gowalk-cicd 1.0.65 → 1.0.66

package/CLAUDE.md

@@ -192,6 +192,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   delivery request. This requires no human handoff. A green CI run alone is not
   evidence that the deferred symbols reached Firebase. Android retains its Dart
   symbols and uploads them before the store bundle, using the configured proxy.
+- Play readiness retries only OAuth transport and cleanup of its known edit. Never
+  replay an ambiguous `edits.insert`; error annotations carry safe phase/category
+  evidence and the edit ID when cleanup remains, without raw provider exceptions.
 - The iOS action reads every script and prompt from the snapshot it takes of
   itself in its first step (`$SWIFT_APP_ACTION`, under `RUNNER_TEMP`), never
   from `${{ github.action_path }}` after that step. The plugin self-update

package/README.md

@@ -298,6 +298,16 @@ and prompt from that copy.
 
 ### Google Play upload retry
 
+The API readiness preflight retries transient OAuth transport failures and cleanup of
+its own known edit up to three times, with one- and two-second delays. It never
+replays an edit creation whose outcome is unknown. Every request keeps the assigned
+Google proxy; an absent edit after cleanup is already closed. Exhausted recovery
+emits the `play_preflight_failed` error annotation with schema
+`gowalk-cicd/play-preflight-failure.v1`, phase (`oauth_refresh`, `edit_create` or
+`edit_cleanup`), classified code and attempt count. Provider bodies, credential
+values and raw network errors are omitted. A cleanup failure also records the known
+edit ID and `cleanup_required: true` so recovery targets that edit.
+
 A Play edit is a short-lived server-side object, and an AAB upload that runs
 long enough outlives one:
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.65
+1.0.66

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.65
+1.0.66

package/android-action/scripts/play_preflight.py

@@ -4,15 +4,16 @@
 from __future__ import annotations
 
 import argparse
+from functools import partial
 import json
 import os
 from pathlib import Path
+from urllib.parse import quote
 
 import google.auth.transport.requests
-from google.auth.exceptions import TransportError
-import requests
 from google.oauth2 import service_account
 
+from play_preflight_transport import call, fail
 from play_store_proxy import session
 
 
@@ -25,52 +26,47 @@ def write_ready(value: bool) -> None:
         stream.write(f"ready={'true' if value else 'false'}\n")
 
 
-def response_message(response: requests.Response) -> str:
-    try:
-        payload = response.json()
-        return str(payload.get("error", {}).get("message", "unknown API error"))[:500]
-    except (ValueError, AttributeError):
-        return "unknown API error"
-
-
 def main() -> None:
     parser = argparse.ArgumentParser()
     parser.add_argument("--package", required=True)
     parser.add_argument("--service-account", required=True, type=Path)
     args = parser.parse_args()
 
