gowalk-cicd 1.0.59 → 1.0.61

package/CLAUDE.md

@@ -96,6 +96,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - Keep the CLI surface minimal: `--dry-run`, `-v`, `-h`. Resist adding flags.
 - `.gitignore` in the consumer repo is git-tracked. Never auto-edit it.
   Detect and warn, tell the user to remove lines manually.
+- Never repeat an `env:` key in another case (`NO_PROXY` beside `no_proxy`): GitHub
+  compares env keys case-insensitively and rejects the whole workflow or action file.
+  `test/env-keys.test.mjs` scans the templates and actions. Set lower-case spellings
+  or clear a lower-case bypass through `play_store_proxy.py -- <command>` (child
+  process) or `play_store_proxy.py --github-env` (later steps), never through YAML.
 - Store API calls belong in GitHub Actions. Local tests may build/sign but must
   never connect to App Store Connect or Google Play.
 - Every Apple/Google store API call, OAuth exchange and binary upload requires its
@@ -110,6 +115,13 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   `IOS_DISTRIBUTION_CERT_REGISTRY_BASE64`), and the Android keystore, properties
   and Play service account into an ephemeral runner checkout.
   Tracked `creds/` files remain a backward-compatible fallback.
+- Never revoke a distribution certificate automatically, including legacy caches.
+  `certificate-cap-policy` accepts only `fail`; a full cap requires registry reconciliation.
+- Keep preinstalled Android SDK/NDKs. Every Gradle test/build and SDK download runs
+  under `play_store_proxy.py --`, whose owned loopback relay gives Java an explicit
+  authenticated account exit without credentials in JVM options. HTTPS is tunneled
+  without TLS interception; no upstream failure may fall back to the destination.
+  The wrapper disables Gradle daemons and closes its relay when the command ends.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and
   supplies it to Compose after the generated `.env`; never print its content.
@@ -163,7 +175,7 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   can be raised to cover a release's life.
 - Firebase Crashlytics traffic follows the Google account proxy. Android builds and
   the pinned Firebase CLI receive the explicit proxy environment; Crashlytics Gradle
-  2.9.2+ and the pinned buildtools support it (generic JVM networking does not).
+  2.9.2+ and the pinned buildtools support it; generic JVM networking uses the relay.
   Native iOS upload-symbols uses NSURLSession, so it is never executed. Before
   archiving, dedicated Crashlytics upload phases in the ephemeral Xcode projects
   are deferred; mixed/unidentified upload phases refuse the archive for repair.

package/README.md

@@ -327,12 +327,19 @@ zip I/O error: No space left on device
 ```
 
 The Android job removes the preinstalled toolchains a Flutter build never uses
-(.NET, the Android NDK, GHC, PowerShell, Swift, Chromium) and prunes Docker
+(.NET, GHC, PowerShell, Swift, Chromium) and prunes Docker
 images, reclaiming roughly 25 GB in a few seconds. It prints `df -h /` before
 and after. Linux only; skipped in Bitrise mode. npm survives on purpose: the
 [Crashlytics symbol upload](#crashlytics-symbol-delivery-firebase_app_id) runs
 the Firebase CLI through `npx`.
 
+The preinstalled Android SDK and NDKs are retained. Gradle and SDK-manager Java
+networking runs through an owned loopback relay to `GOOGLE_STORE_PROXY_URL`.
+The relay authenticates to that exit without putting credentials in JVM options;
+HTTPS remains an end-to-end TLS tunnel. An unavailable proxy fails the request,
+and the relay shuts down with its child command. Gradle daemons are disabled for
+these commands so they cannot retain an expired relay port.
+
 ### Private git dependencies (Flutter)
 
 A Flutter app can depend on private git packages:
@@ -441,7 +448,8 @@ identity and create per-app provisioning profiles, but it never creates,
 replaces, or revokes a registry-managed distribution certificate. Missing,
 partially written, corrupt, expired, Apple-revoked, or resource-ID/P12-mismatched
 managed material aborts with a reconciliation error. Legacy repos without the
-marker keep the historical cache lifecycle.
+marker may create a certificate in an available slot, but never revoke another
+identity. A full certificate cap stops for account-registry reconciliation.
 
 ## How it works
 
@@ -773,7 +781,7 @@ common ones:
 | `bundle-id` | Override the auto-detected bundle identifier |
 | `team-id` | Override the auto-detected team ID |
 | `app-store-apple-id` | Numeric ASC app ID (override auto-lookup) |
-| `certificate-cap-policy` | Full-cap behavior: `fail` preserves identities; default `revoke-oldest` rotates. |
+| `certificate-cap-policy` | Only `fail` is accepted (the default); existing identities are always preserved. |
 | `run-tests` | `false` to skip the simulator test stage |
 | `uses-non-exempt-encryption` | Value for `ITSAppUsesNonExemptEncryption` |
 | `archive` | `false` to build-only (PR runs without secrets) |
@@ -793,8 +801,7 @@ inside GitHub Actions.
 Once the app exists, all subsequent builds and uploads are fully automated via
 the ASC API key.
 
-For accounts where automatic certificate revocation is not acceptable, pass
-`certificate-cap-policy: 'fail'`. The action may add a certificate when Apple has a free
+Automatic certificate revocation is disabled for every account. The action may add a certificate when Apple has a free
 slot, but a full-cap response aborts without listing or revoking existing identities. If
 signing preparation fails after creating a certificate, the default-branch workflow first
 commits any completed cache files, then re-raises the failure so the private key is not lost.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.59
+1.0.61

package/action/action.yml

@@ -53,10 +53,10 @@ inputs:
   certificate-cap-policy:
     description: >
       Behavior when Apple reports the two-certificate Distribution cap.
-      'revoke-oldest' preserves historical behavior; 'fail' aborts without
-      listing or revoking any existing certificate.
+      Only 'fail' is supported: abort without revoking any existing certificate.
+      Reconcile the account registry when no live signing identity is available.
     required: false
-    default: "revoke-oldest"
+    default: "fail"
   persist-signing-cache:
     description: >
       Commit refreshed signing files back to the default branch. Set to

package/action/scripts/cert_factory.py

@@ -3,7 +3,7 @@
 Cert-creation primitives for the iOS native TestFlight action.
 
 Owns the cryptographic legwork (RSA key + CSR), Apple's per-team cert
-cap policy (fail closed or revoke OLDEST on 409), and PKCS12 serialisation. Split
+cap refusal (never automatic revocation), and PKCS12 serialisation. Split
 from ``prepare_signing.py`` so the orchestrator there stays focused on
 the load-or-regen control flow and the file count stays under the
 project's per-file limits.
@@ -16,35 +16,20 @@ from __future__ import annotations
 
 import base64
 import os
-import time
 
-from asc_common import get_json, request
+from asc_common import request
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 from cryptography.hazmat.primitives.serialization import pkcs12
 from cryptography.x509.oid import NameOID
 
-# Apple's cert revoke -> create pipeline is eventually consistent: a
-# DELETE on the per-team cap-blocking cert sometimes still shows up as
-# "active" to a follow-up POST for a second or two, returning a fresh
-# 409 even though we just freed a slot. Sleep then retry-with-backoff
-# rather than failing the whole CI run on a known-transient race.
-CERT_REVOKE_PROPAGATION_DELAY_SEC = float(
-    os.getenv("CERT_REVOKE_PROPAGATION_DELAY_SEC", "2.0")
-)
-CERT_POST_RETRIES_AFTER_REVOKE = int(
-    os.getenv("CERT_POST_RETRIES_AFTER_REVOKE", "2")
-)
-CERTIFICATE_CAP_POLICIES = frozenset({"revoke-oldest", "fail"})
-
 
 def certificate_cap_policy() -> str:
-    """Return the configured full-cap behavior before any provider call."""
-    policy = os.getenv("CERTIFICATE_CAP_POLICY", "revoke-oldest").strip().lower()
-    if policy not in CERTIFICATE_CAP_POLICIES:
-        allowed = ", ".join(sorted(CERTIFICATE_CAP_POLICIES))
-        raise SystemExit(f"invalid CERTIFICATE_CAP_POLICY {policy!r}; use {allowed}")
+    """Refuse destructive legacy policy before any provider call."""
+    policy = os.getenv("CERTIFICATE_CAP_POLICY", "fail").strip().lower()
+    if policy != "fail":
+        raise SystemExit("invalid CERTIFICATE_CAP_POLICY; use fail. Automatic certificate revocation is disabled")
     return policy
 
 
@@ -75,79 +60,9 @@ def generate_key_and_csr() -> tuple[rsa.RSAPrivateKey, bytes]:
     return private_key, csr_payload
 
 
-def oldest_distribution_cert_id(token: str) -> str | None:
-    """Return the DISTRIBUTION cert with the EARLIEST expirationDate.
-
-    Apple caps each team at 2 distribution certs; when CI hits the cap
-    we must revoke one. Picking the OLDEST is the safest choice — the
-    NEWEST cert signed the most recent build that may still be in ASC
-    processing, and revoking that mid-processing produces ITMS-90035
-    ("signed with an ad-hoc certificate, not a distribution
-    certificate") on the prior run. Older certs have long since cleared
-    processing.
-    """
-    data = get_json(
-        "/certificates",
-        token,
-        params={
-            "limit": "200",
-            "sort": "-id",
-            "filter[certificateType]": "DISTRIBUTION",
-        },
-    )
-    oldest_id = None
-    oldest_exp: str | None = None
-    for cert in data.get("data", []):
-        attrs = cert.get("attributes") or {}
-        exp = attrs.get("expirationDate") or ""
-        if not exp:
-            continue
-        if oldest_exp is None or exp < oldest_exp:
-            oldest_exp = exp
-            oldest_id = cert["id"]
-    return oldest_id
-
-
-def _post_with_revoke_backoff(token: str, body: dict):
-    """POST a cert create after a revoke, tolerating ASC propagation lag.
-
-    Apple's DELETE -> POST pipeline is eventually consistent: a freshly
-    revoked cert may still count against the per-team cap for a brief
-    window, producing a spurious 409 on the immediate re-POST. Sleep
-    once for ``CERT_REVOKE_PROPAGATION_DELAY_SEC`` then retry up to
-    ``CERT_POST_RETRIES_AFTER_REVOKE`` times with exponential backoff.
-    The final attempt drops ``allow_status`` so a real 409 surfaces as
-    Apple's full body via ``request``'s SystemExit.
-    """
-    time.sleep(CERT_REVOKE_PROPAGATION_DELAY_SEC)
-    delay = CERT_REVOKE_PROPAGATION_DELAY_SEC
-    for attempt in range(CERT_POST_RETRIES_AFTER_REVOKE):
-        resp = request(
-            "POST", "/certificates", token, json_body=body, allow_status={409}
-        )
-        if resp.status_code != 409:
-            return resp
-        print(
-            f"Post-revoke 409 on attempt {attempt + 1}/"
-            f"{CERT_POST_RETRIES_AFTER_REVOKE}; "
-            f"sleeping {delay}s before final retry"
-        )
-        time.sleep(delay)
-        delay *= 2
-    # Final attempt without allow_status — let Apple's body surface via
-    # request()'s SystemExit if the cap is genuinely still hit.
-    return request("POST", "/certificates", token, json_body=body)
-
-
 def create_distribution_cert(token: str, csr_b64: str) -> tuple[str, bytes]:
-    """POST a CSR to ASC; return ``(cert_id, cert_der)``.
-
-    On 409 (per-team cap of 2 hit) revoke the OLDEST existing cert
-    (see :func:`oldest_distribution_cert_id` for why) and retry with
-    backoff to absorb Apple's revoke -> create propagation lag (see
-    :func:`_post_with_revoke_backoff`).
-    """
-    cap_policy = certificate_cap_policy()
+    """POST one CSR; a full team cap preserves every existing certificate."""
+    certificate_cap_policy()
     body = {
         "data": {
             "type": "certificates",
@@ -161,24 +76,10 @@ def create_distribution_cert(token: str, csr_b64: str) -> tuple[str, bytes]:
         "POST", "/certificates", token, json_body=body, allow_status={409}
     )
     if resp.status_code == 409:
-        if cap_policy == "fail":
-            raise SystemExit(
-                "distribution certificate cap reached; policy=fail preserves all "
-                "existing certificates and refuses automatic revocation"
-            )
-        # Revoke the OLDEST cert, NOT the newest. The newest cert signed
-        # the previous build that may still be in ASC processing — revoking
-        # it during processing yields ITMS-90035 on the prior build.
-        # See oldest_distribution_cert_id() for the full rationale.
-        print("Distribution cert cap hit; revoking oldest existing cert")
-        target = oldest_distribution_cert_id(token)
-        if not target:
-            raise SystemExit(
-                "409 from cert create but no existing DISTRIBUTION cert "
-                "found to revoke"
-            )
-        request("DELETE", f"/certificates/{target}", token)
-        resp = _post_with_revoke_backoff(token, body)
+        raise SystemExit(
+            "distribution certificate cap reached; policy=fail preserves all "
+            "existing certificates and refuses automatic revocation; reconcile the account registry"
+        )
     data = resp.json()["data"]
     cert_id = data["id"]
     cert_der = base64.b64decode(data["attributes"]["certificateContent"])

package/action/scripts/creds_store.py

@@ -220,7 +220,7 @@ def verify_cert_alive(token: str, cert_id: str,
     """Return True iff GET /certificates/{cert_id} returns 200.
 
     A 404 means Apple revoked it (manually or via the cap-rotation done
-    by ``oldest_distribution_cert_id``); any other non-200 is treated
+    by another signing client); any other non-200 is treated
     conservatively as not-alive so we regenerate.
     """
     resp = request(

package/action/scripts/test_certificate_cap_policy.py

@@ -28,27 +28,25 @@ class CertificateCapPolicyTests(unittest.TestCase):
         response = mock.MagicMock(status_code=409)
         with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "fail"}, clear=True):
             with mock.patch.object(cert_factory, "request", return_value=response) as request:
-                with mock.patch.object(cert_factory, "oldest_distribution_cert_id") as oldest:
-                    with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
-                        cert_factory.create_distribution_cert("token", "csr")
+                with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
+                    cert_factory.create_distribution_cert("token", "csr")
         request.assert_called_once()
-        oldest.assert_not_called()
+        self.assertEqual(request.call_args.args[:2], ("POST", "/certificates"))
 
-    def test_default_policy_keeps_backward_compatible_rotation(self):
+    def test_default_policy_never_revokes_or_retries_a_full_cap(self):
         capped = mock.MagicMock(status_code=409)
-        created = mock.MagicMock()
-        created.json.return_value = {
-            "data": {"id": "NEW", "attributes": {"certificateContent": "Y2VydA=="}}
-        }
         with mock.patch.dict(os.environ, {}, clear=True):
-            with mock.patch.object(
-                cert_factory, "request", side_effect=[capped, mock.MagicMock()]
-            ) as request:
-                with mock.patch.object(cert_factory, "oldest_distribution_cert_id", return_value="OLD"):
-                    with mock.patch.object(cert_factory, "_post_with_revoke_backoff", return_value=created):
-                        cert_id, cert_der = cert_factory.create_distribution_cert("token", "csr")
-        self.assertEqual((cert_id, cert_der), ("NEW", b"cert"))
-        request.assert_any_call("DELETE", "/certificates/OLD", "token")
+            with mock.patch.object(cert_factory, "request", return_value=capped) as request:
+                with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
+                    cert_factory.create_distribution_cert("token", "csr")
+        request.assert_called_once()
+
+    def test_historical_destructive_setting_is_refused_before_contacting_apple(self):
+        with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "revoke-oldest"}, clear=True):
+            with mock.patch.object(cert_factory, "request") as request:
+                with self.assertRaisesRegex(SystemExit, "Automatic certificate revocation is disabled"):
+                    cert_factory.create_distribution_cert("token", "csr")
+        request.assert_not_called()
 
 
 class CertificateCapActionWiringTests(unittest.TestCase):
@@ -56,7 +54,7 @@ class CertificateCapActionWiringTests(unittest.TestCase):
         source = ACTION_YAML.read_text(encoding="utf-8")
         self.assertRegex(
             source,
-            r"(?m)^  certificate-cap-policy:\n(?:    .*\n)*?    default: \"revoke-oldest\"$",
+            r"(?m)^  certificate-cap-policy:\n(?:    .*\n)*?    default: \"fail\"$",
         )
         self.assertIn("CERTIFICATE_CAP_POLICY: ${{ inputs.certificate-cap-policy }}", source)
         self.assertIn("SIGNING_PREP_EXIT=$signing_exit", source)

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.59
+1.0.61

package/android-action/action.yml

@@ -128,17 +128,16 @@ runs:
       if: ${{ steps.config.outputs.project_kind == 'flutter' }}
       shell: bash
       env:
+        # Only one spelling per key: GitHub compares env keys case-insensitively and
+        # rejects the file otherwise. play_store_proxy.py -- runs the build with both
+        # spellings set and both NO_PROXY spellings cleared for the child process.
         HTTPS_PROXY: ${{ env.GOOGLE_STORE_PROXY_URL }}
         HTTP_PROXY: ${{ env.GOOGLE_STORE_PROXY_URL }}
-        https_proxy: ${{ env.GOOGLE_STORE_PROXY_URL }}
-        http_proxy: ${{ env.GOOGLE_STORE_PROXY_URL }}
         NO_PROXY: ''
-        no_proxy: ''
         BUILD_NAME: ${{ inputs.build-name }}
         DART_DEFINES: ${{ inputs.dart-defines }}
         DART_SYMBOLS_DIR: ${{ runner.temp }}/dart-symbols/android
       run: |
-        python3 "${{ github.action_path }}/scripts/play_store_proxy.py"
         args=(
           build appbundle
           --release
@@ -158,7 +157,7 @@ runs:
             *) echo "::error::dart-defines entry '$define' is not KEY=VALUE"; exit 1 ;;
           esac
         done
-        flutter "${args[@]}"
+        python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- flutter "${args[@]}"
         if ! ls "$DART_SYMBOLS_DIR"/*.symbols >/dev/null 2>&1; then
           echo "::error::flutter build wrote no Dart symbol files to $DART_SYMBOLS_DIR;" \
                "a crash from this obfuscated build could never be read. Refusing to ship it."
@@ -223,7 +222,8 @@ runs:
       working-directory: ${{ steps.config.outputs.gradle_root || '.' }}
       run: |
         chmod +x ./gradlew
-        ./gradlew test --console=plain --stacktrace
+        python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- \
+          ./gradlew test --console=plain --stacktrace
 
     # ANDROID_BUILD_NUMBER is already in the environment: resolve_android.py
     # exported it through GITHUB_ENV. ANDROID_BUILD_NAME is only set when the
@@ -234,17 +234,17 @@ runs:
       shell: bash
       working-directory: ${{ steps.config.outputs.gradle_root || '.' }}
       env:
+        # Only one spelling per key: GitHub compares env keys case-insensitively and
+        # rejects the file otherwise. play_store_proxy.py -- runs the build with both
+        # spellings set and both NO_PROXY spellings cleared for the child process.
         HTTPS_PROXY: ${{ env.GOOGLE_STORE_PROXY_URL }}
         HTTP_PROXY: ${{ env.GOOGLE_STORE_PROXY_URL }}
-        https_proxy: ${{ env.GOOGLE_STORE_PROXY_URL }}
-        http_proxy: ${{ env.GOOGLE_STORE_PROXY_URL }}
         NO_PROXY: ''
-        no_proxy: ''
         ANDROID_BUILD_NAME: ${{ inputs.build-name }}
       run: |
         chmod +x ./gradlew
-        python3 "${{ github.action_path }}/scripts/play_store_proxy.py"
-        ./gradlew "${ANDROID_GRADLE_MODULE}:bundleRelease" \
+        python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- \
+          ./gradlew "${ANDROID_GRADLE_MODULE}:bundleRelease" \
           --init-script "${{ github.action_path }}/scripts/version_override.init.gradle" \
           --console=plain --stacktrace
 

package/android-action/scripts/jvm_proxy_relay.py

@@ -0,0 +1,119 @@
+"""An owned loopback relay for JVMs that cannot authenticate to the assigned HTTP proxy.
+
+Only the configured upstream is ever dialled. HTTPS remains an opaque CONNECT
+tunnel; Java still verifies the provider's TLS certificate end to end.
+"""
+from __future__ import annotations
+
+import asyncio
+import base64
+from contextlib import contextmanager
+import ssl
+import threading
+from urllib.parse import unquote, urlsplit
+
+
+class Relay:
+    def __init__(self, proxy: str):
+        self.proxy = urlsplit(proxy)
+        self.loop = asyncio.new_event_loop()
+        self.ready = threading.Event()
+        self.thread = threading.Thread(target=self._serve, daemon=True)
+        self.server = None
+        self.port = None
+
+    def _serve(self):
+        asyncio.set_event_loop(self.loop)
+        try:
+            self.server = self.loop.run_until_complete(
+                asyncio.start_server(self._handle, "127.0.0.1", 0, limit=65536))
+            self.port = self.server.sockets[0].getsockname()[1]
+            self.ready.set()
+            self.loop.run_forever()
+        finally:
+            self.ready.set()
+            if self.server:
+                self.server.close()
+                self.loop.run_until_complete(self.server.wait_closed())
+            tasks = asyncio.all_tasks(self.loop)
+            for task in tasks:
+                task.cancel()
+            self.loop.run_until_complete(asyncio.gather(*tasks, return_exceptions=True))
+            self.loop.close()
+
+    async def _upstream(self, request: bytes):
+        secure = ssl.create_default_context() if self.proxy.scheme == "https" else None
+        reader, writer = await asyncio.wait_for(asyncio.open_connection(
+            self.proxy.hostname, self.proxy.port, ssl=secure), timeout=30)
+        lines = request.decode("iso-8859-1").split("\r\n")
+        lines = [line for line in lines if line and not line.lower().startswith("proxy-authorization:")]
+        if self.proxy.username is not None:
+            login = f"{unquote(self.proxy.username)}:{unquote(self.proxy.password or '')}"
+            encoded = base64.b64encode(login.encode()).decode("ascii")
+            lines.append("Proxy-Authorization: Basic " + encoded)
+        writer.write(("\r\n".join(lines) + "\r\n\r\n").encode("iso-8859-1"))
+        await writer.drain()
+        return reader, writer
+
+    async def _pump(self, reader, writer):
+        while data := await asyncio.wait_for(reader.read(65536), timeout=120):
+            writer.write(data)
+            await writer.drain()
+
+    async def _handle(self, reader, writer):
+        upstream = None
+        pumps = []
+        try:
+            request = await asyncio.wait_for(reader.readuntil(b"\r\n\r\n"), timeout=15)
+            upstream_reader, upstream = await self._upstream(request)
+            if request.startswith(b"CONNECT "):
+                answer = await asyncio.wait_for(upstream_reader.readuntil(b"\r\n\r\n"), timeout=30)
+                if answer.split(b" ", 2)[1] != b"200":
+                    raise ConnectionError("upstream tunnel refused")
+                writer.write(b"HTTP/1.1 200 Connection established\r\n\r\n")
+                await writer.drain()
+            pumps = [asyncio.create_task(self._pump(reader, upstream)),
+                     asyncio.create_task(self._pump(upstream_reader, writer))]
+            await asyncio.wait(pumps, return_when=asyncio.FIRST_COMPLETED)
+        except (OSError, ValueError, IndexError, asyncio.TimeoutError,
+                asyncio.IncompleteReadError, asyncio.LimitOverrunError):
+            writer.write(b"HTTP/1.1 502 Proxy unavailable\r\nContent-Length: 0\r\nConnection: close\r\n\r\n")
+        finally:
+            for task in pumps:
+                task.cancel()
+            if pumps:
+                await asyncio.gather(*pumps, return_exceptions=True)
+            for connection in (writer, upstream):
+                if connection:
+                    connection.close()
+                    try:
+                        await connection.wait_closed()
+                    except OSError:
+                        pass
+
+
+@contextmanager
+def running(proxy: str):
+    relay = Relay(proxy)
+    relay.thread.start()
+    try:
+        if not relay.ready.wait(10) or relay.port is None:
+            raise RuntimeError("Could not start the owned JVM proxy relay")
+        yield relay.port
+    finally:
+        if relay.loop.is_running():
+            relay.loop.call_soon_threadsafe(relay.loop.stop)
+        relay.thread.join(timeout=10)
+        if relay.thread.is_alive():
+            raise RuntimeError("Owned JVM proxy relay did not finish cleanup")
+
+
+def environment(env: dict, port: int) -> dict:
+    options = (f"-Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort={port} "
+               f"-Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort={port} "
+               "-Dhttp.nonProxyHosts= -Dhttps.nonProxyHosts= -Djava.net.useSystemProxies=false")
+    # Java prints these options at startup; they contain no proxy credentials.
+    for name in ("JAVA_TOOL_OPTIONS", "JDK_JAVA_OPTIONS", "_JAVA_OPTIONS", "GRADLE_OPTS"):
+        env[name] = (env.get(name, "") + " " + options).strip()
+    env["GRADLE_OPTS"] += " -Dorg.gradle.daemon=false"
+    return env

package/android-action/scripts/play_store_proxy.py

@@ -1,11 +1,27 @@
-"""Google CI transport uses only the account-pinned proxy, including OAuth exchanges."""
+"""Google CI transport uses only the account-pinned proxy, including OAuth exchanges.
+
+Three entry points, all from the one validated ``GOOGLE_STORE_PROXY_URL``:
+
+* ``python3 play_store_proxy.py`` refuses a missing or malformed proxy.
+* ``python3 play_store_proxy.py -- <command …>`` runs a build tool with the explicit
+  proxy in both spellings and both ``NO_PROXY`` spellings cleared. Setting the pairs
+  as YAML ``env`` keys is not an option: GitHub compares env keys case-insensitively
+  and rejects the workflow or action file as invalid.
+* ``python3 play_store_proxy.py --github-env`` clears the lower-case ambient bypass
+  (``no_proxy``) for the rest of the job, so a JavaScript upload step that can only
+  carry upper-case ``env`` keys cannot be bypassed by a runner's ambient value.
+"""
 from __future__ import annotations
 
 import os
+import subprocess
+import sys
 from urllib.parse import urlsplit
 
 import requests
 
+LOWERCASE_BYPASS = ("no_proxy",)
+
 
 def proxy_url() -> str:
     value = os.environ.get("GOOGLE_STORE_PROXY_URL", "").strip()
@@ -33,5 +49,40 @@ def session() -> requests.Session:
     return client
 
 
-if __name__ == "__main__":
+def run(argv: list[str]) -> int:
+    """Run ``argv`` with the explicit proxy environment; the parent process is untouched."""
+    if not argv:
+        raise SystemExit("usage: play_store_proxy.py -- <command …>")
+    from jvm_proxy_relay import environment as jvm_environment, running
+
+    env = environment()
+    with running(proxy_url()) as port:
+        return subprocess.run(argv, env=jvm_environment(env, port), check=False).returncode
+
+
+def clear_github_env_bypass(path: str | None = None) -> list[str]:
+    """Append empty lower-case bypass assignments to ``$GITHUB_ENV`` for later steps."""
     proxy_url()
+    target = path or os.environ.get("GITHUB_ENV", "")
+    if not target:
+        raise SystemExit("GITHUB_ENV is not set; run this inside a GitHub Actions step")
+    lines = [f"{name}=" for name in LOWERCASE_BYPASS]
+    with open(target, "a", encoding="utf-8") as handle:
+        handle.write("".join(line + "\n" for line in lines))
+    return lines
+
+
+def main(args: list[str]) -> int:
+    if args[:1] == ["--github-env"]:
+        clear_github_env_bypass()
+        return 0
+    if args[:1] == ["--"]:
+        return run(args[1:])
+    if args:
+        raise SystemExit("usage: play_store_proxy.py [--github-env | -- <command …>]")
+    proxy_url()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/android-action/scripts/test_jvm_proxy_relay.py

@@ -0,0 +1,99 @@
+"""Real socket and Java proofs: authenticated upstream only, no target fallback."""
+import base64
+from contextlib import closing, contextmanager
+import http.client
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import os
+from pathlib import Path
+import shutil
+import socket
+import subprocess
+import tempfile
+import threading
+import unittest
+
+import jvm_proxy_relay as relay
+
+
+@contextmanager
+def upstream():
+    seen = []
+
+    class Proxy(BaseHTTPRequestHandler):
+        def do_GET(self):
+            seen.append((self.command, self.path, self.headers.get("Proxy-Authorization")))
+            self.send_response(200)
+            self.end_headers()
+            self.wfile.write(b"through pinned proxy")
+
+        def do_CONNECT(self):
+            seen.append((self.command, self.path, self.headers.get("Proxy-Authorization")))
+            self.send_response(200)
+            self.end_headers()
+            value = self.rfile.read(4)
+            self.wfile.write(value)
+
+        def log_message(self, *_):
+            pass
+
+    server = ThreadingHTTPServer(("127.0.0.1", 0), Proxy)
+    server.daemon_threads = True
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        yield f"http://fixture-user:fixture-pass@127.0.0.1:{server.server_port}", seen
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=5)
+
+
+class JvmProxyTests(unittest.TestCase):
+    def test_http_and_connect_only_reach_the_authenticated_upstream_and_cleanup(self):
+        with upstream() as (proxy, seen):
+            with relay.running(proxy) as port:
+                with closing(http.client.HTTPConnection("127.0.0.1", port, timeout=5)) as client:
+                    client.request("GET", "http://unresolvable.invalid/sdk")
+                    self.assertEqual(client.getresponse().read(), b"through pinned proxy")
+                with socket.create_connection(("127.0.0.1", port), timeout=5) as client:
+                    client.sendall(b"CONNECT unresolvable.invalid:443 HTTP/1.1\r\nHost: ignored\r\n\r\n")
+                    self.assertIn(b"200", client.recv(4096))
+                    client.sendall(b"test")
+                    self.assertEqual(client.recv(4), b"test")
+            with self.assertRaises(OSError):
+                socket.create_connection(("127.0.0.1", port), timeout=0.2)
+        auth = "Basic " + base64.b64encode(b"fixture-user:fixture-pass").decode()
+        self.assertEqual(seen, [("GET", "http://unresolvable.invalid/sdk", auth),
+                                ("CONNECT", "unresolvable.invalid:443", auth)])
+
+    def test_upstream_failure_returns_bounded_502_without_a_direct_request(self):
+        with socket.socket() as unused:
+            unused.bind(("127.0.0.1", 0))
+            closed_port = unused.getsockname()[1]
+        with relay.running(f"http://127.0.0.1:{closed_port}") as port:
+            with closing(http.client.HTTPConnection("127.0.0.1", port, timeout=5)) as client:
+                client.request("CONNECT", "unresolvable.invalid:443")
+                response = client.getresponse()
+                self.assertEqual((response.status, response.read()), (502, b""))
+
+    @unittest.skipUnless(shutil.which("java"), "Java runtime unavailable")
+    def test_actual_java_urlconnection_uses_explicit_proxy_with_no_credentials_in_options(self):
+        source = ('import java.net.*; public class Probe { public static void main(String[] args) '
+                  'throws Exception { var c = new URL("http://unresolvable.invalid/sdk").openConnection(); '
+                  'c.setConnectTimeout(3000); c.setReadTimeout(3000); '
+                  'System.out.print(new String(c.getInputStream().readAllBytes())); }}')
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+            target = Path(directory) / "Probe.java"
+            target.write_text(source)
+            with relay.running(proxy) as port:
+                env = relay.environment({**os.environ, "JAVA_TOOL_OPTIONS": "-Dhttp.proxyHost=wrong.invalid"}, port)
+                result = subprocess.run(["java", str(target)], env=env, capture_output=True, text=True, timeout=20)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout, "through pinned proxy")
+        self.assertEqual(seen[0][1], "http://unresolvable.invalid/sdk")
+        self.assertNotIn("fixture-pass", result.stderr)
+        self.assertIn("-Dorg.gradle.daemon=false", env["GRADLE_OPTS"])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_store_proxy.py

@@ -35,6 +35,62 @@ class PlayProxyTests(unittest.TestCase):
                 self.assertFalse(client.trust_env)
                 self.assertEqual(client.proxies, {"http": value, "https": value})
 
+    def test_exec_form_gives_the_child_both_spellings_and_no_bypass(self):
+        value = "http://assigned.proxy.test:1234"
+        probe = ("import os, json; print(json.dumps({k: os.environ.get(k) for k in "
+                 "['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'NO_PROXY', 'no_proxy']}))")
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": value, "no_proxy": "*", "NO_PROXY": "*"}), \
+                mock.patch.object(play_store_proxy.subprocess, "run") as run:
+            run.return_value.returncode = 0
+            self.assertEqual(play_store_proxy.run([sys.executable, "-c", probe]), 0)
+            child = run.call_args.kwargs["env"]
+            self.assertEqual(child["https_proxy"], value)
+            self.assertEqual(child["HTTP_PROXY"], value)
+            self.assertEqual(child["no_proxy"], "")
+            self.assertEqual(child["NO_PROXY"], "")
+            self.assertEqual(os.environ["no_proxy"], "*")
+
+    def test_exec_form_refuses_without_a_proxy_before_running_anything(self):
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": ""}), \
+                mock.patch.object(play_store_proxy.subprocess, "run") as run:
+            with self.assertRaises(SystemExit):
+                play_store_proxy.run(["true"])
+            run.assert_not_called()
+
+    def test_failed_child_preserves_exit_code_and_closes_its_relay(self):
+        import json
+        import socket
+        import tempfile
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "jvm-options.json"
+            probe = ("import json, os, sys; "
+                     "open(sys.argv[1], 'w').write(json.dumps(os.environ['JAVA_TOOL_OPTIONS'])); sys.exit(7)")
+            with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": "http://127.0.0.1:1"}):
+                self.assertEqual(play_store_proxy.run([sys.executable, "-c", probe, str(path)]), 7)
+            options = json.loads(path.read_text())
+            port = int(options.split("-Dhttp.proxyPort=", 1)[1].split()[0])
+            with self.assertRaises(OSError):
+                socket.create_connection(("127.0.0.1", port), timeout=0.2)
+
+    def test_github_env_mode_clears_only_the_lowercase_bypass_for_later_steps(self):
+        import tempfile
+        value = "http://assigned.proxy.test:1234"
+        with tempfile.TemporaryDirectory() as tmp:
+            target = os.path.join(tmp, "github.env")
+            with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": value, "GITHUB_ENV": target, "no_proxy": "*"}):
+                self.assertEqual(play_store_proxy.clear_github_env_bypass(), ["no_proxy="])
+                self.assertEqual(os.environ["no_proxy"], "*")
+            with open(target, encoding="utf-8") as handle:
+                self.assertEqual(handle.read(), "no_proxy=\n")
+
+    def test_github_env_mode_refuses_without_a_proxy_or_target(self):
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": "", "GITHUB_ENV": "/nonexistent"}):
+            with self.assertRaises(SystemExit):
+                play_store_proxy.clear_github_env_bypass()
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": "http://assigned.proxy.test:1234", "GITHUB_ENV": ""}):
+            with self.assertRaises(SystemExit):
+                play_store_proxy.clear_github_env_bypass()
+
 
 if __name__ == "__main__":
     unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.59
+1.0.61

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.59",
+  "version": "1.0.61",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -286,7 +286,8 @@ jobs:
           echo "Before:"; df -h / | tail -1
           # NOT /usr/local/lib/node_modules: npm and npx live there, and the
           # Android action's Crashlytics symbol upload shells out to npx.
-          sudo rm -rf /usr/share/dotnet /usr/local/lib/android/sdk/ndk \
+          # Keep installed Android SDK/NDKs: removing them makes AGP download them again.
+          sudo rm -rf /usr/share/dotnet \
                       /opt/ghc /usr/local/.ghcup /usr/local/share/powershell \
                       /usr/share/swift /usr/local/share/chromium 2>/dev/null || true
           sudo docker image prune --all --force >/dev/null 2>&1 || true
@@ -453,6 +454,14 @@ jobs:
       # Note this also means nothing else should be creating edits against these
       # packages while a deploy runs — an external poller that opens and deletes an
       # edit will invalidate the one this step is holding.
+      # The upload action is JavaScript, so its proxy can only be the step's own
+      # upper-case env keys below. Node clients fall back to a lower-case no_proxy
+      # when NO_PROXY is empty, and GitHub refuses both spellings in one env map, so
+      # the ambient lower-case bypass is cleared through GITHUB_ENV instead.
+      - name: Clear ambient lower-case proxy bypass
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' }}
+        shell: bash
+        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --github-env
       - name: Upload Android release to Google Play
         id: play-upload
         continue-on-error: true
@@ -461,8 +470,7 @@ jobs:
         env:
           HTTPS_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
           HTTP_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
-          NO_PROXY: ''
-          no_proxy: ''
+          NO_PROXY: ''  # one spelling only: GitHub rejects env keys that differ by case
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
           packageName: ${{ steps.android.outputs.package-name }}
@@ -490,8 +498,7 @@ jobs:
         env:
           HTTPS_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
           HTTP_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
-          NO_PROXY: ''
-          no_proxy: ''
+          NO_PROXY: ''  # one spelling only: GitHub rejects env keys that differ by case
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
           packageName: ${{ steps.android.outputs.package-name }}