gowalk-cicd 1.0.61 → 1.0.63

package/CLAUDE.md

@@ -108,7 +108,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Python clients enforce explicit proxies; Play upload steps set the proxy for the
   pinned Google client. Missing configuration must stop before a provider call.
   Apple IPA uploads use `action/scripts/upload_build.py`, not native upload tools.
-  It retains provider IDs/checksums and verifies matching IPA identity before resume.
+  It retains provider IDs/local SHA-256 and verifies matching IPA identity before resume.
+  Finalization sends `uploaded:true` as Apple's documented BuildUpload flow does; the
+  IPA endpoint rejected the optional SHA_256 checksum attribute despite the generic
+  schema advertising it. Completed-file reuse requires the content-derived filename
+  and size; any checksum returned by Apple is verified against the local file.
 - Signing material should use encrypted Actions secrets. `deploy.yml`
   materializes `ASC_KEY_P8` + its ID/issuer, the Apple distribution identity
   (`IOS_DISTRIBUTION_P12_BASE64`, `IOS_DISTRIBUTION_CERT_META_BASE64`,
@@ -119,7 +123,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   `certificate-cap-policy` accepts only `fail`; a full cap requires registry reconciliation.
 - Keep preinstalled Android SDK/NDKs. Every Gradle test/build and SDK download runs
   under `play_store_proxy.py --`, whose owned loopback relay gives Java an explicit
-  authenticated account exit without credentials in JVM options. HTTPS is tunneled
+  authenticated account exit without credentials in JVM options. The child HTTP_PROXY
+  and HTTPS_PROXY variables also name the credential-free loopback relay because
+  Crashlytics Buildtools reads them first and rejects authenticated proxy URLs. HTTPS is tunneled
   without TLS interception; no upstream failure may fall back to the destination.
   The wrapper disables Gradle daemons and closes its relay when the command ends.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`

package/README.md

@@ -962,3 +962,16 @@ even that first auto-bootstrap.
 ## License
 
 MIT
+
+### Recovering an Apple REST upload failure
+
+The uploader retains the local SHA-256, version and provider upload/file IDs. It commits
+completed part transfers with `uploaded: true`, following Apple's
+[BuildUpload walkthrough](https://developer.apple.com/videos/play/wwdc2025/324/).
+The IPA endpoint rejected an optional `sourceFileChecksums` SHA_256 object even though
+the generic schema lists that algorithm; the uploader no longer sends that attribute.
+A completed file is reused only when its content-derived filename and size match, and
+any returned file checksum is verified. A failed upload emits the typed
+`apple_build_upload_failed` error annotation with schema
+`gowalk-cicd/apple-build-upload-failed.v1`; retain the exact IPA/receipt and read back
+the provider state before retrying. All requests and parts still use the Apple proxy.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.61
+1.0.63

package/action/scripts/test_upload_build.py

@@ -62,7 +62,7 @@ class BuildUploadTests(unittest.TestCase):
             api.assert_not_called()
             transfer.assert_not_called()
 
-    def test_parts_are_joined_before_committing_the_checksum(self):
+    def test_parts_are_joined_before_committing_the_uploaded_file(self):
         file = {"id": "file", "attributes": {"uploadOperations": [{"offset": 0, "length": 2},
                                                                         {"offset": 2, "length": 3}]}}
         done = []
@@ -71,8 +71,7 @@ class BuildUploadTests(unittest.TestCase):
             upload_build.transfer_all(Path("unused"), file, {"fileSize": 5, "sha256": "digest"})
             self.assertEqual(sorted(done), [0, 2])
             body = api.call_args.args[2]["data"]["attributes"]
-            self.assertEqual(body, {"uploaded": True, "sourceFileChecksums": {
-                "file": {"hash": "digest", "algorithm": "SHA_256"}}})
+            self.assertEqual(body, {"uploaded": True})
 
     def test_failed_part_never_commits_the_file(self):
         file = {"id": "file", "attributes": {"uploadOperations": [{"offset": 0, "length": 5}]}}

package/action/scripts/test_upload_checksums.py

@@ -0,0 +1,74 @@
+"""Completed-file recovery keeps byte identity without inventing optional provider attributes."""
+import base64
+from contextlib import redirect_stdout
+import hashlib
+import io
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import upload_build
+
+
+class CompletedUploadTests(unittest.TestCase):
+    def test_provider_exit_emits_typed_failure_without_exception_content(self):
+        output = io.StringIO()
+        with tempfile.TemporaryDirectory() as temporary, redirect_stdout(output), \
+                mock.patch.object(sys, "argv", ["upload_build.py", "app.ipa", "--report", temporary + "/receipt.json"]), \
+                mock.patch.object(upload_build, "deliver", side_effect=SystemExit("private-provider-detail")):
+            with self.assertRaisesRegex(SystemExit, "retain its receipt"):
+                upload_build.main()
+        self.assertIn("::error title=apple_build_upload_failed::", output.getvalue())
+        self.assertNotIn("private-provider-detail", output.getvalue())
+
+    def test_provider_completion_without_optional_checksum_reuses_exact_file(self):
+        info = {"fileName": "source-sha256.ipa", "fileSize": 5}
+        file = {"attributes": {**info, "assetDeliveryState": {"state": "COMPLETE"}}}
+        with mock.patch.object(upload_build, "api") as api, mock.patch.object(upload_build, "transfer") as transfer:
+            upload_build.transfer_all(Path("not-read"), file, info)
+            api.assert_not_called()
+            transfer.assert_not_called()
+            file["attributes"]["fileName"] = "another-source.ipa"
+            with self.assertRaisesRegex(ValueError, "identity"):
+                upload_build.transfer_all(Path("not-read"), file, info)
+
+    def test_present_provider_checksums_are_verified_against_actual_bytes(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            ipa = Path(temporary) / "app.ipa"
+            ipa.write_bytes(b"the uploaded file")
+            info = {"fileName": "source-sha256.ipa", "fileSize": ipa.stat().st_size}
+            for algorithm, digest in [("SHA_256", hashlib.sha256(ipa.read_bytes())),
+                                      ("MD5", hashlib.md5(ipa.read_bytes()))]:
+                for value in [digest.hexdigest(), base64.b64encode(digest.digest()).decode()]:
+                    with self.subTest(algorithm=algorithm, encoding=value):
+                        attributes = {**info, "assetDeliveryState": {"state": "COMPLETE"},
+                                      "sourceFileChecksums": {"file": {"hash": value, "algorithm": algorithm}}}
+                        upload_build.transfer_all(ipa, {"attributes": attributes}, info)
+                        attributes["sourceFileChecksums"]["file"]["hash"] = "different-bytes"
+                        with self.assertRaisesRegex(ValueError, "checksum"):
+                            upload_build.transfer_all(ipa, {"attributes": attributes}, info)
+
+    def test_commit_uses_documented_uploaded_attribute_after_all_bytes_finish(self):
+        # Apple's WWDC25 BuildUpload sample sends uploaded=true. The observed IPA
+        # endpoint rejected the optional SHA_256 sourceFileChecksums object with409.
+        parts = [{"offset": 0, "length": 2}, {"offset": 2, "length": 3}]
+        done = []
+        def provider(method, path, body):
+            self.assertEqual(sorted(done), [0, 2])
+            attributes = body["data"]["attributes"]
+            if "sourceFileChecksums" in attributes:
+                raise SystemExit("409 ENTITY_ERROR.ATTRIBUTE.INVALID")
+            self.assertTrue(attributes["uploaded"])
+            return {"data": {"id": "existing-file"}}
+        with mock.patch.object(upload_build, "api", side_effect=provider) as api, \
+                mock.patch.object(upload_build, "transfer", side_effect=lambda _path, op: done.append(op["offset"])):
+            upload_build.transfer_all(Path("not-read"), {"id": "existing-file", "attributes": {
+                "uploadOperations": parts}}, {"fileSize": 5, "sha256": "local-receipt-digest"})
+            self.assertEqual(api.call_count, 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/upload_build.py

@@ -15,6 +15,7 @@ import zipfile
 
 import asc_common
 import apple_store_proxy as store_proxy
+import upload_checksums
 
 
 def api(method: str, path: str, body=None, params=None) -> dict:
@@ -96,9 +97,7 @@ def transfer_all(ipa: Path, file: dict, info: dict) -> None:
     attributes = file.get("attributes") or {}
     state = (attributes.get("assetDeliveryState") or {}).get("state")
     if state == "COMPLETE":
-        expected = {"hash": info["sha256"], "algorithm": "SHA_256"}
-        if (attributes.get("sourceFileChecksums") or {}).get("file") != expected:
-            raise ValueError("Apple's completed file checksum does not match this IPA")
+        upload_checksums.completed(ipa, attributes, info)
         return
     operations = sorted(attributes.get("uploadOperations") or [], key=lambda row: row["offset"])
     offset = 0
@@ -113,8 +112,10 @@ def transfer_all(ipa: Path, file: dict, info: dict) -> None:
         for result in results:
             result.result()
     api("PATCH", f"/buildUploadFiles/{file['id']}", {"data": {
-        "type": "buildUploadFiles", "id": file["id"], "attributes": {"uploaded": True,
-        "sourceFileChecksums": {"file": {"hash": info["sha256"], "algorithm": "SHA_256"}}},
+        # Apple's build-upload contract commits with uploaded=true. Its generic
+        # checksum enum includes SHA_256, but IPA finalization rejected that
+        # optional attribute with ENTITY_ERROR.ATTRIBUTE.INVALID in production.
+        "type": "buildUploadFiles", "id": file["id"], "attributes": {"uploaded": True},
     }})
 
 
@@ -154,7 +155,11 @@ def main() -> None:
     args = parser.parse_args()
     try:
         receipt = deliver(args.ipa, args.report, args.timeout)
-    except (OSError, ValueError, KeyError, RuntimeError):
+    except (OSError, ValueError, KeyError, RuntimeError, SystemExit):
+        print('::error title=apple_build_upload_failed::' + json.dumps({
+            "schema": "gowalk-cicd/apple-build-upload-failed.v1",
+            "receipt_available": args.report.is_file(),
+            "action": "retain the IPA and receipt; read provider upload state before retrying"}))
         message = "Apple REST upload did not complete; retain its receipt and resolve the provider state"
         raise SystemExit(message) from None
     print(json.dumps(receipt))

package/action/scripts/upload_checksums.py

@@ -0,0 +1,24 @@
+"""Check completed upload identity without requiring Apple's optional checksum attribute."""
+from __future__ import annotations
+
+import base64
+import hashlib
+from pathlib import Path
+
+
+def completed(ipa: Path, attributes: dict, info: dict) -> None:
+    if any(attributes.get(key) != info[key] for key in ("fileName", "fileSize")):
+        raise ValueError("Apple's completed file identity does not match this IPA")
+    checksum = (attributes.get("sourceFileChecksums") or {}).get("file")
+    if checksum is None:
+        # The name is the local SHA-256 plus .ipa; upload_file verified this same
+        # provider-owned file identity before any transfer or completed-file reuse.
+        return
+    algorithm = {"SHA_256": "sha256", "MD5": "md5"}.get(checksum.get("algorithm"))
+    if algorithm is None:
+        raise ValueError("Apple returned an unsupported completed-file checksum algorithm")
+    with ipa.open("rb") as stream:
+        digest = hashlib.file_digest(stream, algorithm)
+    expected = {digest.hexdigest(), digest.hexdigest().upper(), base64.b64encode(digest.digest()).decode()}
+    if checksum.get("hash") not in expected:
+        raise ValueError("Apple's completed file checksum does not match this IPA")

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.61
+1.0.63

package/android-action/scripts/crashlytics_symbols.py

@@ -27,12 +27,11 @@ from __future__ import annotations
 import argparse
 import os
 import re
-import subprocess
 import sys
 import tempfile
 from pathlib import Path
 
-from play_store_proxy import environment
+from play_store_proxy import run as run_proxied
 
 # Exact pin, not a range: this job holds the upload keystore and the Play
 # service account, so no floating third-party code runs in it. Bump on purpose.
@@ -99,10 +98,9 @@ def _default_run(cmd: list[str]) -> int:
     # A scratch cwd: the Crashlytics buildtools drop a .crashlytics/ directory
     # (dump_syms.bin, ~4 MB) into the working directory, which must not be the
     # consumer's checkout.
-    env = environment()
     try:
         with tempfile.TemporaryDirectory(prefix="crashlytics-upload-") as workdir:
-            return subprocess.run(cmd, check=False, cwd=workdir, env=env).returncode
+            return run_proxied(cmd, cwd=workdir)
     except FileNotFoundError:
         print(
             "::error::npx is not on PATH, so the Firebase CLI cannot run. "
@@ -161,7 +159,7 @@ def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, r
         print(f"::error::no Dart symbol files in {args.symbols_dir}; nothing to upload to Crashlytics")
         return 1
 
-    cmd = upload_command(app_id, args.symbols_dir, args.firebase_tools)
+    cmd = upload_command(app_id, args.symbols_dir.resolve(), args.firebase_tools)
     print(f"Uploading {len(symbols)} Dart symbol file(s) to Crashlytics app {app_id}:")
     print("  " + " ".join(cmd))
     rc = run(cmd)

package/android-action/scripts/jvm_proxy_relay.py

@@ -109,6 +109,13 @@ def running(proxy: str):
 
 
 def environment(env: dict, port: int) -> dict:
+    # Crashlytics Buildtools prefers HTTP_PROXY to JVM options and rejects URLs
+    # with userinfo. All child clients use the same owned relay; authentication
+    # is added only on its connection to the configured account exit.
+    local = f"http://127.0.0.1:{port}"
+    for name in ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"):
+        env[name] = local
+    env.update(NO_PROXY="", no_proxy="")
     options = (f"-Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort={port} "
                f"-Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort={port} "
                "-Dhttp.nonProxyHosts= -Dhttps.nonProxyHosts= -Djava.net.useSystemProxies=false")

package/android-action/scripts/play_store_proxy.py

@@ -4,7 +4,7 @@ Three entry points, all from the one validated ``GOOGLE_STORE_PROXY_URL``:
 
 * ``python3 play_store_proxy.py`` refuses a missing or malformed proxy.
 * ``python3 play_store_proxy.py -- <command …>`` runs a build tool with the explicit
-  proxy in both spellings and both ``NO_PROXY`` spellings cleared. Setting the pairs
+  owned relay in both proxy spellings and both ``NO_PROXY`` spellings cleared. Setting the pairs
   as YAML ``env`` keys is not an option: GitHub compares env keys case-insensitively
   and rejects the workflow or action file as invalid.
 * ``python3 play_store_proxy.py --github-env`` clears the lower-case ambient bypass
@@ -49,7 +49,7 @@ def session() -> requests.Session:
     return client
 
 
-def run(argv: list[str]) -> int:
+def run(argv: list[str], *, cwd: str | None = None) -> int:
     """Run ``argv`` with the explicit proxy environment; the parent process is untouched."""
     if not argv:
         raise SystemExit("usage: play_store_proxy.py -- <command …>")
@@ -57,7 +57,7 @@ def run(argv: list[str]) -> int:
 
     env = environment()
     with running(proxy_url()) as port:
-        return subprocess.run(argv, env=jvm_environment(env, port), check=False).returncode
+        return subprocess.run(argv, env=jvm_environment(env, port), cwd=cwd, check=False).returncode
 
 
 def clear_github_env_bypass(path: str | None = None) -> list[str]:

package/android-action/scripts/test_crashlytics_symbols.py

@@ -130,7 +130,7 @@ class MainTest(unittest.TestCase):
         self.assertEqual(
             self.calls,
             [["npx", "--yes", cs.FIREBASE_TOOLS, "crashlytics:symbols:upload",
-              f"--app={ANDROID}", str(self.symbols)]],
+              f"--app={ANDROID}", str(self.symbols.resolve())]],
         )
         self.assertIn("Uploaded", out)
         self.assertNotIn("::error::", out)

package/android-action/scripts/test_crashlytics_symbols_proxy.py

@@ -0,0 +1,52 @@
+"""Exercise the actual symbol-uploader child process and its owned proxy lifetime."""
+import base64
+import json
+import os
+from pathlib import Path
+import socket
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+import crashlytics_symbols as symbols
+from test_jvm_proxy_relay import upstream
+
+
+class SymbolsProxyTests(unittest.TestCase):
+    def test_real_upload_child_uses_relay_and_removes_scratch_after_failure(self):
+        probe = """
+import json, os, sys, urllib.request
+from pathlib import Path
+from urllib.parse import urlsplit
+proxy = urlsplit(os.environ['HTTPS_PROXY'])
+assert proxy.hostname == '127.0.0.1' and proxy.username is None
+assert os.environ['NO_PROXY'] == os.environ['no_proxy'] == ''
+reply = urllib.request.urlopen('http://unresolvable.invalid/symbols', timeout=5).read()
+assert reply == b'through pinned proxy'
+Path(sys.argv[1]).write_text(json.dumps({'cwd': os.getcwd(), 'port': proxy.port}))
+sys.exit(7)
+"""
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+            result_path = Path(directory) / "result.json"
+            with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": proxy, "NO_PROXY": "*"}):
+                rc = symbols._default_run([sys.executable, "-c", probe, str(result_path)])
+            result = json.loads(result_path.read_text())
+            self.assertEqual(rc, 7)
+            self.assertFalse(Path(result["cwd"]).exists())
+            self.assertNotEqual(result["cwd"], os.getcwd())
+            with self.assertRaises(OSError):
+                socket.create_connection(("127.0.0.1", result["port"]), timeout=0.2)
+        auth = "Basic " + base64.b64encode(b"fixture-user:fixture-pass").decode()
+        self.assertEqual(seen, [("GET", "http://unresolvable.invalid/symbols", auth)])
+
+    def test_missing_proxy_refuses_before_spawning_the_uploader(self):
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": ""}), \
+                mock.patch("play_store_proxy.subprocess.run") as run:
+            with self.assertRaises(SystemExit):
+                symbols._default_run(["npx", "--yes", symbols.FIREBASE_TOOLS])
+        run.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_jvm_proxy_relay.py

@@ -49,6 +49,28 @@ def upstream():
 
 
 class JvmProxyTests(unittest.TestCase):
+    @unittest.skipUnless(shutil.which("java"), "Java runtime unavailable")
+    def test_environment_first_java_client_receives_a_credential_free_relay(self):
+        source = ('import java.net.*; public class Probe { public static void main(String[] args) '
+                  'throws Exception { var p = new URI(System.getenv("HTTPS_PROXY")); '
+                  'if(p.getUserInfo()!=null) throw new IllegalArgumentException("proxy userinfo unsupported"); '
+                  'var proxy = new Proxy(Proxy.Type.HTTP,new InetSocketAddress(p.getHost(),p.getPort())); '
+                  'var c = new URL("http://unresolvable.invalid/symbols").openConnection(proxy); '
+                  'c.setConnectTimeout(3000); c.setReadTimeout(3000); '
+                  'System.out.print(new String(c.getInputStream().readAllBytes())); }}')
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+            target = Path(directory) / "Probe.java"
+            target.write_text(source)
+            with relay.running(proxy) as port:
+                env = relay.environment({**os.environ, "HTTPS_PROXY": proxy, "NO_PROXY": "*"}, port)
+                result = subprocess.run(["java", str(target)], env=env, capture_output=True, text=True, timeout=20)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout, "through pinned proxy")
+        auth = "Basic " + base64.b64encode(b"fixture-user:fixture-pass").decode()
+        self.assertEqual(seen, [("GET", "http://unresolvable.invalid/symbols", auth)])
+        self.assertNotIn("fixture-pass", result.stderr)
+        self.assertEqual(env["NO_PROXY"], "")
+
     def test_http_and_connect_only_reach_the_authenticated_upstream_and_cleanup(self):
         with upstream() as (proxy, seen):
             with relay.running(proxy) as port:

package/android-action/scripts/test_play_store_proxy.py

@@ -44,8 +44,9 @@ class PlayProxyTests(unittest.TestCase):
             run.return_value.returncode = 0
             self.assertEqual(play_store_proxy.run([sys.executable, "-c", probe]), 0)
             child = run.call_args.kwargs["env"]
-            self.assertEqual(child["https_proxy"], value)
-            self.assertEqual(child["HTTP_PROXY"], value)
+            self.assertTrue(child["https_proxy"].startswith("http://127.0.0.1:"))
+            self.assertEqual(child["HTTP_PROXY"], child["https_proxy"])
+            self.assertEqual(child["GOOGLE_STORE_PROXY_URL"], value)
             self.assertEqual(child["no_proxy"], "")
             self.assertEqual(child["NO_PROXY"], "")
             self.assertEqual(os.environ["no_proxy"], "*")

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.61
+1.0.63

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.61",
+  "version": "1.0.63",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {