gowalk-cicd 1.0.60 → 1.0.62

package/CLAUDE.md

@@ -108,13 +108,24 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Python clients enforce explicit proxies; Play upload steps set the proxy for the
   pinned Google client. Missing configuration must stop before a provider call.
   Apple IPA uploads use `action/scripts/upload_build.py`, not native upload tools.
-  It retains provider IDs/checksums and verifies matching IPA identity before resume.
+  It retains provider IDs/local SHA-256 and verifies matching IPA identity before resume.
+  Finalization sends `uploaded:true` as Apple's documented BuildUpload flow does; the
+  IPA endpoint rejected the optional SHA_256 checksum attribute despite the generic
+  schema advertising it. Completed-file reuse requires the content-derived filename
+  and size; any checksum returned by Apple is verified against the local file.
 - Signing material should use encrypted Actions secrets. `deploy.yml`
   materializes `ASC_KEY_P8` + its ID/issuer, the Apple distribution identity
   (`IOS_DISTRIBUTION_P12_BASE64`, `IOS_DISTRIBUTION_CERT_META_BASE64`,
   `IOS_DISTRIBUTION_CERT_REGISTRY_BASE64`), and the Android keystore, properties
   and Play service account into an ephemeral runner checkout.
   Tracked `creds/` files remain a backward-compatible fallback.
+- Never revoke a distribution certificate automatically, including legacy caches.
+  `certificate-cap-policy` accepts only `fail`; a full cap requires registry reconciliation.
+- Keep preinstalled Android SDK/NDKs. Every Gradle test/build and SDK download runs
+  under `play_store_proxy.py --`, whose owned loopback relay gives Java an explicit
+  authenticated account exit without credentials in JVM options. HTTPS is tunneled
+  without TLS interception; no upstream failure may fall back to the destination.
+  The wrapper disables Gradle daemons and closes its relay when the command ends.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and
   supplies it to Compose after the generated `.env`; never print its content.
@@ -168,7 +179,7 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   can be raised to cover a release's life.
 - Firebase Crashlytics traffic follows the Google account proxy. Android builds and
   the pinned Firebase CLI receive the explicit proxy environment; Crashlytics Gradle
-  2.9.2+ and the pinned buildtools support it (generic JVM networking does not).
+  2.9.2+ and the pinned buildtools support it; generic JVM networking uses the relay.
   Native iOS upload-symbols uses NSURLSession, so it is never executed. Before
   archiving, dedicated Crashlytics upload phases in the ephemeral Xcode projects
   are deferred; mixed/unidentified upload phases refuse the archive for repair.

package/README.md

@@ -327,12 +327,19 @@ zip I/O error: No space left on device
 ```
 
 The Android job removes the preinstalled toolchains a Flutter build never uses
-(.NET, the Android NDK, GHC, PowerShell, Swift, Chromium) and prunes Docker
+(.NET, GHC, PowerShell, Swift, Chromium) and prunes Docker
 images, reclaiming roughly 25 GB in a few seconds. It prints `df -h /` before
 and after. Linux only; skipped in Bitrise mode. npm survives on purpose: the
 [Crashlytics symbol upload](#crashlytics-symbol-delivery-firebase_app_id) runs
 the Firebase CLI through `npx`.
 
+The preinstalled Android SDK and NDKs are retained. Gradle and SDK-manager Java
+networking runs through an owned loopback relay to `GOOGLE_STORE_PROXY_URL`.
+The relay authenticates to that exit without putting credentials in JVM options;
+HTTPS remains an end-to-end TLS tunnel. An unavailable proxy fails the request,
+and the relay shuts down with its child command. Gradle daemons are disabled for
+these commands so they cannot retain an expired relay port.
+
 ### Private git dependencies (Flutter)
 
 A Flutter app can depend on private git packages:
@@ -441,7 +448,8 @@ identity and create per-app provisioning profiles, but it never creates,
 replaces, or revokes a registry-managed distribution certificate. Missing,
 partially written, corrupt, expired, Apple-revoked, or resource-ID/P12-mismatched
 managed material aborts with a reconciliation error. Legacy repos without the
-marker keep the historical cache lifecycle.
+marker may create a certificate in an available slot, but never revoke another
+identity. A full certificate cap stops for account-registry reconciliation.
 
 ## How it works
 
@@ -773,7 +781,7 @@ common ones:
 | `bundle-id` | Override the auto-detected bundle identifier |
 | `team-id` | Override the auto-detected team ID |
 | `app-store-apple-id` | Numeric ASC app ID (override auto-lookup) |
-| `certificate-cap-policy` | Full-cap behavior: `fail` preserves identities; default `revoke-oldest` rotates. |
+| `certificate-cap-policy` | Only `fail` is accepted (the default); existing identities are always preserved. |
 | `run-tests` | `false` to skip the simulator test stage |
 | `uses-non-exempt-encryption` | Value for `ITSAppUsesNonExemptEncryption` |
 | `archive` | `false` to build-only (PR runs without secrets) |
@@ -793,8 +801,7 @@ inside GitHub Actions.
 Once the app exists, all subsequent builds and uploads are fully automated via
 the ASC API key.
 
-For accounts where automatic certificate revocation is not acceptable, pass
-`certificate-cap-policy: 'fail'`. The action may add a certificate when Apple has a free
+Automatic certificate revocation is disabled for every account. The action may add a certificate when Apple has a free
 slot, but a full-cap response aborts without listing or revoking existing identities. If
 signing preparation fails after creating a certificate, the default-branch workflow first
 commits any completed cache files, then re-raises the failure so the private key is not lost.
@@ -955,3 +962,16 @@ even that first auto-bootstrap.
 ## License
 
 MIT
+
+### Recovering an Apple REST upload failure
+
+The uploader retains the local SHA-256, version and provider upload/file IDs. It commits
+completed part transfers with `uploaded: true`, following Apple's
+[BuildUpload walkthrough](https://developer.apple.com/videos/play/wwdc2025/324/).
+The IPA endpoint rejected an optional `sourceFileChecksums` SHA_256 object even though
+the generic schema lists that algorithm; the uploader no longer sends that attribute.
+A completed file is reused only when its content-derived filename and size match, and
+any returned file checksum is verified. A failed upload emits the typed
+`apple_build_upload_failed` error annotation with schema
+`gowalk-cicd/apple-build-upload-failed.v1`; retain the exact IPA/receipt and read back
+the provider state before retrying. All requests and parts still use the Apple proxy.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.60
+1.0.62

package/action/action.yml

@@ -53,10 +53,10 @@ inputs:
   certificate-cap-policy:
     description: >
       Behavior when Apple reports the two-certificate Distribution cap.
-      'revoke-oldest' preserves historical behavior; 'fail' aborts without
-      listing or revoking any existing certificate.
+      Only 'fail' is supported: abort without revoking any existing certificate.
+      Reconcile the account registry when no live signing identity is available.
     required: false
-    default: "revoke-oldest"
+    default: "fail"
   persist-signing-cache:
     description: >
       Commit refreshed signing files back to the default branch. Set to

package/action/scripts/cert_factory.py

@@ -3,7 +3,7 @@
 Cert-creation primitives for the iOS native TestFlight action.
 
 Owns the cryptographic legwork (RSA key + CSR), Apple's per-team cert
-cap policy (fail closed or revoke OLDEST on 409), and PKCS12 serialisation. Split
+cap refusal (never automatic revocation), and PKCS12 serialisation. Split
 from ``prepare_signing.py`` so the orchestrator there stays focused on
 the load-or-regen control flow and the file count stays under the
 project's per-file limits.
@@ -16,35 +16,20 @@ from __future__ import annotations
 
 import base64
 import os
-import time
 
-from asc_common import get_json, request
+from asc_common import request
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 from cryptography.hazmat.primitives.serialization import pkcs12
 from cryptography.x509.oid import NameOID
 
-# Apple's cert revoke -> create pipeline is eventually consistent: a
-# DELETE on the per-team cap-blocking cert sometimes still shows up as
-# "active" to a follow-up POST for a second or two, returning a fresh
-# 409 even though we just freed a slot. Sleep then retry-with-backoff
-# rather than failing the whole CI run on a known-transient race.
-CERT_REVOKE_PROPAGATION_DELAY_SEC = float(
-    os.getenv("CERT_REVOKE_PROPAGATION_DELAY_SEC", "2.0")
-)
-CERT_POST_RETRIES_AFTER_REVOKE = int(
-    os.getenv("CERT_POST_RETRIES_AFTER_REVOKE", "2")
-)
-CERTIFICATE_CAP_POLICIES = frozenset({"revoke-oldest", "fail"})
-
 
 def certificate_cap_policy() -> str:
-    """Return the configured full-cap behavior before any provider call."""
-    policy = os.getenv("CERTIFICATE_CAP_POLICY", "revoke-oldest").strip().lower()
-    if policy not in CERTIFICATE_CAP_POLICIES:
-        allowed = ", ".join(sorted(CERTIFICATE_CAP_POLICIES))
-        raise SystemExit(f"invalid CERTIFICATE_CAP_POLICY {policy!r}; use {allowed}")
+    """Refuse destructive legacy policy before any provider call."""
+    policy = os.getenv("CERTIFICATE_CAP_POLICY", "fail").strip().lower()
+    if policy != "fail":
+        raise SystemExit("invalid CERTIFICATE_CAP_POLICY; use fail. Automatic certificate revocation is disabled")
     return policy
 
 
@@ -75,79 +60,9 @@ def generate_key_and_csr() -> tuple[rsa.RSAPrivateKey, bytes]:
     return private_key, csr_payload
 
 
-def oldest_distribution_cert_id(token: str) -> str | None:
-    """Return the DISTRIBUTION cert with the EARLIEST expirationDate.
-
-    Apple caps each team at 2 distribution certs; when CI hits the cap
-    we must revoke one. Picking the OLDEST is the safest choice — the
-    NEWEST cert signed the most recent build that may still be in ASC
-    processing, and revoking that mid-processing produces ITMS-90035
-    ("signed with an ad-hoc certificate, not a distribution
-    certificate") on the prior run. Older certs have long since cleared
-    processing.
-    """
-    data = get_json(
-        "/certificates",
-        token,
-        params={
-            "limit": "200",
-            "sort": "-id",
-            "filter[certificateType]": "DISTRIBUTION",
-        },
-    )
-    oldest_id = None
-    oldest_exp: str | None = None
-    for cert in data.get("data", []):
-        attrs = cert.get("attributes") or {}
-        exp = attrs.get("expirationDate") or ""
-        if not exp:
-            continue
-        if oldest_exp is None or exp < oldest_exp:
-            oldest_exp = exp
-            oldest_id = cert["id"]
-    return oldest_id
-
-
-def _post_with_revoke_backoff(token: str, body: dict):
-    """POST a cert create after a revoke, tolerating ASC propagation lag.
-
-    Apple's DELETE -> POST pipeline is eventually consistent: a freshly
-    revoked cert may still count against the per-team cap for a brief
-    window, producing a spurious 409 on the immediate re-POST. Sleep
-    once for ``CERT_REVOKE_PROPAGATION_DELAY_SEC`` then retry up to
-    ``CERT_POST_RETRIES_AFTER_REVOKE`` times with exponential backoff.
-    The final attempt drops ``allow_status`` so a real 409 surfaces as
-    Apple's full body via ``request``'s SystemExit.
-    """
-    time.sleep(CERT_REVOKE_PROPAGATION_DELAY_SEC)
-    delay = CERT_REVOKE_PROPAGATION_DELAY_SEC
-    for attempt in range(CERT_POST_RETRIES_AFTER_REVOKE):
-        resp = request(
-            "POST", "/certificates", token, json_body=body, allow_status={409}
-        )
-        if resp.status_code != 409:
-            return resp
-        print(
-            f"Post-revoke 409 on attempt {attempt + 1}/"
-            f"{CERT_POST_RETRIES_AFTER_REVOKE}; "
-            f"sleeping {delay}s before final retry"
-        )
-        time.sleep(delay)
-        delay *= 2
-    # Final attempt without allow_status — let Apple's body surface via
-    # request()'s SystemExit if the cap is genuinely still hit.
-    return request("POST", "/certificates", token, json_body=body)
-
-
 def create_distribution_cert(token: str, csr_b64: str) -> tuple[str, bytes]:
-    """POST a CSR to ASC; return ``(cert_id, cert_der)``.
-
-    On 409 (per-team cap of 2 hit) revoke the OLDEST existing cert
-    (see :func:`oldest_distribution_cert_id` for why) and retry with
-    backoff to absorb Apple's revoke -> create propagation lag (see
-    :func:`_post_with_revoke_backoff`).
-    """
-    cap_policy = certificate_cap_policy()
+    """POST one CSR; a full team cap preserves every existing certificate."""
+    certificate_cap_policy()
     body = {
         "data": {
             "type": "certificates",
@@ -161,24 +76,10 @@ def create_distribution_cert(token: str, csr_b64: str) -> tuple[str, bytes]:
         "POST", "/certificates", token, json_body=body, allow_status={409}
     )
     if resp.status_code == 409:
-        if cap_policy == "fail":
-            raise SystemExit(
-                "distribution certificate cap reached; policy=fail preserves all "
-                "existing certificates and refuses automatic revocation"
-            )
-        # Revoke the OLDEST cert, NOT the newest. The newest cert signed
-        # the previous build that may still be in ASC processing — revoking
-        # it during processing yields ITMS-90035 on the prior build.
-        # See oldest_distribution_cert_id() for the full rationale.
-        print("Distribution cert cap hit; revoking oldest existing cert")
-        target = oldest_distribution_cert_id(token)
-        if not target:
-            raise SystemExit(
-                "409 from cert create but no existing DISTRIBUTION cert "
-                "found to revoke"
-            )
-        request("DELETE", f"/certificates/{target}", token)
-        resp = _post_with_revoke_backoff(token, body)
+        raise SystemExit(
+            "distribution certificate cap reached; policy=fail preserves all "
+            "existing certificates and refuses automatic revocation; reconcile the account registry"
+        )
     data = resp.json()["data"]
     cert_id = data["id"]
     cert_der = base64.b64decode(data["attributes"]["certificateContent"])

package/action/scripts/creds_store.py

@@ -220,7 +220,7 @@ def verify_cert_alive(token: str, cert_id: str,
     """Return True iff GET /certificates/{cert_id} returns 200.
 
     A 404 means Apple revoked it (manually or via the cap-rotation done
-    by ``oldest_distribution_cert_id``); any other non-200 is treated
+    by another signing client); any other non-200 is treated
     conservatively as not-alive so we regenerate.
     """
     resp = request(

package/action/scripts/test_certificate_cap_policy.py

@@ -28,27 +28,25 @@ class CertificateCapPolicyTests(unittest.TestCase):
         response = mock.MagicMock(status_code=409)
         with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "fail"}, clear=True):
             with mock.patch.object(cert_factory, "request", return_value=response) as request:
-                with mock.patch.object(cert_factory, "oldest_distribution_cert_id") as oldest:
-                    with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
-                        cert_factory.create_distribution_cert("token", "csr")
+                with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
+                    cert_factory.create_distribution_cert("token", "csr")
         request.assert_called_once()
-        oldest.assert_not_called()
+        self.assertEqual(request.call_args.args[:2], ("POST", "/certificates"))
 
-    def test_default_policy_keeps_backward_compatible_rotation(self):
+    def test_default_policy_never_revokes_or_retries_a_full_cap(self):
         capped = mock.MagicMock(status_code=409)
-        created = mock.MagicMock()
-        created.json.return_value = {
-            "data": {"id": "NEW", "attributes": {"certificateContent": "Y2VydA=="}}
-        }
         with mock.patch.dict(os.environ, {}, clear=True):
-            with mock.patch.object(
-                cert_factory, "request", side_effect=[capped, mock.MagicMock()]
-            ) as request:
-                with mock.patch.object(cert_factory, "oldest_distribution_cert_id", return_value="OLD"):
-                    with mock.patch.object(cert_factory, "_post_with_revoke_backoff", return_value=created):
-                        cert_id, cert_der = cert_factory.create_distribution_cert("token", "csr")
-        self.assertEqual((cert_id, cert_der), ("NEW", b"cert"))
-        request.assert_any_call("DELETE", "/certificates/OLD", "token")
+            with mock.patch.object(cert_factory, "request", return_value=capped) as request:
+                with self.assertRaisesRegex(SystemExit, "refuses automatic revocation"):
+                    cert_factory.create_distribution_cert("token", "csr")
+        request.assert_called_once()
+
+    def test_historical_destructive_setting_is_refused_before_contacting_apple(self):
+        with mock.patch.dict(os.environ, {"CERTIFICATE_CAP_POLICY": "revoke-oldest"}, clear=True):
+            with mock.patch.object(cert_factory, "request") as request:
+                with self.assertRaisesRegex(SystemExit, "Automatic certificate revocation is disabled"):
+                    cert_factory.create_distribution_cert("token", "csr")
+        request.assert_not_called()
 
 
 class CertificateCapActionWiringTests(unittest.TestCase):
@@ -56,7 +54,7 @@ class CertificateCapActionWiringTests(unittest.TestCase):
         source = ACTION_YAML.read_text(encoding="utf-8")
         self.assertRegex(
             source,
-            r"(?m)^  certificate-cap-policy:\n(?:    .*\n)*?    default: \"revoke-oldest\"$",
+            r"(?m)^  certificate-cap-policy:\n(?:    .*\n)*?    default: \"fail\"$",
         )
         self.assertIn("CERTIFICATE_CAP_POLICY: ${{ inputs.certificate-cap-policy }}", source)
         self.assertIn("SIGNING_PREP_EXIT=$signing_exit", source)

package/action/scripts/test_upload_build.py

@@ -62,7 +62,7 @@ class BuildUploadTests(unittest.TestCase):
             api.assert_not_called()
             transfer.assert_not_called()
 
-    def test_parts_are_joined_before_committing_the_checksum(self):
+    def test_parts_are_joined_before_committing_the_uploaded_file(self):
         file = {"id": "file", "attributes": {"uploadOperations": [{"offset": 0, "length": 2},
                                                                         {"offset": 2, "length": 3}]}}
         done = []
@@ -71,8 +71,7 @@ class BuildUploadTests(unittest.TestCase):
             upload_build.transfer_all(Path("unused"), file, {"fileSize": 5, "sha256": "digest"})
             self.assertEqual(sorted(done), [0, 2])
             body = api.call_args.args[2]["data"]["attributes"]
-            self.assertEqual(body, {"uploaded": True, "sourceFileChecksums": {
-                "file": {"hash": "digest", "algorithm": "SHA_256"}}})
+            self.assertEqual(body, {"uploaded": True})
 
     def test_failed_part_never_commits_the_file(self):
         file = {"id": "file", "attributes": {"uploadOperations": [{"offset": 0, "length": 5}]}}

package/action/scripts/test_upload_checksums.py

@@ -0,0 +1,74 @@
+"""Completed-file recovery keeps byte identity without inventing optional provider attributes."""
+import base64
+from contextlib import redirect_stdout
+import hashlib
+import io
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import upload_build
+
+
+class CompletedUploadTests(unittest.TestCase):
+    def test_provider_exit_emits_typed_failure_without_exception_content(self):
+        output = io.StringIO()
+        with tempfile.TemporaryDirectory() as temporary, redirect_stdout(output), \
+                mock.patch.object(sys, "argv", ["upload_build.py", "app.ipa", "--report", temporary + "/receipt.json"]), \
+                mock.patch.object(upload_build, "deliver", side_effect=SystemExit("private-provider-detail")):
+            with self.assertRaisesRegex(SystemExit, "retain its receipt"):
+                upload_build.main()
+        self.assertIn("::error title=apple_build_upload_failed::", output.getvalue())
+        self.assertNotIn("private-provider-detail", output.getvalue())
+
+    def test_provider_completion_without_optional_checksum_reuses_exact_file(self):
+        info = {"fileName": "source-sha256.ipa", "fileSize": 5}
+        file = {"attributes": {**info, "assetDeliveryState": {"state": "COMPLETE"}}}
+        with mock.patch.object(upload_build, "api") as api, mock.patch.object(upload_build, "transfer") as transfer:
+            upload_build.transfer_all(Path("not-read"), file, info)
+            api.assert_not_called()
+            transfer.assert_not_called()
+            file["attributes"]["fileName"] = "another-source.ipa"
+            with self.assertRaisesRegex(ValueError, "identity"):
+                upload_build.transfer_all(Path("not-read"), file, info)
+
+    def test_present_provider_checksums_are_verified_against_actual_bytes(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            ipa = Path(temporary) / "app.ipa"
+            ipa.write_bytes(b"the uploaded file")
+            info = {"fileName": "source-sha256.ipa", "fileSize": ipa.stat().st_size}
+            for algorithm, digest in [("SHA_256", hashlib.sha256(ipa.read_bytes())),
+                                      ("MD5", hashlib.md5(ipa.read_bytes()))]:
+                for value in [digest.hexdigest(), base64.b64encode(digest.digest()).decode()]:
+                    with self.subTest(algorithm=algorithm, encoding=value):
+                        attributes = {**info, "assetDeliveryState": {"state": "COMPLETE"},
+                                      "sourceFileChecksums": {"file": {"hash": value, "algorithm": algorithm}}}
+                        upload_build.transfer_all(ipa, {"attributes": attributes}, info)
+                        attributes["sourceFileChecksums"]["file"]["hash"] = "different-bytes"
+                        with self.assertRaisesRegex(ValueError, "checksum"):
+                            upload_build.transfer_all(ipa, {"attributes": attributes}, info)
+
+    def test_commit_uses_documented_uploaded_attribute_after_all_bytes_finish(self):
+        # Apple's WWDC25 BuildUpload sample sends uploaded=true. The observed IPA
+        # endpoint rejected the optional SHA_256 sourceFileChecksums object with409.
+        parts = [{"offset": 0, "length": 2}, {"offset": 2, "length": 3}]
+        done = []
+        def provider(method, path, body):
+            self.assertEqual(sorted(done), [0, 2])
+            attributes = body["data"]["attributes"]
+            if "sourceFileChecksums" in attributes:
+                raise SystemExit("409 ENTITY_ERROR.ATTRIBUTE.INVALID")
+            self.assertTrue(attributes["uploaded"])
+            return {"data": {"id": "existing-file"}}
+        with mock.patch.object(upload_build, "api", side_effect=provider) as api, \
+                mock.patch.object(upload_build, "transfer", side_effect=lambda _path, op: done.append(op["offset"])):
+            upload_build.transfer_all(Path("not-read"), {"id": "existing-file", "attributes": {
+                "uploadOperations": parts}}, {"fileSize": 5, "sha256": "local-receipt-digest"})
+            self.assertEqual(api.call_count, 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/upload_build.py

@@ -15,6 +15,7 @@ import zipfile
 
 import asc_common
 import apple_store_proxy as store_proxy
+import upload_checksums
 
 
 def api(method: str, path: str, body=None, params=None) -> dict:
@@ -96,9 +97,7 @@ def transfer_all(ipa: Path, file: dict, info: dict) -> None:
     attributes = file.get("attributes") or {}
     state = (attributes.get("assetDeliveryState") or {}).get("state")
     if state == "COMPLETE":
-        expected = {"hash": info["sha256"], "algorithm": "SHA_256"}
-        if (attributes.get("sourceFileChecksums") or {}).get("file") != expected:
-            raise ValueError("Apple's completed file checksum does not match this IPA")
+        upload_checksums.completed(ipa, attributes, info)
         return
     operations = sorted(attributes.get("uploadOperations") or [], key=lambda row: row["offset"])
     offset = 0
@@ -113,8 +112,10 @@ def transfer_all(ipa: Path, file: dict, info: dict) -> None:
         for result in results:
             result.result()
     api("PATCH", f"/buildUploadFiles/{file['id']}", {"data": {
-        "type": "buildUploadFiles", "id": file["id"], "attributes": {"uploaded": True,
-        "sourceFileChecksums": {"file": {"hash": info["sha256"], "algorithm": "SHA_256"}}},
+        # Apple's build-upload contract commits with uploaded=true. Its generic
+        # checksum enum includes SHA_256, but IPA finalization rejected that
+        # optional attribute with ENTITY_ERROR.ATTRIBUTE.INVALID in production.
+        "type": "buildUploadFiles", "id": file["id"], "attributes": {"uploaded": True},
     }})
 
 
@@ -154,7 +155,11 @@ def main() -> None:
     args = parser.parse_args()
     try:
         receipt = deliver(args.ipa, args.report, args.timeout)
-    except (OSError, ValueError, KeyError, RuntimeError):
+    except (OSError, ValueError, KeyError, RuntimeError, SystemExit):
+        print('::error title=apple_build_upload_failed::' + json.dumps({
+            "schema": "gowalk-cicd/apple-build-upload-failed.v1",
+            "receipt_available": args.report.is_file(),
+            "action": "retain the IPA and receipt; read provider upload state before retrying"}))
         message = "Apple REST upload did not complete; retain its receipt and resolve the provider state"
         raise SystemExit(message) from None
     print(json.dumps(receipt))

package/action/scripts/upload_checksums.py

@@ -0,0 +1,24 @@
+"""Check completed upload identity without requiring Apple's optional checksum attribute."""
+from __future__ import annotations
+
+import base64
+import hashlib
+from pathlib import Path
+
+
+def completed(ipa: Path, attributes: dict, info: dict) -> None:
+    if any(attributes.get(key) != info[key] for key in ("fileName", "fileSize")):
+        raise ValueError("Apple's completed file identity does not match this IPA")
+    checksum = (attributes.get("sourceFileChecksums") or {}).get("file")
+    if checksum is None:
+        # The name is the local SHA-256 plus .ipa; upload_file verified this same
+        # provider-owned file identity before any transfer or completed-file reuse.
+        return
+    algorithm = {"SHA_256": "sha256", "MD5": "md5"}.get(checksum.get("algorithm"))
+    if algorithm is None:
+        raise ValueError("Apple returned an unsupported completed-file checksum algorithm")
+    with ipa.open("rb") as stream:
+        digest = hashlib.file_digest(stream, algorithm)
+    expected = {digest.hexdigest(), digest.hexdigest().upper(), base64.b64encode(digest.digest()).decode()}
+    if checksum.get("hash") not in expected:
+        raise ValueError("Apple's completed file checksum does not match this IPA")

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.60
+1.0.62

package/android-action/action.yml

@@ -222,7 +222,8 @@ runs:
       working-directory: ${{ steps.config.outputs.gradle_root || '.' }}
       run: |
         chmod +x ./gradlew
-        ./gradlew test --console=plain --stacktrace
+        python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- \
+          ./gradlew test --console=plain --stacktrace
 
     # ANDROID_BUILD_NUMBER is already in the environment: resolve_android.py
     # exported it through GITHUB_ENV. ANDROID_BUILD_NAME is only set when the

package/android-action/scripts/jvm_proxy_relay.py

@@ -0,0 +1,119 @@
+"""An owned loopback relay for JVMs that cannot authenticate to the assigned HTTP proxy.
+
+Only the configured upstream is ever dialled. HTTPS remains an opaque CONNECT
+tunnel; Java still verifies the provider's TLS certificate end to end.
+"""
+from __future__ import annotations
+
+import asyncio
+import base64
+from contextlib import contextmanager
+import ssl
+import threading
+from urllib.parse import unquote, urlsplit
+
+
+class Relay:
+    def __init__(self, proxy: str):
+        self.proxy = urlsplit(proxy)
+        self.loop = asyncio.new_event_loop()
+        self.ready = threading.Event()
+        self.thread = threading.Thread(target=self._serve, daemon=True)
+        self.server = None
+        self.port = None
+
+    def _serve(self):
+        asyncio.set_event_loop(self.loop)
+        try:
+            self.server = self.loop.run_until_complete(
+                asyncio.start_server(self._handle, "127.0.0.1", 0, limit=65536))
+            self.port = self.server.sockets[0].getsockname()[1]
+            self.ready.set()
+            self.loop.run_forever()
+        finally:
+            self.ready.set()
+            if self.server:
+                self.server.close()
+                self.loop.run_until_complete(self.server.wait_closed())
+            tasks = asyncio.all_tasks(self.loop)
+            for task in tasks:
+                task.cancel()
+            self.loop.run_until_complete(asyncio.gather(*tasks, return_exceptions=True))
+            self.loop.close()
+
+    async def _upstream(self, request: bytes):
+        secure = ssl.create_default_context() if self.proxy.scheme == "https" else None
+        reader, writer = await asyncio.wait_for(asyncio.open_connection(
+            self.proxy.hostname, self.proxy.port, ssl=secure), timeout=30)
+        lines = request.decode("iso-8859-1").split("\r\n")
+        lines = [line for line in lines if line and not line.lower().startswith("proxy-authorization:")]
+        if self.proxy.username is not None:
+            login = f"{unquote(self.proxy.username)}:{unquote(self.proxy.password or '')}"
+            encoded = base64.b64encode(login.encode()).decode("ascii")
+            lines.append("Proxy-Authorization: Basic " + encoded)
+        writer.write(("\r\n".join(lines) + "\r\n\r\n").encode("iso-8859-1"))
+        await writer.drain()
+        return reader, writer
+
+    async def _pump(self, reader, writer):
+        while data := await asyncio.wait_for(reader.read(65536), timeout=120):
+            writer.write(data)
+            await writer.drain()
+
+    async def _handle(self, reader, writer):
+        upstream = None
+        pumps = []
+        try:
+            request = await asyncio.wait_for(reader.readuntil(b"\r\n\r\n"), timeout=15)
+            upstream_reader, upstream = await self._upstream(request)
+            if request.startswith(b"CONNECT "):
+                answer = await asyncio.wait_for(upstream_reader.readuntil(b"\r\n\r\n"), timeout=30)
+                if answer.split(b" ", 2)[1] != b"200":
+                    raise ConnectionError("upstream tunnel refused")
+                writer.write(b"HTTP/1.1 200 Connection established\r\n\r\n")
+                await writer.drain()
+            pumps = [asyncio.create_task(self._pump(reader, upstream)),
+                     asyncio.create_task(self._pump(upstream_reader, writer))]
+            await asyncio.wait(pumps, return_when=asyncio.FIRST_COMPLETED)
+        except (OSError, ValueError, IndexError, asyncio.TimeoutError,
+                asyncio.IncompleteReadError, asyncio.LimitOverrunError):
+            writer.write(b"HTTP/1.1 502 Proxy unavailable\r\nContent-Length: 0\r\nConnection: close\r\n\r\n")
+        finally:
+            for task in pumps:
+                task.cancel()
+            if pumps:
+                await asyncio.gather(*pumps, return_exceptions=True)
+            for connection in (writer, upstream):
+                if connection:
+                    connection.close()
+                    try:
+                        await connection.wait_closed()
+                    except OSError:
+                        pass
+
+
+@contextmanager
+def running(proxy: str):
+    relay = Relay(proxy)
+    relay.thread.start()
+    try:
+        if not relay.ready.wait(10) or relay.port is None:
+            raise RuntimeError("Could not start the owned JVM proxy relay")
+        yield relay.port
+    finally:
+        if relay.loop.is_running():
+            relay.loop.call_soon_threadsafe(relay.loop.stop)
+        relay.thread.join(timeout=10)
+        if relay.thread.is_alive():
+            raise RuntimeError("Owned JVM proxy relay did not finish cleanup")
+
+
+def environment(env: dict, port: int) -> dict:
+    options = (f"-Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort={port} "
+               f"-Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort={port} "
+               "-Dhttp.nonProxyHosts= -Dhttps.nonProxyHosts= -Djava.net.useSystemProxies=false")
+    # Java prints these options at startup; they contain no proxy credentials.
+    for name in ("JAVA_TOOL_OPTIONS", "JDK_JAVA_OPTIONS", "_JAVA_OPTIONS", "GRADLE_OPTS"):
+        env[name] = (env.get(name, "") + " " + options).strip()
+    env["GRADLE_OPTS"] += " -Dorg.gradle.daemon=false"
+    return env

package/android-action/scripts/play_store_proxy.py

@@ -53,8 +53,11 @@ def run(argv: list[str]) -> int:
     """Run ``argv`` with the explicit proxy environment; the parent process is untouched."""
     if not argv:
         raise SystemExit("usage: play_store_proxy.py -- <command …>")
+    from jvm_proxy_relay import environment as jvm_environment, running
+
     env = environment()
-    return subprocess.run(argv, env=env, check=False).returncode
+    with running(proxy_url()) as port:
+        return subprocess.run(argv, env=jvm_environment(env, port), check=False).returncode
 
 
 def clear_github_env_bypass(path: str | None = None) -> list[str]:

package/android-action/scripts/test_jvm_proxy_relay.py

@@ -0,0 +1,99 @@
+"""Real socket and Java proofs: authenticated upstream only, no target fallback."""
+import base64
+from contextlib import closing, contextmanager
+import http.client
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import os
+from pathlib import Path
+import shutil
+import socket
+import subprocess
+import tempfile
+import threading
+import unittest
+
+import jvm_proxy_relay as relay
+
+
+@contextmanager
+def upstream():
+    seen = []
+
+    class Proxy(BaseHTTPRequestHandler):
+        def do_GET(self):
+            seen.append((self.command, self.path, self.headers.get("Proxy-Authorization")))
+            self.send_response(200)
+            self.end_headers()
+            self.wfile.write(b"through pinned proxy")
+
+        def do_CONNECT(self):
+            seen.append((self.command, self.path, self.headers.get("Proxy-Authorization")))
+            self.send_response(200)
+            self.end_headers()
+            value = self.rfile.read(4)
+            self.wfile.write(value)
+
+        def log_message(self, *_):
+            pass
+
+    server = ThreadingHTTPServer(("127.0.0.1", 0), Proxy)
+    server.daemon_threads = True
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        yield f"http://fixture-user:fixture-pass@127.0.0.1:{server.server_port}", seen
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=5)
+
+
+class JvmProxyTests(unittest.TestCase):
+    def test_http_and_connect_only_reach_the_authenticated_upstream_and_cleanup(self):
+        with upstream() as (proxy, seen):
+            with relay.running(proxy) as port:
+                with closing(http.client.HTTPConnection("127.0.0.1", port, timeout=5)) as client:
+                    client.request("GET", "http://unresolvable.invalid/sdk")
+                    self.assertEqual(client.getresponse().read(), b"through pinned proxy")
+                with socket.create_connection(("127.0.0.1", port), timeout=5) as client:
+                    client.sendall(b"CONNECT unresolvable.invalid:443 HTTP/1.1\r\nHost: ignored\r\n\r\n")
+                    self.assertIn(b"200", client.recv(4096))
+                    client.sendall(b"test")
+                    self.assertEqual(client.recv(4), b"test")
+            with self.assertRaises(OSError):
+                socket.create_connection(("127.0.0.1", port), timeout=0.2)
+        auth = "Basic " + base64.b64encode(b"fixture-user:fixture-pass").decode()
+        self.assertEqual(seen, [("GET", "http://unresolvable.invalid/sdk", auth),
+                                ("CONNECT", "unresolvable.invalid:443", auth)])
+
+    def test_upstream_failure_returns_bounded_502_without_a_direct_request(self):
+        with socket.socket() as unused:
+            unused.bind(("127.0.0.1", 0))
+            closed_port = unused.getsockname()[1]
+        with relay.running(f"http://127.0.0.1:{closed_port}") as port:
+            with closing(http.client.HTTPConnection("127.0.0.1", port, timeout=5)) as client:
+                client.request("CONNECT", "unresolvable.invalid:443")
+                response = client.getresponse()
+                self.assertEqual((response.status, response.read()), (502, b""))
+
+    @unittest.skipUnless(shutil.which("java"), "Java runtime unavailable")
+    def test_actual_java_urlconnection_uses_explicit_proxy_with_no_credentials_in_options(self):
+        source = ('import java.net.*; public class Probe { public static void main(String[] args) '
+                  'throws Exception { var c = new URL("http://unresolvable.invalid/sdk").openConnection(); '
+                  'c.setConnectTimeout(3000); c.setReadTimeout(3000); '
+                  'System.out.print(new String(c.getInputStream().readAllBytes())); }}')
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+            target = Path(directory) / "Probe.java"
+            target.write_text(source)
+            with relay.running(proxy) as port:
+                env = relay.environment({**os.environ, "JAVA_TOOL_OPTIONS": "-Dhttp.proxyHost=wrong.invalid"}, port)
+                result = subprocess.run(["java", str(target)], env=env, capture_output=True, text=True, timeout=20)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout, "through pinned proxy")
+        self.assertEqual(seen[0][1], "http://unresolvable.invalid/sdk")
+        self.assertNotIn("fixture-pass", result.stderr)
+        self.assertIn("-Dorg.gradle.daemon=false", env["GRADLE_OPTS"])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_store_proxy.py

@@ -57,6 +57,21 @@ class PlayProxyTests(unittest.TestCase):
                 play_store_proxy.run(["true"])
             run.assert_not_called()
 
+    def test_failed_child_preserves_exit_code_and_closes_its_relay(self):
+        import json
+        import socket
+        import tempfile
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / "jvm-options.json"
+            probe = ("import json, os, sys; "
+                     "open(sys.argv[1], 'w').write(json.dumps(os.environ['JAVA_TOOL_OPTIONS'])); sys.exit(7)")
+            with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": "http://127.0.0.1:1"}):
+                self.assertEqual(play_store_proxy.run([sys.executable, "-c", probe, str(path)]), 7)
+            options = json.loads(path.read_text())
+            port = int(options.split("-Dhttp.proxyPort=", 1)[1].split()[0])
+            with self.assertRaises(OSError):
+                socket.create_connection(("127.0.0.1", port), timeout=0.2)
+
     def test_github_env_mode_clears_only_the_lowercase_bypass_for_later_steps(self):
         import tempfile
         value = "http://assigned.proxy.test:1234"

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.60
+1.0.62

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.60",
+  "version": "1.0.62",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -286,7 +286,8 @@ jobs:
           echo "Before:"; df -h / | tail -1
           # NOT /usr/local/lib/node_modules: npm and npx live there, and the
           # Android action's Crashlytics symbol upload shells out to npx.
-          sudo rm -rf /usr/share/dotnet /usr/local/lib/android/sdk/ndk \
+          # Keep installed Android SDK/NDKs: removing them makes AGP download them again.
+          sudo rm -rf /usr/share/dotnet \
                       /opt/ghc /usr/local/.ghcup /usr/local/share/powershell \
                       /usr/share/swift /usr/local/share/chromium 2>/dev/null || true
           sudo docker image prune --all --force >/dev/null 2>&1 || true