gowalk-cicd 1.0.58 → 1.0.60

package/CLAUDE.md

@@ -96,6 +96,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - Keep the CLI surface minimal: `--dry-run`, `-v`, `-h`. Resist adding flags.
 - `.gitignore` in the consumer repo is git-tracked. Never auto-edit it.
   Detect and warn, tell the user to remove lines manually.
+- Never repeat an `env:` key in another case (`NO_PROXY` beside `no_proxy`): GitHub
+  compares env keys case-insensitively and rejects the whole workflow or action file.
+  `test/env-keys.test.mjs` scans the templates and actions. Set lower-case spellings
+  or clear a lower-case bypass through `play_store_proxy.py -- <command>` (child
+  process) or `play_store_proxy.py --github-env` (later steps), never through YAML.
 - Store API calls belong in GitHub Actions. Local tests may build/sign but must
   never connect to App Store Connect or Google Play.
 - Every Apple/Google store API call, OAuth exchange and binary upload requires its
@@ -161,31 +166,19 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   must not discard the symbols of a build that is already live. Symbol
   artifacts carry no `retention-days` so the repository's setting governs and
   can be raised to cover a release's life.
-- Crashlytics symbol upload is gated on the `firebase-app-id` action input,
-  which `deploy.yml` feeds from the `FIREBASE_APP_ID` repository variable on
-  both actions. Actions never read `vars.*` themselves — an unavailable
-  context inside a composite action invalidates every consumer's workflow —
-  so the variable crosses the workflow/action boundary as an input and the
-  feature reaches consumers only after the one-off `npx gowalk-cicd` that
-  refreshes `deploy.yml`. The variable holds one id per platform
-  (`1:<n>:android:<hash>`, `1:<n>:ios:<hash>`, comma/whitespace-separated);
-  each action picks its own and fails on anything that is not an id. Android
-  runs `firebase crashlytics:symbols:upload` (the only Android path Firebase
-  documents; needs Node + Java, no credentials) on the `--split-debug-info`
-  directory — `android-action/scripts/crashlytics_symbols.py`. iOS runs the
-  FirebaseCrashlytics pod's `upload-symbols` on the archive's dSYMs —
-  `action/scripts/crashlytics_dsyms.py` — because Flutter's `.symbols` are
-  ELF debug info the Firebase CLI's generators reject for Apple targets, and
-  `App.framework.dSYM` is the documented Apple path. Both run before the
-  store upload and fail closed — except an iOS id on an app with no
-  FirebaseCrashlytics `upload-symbols` tool, which is a warn-and-skip: an app
-  that does not embed the SDK has nothing to symbolicate. Logic belongs in
-  those scripts, where it is unit-tested, not inline in YAML. Supporting
-  invariants: the workflow's disk-space step must never remove
-  `/usr/local/lib/node_modules` (npm and npx live there); `firebase-tools` is
-  pinned exactly because the Android job holds the keystore and the Play
-  service account; the CLI runs from a temp cwd so its `.crashlytics/` debris
-  never lands in the checkout.
+- Firebase Crashlytics traffic follows the Google account proxy. Android builds and
+  the pinned Firebase CLI receive the explicit proxy environment; Crashlytics Gradle
+  2.9.2+ and the pinned buildtools support it (generic JVM networking does not).
+  Native iOS upload-symbols uses NSURLSession, so it is never executed. Before
+  archiving, dedicated Crashlytics upload phases in the ephemeral Xcode projects
+  are deferred; mixed/unidentified upload phases refuse the archive for repair.
+  CI retains the archive's dSYMs as a ZIP with UUIDs, source SHA and SHA-256, then
+  emits `firebase_symbols_pending` (`gowalk-cicd/firebase-symbols-pending.v1`).
+  The app session downloads that exact artifact and uploads it through its
+  account-pinned Firebase console, reading processing back before completing the
+  delivery request. This requires no human handoff. A green CI run alone is not
+  evidence that the deferred symbols reached Firebase. Android retains its Dart
+  symbols and uploads them before the store bundle, using the configured proxy.
 - The iOS action reads every script and prompt from the snapshot it takes of
   itself in its first step (`$SWIFT_APP_ACTION`, under `RUNNER_TEMP`), never
   from `${{ github.action_path }}` after that step. The plugin self-update
@@ -194,14 +187,15 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   release that fixes it; the snapshot is what keeps that run on one version.
   `test_action_step_order.py` pins both. A new script reference in
   `action/action.yml` therefore uses `"$SWIFT_APP_ACTION/scripts/..."`.
-- Two situations end a green job with work for the panel, and each is a typed
+- Three situations end a green job with work for the panel, and each is a typed
   check-run annotation (`::notice title=<name>::<one-line JSON with a versioned
   schema>`), never prose in a `::warning::`: `play_review_pending`
   (`templates/deploy.yml`, Play refused auto-submit and the bundle landed
   unsubmitted) and `store_version_locked` (`action/action.yml`, the
   `TESTFLIGHT_ONLY` decision of `manage_marketing_version.py`: an App Store
   version is under review, so the build shipped to TestFlight under that
-  version and metadata was skipped). The README table lists the schemas; add a
+  version and metadata was skipped), and `firebase_symbols_pending` (the dSYM
+  archive awaits the session's proxied console upload). The README lists the schemas; add a
   field by bumping the version.
 - The JDK is chosen by `scripts/select_jdk.py`, called from the workflow before
   `setup-java`. The `JAVA_VERSION` repo variable always wins; otherwise Flutter

package/README.md

@@ -279,6 +279,7 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | --- | --- | --- |
 | `play_review_pending` | `gowalk-cicd/play-review-pending.v1` | `package`, `track`, `version_code` |
 | `store_version_locked` | `gowalk-cicd/store-version-locked.v1` | `version`, `state`, `build_number` |
+| `firebase_symbols_pending` | `gowalk-cicd/firebase-symbols-pending.v1` | `platform`, `app_id`, `source_sha`, `artifact`, `file`, `sha256`, `status` |
 
 Add a field by bumping the schema version; never change the meaning of an
 existing one.
@@ -329,7 +330,7 @@ The Android job removes the preinstalled toolchains a Flutter build never uses
 (.NET, the Android NDK, GHC, PowerShell, Swift, Chromium) and prunes Docker
 images, reclaiming roughly 25 GB in a few seconds. It prints `df -h /` before
 and after. Linux only; skipped in Bitrise mode. npm survives on purpose: the
-[Crashlytics symbol upload](#crashlytics-symbol-upload-firebase_app_id) runs
+[Crashlytics symbol upload](#crashlytics-symbol-delivery-firebase_app_id) runs
 the Firebase CLI through `npx`.
 
 ### Private git dependencies (Flutter)
@@ -572,72 +573,28 @@ the workflow uploads them itself once the repository variable
 **`FIREBASE_APP_ID`** is set — see below. Sentry or others: upload the same
 directory to that service from your own pipeline.
 
-#### Crashlytics symbol upload (`FIREBASE_APP_ID`)
+#### Crashlytics symbol delivery (`FIREBASE_APP_ID`)
 
-Set the repository variable `FIREBASE_APP_ID` to the app's Firebase App ID —
-`1:<project number>:<platform>:<hash>`. An app that ships both platforms has
-two ids (they differ in the third segment); list both, separated by a comma:
+Set the repository variable to the Firebase App IDs for the shipping platforms
+(`1:<project>:ios:<hash>` and/or `1:<project>:android:<hash>`). The workflow passes it
+as the `firebase-app-id` input. Configure the account's `GOOGLE_STORE_PROXY_URL`
+repository secret before any provider operation.
 
-```
-1:123456789012:android:0a1b2c3d4e5f6a7b,1:123456789012:ios:7b6a5f4e3d2c1b0a
-```
+Android builds and the pinned Firebase CLI receive the proxy explicitly, including
+Crashlytics mapping/native-symbol uploads. Crashlytics Gradle 2.9.2+ supports proxy
+environment variables; older versions must be updated before use. Dart symbols are
+retained as artifacts and uploaded through that transport before the bundle ships.
 
-Find them in `lib/firebase_options.dart` (`appId`), in
-`android/app/google-services.json` (`mobilesdk_app_id`) and
-`ios/Runner/GoogleService-Info.plist` (`GOOGLE_APP_ID`), or under *Project
-settings → Your apps* in the Firebase console. No credentials are needed:
-both upload tools authenticate by app id alone.
+Native iOS `upload-symbols` is refused because it does not use this environment
+transport. CI defers dedicated native upload phases in its ephemeral projects and
+retains `ios-crashlytics-symbols-<run>-<attempt>` with `ios-dsyms.zip` and a manifest
+containing UUIDs, source SHA and SHA-256. The typed `firebase_symbols_pending`
+annotation uses schema `gowalk-cicd/firebase-symbols-pending.v1` and names the exact
+artifact. The autonomous app session must upload it through the account-pinned
+Firebase console's Crashlytics dSYMs tab and read back processing; no human action
+is required. A completed CI run does not mean this deferred upload is complete.
+[Firebase documents the ZIP upload interface](https://firebase.google.com/docs/crashlytics/ios/get-deobfuscated-reports).
 
-The variable reaches the actions through `deploy.yml`, which
-[auto-update never touches](#deployyml-is-not-auto-updated) — an existing repo
-must run `npx --yes gowalk-cicd` once before setting it does anything.
-
-| | Android | iOS |
-|---|---|---|
-| What is uploaded | the `--split-debug-info` directory, with the command Firebase documents for Flutter: `firebase crashlytics:symbols:upload --app=<android id> <dir>` (Firebase CLI through `npx`, major-pinned) | every dSYM in the archive — `App.framework.dSYM` carries the Dart frames — with the `upload-symbols` tool from the FirebaseCrashlytics pod: `upload-symbols -ai <ios id> -p ios -- <archive>/dSYMs` |
-| When | in the Android action, right after the build and before the bundle goes to Play | in the iOS action, right after the IPA export and before the TestFlight upload |
-| If it fails | the deploy fails; nothing ships with crashes nobody can read. The symbols are still in the `android-symbols-*` artifact for a manual upload | same — the failure lands before the TestFlight upload, so nothing shipped; fix the cause and re-run the deploy |
-| Variable unset | a `::warning::` when the app depends on `firebase_crashlytics` (every Dart frame will be `***`) | nothing — the run-script phase that `flutterfire configure` adds already uploads `App.framework.dSYM`, and the workflow installs the flutterfire CLI it needs |
-| Variable set for the other platform only | a `::warning::`, no upload | a `::notice::`, no upload |
-
-Why the two platforms differ: Flutter's `.symbols` files are ELF debug info,
-which the Firebase CLI's symbol generators accept for Android and reject for
-Apple targets; Firebase documents dSYMs as the Apple path, and Flutter 3.12+
-puts the Dart debug info into `App.framework.dSYM`. On iOS the explicit
-upload is a belt-and-braces over the run-script phase — it also covers the
-native `Runner.app.dSYM` and every plugin framework — so a phase that is
-missing or failing can never leave a build unreadable.
-
-A value that is not a Firebase App ID fails the deploy rather than being
-skipped: a typo must not become a fleet that silently stops uploading symbols.
-An iOS id on an app that does not embed Crashlytics (no `upload-symbols` tool
-anywhere under the project) is a warning, not a failure — an app without the
-SDK has no Crashlytics crashes to symbolicate. Android apps delivered through
-Bitrise are built by Bitrise and are not covered.
-
-Obfuscation renames identifiers, so code that depends on their spelling breaks
-at runtime, not at build time. Do not rely on `runtimeType.toString()`,
-`Type.toString()`, or on matching class or function names in stack traces
-(`Foo` becomes `Lk`, and a raw trace is a row of `***`) — compare types with
-`is` instead. Enum values keep their names today (`Color.red.toString()` is
-still `Color.red`), but `flutter build --help` lists `Enum.toString()` among
-the methods that may return obfuscated results, so prefer `Enum.name` when the
-identifier matters.
-
-Where the flags are applied: Android passes them straight to
-`flutter build appbundle`. iOS is less obvious — `deploy.yml` runs
-`flutter build ios --config-only` with the flags, which writes
-`DART_OBFUSCATION=true` and `SPLIT_DEBUG_INFO=<dir>` into
-`ios/Flutter/Generated.xcconfig`, and the Flutter build phase inside the
-`xcodebuild archive` that follows compiles against those settings. The symbol
-directory lives under the runner's temp directory on both platforms, never in
-the checkout.
-
-Because the iOS half lives in `deploy.yml`, which
-[auto-update never touches](#deployyml-is-not-auto-updated), an existing
-Flutter repo gets Android obfuscation on its next auto-update but iOS
-obfuscation only after a one-off `npx --yes gowalk-cicd`. The Android action
-retains its own symbols precisely so that this half-updated state is safe.
 
 ### iOS delivery
 
@@ -975,7 +932,7 @@ Changes that need that manual run:
   `ios-symbols-*`. See [Dart obfuscation](#dart-obfuscation-flutter-apps).
 - **Crashlytics symbol upload** — `firebase-app-id: ${{ vars.FIREBASE_APP_ID }}`
   passed to both actions. Until it is, setting the variable does nothing.
-  See [Crashlytics symbol upload](#crashlytics-symbol-upload-firebase_app_id).
+  See [Crashlytics symbol upload](#crashlytics-symbol-delivery-firebase_app_id).
 
 ### Opt out
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.58
+1.0.60

package/action/action.yml

@@ -693,6 +693,16 @@ runs:
           || /usr/libexec/PlistBuddy -c "Add :ITSAppUsesNonExemptEncryption bool $VALUE" "$INFOPLIST_PATH"
         echo "Set ITSAppUsesNonExemptEncryption=$VALUE in $INFOPLIST_PATH"
 
+    - name: Defer native Firebase upload phases to the proxied console
+      if: ${{ inputs.archive == 'true' }}
+      shell: bash
+      env:
+        PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
+        WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
+      run: |
+        python3 "$SWIFT_APP_ACTION/scripts/prepare_crashlytics_build.py" \
+          --search-root "$(dirname "${WORKSPACE:-$PROJECT}")"
+
     - name: Archive
       if: ${{ inputs.archive == 'true' }}
       shell: bash
@@ -787,20 +797,28 @@ runs:
     # set (deploy.yml passes the FIREBASE_APP_ID repository variable) every
     # dSYM in the archive is uploaded here as well, with the upload-symbols
     # tool from the FirebaseCrashlytics pod, so a missing or broken phase
-    # cannot leave a build unreadable. Before the TestFlight upload on
-    # purpose: a failed upload fails the deploy instead of shipping crashes
-    # nobody can read. Logic and its tests live in scripts/crashlytics_dsyms.py.
-    - name: Upload dSYMs to Crashlytics
-      if: ${{ inputs.archive == 'true' && inputs.upload == 'true' && inputs.firebase-app-id != '' }}
+    # cannot lose the exact build's symbols. The autonomous session completes
+    # the upload through the proxied Firebase console from this typed artifact.
+    - name: Retain dSYMs for the proxied Firebase console
+      if: ${{ inputs.archive == 'true' && inputs.upload == 'true' }}
       shell: bash
       env:
         FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}
         PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
         WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
       run: |
-        python3 "$SWIFT_APP_ACTION/scripts/crashlytics_dsyms.py" \
+        python3 "$SWIFT_APP_ACTION/scripts/prepare_crashlytics_dsyms.py" \
           --archive "$RUNNER_TEMP/app.xcarchive" \
-          --search-root "$(dirname "${WORKSPACE:-$PROJECT}")"
+          --search-root "$(dirname "${WORKSPACE:-$PROJECT}")" \
+          --output "$RUNNER_TEMP/firebase-symbols"
+
+    - name: Preserve the Firebase console upload artifact
+      if: ${{ always() && inputs.archive == 'true' }}
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      with:
+        name: ios-crashlytics-symbols-${{ github.run_id }}-${{ github.run_attempt }}
+        path: ${{ runner.temp }}/firebase-symbols/
+        if-no-files-found: ignore
 
     - name: Upload to TestFlight
       if: ${{ inputs.archive == 'true' && inputs.upload == 'true' }}

package/action/scripts/crashlytics_dsyms.py

@@ -1,28 +1,9 @@
 #!/usr/bin/env python3
-"""Upload every dSYM in the archive to Firebase Crashlytics.
-
-Crashlytics symbolicates Apple crashes from dSYMs. For a Flutter app that
-includes App.framework.dSYM, which is where the Dart frames come from — and
-the only Apple-platform path Firebase documents for Flutter's obfuscated,
---split-debug-info builds (the .symbols files those flags write are ELF
-debug info that the Firebase CLI's symbol generators reject). The run-script
-phase `flutterfire configure` adds already uploads that one dSYM during the
-archive; this script uploads all of them (App.framework, the app binary,
-plugin frameworks) with the `upload-symbols` tool that ships in the
-FirebaseCrashlytics pod, so a missing or broken phase cannot leave a build
-unreadable, and native frames get their symbols too.
-
-    upload-symbols -ai <FIREBASE_APP_ID> -p ios -- <archive>/dSYMs
-
-No credentials: the tool authenticates by app id alone.
-
-Gating: FIREBASE_APP_ID holds the app's Firebase App ID(s),
-`1:<project number>:<platform>:<hash>`, comma- or whitespace-separated when an
-app ships both platforms; the iOS one is used and its absence is a notice, not
-a failure (the run-script phase is the documented default). With an iOS id
-present, a missing tool or a failed upload fails the step — the action runs it
-before the TestFlight upload, so a deploy never goes out with crashes nobody
-can read.
+"""Shared Crashlytics app/tool discovery and the retired native uploader interface.
+
+CI uses prepare_crashlytics_dsyms.py to retain an archive and a typed console-upload
+receipt. Native upload-symbols uses NSURLSession without the task proxy environment,
+so executing it from this legacy interface is refused. No direct fallback is allowed.
 """
 
 from __future__ import annotations
@@ -104,11 +85,8 @@ def upload_command(tool: Path, app_id: str, dsyms_dir: Path) -> list[str]:
 
 
 def _default_run(cmd: list[str]) -> int:
-    try:
-        return subprocess.run(cmd, check=False).returncode
-    except OSError as exc:
-        print(f"::error::could not run {cmd[0]}: {exc}")
-        return 126
+    raise SystemExit("Native Crashlytics upload is refused; use prepare_crashlytics_dsyms.py "
+                     "and complete the upload through the account-proxied console")
 
 
 def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, run=None,
@@ -134,10 +112,10 @@ def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, r
         if ids:
             print(
                 "::notice::FIREBASE_APP_ID names no iOS app (1:<project number>:ios:<hash>); "
-                "relying on the Crashlytics run-script phase for dSYM upload."
+                "native upload is disabled; use the proxied console delivery."
             )
         else:
-            print("FIREBASE_APP_ID unset; relying on the Crashlytics run-script phase for dSYM upload.")
+            print("FIREBASE_APP_ID unset; native upload is disabled; configure proxied console delivery.")
         return 0
 
     dsyms_dir = args.archive / "dSYMs"

package/action/scripts/prepare_crashlytics_build.py

@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""Defer dedicated native Crashlytics upload phases to the proxied console delivery."""
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import plistlib
+import re
+import shlex
+import subprocess
+
+MARKER = "echo 'Crashlytics dSYMs are retained by CI for the account-proxied console upload'"
+UPLOADS = ("upload-crashlytics-symbols", "upload-symbols", "Crashlytics/run")
+
+
+def dedicated(script: str) -> bool:
+    lines = [line.strip() for line in script.replace("\\\n", " ").splitlines()
+             if line.strip() and not line.lstrip().startswith("#")]
+    commands = [line for line in lines if not re.fullmatch(r'(?:export )?PATH=[^;&|<>`]+', line)]
+    if len(commands) != 1 or any(token in script for token in ("$(", "`")):
+        return False
+    lexer = shlex.shlex(commands[0], posix=True, punctuation_chars=";&|<>")
+    lexer.whitespace_split = True
+    tokens = list(lexer)
+    if not tokens or any(set(token) <= set(";&|<>") for token in tokens):
+        return False
+    return (tokens[0].endswith(("upload-symbols", "Crashlytics/run"))
+            or (tokens[0] == "flutterfire" and tokens[1:2] == ["upload-crashlytics-symbols"]))
+
+
+def rewrite(document: dict) -> list[str]:
+    changed = []
+    for identity, phase in document.get("objects", {}).items():
+        if phase.get("isa") != "PBXShellScriptBuildPhase":
+            continue
+        script = phase.get("shellScript", "")
+        active = "\n".join(line for line in script.splitlines() if not line.lstrip().startswith("#"))
+        if not any(token in active for token in UPLOADS):
+            continue
+        if "crashlytics" not in str(phase.get("name", "")).lower() or not dedicated(script):
+            raise ValueError("Crashlytics upload is in a mixed build phase; separate it before archiving")
+        phase["shellScript"] = MARKER
+        changed.append(identity)
+    return changed
+
+
+def prepare(root: Path) -> int:
+    root = root.resolve()
+    projects = sorted(root.rglob("project.pbxproj"))
+    prepared = []
+    for project in projects:
+        if project.is_symlink() or root not in project.resolve().parents:
+            raise ValueError("Xcode project leaves the CI workspace")
+        raw = subprocess.check_output(["plutil", "-convert", "json", "-o", "-", str(project)], timeout=30)
+        document = json.loads(raw)
+        changed = rewrite(document)
+        if changed:
+            prepared.append((project, document, changed))
+    # Validate every project before changing one; a mixed phase cannot produce
+    # a partially rewritten workspace that a caller accidentally archives.
+    for project, document, changed in prepared:
+        temporary = project.with_suffix(".proxy-new")
+        try:
+            temporary.write_bytes(plistlib.dumps(document, sort_keys=False))
+            temporary.replace(project)
+        finally:
+            temporary.unlink(missing_ok=True)
+        print(f"Deferred {len(changed)} Crashlytics upload phase(s) in {project.relative_to(root)}")
+    return sum(len(changed) for _, _, changed in prepared)
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--search-root", required=True, type=Path)
+    args = parser.parse_args()
+    prepare(args.search_root)

package/action/scripts/prepare_crashlytics_dsyms.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Retain iOS dSYMs and a typed receipt for automatic upload through the proxied console."""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import subprocess
+import zipfile
+
+from crashlytics_dsyms import find_upload_symbols, select_app_id
+
+SCHEMA = "gowalk-cicd/firebase-symbols-pending.v1"
+
+
+def prepare(archive: Path, output: Path, app_id: str) -> dict:
+    root = (archive / "dSYMs").resolve()
+    bundles = sorted(root.glob("*.dSYM"))
+    files = sorted(path for bundle in bundles for path in bundle.rglob("*") if path.is_file())
+    if not files or any(path.is_symlink() or root not in path.resolve().parents for path in files):
+        raise ValueError("Archive must contain dSYM files owned by this build")
+    output.mkdir(parents=True, exist_ok=True)
+    target = output / "ios-dsyms.zip"
+    with zipfile.ZipFile(target, "w", compression=zipfile.ZIP_DEFLATED) as zipped:
+        for path in files:
+            zipped.write(path, path.relative_to(root))
+    with target.open("rb") as stream:
+        digest = hashlib.file_digest(stream, "sha256").hexdigest()
+    uuids = subprocess.check_output(["dwarfdump", "--uuid", *(str(bundle) for bundle in bundles)],
+                                    text=True, timeout=60).splitlines()
+    artifact = f"ios-crashlytics-symbols-{os.environ['GITHUB_RUN_ID']}-{os.environ['GITHUB_RUN_ATTEMPT']}"
+    receipt = {"schema": SCHEMA, "platform": "ios", "app_id": app_id,
+               "source_sha": os.environ["GITHUB_SHA"], "artifact": artifact,
+               "file": target.name, "sha256": digest, "status": "pending_console_upload"}
+    (output / "firebase-symbols.json").write_text(json.dumps({**receipt, "uuids": uuids}, indent=2))
+    return receipt
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--archive", required=True, type=Path)
+    parser.add_argument("--search-root", required=True, type=Path)
+    parser.add_argument("--output", required=True, type=Path)
+    args = parser.parse_args()
+    app_id = select_app_id(os.environ.get("FIREBASE_APP_ID", ""), "ios")
+    tool = find_upload_symbols(args.search_root)
+    if not tool:
+        print("No Crashlytics SDK upload tool found; no Firebase symbol delivery is required.")
+        return
+    if not app_id:
+        raise SystemExit("The app embeds Crashlytics but FIREBASE_APP_ID names no iOS app")
+    receipt = prepare(args.archive, args.output, app_id)
+    print("::notice title=firebase_symbols_pending::" + json.dumps(receipt, separators=(",", ":")))
+
+
+if __name__ == "__main__":
+    main()

package/action/scripts/test_crashlytics_dsyms.py

@@ -151,12 +151,9 @@ class MainTest(unittest.TestCase):
         self.assertNotIn("::error::", out)
         self.assertIn("upload-symbols", out)
 
-    def test_a_broken_tool_is_a_named_error_not_a_traceback(self) -> None:
-        out = io.StringIO()
-        with redirect_stdout(out):
-            rc = cd._default_run([str(self.root / "gowalk-cicd-no-such-binary")])
-        self.assertNotEqual(rc, 0)
-        self.assertIn("::error::", out.getvalue())
+    def test_native_tool_is_refused_without_executing_it(self) -> None:
+        with self.assertRaisesRegex(SystemExit, "account-proxied console"):
+            cd._default_run([str(self.root / "upload-symbols")])
 
     def test_missing_dsyms_fail_before_any_upload(self) -> None:
         code, out = self.run_main({"FIREBASE_APP_ID": IOS}, archive=self.root / "missing.xcarchive")
@@ -193,18 +190,18 @@ class CrashlyticsWiringTest(unittest.TestCase):
         self.assertNotIn("vars.", text)
 
     def test_dsyms_go_up_after_export_and_before_testflight(self) -> None:
-        upload = step("Upload dSYMs to Crashlytics")
+        upload = step("Retain dSYMs for the proxied Firebase console")
         self.assertIn("inputs.archive == 'true'", upload)
         # Only builds that actually ship: an archive-only run (upload=false)
         # must not be failed over a symbols upload.
         self.assertIn("inputs.upload == 'true'", upload)
-        self.assertIn("inputs.firebase-app-id != ''", upload)
+        self.assertNotIn("inputs.firebase-app-id != ''", upload)
         self.assertIn("FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}", upload)
-        self.assertIn("scripts/crashlytics_dsyms.py", upload)
+        self.assertIn("scripts/prepare_crashlytics_dsyms.py", upload)
         self.assertIn('--archive "$RUNNER_TEMP/app.xcarchive"', upload)
         text = ACTION_YML.read_text()
-        self.assertLess(text.index("- name: Export IPA"), text.index("- name: Upload dSYMs to Crashlytics"))
-        self.assertLess(text.index("- name: Upload dSYMs to Crashlytics"), text.index("- name: Upload to TestFlight"))
+        self.assertLess(text.index("- name: Export IPA"), text.index("- name: Retain dSYMs for the proxied Firebase console"))
+        self.assertLess(text.index("- name: Retain dSYMs for the proxied Firebase console"), text.index("- name: Upload to TestFlight"))
 
     def test_the_script_ships_with_the_action(self) -> None:
         self.assertTrue((ACTION_YML.parent / "scripts" / "crashlytics_dsyms.py").is_file())

package/action/scripts/test_prepare_crashlytics.py

@@ -0,0 +1,94 @@
+"""Native upload fencing and durable symbols preserve the exact archive without provider calls."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest import mock
+import zipfile
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import crashlytics_dsyms
+import prepare_crashlytics_build as build
+import prepare_crashlytics_dsyms as symbols
+
+
+class BuildPhaseTests(unittest.TestCase):
+    def test_dedicated_phase_is_deferred_without_changing_build_objects(self):
+        other = {"isa": "PBXSourcesBuildPhase", "files": ["source"]}
+        doc = {"objects": {"code": other, "symbols": {"isa": "PBXShellScriptBuildPhase",
+               "name": "Crashlytics Upload Symbols", "shellScript": '"$PODS_ROOT/FirebaseCrashlytics/run"'}}}
+        self.assertEqual(build.rewrite(doc), ["symbols"])
+        self.assertEqual(doc["objects"]["code"], other)
+        self.assertEqual(doc["objects"]["symbols"]["shellScript"], build.MARKER)
+        self.assertEqual(build.rewrite(doc), [])
+
+    def test_unidentified_upload_phase_refuses_the_archive(self):
+        doc = {"objects": {"mixed": {"isa": "PBXShellScriptBuildPhase", "name": "Build everything",
+                                   "shellScript": "compile-app; upload-symbols"}}}
+        with self.assertRaises(ValueError):
+            build.rewrite(doc)
+
+    def test_crashlytics_name_cannot_hide_other_build_work(self):
+        doc = {"objects": {"mixed": {"isa": "PBXShellScriptBuildPhase", "name": "Crashlytics",
+                                   "shellScript": "compile-app; upload-symbols"}}}
+        with self.assertRaises(ValueError):
+            build.rewrite(doc)
+        self.assertTrue(build.dedicated('#!/bin/sh\nPATH="$PATH:$HOME/bin"\n'
+                                       'flutterfire upload-crashlytics-symbols --platform=ios'))
+
+    def test_legacy_native_entrypoint_never_starts_the_binary(self):
+        with mock.patch.object(crashlytics_dsyms.subprocess, "run") as run:
+            with self.assertRaises(SystemExit):
+                crashlytics_dsyms._default_run(["upload-symbols"])
+            run.assert_not_called()
+
+    def test_every_project_is_validated_before_any_file_changes(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            first, second = root / "A.xcodeproj", root / "B.xcodeproj"
+            first.mkdir(); second.mkdir()
+            for parent in (first, second):
+                (parent / "project.pbxproj").write_text("original")
+            documents = [json.dumps({"objects": {"phase": {"isa": "PBXShellScriptBuildPhase",
+                         "name": name, "shellScript": "upload-symbols"}}}).encode()
+                         for name in ("Crashlytics", "Mixed")]
+            with mock.patch.object(build.subprocess, "check_output", side_effect=documents):
+                with self.assertRaises(ValueError):
+                    build.prepare(root)
+            self.assertEqual((first / "project.pbxproj").read_text(), "original")
+
+
+@mock.patch.dict(os.environ, {"GITHUB_RUN_ID": "123", "GITHUB_RUN_ATTEMPT": "2", "GITHUB_SHA": "source-sha"})
+class ArchiveTests(unittest.TestCase):
+    def test_zip_manifest_and_notice_identify_the_same_build(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            dwarf = root / "app.xcarchive/dSYMs/App.framework.dSYM/Contents/Resources/DWARF/App"
+            dwarf.parent.mkdir(parents=True); dwarf.write_bytes(b"actual debug symbols")
+            output = root / "output"
+            with mock.patch.object(symbols.subprocess, "check_output", return_value="UUID: expected (arm64) App\n"):
+                receipt = symbols.prepare(root / "app.xcarchive", output, "1:2:ios:abc")
+            manifest = json.loads((output / "firebase-symbols.json").read_text())
+            self.assertEqual(receipt["source_sha"], "source-sha")
+            self.assertEqual(receipt["artifact"], "ios-crashlytics-symbols-123-2")
+            self.assertEqual(receipt["sha256"], hashlib.sha256((output / "ios-dsyms.zip").read_bytes()).hexdigest())
+            self.assertEqual(manifest["uuids"], ["UUID: expected (arm64) App"])
+            with zipfile.ZipFile(output / "ios-dsyms.zip") as zipped:
+                self.assertEqual(zipped.read(zipped.namelist()[0]), b"actual debug symbols")
+
+    def test_symlink_to_another_owner_cannot_enter_the_artifact(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            other = root / "other"; other.write_bytes(b"private")
+            dsym = root / "app.xcarchive/dSYMs/App.dSYM"; dsym.mkdir(parents=True)
+            (dsym / "outside").symlink_to(other)
+            with self.assertRaises(ValueError):
+                symbols.prepare(root / "app.xcarchive", root / "output", "1:2:ios:abc")
+            self.assertFalse((root / "output").exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.58
+1.0.60

package/android-action/action.yml

@@ -128,6 +128,12 @@ runs:
       if: ${{ steps.config.outputs.project_kind == 'flutter' }}
       shell: bash
       env:
+        # Only one spelling per key: GitHub compares env keys case-insensitively and
+        # rejects the file otherwise. play_store_proxy.py -- runs the build with both
+        # spellings set and both NO_PROXY spellings cleared for the child process.
+        HTTPS_PROXY: ${{ env.GOOGLE_STORE_PROXY_URL }}
+        HTTP_PROXY: ${{ env.GOOGLE_STORE_PROXY_URL }}
+        NO_PROXY: ''
         BUILD_NAME: ${{ inputs.build-name }}
         DART_DEFINES: ${{ inputs.dart-defines }}
         DART_SYMBOLS_DIR: ${{ runner.temp }}/dart-symbols/android
@@ -151,7 +157,7 @@ runs:
             *) echo "::error::dart-defines entry '$define' is not KEY=VALUE"; exit 1 ;;
           esac
         done
-        flutter "${args[@]}"
+        python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- flutter "${args[@]}"
         if ! ls "$DART_SYMBOLS_DIR"/*.symbols >/dev/null 2>&1; then
           echo "::error::flutter build wrote no Dart symbol files to $DART_SYMBOLS_DIR;" \
                "a crash from this obfuscated build could never be read. Refusing to ship it."
@@ -227,10 +233,17 @@ runs:
       shell: bash
       working-directory: ${{ steps.config.outputs.gradle_root || '.' }}
       env:
+        # Only one spelling per key: GitHub compares env keys case-insensitively and
+        # rejects the file otherwise. play_store_proxy.py -- runs the build with both
+        # spellings set and both NO_PROXY spellings cleared for the child process.
+        HTTPS_PROXY: ${{ env.GOOGLE_STORE_PROXY_URL }}
+        HTTP_PROXY: ${{ env.GOOGLE_STORE_PROXY_URL }}
+        NO_PROXY: ''
         ANDROID_BUILD_NAME: ${{ inputs.build-name }}
       run: |
         chmod +x ./gradlew
-        ./gradlew "${ANDROID_GRADLE_MODULE}:bundleRelease" \
+        python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- \
+          ./gradlew "${ANDROID_GRADLE_MODULE}:bundleRelease" \
           --init-script "${{ github.action_path }}/scripts/version_override.init.gradle" \
           --console=plain --stacktrace
 

package/android-action/scripts/crashlytics_symbols.py

@@ -32,6 +32,8 @@ import sys
 import tempfile
 from pathlib import Path
 
+from play_store_proxy import environment
+
 # Exact pin, not a range: this job holds the upload keystore and the Play
 # service account, so no floating third-party code runs in it. Bump on purpose.
 FIREBASE_TOOLS = "firebase-tools@15.28.2"
@@ -97,9 +99,10 @@ def _default_run(cmd: list[str]) -> int:
     # A scratch cwd: the Crashlytics buildtools drop a .crashlytics/ directory
     # (dump_syms.bin, ~4 MB) into the working directory, which must not be the
     # consumer's checkout.
-    workdir = tempfile.mkdtemp(prefix="crashlytics-upload-")
+    env = environment()
     try:
-        return subprocess.run(cmd, check=False, cwd=workdir).returncode
+        with tempfile.TemporaryDirectory(prefix="crashlytics-upload-") as workdir:
+            return subprocess.run(cmd, check=False, cwd=workdir, env=env).returncode
     except FileNotFoundError:
         print(
             "::error::npx is not on PATH, so the Firebase CLI cannot run. "
@@ -166,7 +169,7 @@ def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, r
         print(
             f"::error::Crashlytics symbol upload failed (exit {rc}). The symbols are "
             "retained as the android-symbols artifact; after fixing the cause, upload "
-            f"them by hand with: firebase crashlytics:symbols:upload --app={app_id} <dir>"
+            f"them through the configured proxy after restoring its transport."
         )
         return 1
     print(f"Uploaded Dart symbols to Crashlytics app {app_id}.")

package/android-action/scripts/play_preflight.py

@@ -9,6 +9,7 @@ import os
 from pathlib import Path
 
 import google.auth.transport.requests
+from google.auth.exceptions import TransportError
 import requests
 from google.oauth2 import service_account
 
@@ -71,5 +72,5 @@ def main() -> None:
 if __name__ == "__main__":
     try:
         main()
-    except requests.RequestException:
+    except (requests.RequestException, TransportError):
         raise SystemExit("Google Play preflight failed through the assigned proxy") from None

package/android-action/scripts/play_store_proxy.py

@@ -1,13 +1,29 @@
-"""Google CI transport uses only the account-pinned proxy, including OAuth exchanges."""
+"""Google CI transport uses only the account-pinned proxy, including OAuth exchanges.
+
+Three entry points, all from the one validated ``GOOGLE_STORE_PROXY_URL``:
+
+* ``python3 play_store_proxy.py`` refuses a missing or malformed proxy.
+* ``python3 play_store_proxy.py -- <command …>`` runs a build tool with the explicit
+  proxy in both spellings and both ``NO_PROXY`` spellings cleared. Setting the pairs
+  as YAML ``env`` keys is not an option: GitHub compares env keys case-insensitively
+  and rejects the workflow or action file as invalid.
+* ``python3 play_store_proxy.py --github-env`` clears the lower-case ambient bypass
+  (``no_proxy``) for the rest of the job, so a JavaScript upload step that can only
+  carry upper-case ``env`` keys cannot be bypassed by a runner's ambient value.
+"""
 from __future__ import annotations
 
 import os
+import subprocess
+import sys
 from urllib.parse import urlsplit
 
 import requests
 
+LOWERCASE_BYPASS = ("no_proxy",)
 
-def session() -> requests.Session:
+
+def proxy_url() -> str:
     value = os.environ.get("GOOGLE_STORE_PROXY_URL", "").strip()
     try:
         parsed = urlsplit(value)
@@ -16,7 +32,54 @@ def session() -> requests.Session:
         valid = False
     if not valid:
         raise SystemExit("GOOGLE_STORE_PROXY_URL must contain the account-pinned proxy; direct requests are refused")
+    return value
+
+
+def environment() -> dict[str, str]:
+    value = proxy_url()
+    return {**os.environ, "HTTP_PROXY": value, "HTTPS_PROXY": value,
+            "http_proxy": value, "https_proxy": value, "NO_PROXY": "", "no_proxy": ""}
+
+
+def session() -> requests.Session:
+    value = proxy_url()
     client = requests.Session()
     client.trust_env = False
     client.proxies = {"http": value, "https": value}
     return client
+
+
+def run(argv: list[str]) -> int:
+    """Run ``argv`` with the explicit proxy environment; the parent process is untouched."""
+    if not argv:
+        raise SystemExit("usage: play_store_proxy.py -- <command …>")
+    env = environment()
+    return subprocess.run(argv, env=env, check=False).returncode
+
+
+def clear_github_env_bypass(path: str | None = None) -> list[str]:
+    """Append empty lower-case bypass assignments to ``$GITHUB_ENV`` for later steps."""
+    proxy_url()
+    target = path or os.environ.get("GITHUB_ENV", "")
+    if not target:
+        raise SystemExit("GITHUB_ENV is not set; run this inside a GitHub Actions step")
+    lines = [f"{name}=" for name in LOWERCASE_BYPASS]
+    with open(target, "a", encoding="utf-8") as handle:
+        handle.write("".join(line + "\n" for line in lines))
+    return lines
+
+
+def main(args: list[str]) -> int:
+    if args[:1] == ["--github-env"]:
+        clear_github_env_bypass()
+        return 0
+    if args[:1] == ["--"]:
+        return run(args[1:])
+    if args:
+        raise SystemExit("usage: play_store_proxy.py [--github-env | -- <command …>]")
+    proxy_url()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/android-action/scripts/test_crashlytics_symbols.py

@@ -10,10 +10,12 @@ the bottom, next to the other Flutter obfuscation wiring tests.
 from __future__ import annotations
 
 import io
+import os
 import re
 import sys
 import tempfile
 import unittest
+from unittest import mock
 from contextlib import redirect_stdout
 from pathlib import Path
 
@@ -140,7 +142,8 @@ class MainTest(unittest.TestCase):
 
     def test_a_missing_npx_is_a_named_error_not_a_traceback(self) -> None:
         out = io.StringIO()
-        with redirect_stdout(out):
+        with redirect_stdout(out), mock.patch.dict(os.environ, {
+                "GOOGLE_STORE_PROXY_URL": "http://assigned.proxy.test:1234"}):
             rc = cs._default_run(["gowalk-cicd-no-such-binary-xyz"])
         self.assertNotEqual(rc, 0)
         self.assertIn("::error::", out.getvalue())

package/android-action/scripts/test_play_store_proxy.py

@@ -17,6 +17,16 @@ class PlayProxyTests(unittest.TestCase):
                 play_store_proxy.session()
             session.assert_not_called()
 
+    def test_cli_environment_is_explicit_without_mutating_the_parent(self):
+        value = "http://assigned.proxy.test:1234"
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": value, "NO_PROXY": "*"}):
+            child = play_store_proxy.environment()
+            self.assertEqual(child["HTTPS_PROXY"], value)
+            self.assertEqual(child["http_proxy"], value)
+            self.assertEqual(child["NO_PROXY"], "")
+            self.assertEqual(child["no_proxy"], "")
+            self.assertEqual(os.environ["NO_PROXY"], "*")
+
     def test_ambient_proxy_and_no_proxy_cannot_override_account_exit(self):
         value = "http://assigned.proxy.test:1234"
         with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": value,
@@ -25,6 +35,47 @@ class PlayProxyTests(unittest.TestCase):
                 self.assertFalse(client.trust_env)
                 self.assertEqual(client.proxies, {"http": value, "https": value})
 
+    def test_exec_form_gives_the_child_both_spellings_and_no_bypass(self):
+        value = "http://assigned.proxy.test:1234"
+        probe = ("import os, json; print(json.dumps({k: os.environ.get(k) for k in "
+                 "['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'NO_PROXY', 'no_proxy']}))")
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": value, "no_proxy": "*", "NO_PROXY": "*"}), \
+                mock.patch.object(play_store_proxy.subprocess, "run") as run:
+            run.return_value.returncode = 0
+            self.assertEqual(play_store_proxy.run([sys.executable, "-c", probe]), 0)
+            child = run.call_args.kwargs["env"]
+            self.assertEqual(child["https_proxy"], value)
+            self.assertEqual(child["HTTP_PROXY"], value)
+            self.assertEqual(child["no_proxy"], "")
+            self.assertEqual(child["NO_PROXY"], "")
+            self.assertEqual(os.environ["no_proxy"], "*")
+
+    def test_exec_form_refuses_without_a_proxy_before_running_anything(self):
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": ""}), \
+                mock.patch.object(play_store_proxy.subprocess, "run") as run:
+            with self.assertRaises(SystemExit):
+                play_store_proxy.run(["true"])
+            run.assert_not_called()
+
+    def test_github_env_mode_clears_only_the_lowercase_bypass_for_later_steps(self):
+        import tempfile
+        value = "http://assigned.proxy.test:1234"
+        with tempfile.TemporaryDirectory() as tmp:
+            target = os.path.join(tmp, "github.env")
+            with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": value, "GITHUB_ENV": target, "no_proxy": "*"}):
+                self.assertEqual(play_store_proxy.clear_github_env_bypass(), ["no_proxy="])
+                self.assertEqual(os.environ["no_proxy"], "*")
+            with open(target, encoding="utf-8") as handle:
+                self.assertEqual(handle.read(), "no_proxy=\n")
+
+    def test_github_env_mode_refuses_without_a_proxy_or_target(self):
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": "", "GITHUB_ENV": "/nonexistent"}):
+            with self.assertRaises(SystemExit):
+                play_store_proxy.clear_github_env_bypass()
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": "http://assigned.proxy.test:1234", "GITHUB_ENV": ""}):
+            with self.assertRaises(SystemExit):
+                play_store_proxy.clear_github_env_bypass()
+
 
 if __name__ == "__main__":
     unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.58
+1.0.60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.58",
+  "version": "1.0.60",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -453,6 +453,14 @@ jobs:
       # Note this also means nothing else should be creating edits against these
       # packages while a deploy runs — an external poller that opens and deletes an
       # edit will invalidate the one this step is holding.
+      # The upload action is JavaScript, so its proxy can only be the step's own
+      # upper-case env keys below. Node clients fall back to a lower-case no_proxy
+      # when NO_PROXY is empty, and GitHub refuses both spellings in one env map, so
+      # the ambient lower-case bypass is cleared through GITHUB_ENV instead.
+      - name: Clear ambient lower-case proxy bypass
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' }}
+        shell: bash
+        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --github-env
       - name: Upload Android release to Google Play
         id: play-upload
         continue-on-error: true
@@ -461,8 +469,7 @@ jobs:
         env:
           HTTPS_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
           HTTP_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
-          NO_PROXY: ''
-          no_proxy: ''
+          NO_PROXY: ''  # one spelling only: GitHub rejects env keys that differ by case
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
           packageName: ${{ steps.android.outputs.package-name }}
@@ -490,8 +497,7 @@ jobs:
         env:
           HTTPS_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
           HTTP_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
-          NO_PROXY: ''
-          no_proxy: ''
+          NO_PROXY: ''  # one spelling only: GitHub rejects env keys that differ by case
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
           packageName: ${{ steps.android.outputs.package-name }}