-    client = session()
+    with session() as client:
+        check_ready(client, args.package, args.service_account)
+
+
+def check_ready(client, package: str, account: Path) -> None:
     credentials = service_account.Credentials.from_service_account_file(
-        args.service_account, scopes=[SCOPE]
+        account, scopes=[SCOPE]
     )
-    credentials.refresh(google.auth.transport.requests.Request(session=client))
+    request = partial(google.auth.transport.requests.Request(session=client), timeout=30)
+    call("oauth_refresh", lambda: credentials.refresh(request), retry=True)
     headers = {"Authorization": f"Bearer {credentials.token}"}
-    url = f"{BASE_URL}/applications/{args.package}/edits"
-    response = client.post(url, headers=headers, json={}, timeout=30)
+    url = f"{BASE_URL}/applications/{package}/edits"
+    # A timed-out insert may already have created an edit. Never blindly insert again.
+    response = call("edit_create", lambda: client.post(url, headers=headers, json={}, timeout=30),
+                    accepted=(200, 404))
     if response.status_code == 404:
         write_ready(False)
         print(
-            "::warning::Google Play package is not API-ready. Download the "
-            "android-first-release artifact and upload it once in Play Console; "
-            "later runs will deploy automatically."
+            "::warning::Google Play package is not API-ready. The app session must upload the "
+            "retained android-first-release artifact through its assigned Play Console and "
+            "verify the resulting release before retrying API delivery."
         )
         return
-    if response.status_code != 200:
-        message = response_message(response)
-        raise SystemExit(f"Google Play preflight failed ({response.status_code}): {message}")
-
-    edit_id = json.loads(response.text)["id"]
-    delete_url = f"{url}/{edit_id}"
-    deleted = client.delete(delete_url, headers=headers, timeout=30)
-    if deleted.status_code not in (200, 204):
-        message = response_message(deleted)
-        raise SystemExit(f"cannot close Google Play preflight edit: {message}")
+    try:
+        edit_id = json.loads(response.text)["id"]
+        if not isinstance(edit_id, str) or not edit_id or len(edit_id) > 512:
+            raise ValueError("invalid edit identifier")
+    except (ValueError, TypeError, KeyError):
+        fail("edit_create", "invalid_response", 1)
+    delete_url = f"{url}/{quote(edit_id, safe='')}"
+    call("edit_cleanup", lambda: client.delete(delete_url, headers=headers, timeout=30),
+         retry=True, edit_id=edit_id, accepted=(200, 204, 404))
     write_ready(True)
     print("Google Play package is ready for automated uploads")
 
 
 if __name__ == "__main__":
-    try:
-        main()
-    except (requests.RequestException, TransportError):
-        raise SystemExit("Google Play preflight failed through the assigned proxy") from None
+    main()

package/android-action/scripts/play_preflight_transport.py

@@ -0,0 +1,66 @@
+"""Bound safe preflight retries without replaying an ambiguous edit creation."""
+from __future__ import annotations
+
+import json
+import time
+
+from google.auth.exceptions import RefreshError, TransportError
+import requests
+
+RETRY_STATUSES = {429, 500, 502, 503, 504}
+TRANSPORT_ERRORS = (requests.RequestException, TransportError)
+
+
+def transport_code(error: Exception) -> str:
+    pending, seen = [error], set()
+    while pending and len(seen) < 12:
+        item = pending.pop(0)
+        if id(item) in seen:
+            continue
+        seen.add(id(item))
+        for kind, code in ((requests.exceptions.ProxyError, "proxy_connection_failed"),
+                           (requests.exceptions.SSLError, "tls_failed"),
+                           (requests.exceptions.Timeout, "timed_out"),
+                           (requests.exceptions.ConnectionError, "connection_failed")):
+            if isinstance(item, kind):
+                return code
+        pending.extend(value for value in (item.__cause__, item.__context__, *item.args)
+                       if isinstance(value, Exception))
+    return "transport_failed"
+
+
+def fail(phase: str, code: str, attempt: int, *, status: int | None = None,
+         edit_id: str | None = None) -> None:
+    evidence = {"schema": "gowalk-cicd/play-preflight-failure.v1", "phase": phase,
+                "code": code, "attempts": attempt, "route": "assigned_proxy"}
+    if status is not None:
+        evidence["status"] = status
+    if edit_id is not None:
+        evidence["cleanup_required"] = True
+        evidence["edit_id"] = edit_id
+    encoded = json.dumps(evidence, sort_keys=True)
+    annotation = encoded.replace("%", "%25").replace("\r", "%0D").replace("\n", "%0A")
+    print("::error title=play_preflight_failed::" + annotation)
+    raise SystemExit("Google Play preflight failed: " + encoded) from None
+
+
+def call(phase: str, operation, *, retry: bool = False, edit_id: str | None = None,
+         accepted: tuple[int, ...] | None = None):
+    limit = 3 if retry else 1
+    for attempt in range(1, limit + 1):
+        try:
+            result = operation()
+        except TRANSPORT_ERRORS as error:
+            if attempt == limit:
+                fail(phase, transport_code(error), attempt, edit_id=edit_id)
+        except RefreshError:
+            fail(phase, "oauth_refresh_failed", attempt)
+        else:
+            if not retry or getattr(result, "status_code", None) not in RETRY_STATUSES:
+                if accepted is not None and result.status_code not in accepted:
+                    fail(phase, "provider_refused", attempt, status=result.status_code, edit_id=edit_id)
+                return result
+            if attempt == limit:
+                fail(phase, "provider_unavailable", attempt, status=result.status_code, edit_id=edit_id)
+        print(f"Google Play preflight retry: phase={phase} attempt={attempt + 1}/{limit}")
+        time.sleep(attempt)

package/android-action/scripts/test_play_preflight.py

@@ -0,0 +1,108 @@
+"""Preflight retries safe operations and never duplicates an ambiguous edit insert."""
+import io
+import json
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+import requests
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_preflight as preflight
+import play_preflight_transport as transport
+
+
+class PlayPreflightTests(unittest.TestCase):
+    def setUp(self):
+        self.client = mock.Mock()
+        self.client.post.return_value = mock.Mock(status_code=200, text='{"id":"edit-123"}')
+        self.client.delete.return_value = mock.Mock(status_code=204)
+        self.credentials = mock.Mock(token="private-token")
+        self.factory = self.enterContext(mock.patch.object(preflight.service_account.Credentials,
+                                                          "from_service_account_file"))
+        self.factory.return_value = self.credentials
+        self.ready = self.enterContext(mock.patch.object(preflight, "write_ready"))
+        self.sleep = self.enterContext(mock.patch.object(transport.time, "sleep"))
+        self.output = self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def check(self):
+        return preflight.check_ready(self.client, "com.example.app", Path("account.json"))
+
+    def test_oauth_transport_recovers_before_one_edit_is_created(self):
+        self.credentials.refresh.side_effect = [requests.exceptions.ProxyError("private-proxy"), None]
+        self.check()
+        self.assertEqual(self.credentials.refresh.call_count, 2)
+        self.client.post.assert_called_once()
+        self.client.delete.assert_called_once()
+        self.ready.assert_called_once_with(True)
+        request = self.credentials.refresh.call_args.args[0]
+        self.assertIs(request.func.session, self.client)
+        self.assertEqual(request.keywords, {"timeout": 30})
+        self.assertNotIn("private", self.output.getvalue())
+
+    def test_insert_timeout_is_not_replayed_or_reported_ready(self):
+        self.client.post.side_effect = requests.exceptions.ReadTimeout("private-token")
+        with self.assertRaises(SystemExit) as caught:
+            self.check()
+        self.assertIn('"phase": "edit_create"', str(caught.exception))
+        self.assertIn('"code": "timed_out"', str(caught.exception))
+        self.assertNotIn("private", str(caught.exception))
+        self.client.post.assert_called_once()
+        self.client.delete.assert_not_called()
+        self.ready.assert_not_called()
+        self.sleep.assert_not_called()
+
+    def test_delete_timeout_then_absence_closes_only_the_known_edit(self):
+        self.client.delete.side_effect = [requests.exceptions.ReadTimeout(), mock.Mock(status_code=404)]
+        self.check()
+        self.client.post.assert_called_once()
+        self.assertEqual(self.client.delete.call_count, 2)
+        self.assertEqual(self.client.delete.call_args_list[0], self.client.delete.call_args_list[1])
+        self.assertTrue(self.client.delete.call_args.args[0].endswith("/edit-123"))
+        self.ready.assert_called_once_with(True)
+
+    def test_cleanup_exhaustion_identifies_edit_without_ready_or_duplicate_insert(self):
+        self.client.delete.side_effect = requests.exceptions.ConnectionError("private-proxy")
+        with self.assertRaises(SystemExit) as caught:
+            self.check()
+        evidence = json.loads(str(caught.exception).split(": ", 1)[1])
+        self.assertEqual(evidence["edit_id"], "edit-123")
+        self.assertTrue(evidence["cleanup_required"])
+        self.assertEqual(evidence["attempts"], 3)
+        self.assertNotIn("private", str(caught.exception))
+        self.client.post.assert_called_once()
+        self.assertEqual(self.client.delete.call_count, 3)
+        self.ready.assert_not_called()
+
+    def test_provider_refusal_hides_untrusted_body_and_is_not_retried(self):
+        self.client.post.return_value = mock.Mock(status_code=403, text="private-access-token")
+        with self.assertRaises(SystemExit) as caught:
+            self.check()
+        self.assertIn('"status": 403', str(caught.exception))
+        self.assertNotIn("private", str(caught.exception))
+        self.client.post.assert_called_once()
+        self.ready.assert_not_called()
+
+    def test_unregistered_package_keeps_first_release_path(self):
+        self.client.post.return_value = mock.Mock(status_code=404)
+        self.check()
+        self.ready.assert_called_once_with(False)
+        self.client.delete.assert_not_called()
+
+    def test_opaque_edit_identifier_is_encoded_in_cleanup_path(self):
+        self.client.post.return_value.text = '{"id":"opaque/id?x=y"}'
+        self.check()
+        self.assertTrue(self.client.delete.call_args.args[0].endswith("/opaque%2Fid%3Fx%3Dy"))
+
+    def test_missing_proxy_stops_before_reading_credentials(self):
+        with mock.patch.dict("os.environ", {"GOOGLE_STORE_PROXY_URL": ""}), \
+                mock.patch.object(sys, "argv", ["preflight", "--package", "com.example.app",
+                                               "--service-account", "account.json"]):
+            with self.assertRaises(SystemExit):
+                preflight.main()
+        self.factory.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_preflight_proxy_runtime.py

@@ -0,0 +1,58 @@
+"""Run OAuth's real requests transport against an owned rejecting loopback proxy."""
+from contextlib import redirect_stdout
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import io
+import os
+from pathlib import Path
+import sys
+import threading
+from types import SimpleNamespace
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_preflight as preflight
+import play_preflight_transport as transport
+
+
+class RejectProxy(BaseHTTPRequestHandler):
+    def do_CONNECT(self):
+        self.server.targets.append(self.path)
+        self.send_error(502, "private-proxy-error")
+
+    def log_message(self, *args):
+        pass
+
+
+class PreflightProxyRuntimeTests(unittest.TestCase):
+    def test_oauth_retries_only_through_assigned_proxy_without_secret_output(self):
+        server = ThreadingHTTPServer(("127.0.0.1", 0), RejectProxy)
+        server.targets = []
+        thread = threading.Thread(target=server.serve_forever, daemon=True)
+        thread.start()
+        env = {"GOOGLE_STORE_PROXY_URL": f"http://user:private-password@127.0.0.1:{server.server_port}",
+               "HTTP_PROXY": "http://127.0.0.1:1", "HTTPS_PROXY": "http://127.0.0.1:1", "NO_PROXY": "*"}
+        credentials = SimpleNamespace(refresh=lambda request: request("https://oauth2.googleapis.com/token",
+                                                                      method="POST", body="private-body"))
+        output = io.StringIO()
+        try:
+            with mock.patch.dict(os.environ, env), redirect_stdout(output), \
+                    mock.patch.object(preflight.service_account.Credentials, "from_service_account_file",
+                                      return_value=credentials), \
+                    mock.patch.object(transport.time, "sleep"), \
+                    mock.patch.object(sys, "argv", ["preflight", "--package", "com.example.app",
+                                                   "--service-account", "account.json"]):
+                with self.assertRaises(SystemExit) as caught:
+                    preflight.main()
+            self.assertEqual(server.targets, ["oauth2.googleapis.com:443"] * 3)
+            self.assertIn('"phase": "oauth_refresh"', str(caught.exception))
+            self.assertIn('"code": "proxy_connection_failed"', str(caught.exception))
+            self.assertNotIn("private", str(caught.exception) + output.getvalue())
+        finally:
+            server.shutdown()
+            server.server_close()
+            thread.join(timeout=2)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_preflight_transport.py

@@ -0,0 +1,76 @@
+"""Classified preflight diagnostics never include raw provider/credential exceptions."""
+import io
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+from google.auth.exceptions import RefreshError, TransportError
+import requests
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_preflight_transport as transport
+
+
+class PreflightTransportTests(unittest.TestCase):
+    def setUp(self):
+        self.sleep = self.enterContext(mock.patch.object(transport.time, "sleep"))
+        self.output = self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def test_wrapped_oauth_transport_error_classification_does_not_read_raw_text(self):
+        for error, expected in ((requests.exceptions.ProxyError("private"), "proxy_connection_failed"),
+                                (requests.exceptions.SSLError("private"), "tls_failed"),
+                                (requests.exceptions.ReadTimeout("private"), "timed_out")):
+            wrapped = TransportError(error)
+            self.assertEqual(transport.transport_code(wrapped), expected)
+
+    def test_safe_operation_has_bounded_retry_and_sanitized_terminal_error(self):
+        operation = mock.Mock(side_effect=TransportError(requests.exceptions.ProxyError("private")))
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("oauth_refresh", operation, retry=True)
+        self.assertEqual(operation.call_count, 3)
+        self.assertEqual(self.sleep.call_args_list, [mock.call(1), mock.call(2)])
+        self.assertIn('"code": "proxy_connection_failed"', str(caught.exception))
+        self.assertNotIn("private", str(caught.exception) + self.output.getvalue())
+
+    def test_oauth_provider_error_is_sanitized_without_an_extra_retry(self):
+        operation = mock.Mock(side_effect=RefreshError("private-provider-body"))
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("oauth_refresh", operation, retry=True)
+        operation.assert_called_once()
+        self.assertIn("oauth_refresh_failed", str(caught.exception))
+        self.assertNotIn("private", str(caught.exception))
+
+    def test_cleanup_retries_server_failure_then_returns_the_success(self):
+        good = mock.Mock(status_code=204)
+        operation = mock.Mock(side_effect=[mock.Mock(status_code=503), good])
+        self.assertIs(transport.call("edit_cleanup", operation, retry=True, edit_id="123"), good)
+        self.assertEqual(operation.call_count, 2)
+
+    def test_ambiguous_server_error_on_insert_is_never_retried(self):
+        response = mock.Mock(status_code=503)
+        operation = mock.Mock(return_value=response)
+        self.assertIs(transport.call("edit_create", operation), response)
+        operation.assert_called_once()
+        self.sleep.assert_not_called()
+
+    def test_cleanup_server_failure_exhaustion_preserves_classified_evidence(self):
+        operation = mock.Mock(return_value=mock.Mock(status_code=503))
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_cleanup", operation, retry=True, edit_id="123")
+        self.assertIn('"code": "provider_unavailable"', str(caught.exception))
+        self.assertIn('"status": 503', str(caught.exception))
+        self.assertIn('"edit_id": "123"', str(caught.exception))
+        self.assertEqual(operation.call_count, 3)
+
+    def test_refusal_after_retry_records_the_actual_attempt_in_a_safe_annotation(self):
+        operation = mock.Mock(side_effect=[mock.Mock(status_code=503), mock.Mock(status_code=403)])
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_cleanup", operation, retry=True, edit_id="123", accepted=(200, 204, 404))
+        self.assertIn('"attempts": 2', str(caught.exception))
+        self.assertIn("::error title=play_preflight_failed::", self.output.getvalue())
+        self.assertIn('"cleanup_required": true', self.output.getvalue())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.65
+1.0.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.65",
+  "version": "1.0.66",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {