE 'UPLOAD SUCCEEDED|No errors uploading archive' "$LOG"; then
-          echo "altool reported an upload failure (rc=$ALTOOL_RC)"
-          exit 1
-        fi
-        echo "Upload succeeded"
+        python3 "$SWIFT_APP_ACTION/scripts/upload_build.py" "$IPA" \
+          --report "$RUNNER_TEMP/apple-build-upload.json"
+
+    - name: Retain Apple upload receipt
+      if: ${{ always() && inputs.archive == 'true' && inputs.upload == 'true' }}
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      with:
+        name: apple-upload-${{ github.run_id }}-${{ github.run_attempt }}
+        path: ${{ runner.temp }}/apple-build-upload.json
+        if-no-files-found: ignore
 
     # Both App Store metadata writers are skipped while an App Store version
     # is locked (STORE_VERSION_LOCKED, the TESTFLIGHT_ONLY decision): there is

package/action/scripts/apple_store_proxy.py

@@ -0,0 +1,28 @@
+"""Explicit account-pinned transport for CI; missing proxy never means direct egress."""
+from __future__ import annotations
+
+import os
+from urllib.parse import urlsplit
+
+import requests
+
+
+def proxies() -> dict[str, str]:
+    value = os.environ.get("APPLE_STORE_PROXY_URL", "").strip()
+    try:
+        parsed = urlsplit(value)
+        valid = parsed.scheme in {"http", "https"} and parsed.hostname and parsed.port
+    except ValueError:
+        valid = False
+    if not valid:
+        raise SystemExit("APPLE_STORE_PROXY_URL must contain the account-pinned proxy; direct requests are refused")
+    return {"http": value, "https": value}
+
+
+def request(method: str, url: str, **kwargs) -> requests.Response:
+    # An explicit map also wins over NO_PROXY and any unrelated runner proxy.
+    try:
+        return requests.request(method, url, proxies=proxies(), **kwargs)
+    except requests.RequestException:
+        # Proxy errors can embed credentials and signed upload URLs.
+        raise RuntimeError("Apple request failed through the configured proxy") from None

package/action/scripts/asc_common.py

@@ -16,6 +16,8 @@ from typing import Any
 import jwt
 import requests
 
+from apple_store_proxy import proxies
+
 
 ASC_BASE = "https://api.appstoreconnect.apple.com/v1"
 
@@ -162,11 +164,11 @@ def _retry_network_error(
     if attempt >= total - 1:
         raise SystemExit(
             f"ASC {method} {path} network error after {total} "
-            f"attempts: {exc!r}"
+            "attempts through the configured proxy"
         )
     delay = backoffs[attempt]
     print(
-        f"ASC {method} {path} network error ({exc!r}); "
+        f"ASC {method} {path} network error through the configured proxy; "
         f"retrying in {delay}s ({attempt + 1}/{total - 1})",
         file=sys.stderr,
     )
@@ -222,7 +224,7 @@ def request(
         try:
             resp = requests.request(
                 method, url, headers=headers, params=params,
-                json=json_body, timeout=timeout,
+                json=json_body, timeout=timeout, proxies=proxies(),
             )
         except requests.RequestException as exc:
             _retry_network_error(method, path, attempt, total, backoffs, exc)

package/action/scripts/crashlytics_dsyms.py

@@ -1,28 +1,9 @@
 #!/usr/bin/env python3
-"""Upload every dSYM in the archive to Firebase Crashlytics.
-
-Crashlytics symbolicates Apple crashes from dSYMs. For a Flutter app that
-includes App.framework.dSYM, which is where the Dart frames come from — and
-the only Apple-platform path Firebase documents for Flutter's obfuscated,
---split-debug-info builds (the .symbols files those flags write are ELF
-debug info that the Firebase CLI's symbol generators reject). The run-script
-phase `flutterfire configure` adds already uploads that one dSYM during the
-archive; this script uploads all of them (App.framework, the app binary,
-plugin frameworks) with the `upload-symbols` tool that ships in the
-FirebaseCrashlytics pod, so a missing or broken phase cannot leave a build
-unreadable, and native frames get their symbols too.
-
-    upload-symbols -ai <FIREBASE_APP_ID> -p ios -- <archive>/dSYMs
-
-No credentials: the tool authenticates by app id alone.
-
-Gating: FIREBASE_APP_ID holds the app's Firebase App ID(s),
-`1:<project number>:<platform>:<hash>`, comma- or whitespace-separated when an
-app ships both platforms; the iOS one is used and its absence is a notice, not
-a failure (the run-script phase is the documented default). With an iOS id
-present, a missing tool or a failed upload fails the step — the action runs it
-before the TestFlight upload, so a deploy never goes out with crashes nobody
-can read.
+"""Shared Crashlytics app/tool discovery and the retired native uploader interface.
+
+CI uses prepare_crashlytics_dsyms.py to retain an archive and a typed console-upload
+receipt. Native upload-symbols uses NSURLSession without the task proxy environment,
+so executing it from this legacy interface is refused. No direct fallback is allowed.
 """
 
 from __future__ import annotations
@@ -104,11 +85,8 @@ def upload_command(tool: Path, app_id: str, dsyms_dir: Path) -> list[str]:
 
 
 def _default_run(cmd: list[str]) -> int:
-    try:
-        return subprocess.run(cmd, check=False).returncode
-    except OSError as exc:
-        print(f"::error::could not run {cmd[0]}: {exc}")
-        return 126
+    raise SystemExit("Native Crashlytics upload is refused; use prepare_crashlytics_dsyms.py "
+                     "and complete the upload through the account-proxied console")
 
 
 def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, run=None,
@@ -134,10 +112,10 @@ def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, r
         if ids:
             print(
                 "::notice::FIREBASE_APP_ID names no iOS app (1:<project number>:ios:<hash>); "
-                "relying on the Crashlytics run-script phase for dSYM upload."
+                "native upload is disabled; use the proxied console delivery."
             )
         else:
-            print("FIREBASE_APP_ID unset; relying on the Crashlytics run-script phase for dSYM upload.")
+            print("FIREBASE_APP_ID unset; native upload is disabled; configure proxied console delivery.")
         return 0
 
     dsyms_dir = args.archive / "dSYMs"

package/action/scripts/prepare_crashlytics_build.py

@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""Defer dedicated native Crashlytics upload phases to the proxied console delivery."""
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import plistlib
+import re
+import shlex
+import subprocess
+
+MARKER = "echo 'Crashlytics dSYMs are retained by CI for the account-proxied console upload'"
+UPLOADS = ("upload-crashlytics-symbols", "upload-symbols", "Crashlytics/run")
+
+
+def dedicated(script: str) -> bool:
+    lines = [line.strip() for line in script.replace("\\\n", " ").splitlines()
+             if line.strip() and not line.lstrip().startswith("#")]
+    commands = [line for line in lines if not re.fullmatch(r'(?:export )?PATH=[^;&|<>`]+', line)]
+    if len(commands) != 1 or any(token in script for token in ("$(", "`")):
+        return False
+    lexer = shlex.shlex(commands[0], posix=True, punctuation_chars=";&|<>")
+    lexer.whitespace_split = True
+    tokens = list(lexer)
+    if not tokens or any(set(token) <= set(";&|<>") for token in tokens):
+        return False
+    return (tokens[0].endswith(("upload-symbols", "Crashlytics/run"))
+            or (tokens[0] == "flutterfire" and tokens[1:2] == ["upload-crashlytics-symbols"]))
+
+
+def rewrite(document: dict) -> list[str]:
+    changed = []
+    for identity, phase in document.get("objects", {}).items():
+        if phase.get("isa") != "PBXShellScriptBuildPhase":
+            continue
+        script = phase.get("shellScript", "")
+        active = "\n".join(line for line in script.splitlines() if not line.lstrip().startswith("#"))
+        if not any(token in active for token in UPLOADS):
+            continue
+        if "crashlytics" not in str(phase.get("name", "")).lower() or not dedicated(script):
+            raise ValueError("Crashlytics upload is in a mixed build phase; separate it before archiving")
+        phase["shellScript"] = MARKER
+        changed.append(identity)
+    return changed
+
+
+def prepare(root: Path) -> int:
+    root = root.resolve()
+    projects = sorted(root.rglob("project.pbxproj"))
+    prepared = []
+    for project in projects:
+        if project.is_symlink() or root not in project.resolve().parents:
+            raise ValueError("Xcode project leaves the CI workspace")
+        raw = subprocess.check_output(["plutil", "-convert", "json", "-o", "-", str(project)], timeout=30)
+        document = json.loads(raw)
+        changed = rewrite(document)
+        if changed:
+            prepared.append((project, document, changed))
+    # Validate every project before changing one; a mixed phase cannot produce
+    # a partially rewritten workspace that a caller accidentally archives.
+    for project, document, changed in prepared:
+        temporary = project.with_suffix(".proxy-new")
+        try:
+            temporary.write_bytes(plistlib.dumps(document, sort_keys=False))
+            temporary.replace(project)
+        finally:
+            temporary.unlink(missing_ok=True)
+        print(f"Deferred {len(changed)} Crashlytics upload phase(s) in {project.relative_to(root)}")
+    return sum(len(changed) for _, _, changed in prepared)
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--search-root", required=True, type=Path)
+    args = parser.parse_args()
+    prepare(args.search_root)

package/action/scripts/prepare_crashlytics_dsyms.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Retain iOS dSYMs and a typed receipt for automatic upload through the proxied console."""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import subprocess
+import zipfile
+
+from crashlytics_dsyms import find_upload_symbols, select_app_id
+
+SCHEMA = "gowalk-cicd/firebase-symbols-pending.v1"
+
+
+def prepare(archive: Path, output: Path, app_id: str) -> dict:
+    root = (archive / "dSYMs").resolve()
+    bundles = sorted(root.glob("*.dSYM"))
+    files = sorted(path for bundle in bundles for path in bundle.rglob("*") if path.is_file())
+    if not files or any(path.is_symlink() or root not in path.resolve().parents for path in files):
+        raise ValueError("Archive must contain dSYM files owned by this build")
+    output.mkdir(parents=True, exist_ok=True)
+    target = output / "ios-dsyms.zip"
+    with zipfile.ZipFile(target, "w", compression=zipfile.ZIP_DEFLATED) as zipped:
+        for path in files:
+            zipped.write(path, path.relative_to(root))
+    with target.open("rb") as stream:
+        digest = hashlib.file_digest(stream, "sha256").hexdigest()
+    uuids = subprocess.check_output(["dwarfdump", "--uuid", *(str(bundle) for bundle in bundles)],
+                                    text=True, timeout=60).splitlines()
+    artifact = f"ios-crashlytics-symbols-{os.environ['GITHUB_RUN_ID']}-{os.environ['GITHUB_RUN_ATTEMPT']}"
+    receipt = {"schema": SCHEMA, "platform": "ios", "app_id": app_id,
+               "source_sha": os.environ["GITHUB_SHA"], "artifact": artifact,
+               "file": target.name, "sha256": digest, "status": "pending_console_upload"}
+    (output / "firebase-symbols.json").write_text(json.dumps({**receipt, "uuids": uuids}, indent=2))
+    return receipt
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--archive", required=True, type=Path)
+    parser.add_argument("--search-root", required=True, type=Path)
+    parser.add_argument("--output", required=True, type=Path)
+    args = parser.parse_args()
+    app_id = select_app_id(os.environ.get("FIREBASE_APP_ID", ""), "ios")
+    tool = find_upload_symbols(args.search_root)
+    if not tool:
+        print("No Crashlytics SDK upload tool found; no Firebase symbol delivery is required.")
+        return
+    if not app_id:
+        raise SystemExit("The app embeds Crashlytics but FIREBASE_APP_ID names no iOS app")
+    receipt = prepare(args.archive, args.output, app_id)
+    print("::notice title=firebase_symbols_pending::" + json.dumps(receipt, separators=(",", ":")))
+
+
+if __name__ == "__main__":
+    main()

package/action/scripts/test_action_step_order.py

@@ -47,7 +47,7 @@ class TestActionStepOrder(unittest.TestCase):
                         order["Commit + push refreshed app-ci"])
         # ... and before every other step that talks to a store or signs.
         for later in ("Resolve credentials + auto-detect Xcode project",
-                      "Stage ASC API key for xcrun / altool",
+                      "Stage ASC API key for authenticated REST uploads",
                       "Prepare signing (cert + keychain + per-target profiles + pbxproj)",
                       "Archive"):
             self.assertLess(order["Commit + push refreshed app-ci"], order[later], later)