gowalk-cicd 1.0.62 → 1.0.64

package/CLAUDE.md

@@ -123,7 +123,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   `certificate-cap-policy` accepts only `fail`; a full cap requires registry reconciliation.
 - Keep preinstalled Android SDK/NDKs. Every Gradle test/build and SDK download runs
   under `play_store_proxy.py --`, whose owned loopback relay gives Java an explicit
-  authenticated account exit without credentials in JVM options. HTTPS is tunneled
+  authenticated account exit without credentials in JVM options. The child HTTP_PROXY
+  and HTTPS_PROXY variables also name the credential-free loopback relay because
+  Crashlytics Buildtools reads them first and rejects authenticated proxy URLs. HTTPS is tunneled
   without TLS interception; no upstream failure may fall back to the destination.
   The wrapper disables Gradle daemons and closes its relay when the command ends.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`

package/README.md

@@ -280,6 +280,7 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | `play_review_pending` | `gowalk-cicd/play-review-pending.v1` | `package`, `track`, `version_code` |
 | `store_version_locked` | `gowalk-cicd/store-version-locked.v1` | `version`, `state`, `build_number` |
 | `firebase_symbols_pending` | `gowalk-cicd/firebase-symbols-pending.v1` | `platform`, `app_id`, `source_sha`, `artifact`, `file`, `sha256`, `status` |
+| `apple_build_upload_failed` (error) | `gowalk-cicd/apple-build-upload-failed.v2` | `category`, `stage`, `receipt_available`, receipt identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`, `provider_status`, `provider_code`, `provider_pointer`), `action` |
 
 Add a field by bumping the schema version; never change the meaning of an
 existing one.
@@ -965,13 +966,28 @@ MIT
 
 ### Recovering an Apple REST upload failure
 
-The uploader retains the local SHA-256, version and provider upload/file IDs. It commits
-completed part transfers with `uploaded: true`, following Apple's
+The uploader writes its receipt (`apple-upload-<run>-<attempt>`, schema
+`gowalk-cicd/apple-build-upload-receipt.v1`) after every stage — `identity` (local
+SHA-256, file name/size, bundle and versions), `app_verified`, `upload_reserved`
+(`upload_id`), `file_reserved` (`file_id`), `transferred`, `processing` and `complete`
+(`build_id`) — so a job that fails at any point still names what the provider holds. It
+commits completed part transfers with `uploaded: true`, following Apple's
 [BuildUpload walkthrough](https://developer.apple.com/videos/play/wwdc2025/324/).
 The IPA endpoint rejected an optional `sourceFileChecksums` SHA_256 object even though
 the generic schema lists that algorithm; the uploader no longer sends that attribute.
 A completed file is reused only when its content-derived filename and size match, and
-any returned file checksum is verified. A failed upload emits the typed
-`apple_build_upload_failed` error annotation with schema
-`gowalk-cicd/apple-build-upload-failed.v1`; retain the exact IPA/receipt and read back
-the provider state before retrying. All requests and parts still use the Apple proxy.
+any returned file checksum is verified.
+
+A failed upload emits the typed `apple_build_upload_failed` error annotation with schema
+`gowalk-cicd/apple-build-upload-failed.v2`: `category` (`proxy_missing`, `ipa_invalid`,
+`configuration_missing`, `app_mismatch`, `provider_request_failed`, `upload_identity_conflict`,
+`upload_destination_invalid`, `ipa_changed`, `part_refused`, `processing_failed`,
+`processing_pending`, or a fallback such as `local_io`), `stage`, `receipt_available` and
+the receipt's own identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`,
+`provider_status`, `provider_code`, `provider_pointer`). Exception text is never
+published. The job also retains the exact exported IPA as `apple-ipa-<run>-<attempt>`
+(14 days) so a continuation can complete that same upload identity instead of rebuilding
+different bytes under the same number. Build numbers come from `/builds`,
+`/preReleaseVersions` **and** `/apps/{id}/buildUploads`, so an unfinished or refused
+reservation is never reused; delete such a reservation only after reading it back.
+All requests and parts still use the Apple proxy.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.62
+1.0.64

package/action/action.yml

@@ -821,6 +821,7 @@ runs:
         if-no-files-found: ignore
 
     - name: Upload to TestFlight
+      id: upload
       if: ${{ inputs.archive == 'true' && inputs.upload == 'true' }}
       shell: bash
       env:
@@ -838,6 +839,18 @@ runs:
         path: ${{ runner.temp }}/apple-build-upload.json
         if-no-files-found: ignore
 
+    # A failed REST upload keeps the exact exported IPA next to its receipt, so a
+    # continuation can resume or complete that same upload identity instead of
+    # rebuilding different bytes under the number the receipt names.
+    - name: Retain the exported IPA for upload recovery
+      if: ${{ always() && inputs.archive == 'true' && inputs.upload == 'true' && steps.upload.outcome != 'success' }}
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      with:
+        name: apple-ipa-${{ github.run_id }}-${{ github.run_attempt }}
+        path: ${{ runner.temp }}/export/*.ipa
+        if-no-files-found: ignore
+        retention-days: 14
+
     # Both App Store metadata writers are skipped while an App Store version
     # is locked (STORE_VERSION_LOCKED, the TESTFLIGHT_ONLY decision): there is
     # no editable version id to write to, and each script requires one.

package/action/scripts/next_build_number.py

@@ -20,6 +20,12 @@ to fail with::
 So we union build versions from BOTH ``/builds`` and
 ``/preReleaseVersions?include=builds`` before taking the max.
 
+A REST build upload reserves its number the moment ``/buildUploads`` is
+created. A reservation whose transfer or commit never finished (state
+AWAITING_UPLOAD or PROCESSING, or one Apple refused) appears in neither
+list above, yet the uploader must never reuse that number for different
+IPA bytes, so ``/apps/{id}/buildUploads`` is the third source.
+
 Environment
 -----------
   ASC_KEY_ID           API key ID
@@ -121,6 +127,34 @@ def fetch_prerelease_versions(app_id: str, token: str) -> set[int]:
     return {n for n in map(_build_version_int, builds) if n is not None}
 
 
+def _upload_version_int(upload: dict) -> int | None:
+    try:
+        return int((upload.get("attributes") or {}).get("cfBundleVersion"))
+    except (TypeError, ValueError):
+        return None
+
+
+def fetch_build_upload_versions(app_id: str, token: str) -> set[int]:
+    """Versions reserved by REST build uploads (``/apps/{id}/buildUploads``), any state.
+
+    Every reservation counts, finished or not: a fresh number is always safe,
+    while reusing one that an unfinished or refused upload still holds makes
+    the next run collide with that upload identity.
+    """
+    data = get_json(
+        f"/apps/{app_id}/buildUploads",
+        token,
+        params={"filter[platform]": "IOS", "limit": "200"},
+    )
+    uploads = data.get("data", []) or []
+    print(f"ASC /buildUploads: scanning {len(uploads)} upload reservations", file=sys.stderr)
+    for upload in uploads[:3]:
+        attrs = upload.get("attributes") or {}
+        state = (attrs.get("state") or {}).get("state") if isinstance(attrs.get("state"), dict) else attrs.get("state")
+        print(f"ASC upload reservation: v={attrs.get('cfBundleVersion')!r} state={state!r}", file=sys.stderr)
+    return {n for n in map(_upload_version_int, uploads) if n is not None}
+
+
 def _read_pbxproj_build_number() -> int | None:
     """Best-effort local fallback: read CURRENT_PROJECT_VERSION from pbxproj.
 
@@ -162,6 +196,7 @@ def resolve_next_build_number(app_id: str, token: str) -> int:
     """Aggregate every known source of uploaded build versions."""
     versions = fetch_build_versions(app_id, token)
     versions |= fetch_prerelease_versions(app_id, token)
+    versions |= fetch_build_upload_versions(app_id, token)
     highest = max(versions, default=0)
     print(f"ASC highest build version seen: {highest}", file=sys.stderr)
     return highest + 1

package/action/scripts/test_next_build_number.py

@@ -83,12 +83,45 @@ class FetchPreReleaseVersionsTests(unittest.TestCase):
         self.assertEqual(got, set())
 
 
+class FetchBuildUploadVersionsTests(unittest.TestCase):
+    def _upload(self, version: str, state: str) -> dict:
+        return {"type": "buildUploads", "attributes": {"cfBundleVersion": version, "platform": "IOS",
+                                                       "state": {"state": state}}}
+
+    def test_every_reservation_counts_whatever_its_state(self):
+        payload = {"data": [self._upload("2", "AWAITING_UPLOAD"), self._upload("3", "FAILED"),
+                            self._upload("4", "COMPLETE"), self._upload("x", "PROCESSING")]}
+        with mock.patch.object(nb, "get_json", return_value=payload) as mget:
+            got = nb.fetch_build_upload_versions("111", "tok")
+        self.assertEqual(got, {2, 3, 4})
+        args, kwargs = mget.call_args
+        self.assertEqual(args[0], "/apps/111/buildUploads")
+        self.assertEqual(kwargs["params"]["filter[platform]"], "IOS")
+
+    def test_no_reservations_is_empty(self):
+        with mock.patch.object(nb, "get_json", return_value={"data": []}):
+            self.assertEqual(nb.fetch_build_upload_versions("111", "tok"), set())
+
+
 class ResolveNextBuildNumberTests(unittest.TestCase):
+    def setUp(self):
+        patcher = mock.patch.object(nb, "fetch_build_upload_versions", return_value=set())
+        self.uploads = patcher.start()
+        self.addCleanup(patcher.stop)
+
     def test_max_across_both_sources_plus_one(self):
         with mock.patch.object(nb, "fetch_build_versions", return_value={1, 2}), \
              mock.patch.object(nb, "fetch_prerelease_versions", return_value={5}):
             self.assertEqual(nb.resolve_next_build_number("111", "tok"), 6)
 
+    def test_unfinished_upload_reservation_is_never_reused(self):
+        # The exact production collision: build 1 processed, build 2 reserved by a REST
+        # upload whose commit was refused, so /builds and /preReleaseVersions know only 1.
+        self.uploads.return_value = {2}
+        with mock.patch.object(nb, "fetch_build_versions", return_value={1}), \
+             mock.patch.object(nb, "fetch_prerelease_versions", return_value={1}):
+            self.assertEqual(nb.resolve_next_build_number("111", "tok"), 3)
+
     def test_prerelease_fills_gap_when_builds_empty(self):
         # Simulates the exact bug: /builds misses the fresh upload but
         # /preReleaseVersions still sees it.

package/action/scripts/test_upload_build.py

@@ -1,16 +1,21 @@
 """REST IPA upload identity, resume, complete byte coverage and proxy-only transfer."""
 import hashlib
+import io
+import json
 import os
 from pathlib import Path
 import plistlib
 import sys
 import tempfile
 import unittest
+from contextlib import redirect_stderr, redirect_stdout
 from unittest import mock
 import zipfile
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import upload_build
+import upload_receipt
+from upload_receipt import UploadError
 
 
 class BuildUploadTests(unittest.TestCase):
@@ -37,9 +42,11 @@ class BuildUploadTests(unittest.TestCase):
         existing = {"data": [{"id": "file", "attributes": {
             "assetType": "ASSET", "fileName": "other.ipa", "fileSize": 10}}]}
         with mock.patch.object(upload_build, "api", return_value=existing) as api:
-            with self.assertRaises(ValueError):
+            with self.assertRaises(UploadError) as caught:
                 upload_build.upload_file({"id": "upload"}, {"fileName": "wanted.ipa", "fileSize": 10})
             self.assertEqual(api.call_count, 1)
+        self.assertEqual(caught.exception.category, "upload_identity_conflict")
+        self.assertEqual(caught.exception.details, {"upload_id": "upload", "file_id": "file"})
 
     def test_part_transfer_uses_proxy_without_asc_bearer(self):
         with tempfile.TemporaryDirectory() as temporary:
@@ -57,7 +64,7 @@ class BuildUploadTests(unittest.TestCase):
     def test_missing_parts_never_mark_a_file_uploaded(self):
         file = {"id": "file", "attributes": {"uploadOperations": [{"offset": 0, "length": 4}]}}
         with mock.patch.object(upload_build, "api") as api, mock.patch.object(upload_build, "transfer") as transfer:
-            with self.assertRaises(ValueError):
+            with self.assertRaises(UploadError):
                 upload_build.transfer_all(Path("unused"), file, {"fileSize": 5, "sha256": "hash"})
             api.assert_not_called()
             transfer.assert_not_called()
@@ -88,11 +95,15 @@ class BuildDeliveryTests(unittest.TestCase):
         with mock.patch.object(upload_build, "identity", return_value={"bundle_id": "com.expected.app"}), \
                 mock.patch.object(upload_build, "api", return_value={"data": {"attributes": {
                     "bundleId": "com.other.app"}}}) as api, \
-                mock.patch.object(upload_build, "upload_record") as create:
-            with self.assertRaises(ValueError):
-                upload_build.deliver(Path("unused"), Path("unused-report"), 1)
+                mock.patch.object(upload_build, "upload_record") as create, \
+                tempfile.TemporaryDirectory() as temporary:
+            report = Path(temporary) / "receipt.json"
+            with self.assertRaises(UploadError) as caught:
+                upload_build.deliver(Path("unused"), report, 1)
             self.assertEqual(api.call_count, 1)
             create.assert_not_called()
+            self.assertEqual(caught.exception.category, "app_mismatch")
+            self.assertEqual(json.loads(report.read_text())["stage"], "identity")
 
     @mock.patch.dict(os.environ, {"APP_STORE_APPLE_ID": "app", "APPLE_STORE_PROXY_URL": "http://proxy.test:1234"})
     def test_completed_readback_retains_provider_build_identity(self):
@@ -113,5 +124,152 @@ class BuildDeliveryTests(unittest.TestCase):
             self.assertEqual(api.call_args.kwargs["params"], {"include": "build"})
 
 
+IDENTITY = {"bundle_id": "com.expected.app", "cfBundleVersion": "2", "cfBundleShortVersionString": "1.0.0",
+            "sha256": "ab" * 32, "fileName": "ab" * 32 + ".ipa", "fileSize": 10}
+ENV = {"APP_STORE_APPLE_ID": "app", "APPLE_STORE_PROXY_URL": "http://proxy.test:1234"}
+
+
+class ReceiptStageTests(unittest.TestCase):
+    """The receipt exists from the first local identity on and names every provider id it learns."""
+
+    @mock.patch.dict(os.environ, ENV)
+    def test_identity_is_written_before_the_first_provider_request(self):
+        with tempfile.TemporaryDirectory() as temporary, \
+                mock.patch.object(upload_build, "identity", return_value=dict(IDENTITY)), \
+                mock.patch.object(upload_build, "api", side_effect=SystemExit("ASC GET failed: 503 body")):
+            report = Path(temporary) / "receipt.json"
+            with self.assertRaises(SystemExit):
+                upload_build.deliver(Path("unused"), report, 1)
+            receipt = json.loads(report.read_text())
+        self.assertEqual(receipt["stage"], "identity")
+        self.assertEqual(receipt["sha256"], IDENTITY["sha256"])
+        self.assertEqual(receipt["cfBundleVersion"], "2")
+        self.assertTrue(receipt["proxy_required"])
+
+    @mock.patch.dict(os.environ, ENV)
+    def test_upload_id_is_written_before_the_file_is_reserved(self):
+        with tempfile.TemporaryDirectory() as temporary, \
+                mock.patch.object(upload_build, "identity", return_value=dict(IDENTITY)), \
+                mock.patch.object(upload_build, "api", return_value={"data": {"attributes": {
+                    "bundleId": "com.expected.app"}}}), \
+                mock.patch.object(upload_build, "upload_record", return_value={"id": "upload-1"}), \
+                mock.patch.object(upload_build, "upload_file", side_effect=UploadError(
+                    "upload_identity_conflict", "different bytes", upload_id="upload-1", file_id="file-old")):
+            report = Path(temporary) / "receipt.json"
+            with self.assertRaises(UploadError):
+                upload_build.deliver(Path("unused"), report, 1)
+            receipt = json.loads(report.read_text())
+        self.assertEqual(receipt["stage"], "upload_reserved")
+        self.assertEqual(receipt["upload_id"], "upload-1")
+        self.assertEqual(receipt["app_id"], "app")
+
+    @mock.patch.dict(os.environ, {"APP_STORE_APPLE_ID": "app"}, clear=False)
+    def test_missing_proxy_is_classified_without_any_request(self):
+        with tempfile.TemporaryDirectory() as temporary, \
+                mock.patch.dict(os.environ, {"APPLE_STORE_PROXY_URL": ""}), \
+                mock.patch.object(upload_build, "api") as api:
+            with self.assertRaises(UploadError) as caught:
+                upload_build.deliver(Path("unused"), Path(temporary) / "receipt.json", 1)
+            api.assert_not_called()
+        self.assertEqual(caught.exception.category, "proxy_missing")
+
+
+class FailureAnnotationTests(unittest.TestCase):
+    """The typed annotation carries the category and identifiers, never exception text."""
+
+    def run_main(self, exc: BaseException, report: Path) -> tuple[dict, str, str]:
+        out, err = io.StringIO(), io.StringIO()
+        argv = ["upload_build.py", "app.ipa", "--report", str(report)]
+        with mock.patch.object(upload_build, "deliver", side_effect=exc), \
+                mock.patch.object(sys, "argv", argv), redirect_stdout(out), redirect_stderr(err):
+            with self.assertRaises(SystemExit) as caught:
+                upload_build.main()
+        self.assertIn("retain its receipt and IPA", str(caught.exception.code))
+        prefix = "::error title=apple_build_upload_failed::"
+        line = next(row for row in out.getvalue().splitlines() if row.startswith(prefix))
+        return json.loads(line.split("::", 2)[2]), out.getvalue(), str(caught.exception.code)
+
+    def test_provider_exit_text_stays_out_of_the_annotation_and_receipt(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            report = Path(temporary) / "receipt.json"
+            report.write_text(json.dumps({"stage": "file_reserved", "upload_id": "upload-1", "file_id": "file-1",
+                                          "cfBundleVersion": "2"}))
+            secret = "Bearer eyJ-secret-token-value"
+            failure, out, err = self.run_main(SystemExit(f"ASC PATCH /x failed: 409 {secret}"), report)
+            receipt = json.loads(report.read_text())
+        self.assertEqual(failure["schema"], "gowalk-cicd/apple-build-upload-failed.v2")
+        self.assertEqual((failure["category"], failure["stage"]), ("provider_request_failed", "file_reserved"))
+        self.assertEqual((failure["upload_id"], failure["file_id"], failure["cfBundleVersion"]),
+                         ("upload-1", "file-1", "2"))
+        self.assertTrue(failure["receipt_available"])
+        self.assertEqual(receipt["failure"], {"category": "provider_request_failed", "exception": "SystemExit"})
+        for text in (out, err, json.dumps(receipt)):
+            self.assertNotIn("secret-token-value", text)
+            self.assertNotIn("ASC PATCH", text)
+
+    def test_classified_details_are_published(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            report = Path(temporary) / "receipt.json"
+            exc = UploadError("provider_request_failed", "refused", provider_status=409,
+                              provider_code="ENTITY_ERROR.ATTRIBUTE.INVALID",
+                              provider_pointer="/data/attributes/sourceFileChecksums")
+            failure, _, err = self.run_main(exc, report)
+        self.assertEqual(failure["provider_status"], 409)
+        self.assertEqual(failure["provider_code"], "ENTITY_ERROR.ATTRIBUTE.INVALID")
+        self.assertEqual(failure["stage"], "start")
+        self.assertTrue(failure["receipt_available"])
+        self.assertIn("provider_request_failed at stage start", err)
+        self.assertNotIn("refused", err)
+
+    def test_unknown_failures_fall_back_to_a_safe_category(self):
+        self.assertEqual(upload_receipt.classify(KeyError("data")), "provider_response_shape")
+        self.assertEqual(upload_receipt.classify(OSError("disk")), "local_io")
+        self.assertEqual(upload_receipt.classify(ValueError("x")), "invalid_state")
+        self.assertEqual(upload_receipt.classify(RuntimeError("x")), "upload_failed")
+        self.assertEqual(upload_receipt.classify(ZeroDivisionError()), "unexpected")
+
+
+class ProviderRefusalTests(unittest.TestCase):
+    @mock.patch.dict(os.environ, {"ASC_KEY_ID": "k", "ASC_ISSUER_ID": "i", "ASC_KEY_PATH": "p"})
+    def test_provider_refusal_becomes_a_classified_error_with_the_apple_code(self):
+        response = mock.Mock(status_code=409)
+        response.json.return_value = {"errors": [{"code": "ENTITY_ERROR.ATTRIBUTE.INVALID",
+                                                  "detail": "body text that must not leak",
+                                                  "source": {"pointer": "/data/attributes/sourceFileChecksums"}}]}
+        with mock.patch.object(upload_build.asc_common, "make_jwt", return_value="jwt"), \
+                mock.patch.object(upload_build.asc_common, "request", return_value=response) as request:
+            with self.assertRaises(UploadError) as caught:
+                upload_build.api("PATCH", "/buildUploadFiles/f", {"data": {}})
+        self.assertEqual(caught.exception.category, "provider_request_failed")
+        self.assertEqual(caught.exception.details, {
+            "provider_status": 409, "provider_code": "ENTITY_ERROR.ATTRIBUTE.INVALID",
+            "provider_pointer": "/data/attributes/sourceFileChecksums"})
+        self.assertNotIn("body text", json.dumps(caught.exception.details))
+        self.assertEqual(request.call_args.kwargs["allow_status"], upload_build.CLASSIFIED_STATUSES)
+        self.assertEqual(request.call_args.kwargs["max_attempts"], 1)
+
+    def test_unreadable_ipa_is_classified(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            ipa = Path(temporary) / "app.ipa"
+            ipa.write_bytes(b"not a zip")
+            with self.assertRaises(UploadError) as caught:
+                upload_build.identity(ipa)
+        self.assertEqual(caught.exception.category, "ipa_invalid")
+
+
+class ActionWiringTests(unittest.TestCase):
+    def test_failed_upload_retains_the_exported_ipa_next_to_its_receipt(self):
+        text = (Path(__file__).resolve().parents[1] / "action.yml").read_text()
+        upload = text.index("- name: Upload to TestFlight")
+        self.assertIn("id: upload", text[upload:upload + 200])
+        retain = text.index("- name: Retain the exported IPA for upload recovery")
+        self.assertLess(text.index("- name: Retain Apple upload receipt"), retain)
+        block = text[retain:retain + 700]
+        self.assertIn("steps.upload.outcome != 'success'", block)
+        self.assertIn("name: apple-ipa-${{ github.run_id }}-${{ github.run_attempt }}", block)
+        self.assertIn("path: ${{ runner.temp }}/export/*.ipa", block)
+        self.assertIn("if-no-files-found: ignore", block)
+
+
 if __name__ == "__main__":
     unittest.main()

package/action/scripts/upload_build.py

@@ -16,6 +16,12 @@ import zipfile
 import asc_common
 import apple_store_proxy as store_proxy
 import upload_checksums
+import upload_receipt
+from upload_receipt import Receipt, UploadError
+
+# Provider refusals the uploader classifies itself instead of letting the shared
+# client exit with the response body in its message.
+CLASSIFIED_STATUSES = {400, 401, 403, 404, 409, 412, 422}
 
 
 def api(method: str, path: str, body=None, params=None) -> dict:
@@ -23,17 +29,29 @@ def api(method: str, path: str, body=None, params=None) -> dict:
                                 os.environ["ASC_KEY_PATH"])
     # An uncertain create is discovered from the provider on the next invocation,
     # never repeated automatically under a second upload identity.
-    return asc_common.request(method, path, token, json_body=body, params=params,
-                              max_attempts=3 if method == "GET" else 1).json()
+    response = asc_common.request(method, path, token, json_body=body, params=params,
+                                  allow_status=CLASSIFIED_STATUSES, max_attempts=3 if method == "GET" else 1)
+    if response.status_code >= 400:
+        try:
+            error = (response.json().get("errors") or [{}])[0]
+        except ValueError:
+            error = {}
+        raise UploadError("provider_request_failed", f"Apple refused {method} {path}",
+                          provider_status=response.status_code, provider_code=str(error.get("code") or ""),
+                          provider_pointer=str((error.get("source") or {}).get("pointer") or ""))
+    return response.json()
 
 
 def identity(ipa: Path) -> dict:
-    with zipfile.ZipFile(ipa) as archive:
-        names = [name for name in archive.namelist()
-                 if name.startswith("Payload/") and name.endswith(".app/Info.plist") and name.count("/") == 2]
-        if len(names) != 1:
-            raise ValueError("IPA must contain one top-level app Info.plist")
-        info = plistlib.loads(archive.read(names[0]))
+    try:
+        with zipfile.ZipFile(ipa) as archive:
+            names = [name for name in archive.namelist()
+                     if name.startswith("Payload/") and name.endswith(".app/Info.plist") and name.count("/") == 2]
+            if len(names) != 1:
+                raise UploadError("ipa_invalid", "IPA must contain one top-level app Info.plist")
+            info = plistlib.loads(archive.read(names[0]))
+    except (zipfile.BadZipFile, plistlib.InvalidFileException, KeyError) as exc:
+        raise UploadError("ipa_invalid", "IPA is not a readable app archive") from exc
     with ipa.open("rb") as stream:
         digest = hashlib.file_digest(stream, "sha256").hexdigest()
     return {"bundle_id": str(info["CFBundleIdentifier"]),
@@ -49,7 +67,8 @@ def upload_record(app_id: str, info: dict) -> dict:
     rows = api("GET", f"/apps/{app_id}/buildUploads", params=params).get("data") or []
     rows = [row for row in rows if ((row.get("attributes") or {}).get("state") or {}).get("state") != "FAILED"]
     if len(rows) > 1:
-        raise ValueError("multiple matching Apple build uploads; resolve their provider state before retrying")
+        raise UploadError("upload_identity_conflict",
+                          "multiple matching Apple build uploads; resolve their provider state before retrying")
     if rows:
         return rows[0]
     return api("POST", "/buildUploads", {"data": {
@@ -65,7 +84,9 @@ def upload_file(record: dict, info: dict) -> dict:
     if assets:
         if len(assets) != 1 or any(assets[0]["attributes"].get(key) != info[key]
                                   for key in ("fileName", "fileSize")):
-            raise ValueError("existing Apple build upload belongs to different IPA bytes; do not overwrite it")
+            raise UploadError("upload_identity_conflict",
+                              "existing Apple build upload belongs to different IPA bytes; do not overwrite it",
+                              upload_id=record["id"], file_id=str(assets[0].get("id") or ""))
         return assets[0]
     return api("POST", "/buildUploadFiles", {"data": {
         "type": "buildUploadFiles", "attributes": {
@@ -78,19 +99,20 @@ def transfer(ipa: Path, operation: dict) -> None:
     parsed = urlsplit(operation["url"])
     hosts = (".apple.com", ".icloud.com", ".amazonaws.com")
     if parsed.scheme != "https" or not any((parsed.hostname or "").endswith(host) for host in hosts):
-        raise ValueError("Apple returned an unsupported upload destination")
+        raise UploadError("upload_destination_invalid", "Apple returned an unsupported upload destination")
     if operation.get("method") != "PUT":
-        raise ValueError("Apple returned an unsupported upload method")
+        raise UploadError("upload_destination_invalid", "Apple returned an unsupported upload method")
     with ipa.open("rb") as stream:
         stream.seek(operation["offset"])
         data = stream.read(operation["length"])
     if len(data) != operation["length"]:
-        raise ValueError("IPA changed during upload")
+        raise UploadError("ipa_changed", "IPA changed during upload")
     headers = {row["name"]: row["value"] for row in operation.get("requestHeaders") or []}
     response = store_proxy.request("PUT", operation["url"], headers=headers, data=data,
                                    timeout=(20, 300), allow_redirects=False)
     if not 200 <= response.status_code < 300:
-        raise RuntimeError(f"Apple upload part refused ({response.status_code}); read upload state before retrying")
+        raise UploadError("part_refused", "Apple upload part refused; read upload state before retrying",
+                          provider_status=response.status_code)
 
 
 def transfer_all(ipa: Path, file: dict, info: dict) -> None:
@@ -103,10 +125,10 @@ def transfer_all(ipa: Path, file: dict, info: dict) -> None:
     offset = 0
     for operation in operations:
         if operation.get("offset") != offset or operation.get("length", 0) <= 0:
-            raise ValueError("Apple upload operations do not cover the IPA exactly")
+            raise UploadError("upload_destination_invalid", "Apple upload operations do not cover the IPA exactly")
         offset += operation["length"]
     if offset != info["fileSize"]:
-        raise ValueError("Apple upload operations do not cover the IPA exactly")
+        raise UploadError("upload_destination_invalid", "Apple upload operations do not cover the IPA exactly")
     with ThreadPoolExecutor(max_workers=3) as executor:
         results = [executor.submit(transfer, ipa, operation) for operation in operations]
         for result in results:
@@ -120,30 +142,39 @@ def transfer_all(ipa: Path, file: dict, info: dict) -> None:
 
 
 def deliver(ipa: Path, report: Path, timeout: int) -> dict:
-    store_proxy.proxies()  # Refuse before any identity or provider request.
-    info = identity(ipa)
-    app_id = os.environ["APP_STORE_APPLE_ID"]
+    receipt = Receipt(report)
+    try:
+        store_proxy.proxies()  # Refuse before any identity or provider request.
+    except SystemExit as exc:
+        raise UploadError("proxy_missing", "the account-pinned Apple proxy is not configured") from exc
+    receipt.update("identity", **identity(ipa))
+    app_id = os.environ.get("APP_STORE_APPLE_ID") or ""
+    if not app_id:
+        raise UploadError("configuration_missing", "APP_STORE_APPLE_ID is empty")
     app = api("GET", f"/apps/{app_id}")["data"]
-    if (app.get("attributes") or {}).get("bundleId") != info["bundle_id"]:
-        raise ValueError("IPA bundle identity does not match the selected App Store app")
+    if (app.get("attributes") or {}).get("bundleId") != receipt.data["bundle_id"]:
+        raise UploadError("app_mismatch", "IPA bundle identity does not match the selected App Store app")
+    info = receipt.update("app_verified", app_id=app_id)
     record = upload_record(app_id, info)
+    receipt.update("upload_reserved", upload_id=record["id"])
     file = upload_file(record, info)
-    receipt = {**info, "upload_id": record["id"], "file_id": file["id"], "proxy_required": True}
-    report.write_text(json.dumps(receipt, indent=2))
+    receipt.update("file_reserved", file_id=file["id"])
     transfer_all(ipa, file, info)
+    receipt.update("transferred")
     deadline = time.monotonic() + timeout
     while True:
         current = api("GET", f"/buildUploads/{record['id']}", params={"include": "build"})["data"]
         state = ((current.get("attributes") or {}).get("state") or {}).get("state")
-        receipt["state"] = state
-        receipt["build_id"] = (((current.get("relationships") or {}).get("build") or {}).get("data") or {}).get("id")
-        report.write_text(json.dumps(receipt, indent=2))
+        build_id = (((current.get("relationships") or {}).get("build") or {}).get("data") or {}).get("id")
         if state == "COMPLETE":
-            return receipt
+            return receipt.update("complete", state=state, build_id=build_id)
+        receipt.update("processing", state=state, build_id=build_id)
         if state == "FAILED":
-            raise RuntimeError("Apple build upload failed processing; inspect the upload ID's provider errors")
+            raise UploadError("processing_failed",
+                              "Apple build upload failed processing; inspect the upload ID's provider errors")
         if time.monotonic() >= deadline:
-            raise RuntimeError("Apple build processing is pending; reuse this upload ID on continuation")
+            raise UploadError("processing_pending",
+                              "Apple build processing is pending; reuse this upload ID on continuation")
         time.sleep(10)
 
 
@@ -155,13 +186,13 @@ def main() -> None:
     args = parser.parse_args()
     try:
         receipt = deliver(args.ipa, args.report, args.timeout)
-    except (OSError, ValueError, KeyError, RuntimeError, SystemExit):
-        print('::error title=apple_build_upload_failed::' + json.dumps({
-            "schema": "gowalk-cicd/apple-build-upload-failed.v1",
-            "receipt_available": args.report.is_file(),
-            "action": "retain the IPA and receipt; read provider upload state before retrying"}))
-        message = "Apple REST upload did not complete; retain its receipt and resolve the provider state"
-        raise SystemExit(message) from None
+    except (OSError, ValueError, KeyError, RuntimeError, SystemExit) as exc:
+        # The receipt and annotation carry the classified category and identifiers only;
+        # exception text can quote provider bodies or transport details and stays out.
+        failure = upload_receipt.record_failure(args.report, exc)
+        print("::error title=apple_build_upload_failed::" + json.dumps(failure))
+        raise SystemExit(f"Apple REST upload did not complete ({failure['category']} at stage "
+                         f"{failure['stage']}); retain its receipt and IPA and resolve the provider state") from None
     print(json.dumps(receipt))
 
 

package/action/scripts/upload_receipt.py

@@ -0,0 +1,70 @@
+"""Incremental Apple upload receipt and the typed, credential-free failure annotation."""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+RECEIPT_SCHEMA = "gowalk-cicd/apple-build-upload-receipt.v1"
+FAILURE_SCHEMA = "gowalk-cicd/apple-build-upload-failed.v2"
+ACTION = "retain the IPA and receipt; read provider upload state before retrying"
+# Safe receipt fields the annotation republishes so recovery needs no log parsing.
+PUBLISHED = ("cfBundleVersion", "cfBundleShortVersionString", "upload_id", "file_id", "state",
+             "provider_status", "provider_code", "provider_pointer")
+FALLBACK_CATEGORIES = ((SystemExit, "provider_request_failed"), (KeyError, "provider_response_shape"),
+                       (OSError, "local_io"), (ValueError, "invalid_state"), (RuntimeError, "upload_failed"))
+
+
+class UploadError(RuntimeError):
+    """A classified failure: `category` and `details` are safe to publish; the message never is."""
+
+    def __init__(self, category: str, message: str, **details):
+        super().__init__(message)
+        self.category = category
+        self.details = details
+
+
+class Receipt:
+    """The upload receipt written after every stage so a failed job still explains itself."""
+
+    def __init__(self, path: Path):
+        self.path = path
+        self.data = {"schema": RECEIPT_SCHEMA, "proxy_required": True, "stage": "start"}
+        if path.is_file():
+            try:
+                previous = json.loads(path.read_text())
+            except ValueError:
+                previous = None
+            if isinstance(previous, dict):
+                self.data.update(previous)
+
+    def update(self, stage: str, **fields) -> dict:
+        self.data.update(fields)
+        self.data["stage"] = stage
+        self.path.write_text(json.dumps(self.data, indent=2))
+        return dict(self.data)
+
+
+def classify(exc: BaseException) -> str:
+    if isinstance(exc, UploadError):
+        return exc.category
+    for kind, category in FALLBACK_CATEGORIES:
+        if isinstance(exc, kind):
+            return category
+    return "unexpected"
+
+
+def record_failure(report: Path, exc: BaseException) -> dict:
+    """Write the classified failure into the receipt and return the annotation payload.
+
+    Neither carries exception text: provider bodies and transport errors may quote
+    request details, so only the category, stage, exception class and the receipt's
+    own identifiers are published.
+    """
+    receipt = Receipt(report)
+    category = classify(exc)
+    details = dict(getattr(exc, "details", {}) or {})
+    data = receipt.update(receipt.data["stage"], **details,
+                          failure={"category": category, "exception": type(exc).__name__})
+    published = {key: data[key] for key in PUBLISHED if data.get(key) not in (None, "")}
+    return {"schema": FAILURE_SCHEMA, "category": category, "stage": data["stage"],
+            "receipt_available": report.is_file(), **published, "action": ACTION}

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.62
+1.0.64

package/android-action/scripts/crashlytics_symbols.py

@@ -27,12 +27,11 @@ from __future__ import annotations
 import argparse
 import os
 import re
-import subprocess
 import sys
 import tempfile
 from pathlib import Path
 
-from play_store_proxy import environment
+from play_store_proxy import run as run_proxied
 
 # Exact pin, not a range: this job holds the upload keystore and the Play
 # service account, so no floating third-party code runs in it. Bump on purpose.
@@ -99,10 +98,9 @@ def _default_run(cmd: list[str]) -> int:
     # A scratch cwd: the Crashlytics buildtools drop a .crashlytics/ directory
     # (dump_syms.bin, ~4 MB) into the working directory, which must not be the
     # consumer's checkout.
-    env = environment()
     try:
         with tempfile.TemporaryDirectory(prefix="crashlytics-upload-") as workdir:
-            return subprocess.run(cmd, check=False, cwd=workdir, env=env).returncode
+            return run_proxied(cmd, cwd=workdir)
     except FileNotFoundError:
         print(
             "::error::npx is not on PATH, so the Firebase CLI cannot run. "
@@ -161,7 +159,7 @@ def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, r
         print(f"::error::no Dart symbol files in {args.symbols_dir}; nothing to upload to Crashlytics")
         return 1
 
-    cmd = upload_command(app_id, args.symbols_dir, args.firebase_tools)
+    cmd = upload_command(app_id, args.symbols_dir.resolve(), args.firebase_tools)
     print(f"Uploading {len(symbols)} Dart symbol file(s) to Crashlytics app {app_id}:")
     print("  " + " ".join(cmd))
     rc = run(cmd)

package/android-action/scripts/jvm_proxy_relay.py

@@ -109,6 +109,13 @@ def running(proxy: str):
 
 
 def environment(env: dict, port: int) -> dict:
+    # Crashlytics Buildtools prefers HTTP_PROXY to JVM options and rejects URLs
+    # with userinfo. All child clients use the same owned relay; authentication
+    # is added only on its connection to the configured account exit.
+    local = f"http://127.0.0.1:{port}"
+    for name in ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"):
+        env[name] = local
+    env.update(NO_PROXY="", no_proxy="")
     options = (f"-Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort={port} "
                f"-Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort={port} "
                "-Dhttp.nonProxyHosts= -Dhttps.nonProxyHosts= -Djava.net.useSystemProxies=false")

package/android-action/scripts/play_store_proxy.py

@@ -4,7 +4,7 @@ Three entry points, all from the one validated ``GOOGLE_STORE_PROXY_URL``:
 
 * ``python3 play_store_proxy.py`` refuses a missing or malformed proxy.
 * ``python3 play_store_proxy.py -- <command …>`` runs a build tool with the explicit
-  proxy in both spellings and both ``NO_PROXY`` spellings cleared. Setting the pairs
+  owned relay in both proxy spellings and both ``NO_PROXY`` spellings cleared. Setting the pairs
   as YAML ``env`` keys is not an option: GitHub compares env keys case-insensitively
   and rejects the workflow or action file as invalid.
 * ``python3 play_store_proxy.py --github-env`` clears the lower-case ambient bypass
@@ -49,7 +49,7 @@ def session() -> requests.Session:
     return client
 
 
-def run(argv: list[str]) -> int:
+def run(argv: list[str], *, cwd: str | None = None) -> int:
     """Run ``argv`` with the explicit proxy environment; the parent process is untouched."""
     if not argv:
         raise SystemExit("usage: play_store_proxy.py -- <command …>")
@@ -57,7 +57,7 @@ def run(argv: list[str]) -> int:
 
     env = environment()
     with running(proxy_url()) as port:
-        return subprocess.run(argv, env=jvm_environment(env, port), check=False).returncode
+        return subprocess.run(argv, env=jvm_environment(env, port), cwd=cwd, check=False).returncode
 
 
 def clear_github_env_bypass(path: str | None = None) -> list[str]:

package/android-action/scripts/test_crashlytics_symbols.py

@@ -130,7 +130,7 @@ class MainTest(unittest.TestCase):
         self.assertEqual(
             self.calls,
             [["npx", "--yes", cs.FIREBASE_TOOLS, "crashlytics:symbols:upload",
-              f"--app={ANDROID}", str(self.symbols)]],
+              f"--app={ANDROID}", str(self.symbols.resolve())]],
         )
         self.assertIn("Uploaded", out)
         self.assertNotIn("::error::", out)

package/android-action/scripts/test_crashlytics_symbols_proxy.py

@@ -0,0 +1,52 @@
+"""Exercise the actual symbol-uploader child process and its owned proxy lifetime."""
+import base64
+import json
+import os
+from pathlib import Path
+import socket
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+import crashlytics_symbols as symbols
+from test_jvm_proxy_relay import upstream
+
+
+class SymbolsProxyTests(unittest.TestCase):
+    def test_real_upload_child_uses_relay_and_removes_scratch_after_failure(self):
+        probe = """
+import json, os, sys, urllib.request
+from pathlib import Path
+from urllib.parse import urlsplit
+proxy = urlsplit(os.environ['HTTPS_PROXY'])
+assert proxy.hostname == '127.0.0.1' and proxy.username is None
+assert os.environ['NO_PROXY'] == os.environ['no_proxy'] == ''
+reply = urllib.request.urlopen('http://unresolvable.invalid/symbols', timeout=5).read()
+assert reply == b'through pinned proxy'
+Path(sys.argv[1]).write_text(json.dumps({'cwd': os.getcwd(), 'port': proxy.port}))
+sys.exit(7)
+"""
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+            result_path = Path(directory) / "result.json"
+            with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": proxy, "NO_PROXY": "*"}):
+                rc = symbols._default_run([sys.executable, "-c", probe, str(result_path)])
+            result = json.loads(result_path.read_text())
+            self.assertEqual(rc, 7)
+            self.assertFalse(Path(result["cwd"]).exists())
+            self.assertNotEqual(result["cwd"], os.getcwd())
+            with self.assertRaises(OSError):
+                socket.create_connection(("127.0.0.1", result["port"]), timeout=0.2)
+        auth = "Basic " + base64.b64encode(b"fixture-user:fixture-pass").decode()
+        self.assertEqual(seen, [("GET", "http://unresolvable.invalid/symbols", auth)])
+
+    def test_missing_proxy_refuses_before_spawning_the_uploader(self):
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": ""}), \
+                mock.patch("play_store_proxy.subprocess.run") as run:
+            with self.assertRaises(SystemExit):
+                symbols._default_run(["npx", "--yes", symbols.FIREBASE_TOOLS])
+        run.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_jvm_proxy_relay.py

@@ -49,6 +49,28 @@ def upstream():
 
 
 class JvmProxyTests(unittest.TestCase):
+    @unittest.skipUnless(shutil.which("java"), "Java runtime unavailable")
+    def test_environment_first_java_client_receives_a_credential_free_relay(self):
+        source = ('import java.net.*; public class Probe { public static void main(String[] args) '
+                  'throws Exception { var p = new URI(System.getenv("HTTPS_PROXY")); '
+                  'if(p.getUserInfo()!=null) throw new IllegalArgumentException("proxy userinfo unsupported"); '
+                  'var proxy = new Proxy(Proxy.Type.HTTP,new InetSocketAddress(p.getHost(),p.getPort())); '
+                  'var c = new URL("http://unresolvable.invalid/symbols").openConnection(proxy); '
+                  'c.setConnectTimeout(3000); c.setReadTimeout(3000); '
+                  'System.out.print(new String(c.getInputStream().readAllBytes())); }}')
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+            target = Path(directory) / "Probe.java"
+            target.write_text(source)
+            with relay.running(proxy) as port:
+                env = relay.environment({**os.environ, "HTTPS_PROXY": proxy, "NO_PROXY": "*"}, port)
+                result = subprocess.run(["java", str(target)], env=env, capture_output=True, text=True, timeout=20)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout, "through pinned proxy")
+        auth = "Basic " + base64.b64encode(b"fixture-user:fixture-pass").decode()
+        self.assertEqual(seen, [("GET", "http://unresolvable.invalid/symbols", auth)])
+        self.assertNotIn("fixture-pass", result.stderr)
+        self.assertEqual(env["NO_PROXY"], "")
+
     def test_http_and_connect_only_reach_the_authenticated_upstream_and_cleanup(self):
         with upstream() as (proxy, seen):
             with relay.running(proxy) as port:

package/android-action/scripts/test_play_store_proxy.py

@@ -44,8 +44,9 @@ class PlayProxyTests(unittest.TestCase):
             run.return_value.returncode = 0
             self.assertEqual(play_store_proxy.run([sys.executable, "-c", probe]), 0)
             child = run.call_args.kwargs["env"]
-            self.assertEqual(child["https_proxy"], value)
-            self.assertEqual(child["HTTP_PROXY"], value)
+            self.assertTrue(child["https_proxy"].startswith("http://127.0.0.1:"))
+            self.assertEqual(child["HTTP_PROXY"], child["https_proxy"])
+            self.assertEqual(child["GOOGLE_STORE_PROXY_URL"], value)
             self.assertEqual(child["no_proxy"], "")
             self.assertEqual(child["NO_PROXY"], "")
             self.assertEqual(os.environ["no_proxy"], "*")

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.62
+1.0.64

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.62",
+  "version": "1.0.64",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {