gowalk-cicd 1.0.62 → 1.0.63

package/CLAUDE.md

@@ -123,7 +123,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   `certificate-cap-policy` accepts only `fail`; a full cap requires registry reconciliation.
 - Keep preinstalled Android SDK/NDKs. Every Gradle test/build and SDK download runs
   under `play_store_proxy.py --`, whose owned loopback relay gives Java an explicit
-  authenticated account exit without credentials in JVM options. HTTPS is tunneled
+  authenticated account exit without credentials in JVM options. The child HTTP_PROXY
+  and HTTPS_PROXY variables also name the credential-free loopback relay because
+  Crashlytics Buildtools reads them first and rejects authenticated proxy URLs. HTTPS is tunneled
   without TLS interception; no upstream failure may fall back to the destination.
   The wrapper disables Gradle daemons and closes its relay when the command ends.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`

package/action/.daemux-version

@@ -1 +1 @@
-1.0.62
+1.0.63

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.62
+1.0.63

package/android-action/scripts/crashlytics_symbols.py

@@ -27,12 +27,11 @@ from __future__ import annotations
 import argparse
 import os
 import re
-import subprocess
 import sys
 import tempfile
 from pathlib import Path
 
-from play_store_proxy import environment
+from play_store_proxy import run as run_proxied
 
 # Exact pin, not a range: this job holds the upload keystore and the Play
 # service account, so no floating third-party code runs in it. Bump on purpose.
@@ -99,10 +98,9 @@ def _default_run(cmd: list[str]) -> int:
     # A scratch cwd: the Crashlytics buildtools drop a .crashlytics/ directory
     # (dump_syms.bin, ~4 MB) into the working directory, which must not be the
     # consumer's checkout.
-    env = environment()
     try:
         with tempfile.TemporaryDirectory(prefix="crashlytics-upload-") as workdir:
-            return subprocess.run(cmd, check=False, cwd=workdir, env=env).returncode
+            return run_proxied(cmd, cwd=workdir)
     except FileNotFoundError:
         print(
             "::error::npx is not on PATH, so the Firebase CLI cannot run. "
@@ -161,7 +159,7 @@ def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, r
         print(f"::error::no Dart symbol files in {args.symbols_dir}; nothing to upload to Crashlytics")
         return 1
 
-    cmd = upload_command(app_id, args.symbols_dir, args.firebase_tools)
+    cmd = upload_command(app_id, args.symbols_dir.resolve(), args.firebase_tools)
     print(f"Uploading {len(symbols)} Dart symbol file(s) to Crashlytics app {app_id}:")
     print("  " + " ".join(cmd))
     rc = run(cmd)

package/android-action/scripts/jvm_proxy_relay.py

@@ -109,6 +109,13 @@ def running(proxy: str):
 
 
 def environment(env: dict, port: int) -> dict:
+    # Crashlytics Buildtools prefers HTTP_PROXY to JVM options and rejects URLs
+    # with userinfo. All child clients use the same owned relay; authentication
+    # is added only on its connection to the configured account exit.
+    local = f"http://127.0.0.1:{port}"
+    for name in ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"):
+        env[name] = local
+    env.update(NO_PROXY="", no_proxy="")
     options = (f"-Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort={port} "
                f"-Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort={port} "
                "-Dhttp.nonProxyHosts= -Dhttps.nonProxyHosts= -Djava.net.useSystemProxies=false")

package/android-action/scripts/play_store_proxy.py

@@ -4,7 +4,7 @@ Three entry points, all from the one validated ``GOOGLE_STORE_PROXY_URL``:
 
 * ``python3 play_store_proxy.py`` refuses a missing or malformed proxy.
 * ``python3 play_store_proxy.py -- <command …>`` runs a build tool with the explicit
-  proxy in both spellings and both ``NO_PROXY`` spellings cleared. Setting the pairs
+  owned relay in both proxy spellings and both ``NO_PROXY`` spellings cleared. Setting the pairs
   as YAML ``env`` keys is not an option: GitHub compares env keys case-insensitively
   and rejects the workflow or action file as invalid.
 * ``python3 play_store_proxy.py --github-env`` clears the lower-case ambient bypass
@@ -49,7 +49,7 @@ def session() -> requests.Session:
     return client
 
 
-def run(argv: list[str]) -> int:
+def run(argv: list[str], *, cwd: str | None = None) -> int:
     """Run ``argv`` with the explicit proxy environment; the parent process is untouched."""
     if not argv:
         raise SystemExit("usage: play_store_proxy.py -- <command …>")
@@ -57,7 +57,7 @@ def run(argv: list[str]) -> int:
 
     env = environment()
     with running(proxy_url()) as port:
-        return subprocess.run(argv, env=jvm_environment(env, port), check=False).returncode
+        return subprocess.run(argv, env=jvm_environment(env, port), cwd=cwd, check=False).returncode
 
 
 def clear_github_env_bypass(path: str | None = None) -> list[str]:

package/android-action/scripts/test_crashlytics_symbols.py

@@ -130,7 +130,7 @@ class MainTest(unittest.TestCase):
         self.assertEqual(
             self.calls,
             [["npx", "--yes", cs.FIREBASE_TOOLS, "crashlytics:symbols:upload",
-              f"--app={ANDROID}", str(self.symbols)]],
+              f"--app={ANDROID}", str(self.symbols.resolve())]],
         )
         self.assertIn("Uploaded", out)
         self.assertNotIn("::error::", out)

package/android-action/scripts/test_crashlytics_symbols_proxy.py

@@ -0,0 +1,52 @@
+"""Exercise the actual symbol-uploader child process and its owned proxy lifetime."""
+import base64
+import json
+import os
+from pathlib import Path
+import socket
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+import crashlytics_symbols as symbols
+from test_jvm_proxy_relay import upstream
+
+
+class SymbolsProxyTests(unittest.TestCase):
+    def test_real_upload_child_uses_relay_and_removes_scratch_after_failure(self):
+        probe = """
+import json, os, sys, urllib.request
+from pathlib import Path
+from urllib.parse import urlsplit
+proxy = urlsplit(os.environ['HTTPS_PROXY'])
+assert proxy.hostname == '127.0.0.1' and proxy.username is None
+assert os.environ['NO_PROXY'] == os.environ['no_proxy'] == ''
+reply = urllib.request.urlopen('http://unresolvable.invalid/symbols', timeout=5).read()
+assert reply == b'through pinned proxy'
+Path(sys.argv[1]).write_text(json.dumps({'cwd': os.getcwd(), 'port': proxy.port}))
+sys.exit(7)
+"""
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+            result_path = Path(directory) / "result.json"
+            with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": proxy, "NO_PROXY": "*"}):
+                rc = symbols._default_run([sys.executable, "-c", probe, str(result_path)])
+            result = json.loads(result_path.read_text())
+            self.assertEqual(rc, 7)
+            self.assertFalse(Path(result["cwd"]).exists())
+            self.assertNotEqual(result["cwd"], os.getcwd())
+            with self.assertRaises(OSError):
+                socket.create_connection(("127.0.0.1", result["port"]), timeout=0.2)
+        auth = "Basic " + base64.b64encode(b"fixture-user:fixture-pass").decode()
+        self.assertEqual(seen, [("GET", "http://unresolvable.invalid/symbols", auth)])
+
+    def test_missing_proxy_refuses_before_spawning_the_uploader(self):
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": ""}), \
+                mock.patch("play_store_proxy.subprocess.run") as run:
+            with self.assertRaises(SystemExit):
+                symbols._default_run(["npx", "--yes", symbols.FIREBASE_TOOLS])
+        run.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_jvm_proxy_relay.py

@@ -49,6 +49,28 @@ def upstream():
 
 
 class JvmProxyTests(unittest.TestCase):
+    @unittest.skipUnless(shutil.which("java"), "Java runtime unavailable")
+    def test_environment_first_java_client_receives_a_credential_free_relay(self):
+        source = ('import java.net.*; public class Probe { public static void main(String[] args) '
+                  'throws Exception { var p = new URI(System.getenv("HTTPS_PROXY")); '
+                  'if(p.getUserInfo()!=null) throw new IllegalArgumentException("proxy userinfo unsupported"); '
+                  'var proxy = new Proxy(Proxy.Type.HTTP,new InetSocketAddress(p.getHost(),p.getPort())); '
+                  'var c = new URL("http://unresolvable.invalid/symbols").openConnection(proxy); '
+                  'c.setConnectTimeout(3000); c.setReadTimeout(3000); '
+                  'System.out.print(new String(c.getInputStream().readAllBytes())); }}')
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+            target = Path(directory) / "Probe.java"
+            target.write_text(source)
+            with relay.running(proxy) as port:
+                env = relay.environment({**os.environ, "HTTPS_PROXY": proxy, "NO_PROXY": "*"}, port)
+                result = subprocess.run(["java", str(target)], env=env, capture_output=True, text=True, timeout=20)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout, "through pinned proxy")
+        auth = "Basic " + base64.b64encode(b"fixture-user:fixture-pass").decode()
+        self.assertEqual(seen, [("GET", "http://unresolvable.invalid/symbols", auth)])
+        self.assertNotIn("fixture-pass", result.stderr)
+        self.assertEqual(env["NO_PROXY"], "")
+
     def test_http_and_connect_only_reach_the_authenticated_upstream_and_cleanup(self):
         with upstream() as (proxy, seen):
             with relay.running(proxy) as port:

package/android-action/scripts/test_play_store_proxy.py

@@ -44,8 +44,9 @@ class PlayProxyTests(unittest.TestCase):
             run.return_value.returncode = 0
             self.assertEqual(play_store_proxy.run([sys.executable, "-c", probe]), 0)
             child = run.call_args.kwargs["env"]
-            self.assertEqual(child["https_proxy"], value)
-            self.assertEqual(child["HTTP_PROXY"], value)
+            self.assertTrue(child["https_proxy"].startswith("http://127.0.0.1:"))
+            self.assertEqual(child["HTTP_PROXY"], child["https_proxy"])
+            self.assertEqual(child["GOOGLE_STORE_PROXY_URL"], value)
             self.assertEqual(child["no_proxy"], "")
             self.assertEqual(child["NO_PROXY"], "")
             self.assertEqual(os.environ["no_proxy"], "*")

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.62
+1.0.63

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.62",
+  "version": "1.0.63",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {