gowalk-cicd 1.0.61 → 1.0.62

package/CLAUDE.md

@@ -108,7 +108,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Python clients enforce explicit proxies; Play upload steps set the proxy for the
   pinned Google client. Missing configuration must stop before a provider call.
   Apple IPA uploads use `action/scripts/upload_build.py`, not native upload tools.
-  It retains provider IDs/checksums and verifies matching IPA identity before resume.
+  It retains provider IDs/local SHA-256 and verifies matching IPA identity before resume.
+  Finalization sends `uploaded:true` as Apple's documented BuildUpload flow does; the
+  IPA endpoint rejected the optional SHA_256 checksum attribute despite the generic
+  schema advertising it. Completed-file reuse requires the content-derived filename
+  and size; any checksum returned by Apple is verified against the local file.
 - Signing material should use encrypted Actions secrets. `deploy.yml`
   materializes `ASC_KEY_P8` + its ID/issuer, the Apple distribution identity
   (`IOS_DISTRIBUTION_P12_BASE64`, `IOS_DISTRIBUTION_CERT_META_BASE64`,

package/README.md

@@ -962,3 +962,16 @@ even that first auto-bootstrap.
 ## License
 
 MIT
+
+### Recovering an Apple REST upload failure
+
+The uploader retains the local SHA-256, version and provider upload/file IDs. It commits
+completed part transfers with `uploaded: true`, following Apple's
+[BuildUpload walkthrough](https://developer.apple.com/videos/play/wwdc2025/324/).
+The IPA endpoint rejected an optional `sourceFileChecksums` SHA_256 object even though
+the generic schema lists that algorithm; the uploader no longer sends that attribute.
+A completed file is reused only when its content-derived filename and size match, and
+any returned file checksum is verified. A failed upload emits the typed
+`apple_build_upload_failed` error annotation with schema
+`gowalk-cicd/apple-build-upload-failed.v1`; retain the exact IPA/receipt and read back
+the provider state before retrying. All requests and parts still use the Apple proxy.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.61
+1.0.62

package/action/scripts/test_upload_build.py

@@ -62,7 +62,7 @@ class BuildUploadTests(unittest.TestCase):
             api.assert_not_called()
             transfer.assert_not_called()
 
-    def test_parts_are_joined_before_committing_the_checksum(self):
+    def test_parts_are_joined_before_committing_the_uploaded_file(self):
         file = {"id": "file", "attributes": {"uploadOperations": [{"offset": 0, "length": 2},
                                                                         {"offset": 2, "length": 3}]}}
         done = []
@@ -71,8 +71,7 @@ class BuildUploadTests(unittest.TestCase):
             upload_build.transfer_all(Path("unused"), file, {"fileSize": 5, "sha256": "digest"})
             self.assertEqual(sorted(done), [0, 2])
             body = api.call_args.args[2]["data"]["attributes"]
-            self.assertEqual(body, {"uploaded": True, "sourceFileChecksums": {
-                "file": {"hash": "digest", "algorithm": "SHA_256"}}})
+            self.assertEqual(body, {"uploaded": True})
 
     def test_failed_part_never_commits_the_file(self):
         file = {"id": "file", "attributes": {"uploadOperations": [{"offset": 0, "length": 5}]}}

package/action/scripts/test_upload_checksums.py

@@ -0,0 +1,74 @@
+"""Completed-file recovery keeps byte identity without inventing optional provider attributes."""
+import base64
+from contextlib import redirect_stdout
+import hashlib
+import io
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import upload_build
+
+
+class CompletedUploadTests(unittest.TestCase):
+    def test_provider_exit_emits_typed_failure_without_exception_content(self):
+        output = io.StringIO()
+        with tempfile.TemporaryDirectory() as temporary, redirect_stdout(output), \
+                mock.patch.object(sys, "argv", ["upload_build.py", "app.ipa", "--report", temporary + "/receipt.json"]), \
+                mock.patch.object(upload_build, "deliver", side_effect=SystemExit("private-provider-detail")):
+            with self.assertRaisesRegex(SystemExit, "retain its receipt"):
+                upload_build.main()
+        self.assertIn("::error title=apple_build_upload_failed::", output.getvalue())
+        self.assertNotIn("private-provider-detail", output.getvalue())
+
+    def test_provider_completion_without_optional_checksum_reuses_exact_file(self):
+        info = {"fileName": "source-sha256.ipa", "fileSize": 5}
+        file = {"attributes": {**info, "assetDeliveryState": {"state": "COMPLETE"}}}
+        with mock.patch.object(upload_build, "api") as api, mock.patch.object(upload_build, "transfer") as transfer:
+            upload_build.transfer_all(Path("not-read"), file, info)
+            api.assert_not_called()
+            transfer.assert_not_called()
+            file["attributes"]["fileName"] = "another-source.ipa"
+            with self.assertRaisesRegex(ValueError, "identity"):
+                upload_build.transfer_all(Path("not-read"), file, info)
+
+    def test_present_provider_checksums_are_verified_against_actual_bytes(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            ipa = Path(temporary) / "app.ipa"
+            ipa.write_bytes(b"the uploaded file")
+            info = {"fileName": "source-sha256.ipa", "fileSize": ipa.stat().st_size}
+            for algorithm, digest in [("SHA_256", hashlib.sha256(ipa.read_bytes())),
+                                      ("MD5", hashlib.md5(ipa.read_bytes()))]:
+                for value in [digest.hexdigest(), base64.b64encode(digest.digest()).decode()]:
+                    with self.subTest(algorithm=algorithm, encoding=value):
+                        attributes = {**info, "assetDeliveryState": {"state": "COMPLETE"},
+                                      "sourceFileChecksums": {"file": {"hash": value, "algorithm": algorithm}}}
+                        upload_build.transfer_all(ipa, {"attributes": attributes}, info)
+                        attributes["sourceFileChecksums"]["file"]["hash"] = "different-bytes"
+                        with self.assertRaisesRegex(ValueError, "checksum"):
+                            upload_build.transfer_all(ipa, {"attributes": attributes}, info)
+
+    def test_commit_uses_documented_uploaded_attribute_after_all_bytes_finish(self):
+        # Apple's WWDC25 BuildUpload sample sends uploaded=true. The observed IPA
+        # endpoint rejected the optional SHA_256 sourceFileChecksums object with409.
+        parts = [{"offset": 0, "length": 2}, {"offset": 2, "length": 3}]
+        done = []
+        def provider(method, path, body):
+            self.assertEqual(sorted(done), [0, 2])
+            attributes = body["data"]["attributes"]
+            if "sourceFileChecksums" in attributes:
+                raise SystemExit("409 ENTITY_ERROR.ATTRIBUTE.INVALID")
+            self.assertTrue(attributes["uploaded"])
+            return {"data": {"id": "existing-file"}}
+        with mock.patch.object(upload_build, "api", side_effect=provider) as api, \
+                mock.patch.object(upload_build, "transfer", side_effect=lambda _path, op: done.append(op["offset"])):
+            upload_build.transfer_all(Path("not-read"), {"id": "existing-file", "attributes": {
+                "uploadOperations": parts}}, {"fileSize": 5, "sha256": "local-receipt-digest"})
+            self.assertEqual(api.call_count, 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/upload_build.py

@@ -15,6 +15,7 @@ import zipfile
 
 import asc_common
 import apple_store_proxy as store_proxy
+import upload_checksums
 
 
 def api(method: str, path: str, body=None, params=None) -> dict:
@@ -96,9 +97,7 @@ def transfer_all(ipa: Path, file: dict, info: dict) -> None:
     attributes = file.get("attributes") or {}
     state = (attributes.get("assetDeliveryState") or {}).get("state")
     if state == "COMPLETE":
-        expected = {"hash": info["sha256"], "algorithm": "SHA_256"}
-        if (attributes.get("sourceFileChecksums") or {}).get("file") != expected:
-            raise ValueError("Apple's completed file checksum does not match this IPA")
+        upload_checksums.completed(ipa, attributes, info)
         return
     operations = sorted(attributes.get("uploadOperations") or [], key=lambda row: row["offset"])
     offset = 0
@@ -113,8 +112,10 @@ def transfer_all(ipa: Path, file: dict, info: dict) -> None:
         for result in results:
             result.result()
     api("PATCH", f"/buildUploadFiles/{file['id']}", {"data": {
-        "type": "buildUploadFiles", "id": file["id"], "attributes": {"uploaded": True,
-        "sourceFileChecksums": {"file": {"hash": info["sha256"], "algorithm": "SHA_256"}}},
+        # Apple's build-upload contract commits with uploaded=true. Its generic
+        # checksum enum includes SHA_256, but IPA finalization rejected that
+        # optional attribute with ENTITY_ERROR.ATTRIBUTE.INVALID in production.
+        "type": "buildUploadFiles", "id": file["id"], "attributes": {"uploaded": True},
     }})
 
 
@@ -154,7 +155,11 @@ def main() -> None:
     args = parser.parse_args()
     try:
         receipt = deliver(args.ipa, args.report, args.timeout)
-    except (OSError, ValueError, KeyError, RuntimeError):
+    except (OSError, ValueError, KeyError, RuntimeError, SystemExit):
+        print('::error title=apple_build_upload_failed::' + json.dumps({
+            "schema": "gowalk-cicd/apple-build-upload-failed.v1",
+            "receipt_available": args.report.is_file(),
+            "action": "retain the IPA and receipt; read provider upload state before retrying"}))
         message = "Apple REST upload did not complete; retain its receipt and resolve the provider state"
         raise SystemExit(message) from None
     print(json.dumps(receipt))

package/action/scripts/upload_checksums.py

@@ -0,0 +1,24 @@
+"""Check completed upload identity without requiring Apple's optional checksum attribute."""
+from __future__ import annotations
+
+import base64
+import hashlib
+from pathlib import Path
+
+
+def completed(ipa: Path, attributes: dict, info: dict) -> None:
+    if any(attributes.get(key) != info[key] for key in ("fileName", "fileSize")):
+        raise ValueError("Apple's completed file identity does not match this IPA")
+    checksum = (attributes.get("sourceFileChecksums") or {}).get("file")
+    if checksum is None:
+        # The name is the local SHA-256 plus .ipa; upload_file verified this same
+        # provider-owned file identity before any transfer or completed-file reuse.
+        return
+    algorithm = {"SHA_256": "sha256", "MD5": "md5"}.get(checksum.get("algorithm"))
+    if algorithm is None:
+        raise ValueError("Apple returned an unsupported completed-file checksum algorithm")
+    with ipa.open("rb") as stream:
+        digest = hashlib.file_digest(stream, algorithm)
+    expected = {digest.hexdigest(), digest.hexdigest().upper(), base64.b64encode(digest.digest()).decode()}
+    if checksum.get("hash") not in expected:
+        raise ValueError("Apple's completed file checksum does not match this IPA")

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.61
+1.0.62

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.61
+1.0.62

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.61",
+  "version": "1.0.62",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {