gowalk-cicd 1.0.6 → 1.0.7

package/action/.daemux-version

@@ -1 +1 @@
-1.0.6
+1.0.7

package/action/scripts/capabilities.py

@@ -28,6 +28,13 @@ from pathlib import Path
 from asc_common import get_json, request
 
 
+# asc_common.request signals a non-retryable failure with SystemExit, which is
+# a BaseException — `except Exception` sails straight past it. Spelling both
+# out is what makes the "best-effort" promise below actually hold; without it
+# a capability call that Apple rejects kills the whole signing step.
+_API_FAILURES = (Exception, SystemExit)
+
+
 # Entitlement key -> App Store Connect capabilityType, for capabilities that
 # are a bare toggle. An entitlement absent from this map is not an error: most
 # entitlements (keychain-access-groups, get-task-allow, ...) need no App ID
@@ -100,11 +107,10 @@ def warn_about_manual_entitlements(entitlement_keys: set[str], bundle_id: str) -
 
 def enabled_capabilities(token: str, bundle_pk: str) -> set[str]:
     try:
-        data = get_json(
-            f"/bundleIds/{bundle_pk}/bundleIdCapabilities", token,
-            params={"limit": "200"},
-        )
-    except Exception as exc:  # noqa: BLE001 - never fail signing over a read
+        # No `limit` here: this relationship rejects it outright with
+        # PARAMETER_ERROR.ILLEGAL. Apple returns the full capability set.
+        data = get_json(f"/bundleIds/{bundle_pk}/bundleIdCapabilities", token)
+    except _API_FAILURES as exc:
         print(f"::warning::could not list capabilities for {bundle_pk}: {exc!r}")
         return set()
     found = set()
@@ -131,7 +137,7 @@ def enable_capability(token: str, bundle_pk: str, capability: str) -> bool:
             "POST", "/bundleIdCapabilities", token,
             json_body=body, allow_status={200, 201, 409},
         )
-    except Exception as exc:  # noqa: BLE001 - Apple's archive error is clearer
+    except _API_FAILURES as exc:
         print(f"::warning::could not enable {capability}: {exc!r}")
         return False
     if response.status_code == 409:

package/action/scripts/test_capabilities.py

@@ -129,6 +129,26 @@ class ReconcileTest(unittest.TestCase):
 
         self.assertFalse(changed)
 
+    def test_systemexit_from_asc_does_not_kill_signing(self) -> None:
+        # asc_common.request raises SystemExit, not Exception, so a bare
+        # `except Exception` would let an Apple 4xx abort the whole run.
+        with mock.patch.object(capabilities, "get_json", side_effect=SystemExit("400")), \
+                mock.patch.object(capabilities, "request", side_effect=SystemExit("400")):
+            changed = capabilities.reconcile(
+                "tok", "PK", "com.gowalk.form",
+                {"com.apple.developer.devicecheck.appattest-environment"},
+            )
+
+        self.assertFalse(changed)
+
+    def test_capability_listing_sends_no_limit_parameter(self) -> None:
+        # /bundleIds/{id}/bundleIdCapabilities rejects `limit` with
+        # PARAMETER_ERROR.ILLEGAL rather than ignoring it.
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}) as get:
+            capabilities.enabled_capabilities("tok", "PK")
+
+        get.assert_called_once_with("/bundleIds/PK/bundleIdCapabilities", "tok")
+
     def test_warns_about_capabilities_it_will_not_guess(self) -> None:
         with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
                 mock.patch("builtins.print") as printed:

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.6
+1.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {