gowalk-cicd 1.0.59 → 1.0.60

package/CLAUDE.md

@@ -96,6 +96,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - Keep the CLI surface minimal: `--dry-run`, `-v`, `-h`. Resist adding flags.
 - `.gitignore` in the consumer repo is git-tracked. Never auto-edit it.
   Detect and warn, tell the user to remove lines manually.
+- Never repeat an `env:` key in another case (`NO_PROXY` beside `no_proxy`): GitHub
+  compares env keys case-insensitively and rejects the whole workflow or action file.
+  `test/env-keys.test.mjs` scans the templates and actions. Set lower-case spellings
+  or clear a lower-case bypass through `play_store_proxy.py -- <command>` (child
+  process) or `play_store_proxy.py --github-env` (later steps), never through YAML.
 - Store API calls belong in GitHub Actions. Local tests may build/sign but must
   never connect to App Store Connect or Google Play.
 - Every Apple/Google store API call, OAuth exchange and binary upload requires its

package/action/.daemux-version

@@ -1 +1 @@
-1.0.59
+1.0.60

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.59
+1.0.60

package/android-action/action.yml

@@ -128,17 +128,16 @@ runs:
       if: ${{ steps.config.outputs.project_kind == 'flutter' }}
       shell: bash
       env:
+        # Only one spelling per key: GitHub compares env keys case-insensitively and
+        # rejects the file otherwise. play_store_proxy.py -- runs the build with both
+        # spellings set and both NO_PROXY spellings cleared for the child process.
         HTTPS_PROXY: ${{ env.GOOGLE_STORE_PROXY_URL }}
         HTTP_PROXY: ${{ env.GOOGLE_STORE_PROXY_URL }}
-        https_proxy: ${{ env.GOOGLE_STORE_PROXY_URL }}
-        http_proxy: ${{ env.GOOGLE_STORE_PROXY_URL }}
         NO_PROXY: ''
-        no_proxy: ''
         BUILD_NAME: ${{ inputs.build-name }}
         DART_DEFINES: ${{ inputs.dart-defines }}
         DART_SYMBOLS_DIR: ${{ runner.temp }}/dart-symbols/android
       run: |
-        python3 "${{ github.action_path }}/scripts/play_store_proxy.py"
         args=(
           build appbundle
           --release
@@ -158,7 +157,7 @@ runs:
             *) echo "::error::dart-defines entry '$define' is not KEY=VALUE"; exit 1 ;;
           esac
         done
-        flutter "${args[@]}"
+        python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- flutter "${args[@]}"
         if ! ls "$DART_SYMBOLS_DIR"/*.symbols >/dev/null 2>&1; then
           echo "::error::flutter build wrote no Dart symbol files to $DART_SYMBOLS_DIR;" \
                "a crash from this obfuscated build could never be read. Refusing to ship it."
@@ -234,17 +233,17 @@ runs:
       shell: bash
       working-directory: ${{ steps.config.outputs.gradle_root || '.' }}
       env:
+        # Only one spelling per key: GitHub compares env keys case-insensitively and
+        # rejects the file otherwise. play_store_proxy.py -- runs the build with both
+        # spellings set and both NO_PROXY spellings cleared for the child process.
         HTTPS_PROXY: ${{ env.GOOGLE_STORE_PROXY_URL }}
         HTTP_PROXY: ${{ env.GOOGLE_STORE_PROXY_URL }}
-        https_proxy: ${{ env.GOOGLE_STORE_PROXY_URL }}
-        http_proxy: ${{ env.GOOGLE_STORE_PROXY_URL }}
         NO_PROXY: ''
-        no_proxy: ''
         ANDROID_BUILD_NAME: ${{ inputs.build-name }}
       run: |
         chmod +x ./gradlew
-        python3 "${{ github.action_path }}/scripts/play_store_proxy.py"
-        ./gradlew "${ANDROID_GRADLE_MODULE}:bundleRelease" \
+        python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- \
+          ./gradlew "${ANDROID_GRADLE_MODULE}:bundleRelease" \
           --init-script "${{ github.action_path }}/scripts/version_override.init.gradle" \
           --console=plain --stacktrace
 

package/android-action/scripts/play_store_proxy.py

@@ -1,11 +1,27 @@
-"""Google CI transport uses only the account-pinned proxy, including OAuth exchanges."""
+"""Google CI transport uses only the account-pinned proxy, including OAuth exchanges.
+
+Three entry points, all from the one validated ``GOOGLE_STORE_PROXY_URL``:
+
+* ``python3 play_store_proxy.py`` refuses a missing or malformed proxy.
+* ``python3 play_store_proxy.py -- <command …>`` runs a build tool with the explicit
+  proxy in both spellings and both ``NO_PROXY`` spellings cleared. Setting the pairs
+  as YAML ``env`` keys is not an option: GitHub compares env keys case-insensitively
+  and rejects the workflow or action file as invalid.
+* ``python3 play_store_proxy.py --github-env`` clears the lower-case ambient bypass
+  (``no_proxy``) for the rest of the job, so a JavaScript upload step that can only
+  carry upper-case ``env`` keys cannot be bypassed by a runner's ambient value.
+"""
 from __future__ import annotations
 
 import os
+import subprocess
+import sys
 from urllib.parse import urlsplit
 
 import requests
 
+LOWERCASE_BYPASS = ("no_proxy",)
+
 
 def proxy_url() -> str:
     value = os.environ.get("GOOGLE_STORE_PROXY_URL", "").strip()
@@ -33,5 +49,37 @@ def session() -> requests.Session:
     return client
 
 
-if __name__ == "__main__":
+def run(argv: list[str]) -> int:
+    """Run ``argv`` with the explicit proxy environment; the parent process is untouched."""
+    if not argv:
+        raise SystemExit("usage: play_store_proxy.py -- <command …>")
+    env = environment()
+    return subprocess.run(argv, env=env, check=False).returncode
+
+
+def clear_github_env_bypass(path: str | None = None) -> list[str]:
+    """Append empty lower-case bypass assignments to ``$GITHUB_ENV`` for later steps."""
     proxy_url()
+    target = path or os.environ.get("GITHUB_ENV", "")
+    if not target:
+        raise SystemExit("GITHUB_ENV is not set; run this inside a GitHub Actions step")
+    lines = [f"{name}=" for name in LOWERCASE_BYPASS]
+    with open(target, "a", encoding="utf-8") as handle:
+        handle.write("".join(line + "\n" for line in lines))
+    return lines
+
+
+def main(args: list[str]) -> int:
+    if args[:1] == ["--github-env"]:
+        clear_github_env_bypass()
+        return 0
+    if args[:1] == ["--"]:
+        return run(args[1:])
+    if args:
+        raise SystemExit("usage: play_store_proxy.py [--github-env | -- <command …>]")
+    proxy_url()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/android-action/scripts/test_play_store_proxy.py

@@ -35,6 +35,47 @@ class PlayProxyTests(unittest.TestCase):
                 self.assertFalse(client.trust_env)
                 self.assertEqual(client.proxies, {"http": value, "https": value})
 
+    def test_exec_form_gives_the_child_both_spellings_and_no_bypass(self):
+        value = "http://assigned.proxy.test:1234"
+        probe = ("import os, json; print(json.dumps({k: os.environ.get(k) for k in "
+                 "['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'NO_PROXY', 'no_proxy']}))")
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": value, "no_proxy": "*", "NO_PROXY": "*"}), \
+                mock.patch.object(play_store_proxy.subprocess, "run") as run:
+            run.return_value.returncode = 0
+            self.assertEqual(play_store_proxy.run([sys.executable, "-c", probe]), 0)
+            child = run.call_args.kwargs["env"]
+            self.assertEqual(child["https_proxy"], value)
+            self.assertEqual(child["HTTP_PROXY"], value)
+            self.assertEqual(child["no_proxy"], "")
+            self.assertEqual(child["NO_PROXY"], "")
+            self.assertEqual(os.environ["no_proxy"], "*")
+
+    def test_exec_form_refuses_without_a_proxy_before_running_anything(self):
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": ""}), \
+                mock.patch.object(play_store_proxy.subprocess, "run") as run:
+            with self.assertRaises(SystemExit):
+                play_store_proxy.run(["true"])
+            run.assert_not_called()
+
+    def test_github_env_mode_clears_only_the_lowercase_bypass_for_later_steps(self):
+        import tempfile
+        value = "http://assigned.proxy.test:1234"
+        with tempfile.TemporaryDirectory() as tmp:
+            target = os.path.join(tmp, "github.env")
+            with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": value, "GITHUB_ENV": target, "no_proxy": "*"}):
+                self.assertEqual(play_store_proxy.clear_github_env_bypass(), ["no_proxy="])
+                self.assertEqual(os.environ["no_proxy"], "*")
+            with open(target, encoding="utf-8") as handle:
+                self.assertEqual(handle.read(), "no_proxy=\n")
+
+    def test_github_env_mode_refuses_without_a_proxy_or_target(self):
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": "", "GITHUB_ENV": "/nonexistent"}):
+            with self.assertRaises(SystemExit):
+                play_store_proxy.clear_github_env_bypass()
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": "http://assigned.proxy.test:1234", "GITHUB_ENV": ""}):
+            with self.assertRaises(SystemExit):
+                play_store_proxy.clear_github_env_bypass()
+
 
 if __name__ == "__main__":
     unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.59
+1.0.60

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.59",
+  "version": "1.0.60",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -453,6 +453,14 @@ jobs:
       # Note this also means nothing else should be creating edits against these
       # packages while a deploy runs — an external poller that opens and deletes an
       # edit will invalidate the one this step is holding.
+      # The upload action is JavaScript, so its proxy can only be the step's own
+      # upper-case env keys below. Node clients fall back to a lower-case no_proxy
+      # when NO_PROXY is empty, and GitHub refuses both spellings in one env map, so
+      # the ambient lower-case bypass is cleared through GITHUB_ENV instead.
+      - name: Clear ambient lower-case proxy bypass
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' }}
+        shell: bash
+        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --github-env
       - name: Upload Android release to Google Play
         id: play-upload
         continue-on-error: true
@@ -461,8 +469,7 @@ jobs:
         env:
           HTTPS_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
           HTTP_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
-          NO_PROXY: ''
-          no_proxy: ''
+          NO_PROXY: ''  # one spelling only: GitHub rejects env keys that differ by case
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
           packageName: ${{ steps.android.outputs.package-name }}
@@ -490,8 +497,7 @@ jobs:
         env:
           HTTPS_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
           HTTP_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
-          NO_PROXY: ''
-          no_proxy: ''
+          NO_PROXY: ''  # one spelling only: GitHub rejects env keys that differ by case
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
           packageName: ${{ steps.android.outputs.package-name }}