gowalk-cicd 1.0.65 → 1.0.67

package/CLAUDE.md

@@ -192,6 +192,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   delivery request. This requires no human handoff. A green CI run alone is not
   evidence that the deferred symbols reached Firebase. Android retains its Dart
   symbols and uploads them before the store bundle, using the configured proxy.
+- Play readiness and AAB/APK version inventory share one prebuild edit. Retry OAuth
+  transport, inventory reads and cleanup of that known edit; never replay an ambiguous
+  `edits.insert`. Only an explicit package-404 allows first-release defaults; failed
+  inventory is not an empty account. The action exposes `play-api-ready` so current
+  workflows skip the redundant postbuild check. Error annotations carry safe
+  phase/category evidence and any cleanup edit ID without raw provider exceptions.
 - The iOS action reads every script and prompt from the snapshot it takes of
   itself in its first step (`$SWIFT_APP_ACTION`, under `RUNNER_TEMP`), never
   from `${{ github.action_path }}` after that step. The plugin self-update

package/README.md

@@ -298,6 +298,26 @@ and prompt from that copy.
 
 ### Google Play upload retry
 
+Android resolves Play readiness and existing AAB/APK version codes together, in one
+owned edit before compilation or Crashlytics work. Auth, permission, transport and
+invalid inventory failures stop there; they never select a fallback version as though
+the package were new. A positively absent package (edit creation returns 404) keeps
+the first-release path: build and retain the signed AAB for the app session's console
+upload. Explicit version pins are preserved and still require the readiness check.
+The action exports `play-api-ready`; current workflows consume that result without
+another store call. A newer workflow with an older action copy retains the original
+standalone preflight. Refreshing the workflow alongside actions removes that late call.
+
+The API readiness preflight retries transient OAuth transport failures and cleanup of
+its own known edit up to three times, with one- and two-second delays. It never
+replays an edit creation whose outcome is unknown. Every request keeps the assigned
+Google proxy; an absent edit after cleanup is already closed. Exhausted recovery
+emits the `play_preflight_failed` error annotation with schema
+`gowalk-cicd/play-preflight-failure.v1`, phase (`oauth_refresh`, `edit_create`,
+`version_inventory` or `edit_cleanup`), classified code and attempt count. Provider bodies, credential
+values and raw network errors are omitted. A cleanup failure also records the known
+edit ID and `cleanup_required: true` so recovery targets that edit.
+
 A Play edit is a short-lived server-side object, and an AAB upload that runs
 long enough outlives one:
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.65
+1.0.67

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.65
+1.0.67

package/android-action/action.yml

@@ -63,6 +63,9 @@ outputs:
   play-service-account:
     description: Path to the discovered Google Play service-account JSON
     value: ${{ steps.config.outputs.service_account }}
+  play-api-ready:
+    description: Prebuild readiness from the same owned edit used to read existing version codes
+    value: ${{ steps.config.outputs.play_api_ready }}
   project-kind:
     description: Detected build system — `flutter` or `gradle`
     value: ${{ steps.config.outputs.project_kind }}
@@ -76,12 +79,12 @@ outputs:
 runs:
   using: composite
   steps:
-    # resolve_android.py asks Google Play for the highest versionCode already
-    # uploaded, so it needs these. Installing them here (rather than relying on the
-    # caller) keeps the action self-contained.
+    # Resolve readiness and highest versionCode together before any compilation.
+    # Missing dependencies or an indeterminate store read must fail here; they are
+    # not evidence of a new package with no existing version codes.
     - name: Install Play API dependencies
       shell: bash
-      run: python3 -m pip install --disable-pip-version-check -q 'google-auth>=2.40,<3' 'requests>=2.32,<3' || true
+      run: python3 -m pip install --disable-pip-version-check -q 'google-auth>=2.40,<3' 'requests>=2.32,<3'
 
     - name: Resolve Android app and credentials
       id: config

package/android-action/scripts/play_inventory.py

@@ -0,0 +1,50 @@
+"""Resolve readiness and version inventory in one owned, proxy-bound Play edit."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+
+from play_preflight import opened_edit
+from play_preflight_transport import call, fail
+from play_store_proxy import session
+
+
+@dataclass(frozen=True)
+class PlayInventory:
+    ready: bool
+    highest_version: int | None
+
+
+def version_codes(response, kind: str) -> list[int]:
+    try:
+        payload = response.json()
+        if not isinstance(payload, dict) or "error" in payload:
+            raise ValueError("invalid inventory")
+        rows = payload.get(kind, [])
+        if not isinstance(rows, list):
+            raise ValueError("invalid inventory")
+        values = []
+        for row in rows:
+            raw = row["versionCode"]
+            if isinstance(raw, bool) or not isinstance(raw, (int, str)):
+                raise ValueError("invalid version")
+            value = int(raw)
+            if not 1 <= value <= 2_100_000_000:
+                raise ValueError("invalid version")
+            values.append(value)
+        return values
+    except (ValueError, TypeError, KeyError):
+        fail("version_inventory", "invalid_response", 1)
+
+
+def read_inventory(package: str, account: Path) -> PlayInventory:
+    with session() as client, opened_edit(client, package, account) as edit:
+        if edit is None:
+            return PlayInventory(ready=False, highest_version=None)
+        url, headers = edit
+        codes = []
+        for kind in ("bundles", "apks"):
+            response = call("version_inventory", lambda: client.get(f"{url}/{kind}", headers=headers, timeout=30),
+                            retry=True, accepted=(200,))
+            codes.extend(version_codes(response, kind))
+        return PlayInventory(ready=True, highest_version=max(codes) if codes else None)

package/android-action/scripts/play_preflight.py

@@ -4,15 +4,17 @@
 from __future__ import annotations
 
 import argparse
+from contextlib import contextmanager
+from functools import partial
 import json
 import os
 from pathlib import Path
+from urllib.parse import quote
 
 import google.auth.transport.requests
-from google.auth.exceptions import TransportError
-import requests
 from google.oauth2 import service_account
 
+from play_preflight_transport import call, fail
 from play_store_proxy import session
 
 
@@ -25,52 +27,58 @@ def write_ready(value: bool) -> None:
         stream.write(f"ready={'true' if value else 'false'}\n")
 
 
-def response_message(response: requests.Response) -> str:
-    try:
-        payload = response.json()
-        return str(payload.get("error", {}).get("message", "unknown API error"))[:500]
-    except (ValueError, AttributeError):
-        return "unknown API error"
-
-
 def main() -> None:
     parser = argparse.ArgumentParser()
     parser.add_argument("--package", required=True)
     parser.add_argument("--service-account", required=True, type=Path)
     args = parser.parse_args()
 
-    client = session()
+    with session() as client:
+        check_ready(client, args.package, args.service_account)
+
+
+def check_ready(client, package: str, account: Path) -> None:
+    with opened_edit(client, package, account) as edit:
+        ready = edit is not None
+    write_ready(ready)
+    if ready:
+        print("Google Play package is ready for automated uploads")
+
+
+@contextmanager
+def opened_edit(client, package: str, account: Path):
+    """Own one preflight edit; callers may perform reads before its verified cleanup."""
     credentials = service_account.Credentials.from_service_account_file(
-        args.service_account, scopes=[SCOPE]
+        account, scopes=[SCOPE]
     )
-    credentials.refresh(google.auth.transport.requests.Request(session=client))
+    request = partial(google.auth.transport.requests.Request(session=client), timeout=30)
+    call("oauth_refresh", lambda: credentials.refresh(request), retry=True)
     headers = {"Authorization": f"Bearer {credentials.token}"}
-    url = f"{BASE_URL}/applications/{args.package}/edits"
-    response = client.post(url, headers=headers, json={}, timeout=30)
+    url = f"{BASE_URL}/applications/{package}/edits"
+    # A timed-out insert may already have created an edit. Never blindly insert again.
+    response = call("edit_create", lambda: client.post(url, headers=headers, json={}, timeout=30),
+                    accepted=(200, 404))
     if response.status_code == 404:
-        write_ready(False)
         print(
-            "::warning::Google Play package is not API-ready. Download the "
-            "android-first-release artifact and upload it once in Play Console; "
-            "later runs will deploy automatically."
+            "::warning::Google Play package is not API-ready. The app session must upload the "
+            "signed Android artifact retained by this build through its assigned Play Console "
+            "and verify the resulting release before retrying API delivery."
         )
+        yield None
         return
-    if response.status_code != 200:
-        message = response_message(response)
-        raise SystemExit(f"Google Play preflight failed ({response.status_code}): {message}")
-
-    edit_id = json.loads(response.text)["id"]
-    delete_url = f"{url}/{edit_id}"
-    deleted = client.delete(delete_url, headers=headers, timeout=30)
-    if deleted.status_code not in (200, 204):
-        message = response_message(deleted)
-        raise SystemExit(f"cannot close Google Play preflight edit: {message}")
-    write_ready(True)
-    print("Google Play package is ready for automated uploads")
+    try:
+        edit_id = json.loads(response.text)["id"]
+        if not isinstance(edit_id, str) or not edit_id or len(edit_id) > 512:
+            raise ValueError("invalid edit identifier")
+    except (ValueError, TypeError, KeyError):
+        fail("edit_create", "invalid_response", 1)
+    delete_url = f"{url}/{quote(edit_id, safe='')}"
+    try:
+        yield (delete_url, headers)
+    finally:
+        call("edit_cleanup", lambda: client.delete(delete_url, headers=headers, timeout=30),
+             retry=True, edit_id=edit_id, accepted=(200, 204, 404))
 
 
 if __name__ == "__main__":
-    try:
-        main()
-    except (requests.RequestException, TransportError):
-        raise SystemExit("Google Play preflight failed through the assigned proxy") from None
+    main()

package/android-action/scripts/play_preflight_transport.py

@@ -0,0 +1,66 @@
+"""Bound safe preflight retries without replaying an ambiguous edit creation."""
+from __future__ import annotations
+
+import json
+import time
+
+from google.auth.exceptions import RefreshError, TransportError
+import requests
+
+RETRY_STATUSES = {429, 500, 502, 503, 504}
+TRANSPORT_ERRORS = (requests.RequestException, TransportError)
+
+
+def transport_code(error: Exception) -> str:
+    pending, seen = [error], set()
+    while pending and len(seen) < 12:
+        item = pending.pop(0)
+        if id(item) in seen:
+            continue
+        seen.add(id(item))
+        for kind, code in ((requests.exceptions.ProxyError, "proxy_connection_failed"),
+                           (requests.exceptions.SSLError, "tls_failed"),
+                           (requests.exceptions.Timeout, "timed_out"),
+                           (requests.exceptions.ConnectionError, "connection_failed")):
+            if isinstance(item, kind):
+                return code
+        pending.extend(value for value in (item.__cause__, item.__context__, *item.args)
+                       if isinstance(value, Exception))
+    return "transport_failed"
+
+
+def fail(phase: str, code: str, attempt: int, *, status: int | None = None,
+         edit_id: str | None = None) -> None:
+    evidence = {"schema": "gowalk-cicd/play-preflight-failure.v1", "phase": phase,
+                "code": code, "attempts": attempt, "route": "assigned_proxy"}
+    if status is not None:
+        evidence["status"] = status
+    if edit_id is not None:
+        evidence["cleanup_required"] = True
+        evidence["edit_id"] = edit_id
+    encoded = json.dumps(evidence, sort_keys=True)
+    annotation = encoded.replace("%", "%25").replace("\r", "%0D").replace("\n", "%0A")
+    print("::error title=play_preflight_failed::" + annotation)
+    raise SystemExit("Google Play preflight failed: " + encoded) from None
+
+
+def call(phase: str, operation, *, retry: bool = False, edit_id: str | None = None,
+         accepted: tuple[int, ...] | None = None):
+    limit = 3 if retry else 1
+    for attempt in range(1, limit + 1):
+        try:
+            result = operation()
+        except TRANSPORT_ERRORS as error:
+            if attempt == limit:
+                fail(phase, transport_code(error), attempt, edit_id=edit_id)
+        except RefreshError:
+            fail(phase, "oauth_refresh_failed", attempt)
+        else:
+            if not retry or getattr(result, "status_code", None) not in RETRY_STATUSES:
+                if accepted is not None and result.status_code not in accepted:
+                    fail(phase, "provider_refused", attempt, status=result.status_code, edit_id=edit_id)
+                return result
+            if attempt == limit:
+                fail(phase, "provider_unavailable", attempt, status=result.status_code, edit_id=edit_id)
+        print(f"Google Play preflight retry: phase={phase} attempt={attempt + 1}/{limit}")
+        time.sleep(attempt)

package/android-action/scripts/resolve_android.py

@@ -9,7 +9,7 @@ import sys
 from pathlib import Path
 
 import gradle_wrapper
-from play_store_proxy import session
+from play_inventory import read_inventory
 from android_config import (
     ConfigError,
     detect_package_name,
@@ -36,74 +36,13 @@ def resolve_build_number(raw: str) -> int:
     return number
 
 
-def highest_play_version_code(package_name: str, service_account: Path) -> int | None:
-    """Highest versionCode Google Play already holds for this package, or None.
-
-    Best-effort: any failure (offline, no permission, app not yet created) returns
-    None so the caller falls back to GITHUB_RUN_NUMBER.
-    """
-    client = session()
-    try:
-        import google.auth.transport.requests  # noqa: PLC0415
-        import requests  # noqa: PLC0415
-        from google.oauth2 import service_account as gsa  # noqa: PLC0415
-
-        creds = gsa.Credentials.from_service_account_file(
-            str(service_account),
-            scopes=["https://www.googleapis.com/auth/androidpublisher"],
-        )
-        creds.refresh(google.auth.transport.requests.Request(session=client))
-        base = "https://androidpublisher.googleapis.com/androidpublisher/v3"
-        headers = {"Authorization": f"Bearer {creds.token}"}
-
-        edit = client.post(
-            f"{base}/applications/{package_name}/edits", headers=headers, timeout=60
-        )
-        edit.raise_for_status()
-        edit_id = edit.json()["id"]
-        try:
-            listed = client.get(
-                f"{base}/applications/{package_name}/edits/{edit_id}/bundles",
-                headers=headers,
-                timeout=60,
-            )
-            listed.raise_for_status()
-            codes = [
-                int(b["versionCode"])
-                for b in listed.json().get("bundles", [])
-                if b.get("versionCode") is not None
-            ]
-        finally:
-            client.delete(
-                f"{base}/applications/{package_name}/edits/{edit_id}",
-                headers=headers,
-                timeout=60,
-            )
-        return max(codes) if codes else None
-    except Exception as exc:  # noqa: BLE001 - never fail the build over this
-        print("::warning::Could not read existing Play versionCodes through the configured proxy; "
-              f"falling back to GITHUB_RUN_NUMBER")
-        return None
-
-
-def auto_build_number(package_name: str, service_account: Path) -> int:
-    """versionCode to use when the caller did not pin one.
-
-    GITHUB_RUN_NUMBER alone is wrong: it restarts at 1 on a freshly-onboarded repo,
-    so it collides with versionCodes Play already holds and every upload is rejected
-    ("Version code N has already been used"). Take whichever is higher: the run
-    number, or one past the highest code Play knows about.
-    """
+def auto_build_number(highest: int | None) -> int:
+    """Choose the next version only from a successfully read Play inventory."""
     run_number = resolve_build_number(os.environ.get("GITHUB_RUN_NUMBER", "1"))
-    highest = highest_play_version_code(package_name, service_account)
-    if highest is None:
-        return run_number
-    candidate = max(run_number, highest + 1)
+    candidate = resolve_build_number(str(max(run_number, (highest or 0) + 1)))
     if candidate != run_number:
-        print(
-            f"Play already holds versionCode {highest}; using {candidate} "
-            f"instead of GITHUB_RUN_NUMBER {run_number}"
-        )
+        print(f"Play already holds versionCode {highest}; using {candidate} "
+              f"instead of GITHUB_RUN_NUMBER {run_number}")
     return candidate
 
 
@@ -148,10 +87,19 @@ def flutter_root() -> Path | None:
     return Path(binary).resolve().parent.parent
 
 
+def prepare_flutter_toolchain(workspace: Path) -> None:
+    # Flutter stable can raise its Gradle/AGP/Kotlin floor. Repair the ephemeral
+    # checkout only after the store inventory has been read successfully.
+    root = flutter_root()
+    if root is None:
+        print("::warning::Flutter SDK not found; skipping the build toolchain check")
+    else:
+        for message in gradle_wrapper.ensure_toolchain(workspace, root):
+            print(message)
+
+
 def main() -> None:
     workspace = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
-    env_path = Path(os.environ["GITHUB_ENV"])
-    output_path = Path(os.environ["GITHUB_OUTPUT"])
     gradle_root = ""
     gradle_module = ""
     try:
@@ -162,11 +110,12 @@ def main() -> None:
         package_name = os.environ.get("INPUT_PACKAGE_NAME") or detect_package_name(
             workspace, project.build_file if project else None
         )
+        inventory = read_inventory(package_name, service_account)
         pinned = os.environ.get("INPUT_BUILD_NUMBER") or ""
         if pinned:
             build_number = resolve_build_number(pinned)
         else:
-            build_number = auto_build_number(package_name, service_account)
+            build_number = auto_build_number(inventory.highest_version)
         if project is not None:
             gradle_root = str(project.root)
             gradle_module = project.module
@@ -174,45 +123,43 @@ def main() -> None:
                 project, build_number, os.environ.get("INPUT_BUILD_NAME") or ""
             )
         else:
-            # Flutter refuses to apply its Gradle plugin when the project's
-            # Gradle, AGP or Kotlin plugin is older than the SDK's floor, and CI
-            # tracks `stable`, so those floors rise without the app changing.
-            # Raise them in the checkout rather than letting every app in the
-            # fleet break on Flutter's release day.
-            root = flutter_root()
-            if root is None:
-                print("::warning::Flutter SDK not found; skipping the build toolchain check")
-            else:
-                for message in gradle_wrapper.ensure_toolchain(workspace, root):
-                    print(message)
+            prepare_flutter_toolchain(workspace)
     except (ConfigError, KeyError, OSError) as exc:
         print(f"::error::{exc}")
         raise SystemExit(1) from exc
 
-    for secret in (signing.store_password, signing.key_password):
-        print(f"::add-mask::{secret}")
     values = {
         "ANDROID_PACKAGE_NAME": package_name,
         "ANDROID_BUILD_NUMBER": str(build_number),
         "ANDROID_SIGNING_PROPERTIES": str(signing.properties_path),
         "ANDROID_KEYSTORE_PATH": str(signing.keystore_path),
         "ANDROID_PLAY_SERVICE_ACCOUNT": str(service_account),
+        "ANDROID_PLAY_API_READY": "true" if inventory.ready else "false",
         "ANDROID_PROJECT_KIND": kind,
         "ANDROID_GRADLE_ROOT": gradle_root,
         "ANDROID_GRADLE_MODULE": gradle_module,
     }
+    write_config(values, signing)
+    print(f"Resolved {kind} Android package {package_name}, build {build_number}")
+
+
+def write_config(values: dict[str, str], signing) -> None:
+    env_path = Path(os.environ["GITHUB_ENV"])
+    output_path = Path(os.environ["GITHUB_OUTPUT"])
+    for secret in (signing.store_password, signing.key_password):
+        print(f"::add-mask::{secret}")
     for name, value in values.items():
         append_value(env_path, name, value)
-    for name, value in (
-        ("package_name", package_name),
-        ("service_account", str(service_account)),
-        ("build_number", str(build_number)),
-        ("project_kind", kind),
-        ("gradle_root", gradle_root),
-        ("gradle_module", gradle_module),
+    for name, source in (
+        ("package_name", "ANDROID_PACKAGE_NAME"),
+        ("service_account", "ANDROID_PLAY_SERVICE_ACCOUNT"),
+        ("build_number", "ANDROID_BUILD_NUMBER"),
+        ("play_api_ready", "ANDROID_PLAY_API_READY"),
+        ("project_kind", "ANDROID_PROJECT_KIND"),
+        ("gradle_root", "ANDROID_GRADLE_ROOT"),
+        ("gradle_module", "ANDROID_GRADLE_MODULE"),
     ):
-        append_value(output_path, name, value)
-    print(f"Resolved {kind} Android package {package_name}, build {build_number}")
+        append_value(output_path, name, values[source])
 
 
 if __name__ == "__main__":

package/android-action/scripts/test_android_config.py

@@ -265,30 +265,17 @@ class AutoBuildNumberTest(unittest.TestCase):
     def test_uses_play_high_water_mark_when_run_number_is_lower(self) -> None:
         import resolve_android
 
-        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=173):
-            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "1"}):
-                # A freshly-onboarded repo starts at run 1; Play already has 173.
-                self.assertEqual(
-                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
-                    174,
-                )
+        with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "1"}):
+            self.assertEqual(resolve_android.auto_build_number(173), 174)
 
     def test_uses_run_number_when_it_is_already_higher(self) -> None:
         import resolve_android
 
-        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=5):
-            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "42"}):
-                self.assertEqual(
-                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
-                    42,
-                )
+        with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "42"}):
+            self.assertEqual(resolve_android.auto_build_number(5), 42)
 
-    def test_falls_back_to_run_number_when_play_is_unreachable(self) -> None:
+    def test_uses_run_number_for_a_successfully_read_empty_inventory(self) -> None:
         import resolve_android
 
-        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=None):
-            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "7"}):
-                self.assertEqual(
-                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
-                    7,
-                )
+        with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "7"}):
+            self.assertEqual(resolve_android.auto_build_number(None), 7)

package/android-action/scripts/test_early_play_workflow.py

@@ -0,0 +1,77 @@
+"""Current actions avoid late store calls while older action copies remain compatible."""
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[2]
+ACTION = (ROOT / "android-action/action.yml").read_text()
+WORKFLOW = (ROOT / "templates/deploy.yml").read_text()
+
+
+def readiness_step() -> str:
+    start = WORKFLOW.index("      - name: Check Google Play API readiness")
+    finish = WORKFLOW.index("      # Play edits", start)
+    return WORKFLOW[start:finish]
+
+
+class EarlyPlayWorkflowTests(unittest.TestCase):
+    def run_step(self, readiness: str):
+        step = readiness_step().split("        run: |\n", 1)[1]
+        script = "\n".join(line[10:] for line in step.splitlines())
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            fake = root / "python3"
+            fake.write_text('#!/bin/sh\necho called >> "$TRACE"\necho ready=true >> "$GITHUB_OUTPUT"\n')
+            fake.chmod(0o700)
+            env = {**os.environ, "PATH": f"{root}:{os.environ['PATH']}", "EARLY_READINESS": readiness,
+                   "TRACE": str(root / "trace"), "GITHUB_OUTPUT": str(root / "output"),
+                   "PACKAGE_NAME": "com.example.app", "SERVICE_ACCOUNT": "fixture.json"}
+            result = subprocess.run(["bash", "-e", "-o", "pipefail", "-c", script], env=env,
+                                    capture_output=True, text=True, check=False)
+            output = (root / "output").read_text() if (root / "output").exists() else ""
+            return result, output, (root / "trace").exists()
+
+    def test_resolver_precedes_both_build_systems_and_dependency_failures_stop_it(self):
+        resolver = ACTION.index("- name: Resolve Android app and credentials")
+        for step in ("Get Flutter dependencies", "Analyze Flutter app", "Test Android app",
+                     "Build release Android App Bundle", "Upload Dart symbols to Crashlytics"):
+            self.assertLess(resolver, ACTION.index(f"- name: {step}"))
+        dependencies = ACTION[ACTION.index("- name: Install Play API dependencies"):resolver]
+        self.assertNotIn("|| true", dependencies)
+        self.assertIn("value: ${{ steps.config.outputs.play_api_ready }}", ACTION)
+
+    def test_verified_readiness_does_not_make_another_store_request(self):
+        result, output, called = self.run_step("true")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(output, "ready=true\n")
+        self.assertFalse(called)
+
+    def test_first_release_is_retained_and_false_readiness_only_skips_upload(self):
+        result, output, called = self.run_step("false")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(output, "ready=false\n")
+        self.assertFalse(called)
+        start = WORKFLOW.index("- name: Build and sign Android release")
+        end = WORKFLOW.index("- name: Install Google Play preflight dependencies", start)
+        self.assertNotIn("ready ==", WORKFLOW[start:end])
+        self.assertIn("- name: Retain signed Android App Bundle", WORKFLOW[start:end])
+        self.assertIn("steps.play.outputs.ready == 'true'", WORKFLOW)
+
+    def test_older_action_without_new_output_uses_original_cli_contract(self):
+        result, output, called = self.run_step("")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(output, "ready=true\n")
+        self.assertTrue(called)
+        self.assertRegex(readiness_step(), r'--package "\$PACKAGE_NAME"\s*\\\s*--service-account "\$SERVICE_ACCOUNT"')
+
+    def test_invalid_output_cannot_silently_skip_preflight(self):
+        result, output, called = self.run_step("unknown")
+        self.assertEqual(result.returncode, 1)
+        self.assertEqual(output, "")
+        self.assertFalse(called)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_inventory.py

@@ -0,0 +1,98 @@
+"""A single early edit verifies readiness and inventories AAB/APK version codes."""
+import io
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+import requests
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_inventory as inventory
+import play_preflight as preflight
+import play_preflight_transport as transport
+
+
+class PlayInventoryTests(unittest.TestCase):
+    def setUp(self):
+        self.client = mock.MagicMock()
+        self.client.__enter__.return_value = self.client
+        self.client.post.return_value = mock.Mock(status_code=200, text='{"id":"edit-123"}')
+        self.client.delete.return_value = mock.Mock(status_code=204)
+        self.client.get.side_effect = [mock.Mock(status_code=200, json=lambda: {"bundles": [{"versionCode": 41}]}),
+                                       mock.Mock(status_code=200, json=lambda: {"apks": [{"versionCode": 55}]})]
+        self.credentials = mock.Mock(token="private-token")
+        self.enterContext(mock.patch.object(preflight.service_account.Credentials,
+                                           "from_service_account_file", return_value=self.credentials))
+        self.enterContext(mock.patch.object(inventory, "session", return_value=self.client))
+        self.sleep = self.enterContext(mock.patch.object(transport.time, "sleep"))
+        self.output = self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def read(self):
+        return inventory.read_inventory("com.example.app", Path("account.json"))
+
+    def test_bundles_and_apks_share_one_edit_and_highest_code(self):
+        result = self.read()
+        self.assertTrue(result.ready)
+        self.assertEqual(result.highest_version, 55)
+        self.credentials.refresh.assert_called_once()
+        self.client.post.assert_called_once()
+        self.client.delete.assert_called_once()
+        self.assertEqual([c.args[0].rsplit("/", 1)[-1] for c in self.client.get.call_args_list], ["bundles", "apks"])
+
+    def test_positive_package_absence_skips_inventory_and_allows_first_artifact(self):
+        self.client.post.return_value.status_code = 404
+        self.assertEqual(self.read(), inventory.PlayInventory(False, None))
+        self.assertIn("assigned Play Console", self.output.getvalue())
+        self.client.get.assert_not_called()
+        self.client.delete.assert_not_called()
+
+    def test_successful_empty_inventory_is_distinct_from_package_absence(self):
+        self.client.get.side_effect = [mock.Mock(status_code=200, json=lambda: {}),
+                                       mock.Mock(status_code=200, json=lambda: {})]
+        self.assertEqual(self.read(), inventory.PlayInventory(True, None))
+        self.client.delete.assert_called_once()
+
+    def test_inventory_get_retry_keeps_the_same_edit(self):
+        good = mock.Mock(status_code=200, json=lambda: {})
+        self.client.get.side_effect = [requests.exceptions.ReadTimeout(), good, good]
+        self.assertTrue(self.read().ready)
+        self.assertEqual(self.client.get.call_count, 3)
+        self.client.post.assert_called_once()
+        self.client.delete.assert_called_once()
+
+    def test_permission_denial_is_fatal_and_closes_the_owned_edit(self):
+        self.client.get.side_effect = [mock.Mock(status_code=403, text="private-provider-body")]
+        with self.assertRaises(SystemExit) as caught:
+            self.read()
+        self.assertIn('"phase": "version_inventory"', str(caught.exception))
+        self.assertIn('"status": 403', str(caught.exception))
+        self.assertNotIn("private", str(caught.exception) + self.output.getvalue())
+        self.client.delete.assert_called_once()
+
+    def test_lost_edit_is_not_misclassified_as_absent_package(self):
+        self.client.get.side_effect = [mock.Mock(status_code=404)]
+        with self.assertRaises(SystemExit):
+            self.read()
+        self.client.post.assert_called_once()
+        self.client.delete.assert_called_once()
+
+    def test_invalid_inventory_is_fatal_and_cleanup_still_runs(self):
+        self.client.get.side_effect = [mock.Mock(status_code=200, json=lambda: {"bundles": [{"versionCode": "bad"}]})]
+        with self.assertRaises(SystemExit) as caught:
+            self.read()
+        self.assertIn('"code": "invalid_response"', str(caught.exception))
+        self.client.delete.assert_called_once()
+
+    def test_cleanup_failure_prevents_success_and_retains_its_edit_identifier(self):
+        self.client.delete.side_effect = requests.exceptions.ConnectionError("private-proxy")
+        with self.assertRaises(SystemExit) as caught:
+            self.read()
+        self.assertIn('"cleanup_required": true', str(caught.exception))
+        self.assertIn('"edit_id": "edit-123"', str(caught.exception))
+        self.client.post.assert_called_once()
+        self.assertEqual(self.client.delete.call_count, 3)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_preflight.py

@@ -0,0 +1,108 @@
+"""Preflight retries safe operations and never duplicates an ambiguous edit insert."""
+import io
+import json
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+import requests
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_preflight as preflight
+import play_preflight_transport as transport
+
+
+class PlayPreflightTests(unittest.TestCase):
+    def setUp(self):
+        self.client = mock.Mock()
+        self.client.post.return_value = mock.Mock(status_code=200, text='{"id":"edit-123"}')
+        self.client.delete.return_value = mock.Mock(status_code=204)
+        self.credentials = mock.Mock(token="private-token")
+        self.factory = self.enterContext(mock.patch.object(preflight.service_account.Credentials,
+                                                          "from_service_account_file"))
+        self.factory.return_value = self.credentials
+        self.ready = self.enterContext(mock.patch.object(preflight, "write_ready"))
+        self.sleep = self.enterContext(mock.patch.object(transport.time, "sleep"))
+        self.output = self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def check(self):
+        return preflight.check_ready(self.client, "com.example.app", Path("account.json"))
+
+    def test_oauth_transport_recovers_before_one_edit_is_created(self):
+        self.credentials.refresh.side_effect = [requests.exceptions.ProxyError("private-proxy"), None]
+        self.check()
+        self.assertEqual(self.credentials.refresh.call_count, 2)
+        self.client.post.assert_called_once()
+        self.client.delete.assert_called_once()
+        self.ready.assert_called_once_with(True)
+        request = self.credentials.refresh.call_args.args[0]
+        self.assertIs(request.func.session, self.client)
+        self.assertEqual(request.keywords, {"timeout": 30})
+        self.assertNotIn("private", self.output.getvalue())
+
+    def test_insert_timeout_is_not_replayed_or_reported_ready(self):
+        self.client.post.side_effect = requests.exceptions.ReadTimeout("private-token")
+        with self.assertRaises(SystemExit) as caught:
+            self.check()
+        self.assertIn('"phase": "edit_create"', str(caught.exception))
+        self.assertIn('"code": "timed_out"', str(caught.exception))
+        self.assertNotIn("private", str(caught.exception))
+        self.client.post.assert_called_once()
+        self.client.delete.assert_not_called()
+        self.ready.assert_not_called()
+        self.sleep.assert_not_called()
+
+    def test_delete_timeout_then_absence_closes_only_the_known_edit(self):
+        self.client.delete.side_effect = [requests.exceptions.ReadTimeout(), mock.Mock(status_code=404)]
+        self.check()
+        self.client.post.assert_called_once()
+        self.assertEqual(self.client.delete.call_count, 2)
+        self.assertEqual(self.client.delete.call_args_list[0], self.client.delete.call_args_list[1])
+        self.assertTrue(self.client.delete.call_args.args[0].endswith("/edit-123"))
+        self.ready.assert_called_once_with(True)
+
+    def test_cleanup_exhaustion_identifies_edit_without_ready_or_duplicate_insert(self):
+        self.client.delete.side_effect = requests.exceptions.ConnectionError("private-proxy")
+        with self.assertRaises(SystemExit) as caught:
+            self.check()
+        evidence = json.loads(str(caught.exception).split(": ", 1)[1])
+        self.assertEqual(evidence["edit_id"], "edit-123")
+        self.assertTrue(evidence["cleanup_required"])
+        self.assertEqual(evidence["attempts"], 3)
+        self.assertNotIn("private", str(caught.exception))
+        self.client.post.assert_called_once()
+        self.assertEqual(self.client.delete.call_count, 3)
+        self.ready.assert_not_called()
+
+    def test_provider_refusal_hides_untrusted_body_and_is_not_retried(self):
+        self.client.post.return_value = mock.Mock(status_code=403, text="private-access-token")
+        with self.assertRaises(SystemExit) as caught:
+            self.check()
+        self.assertIn('"status": 403', str(caught.exception))
+        self.assertNotIn("private", str(caught.exception))
+        self.client.post.assert_called_once()
+        self.ready.assert_not_called()
+
+    def test_unregistered_package_keeps_first_release_path(self):
+        self.client.post.return_value = mock.Mock(status_code=404)
+        self.check()
+        self.ready.assert_called_once_with(False)
+        self.client.delete.assert_not_called()
+
+    def test_opaque_edit_identifier_is_encoded_in_cleanup_path(self):
+        self.client.post.return_value.text = '{"id":"opaque/id?x=y"}'
+        self.check()
+        self.assertTrue(self.client.delete.call_args.args[0].endswith("/opaque%2Fid%3Fx%3Dy"))
+
+    def test_missing_proxy_stops_before_reading_credentials(self):
+        with mock.patch.dict("os.environ", {"GOOGLE_STORE_PROXY_URL": ""}), \
+                mock.patch.object(sys, "argv", ["preflight", "--package", "com.example.app",
+                                               "--service-account", "account.json"]):
+            with self.assertRaises(SystemExit):
+                preflight.main()
+        self.factory.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_preflight_proxy_runtime.py

@@ -0,0 +1,58 @@
+"""Run OAuth's real requests transport against an owned rejecting loopback proxy."""
+from contextlib import redirect_stdout
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import io
+import os
+from pathlib import Path
+import sys
+import threading
+from types import SimpleNamespace
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_preflight as preflight
+import play_preflight_transport as transport
+
+
+class RejectProxy(BaseHTTPRequestHandler):
+    def do_CONNECT(self):
+        self.server.targets.append(self.path)
+        self.send_error(502, "private-proxy-error")
+
+    def log_message(self, *args):
+        pass
+
+
+class PreflightProxyRuntimeTests(unittest.TestCase):
+    def test_oauth_retries_only_through_assigned_proxy_without_secret_output(self):
+        server = ThreadingHTTPServer(("127.0.0.1", 0), RejectProxy)
+        server.targets = []
+        thread = threading.Thread(target=server.serve_forever, daemon=True)
+        thread.start()
+        env = {"GOOGLE_STORE_PROXY_URL": f"http://user:private-password@127.0.0.1:{server.server_port}",
+               "HTTP_PROXY": "http://127.0.0.1:1", "HTTPS_PROXY": "http://127.0.0.1:1", "NO_PROXY": "*"}
+        credentials = SimpleNamespace(refresh=lambda request: request("https://oauth2.googleapis.com/token",
+                                                                      method="POST", body="private-body"))
+        output = io.StringIO()
+        try:
+            with mock.patch.dict(os.environ, env), redirect_stdout(output), \
+                    mock.patch.object(preflight.service_account.Credentials, "from_service_account_file",
+                                      return_value=credentials), \
+                    mock.patch.object(transport.time, "sleep"), \
+                    mock.patch.object(sys, "argv", ["preflight", "--package", "com.example.app",
+                                                   "--service-account", "account.json"]):
+                with self.assertRaises(SystemExit) as caught:
+                    preflight.main()
+            self.assertEqual(server.targets, ["oauth2.googleapis.com:443"] * 3)
+            self.assertIn('"phase": "oauth_refresh"', str(caught.exception))
+            self.assertIn('"code": "proxy_connection_failed"', str(caught.exception))
+            self.assertNotIn("private", str(caught.exception) + output.getvalue())
+        finally:
+            server.shutdown()
+            server.server_close()
+            thread.join(timeout=2)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_preflight_transport.py

@@ -0,0 +1,76 @@
+"""Classified preflight diagnostics never include raw provider/credential exceptions."""
+import io
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+from google.auth.exceptions import RefreshError, TransportError
+import requests
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_preflight_transport as transport
+
+
+class PreflightTransportTests(unittest.TestCase):
+    def setUp(self):
+        self.sleep = self.enterContext(mock.patch.object(transport.time, "sleep"))
+        self.output = self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def test_wrapped_oauth_transport_error_classification_does_not_read_raw_text(self):
+        for error, expected in ((requests.exceptions.ProxyError("private"), "proxy_connection_failed"),
+                                (requests.exceptions.SSLError("private"), "tls_failed"),
+                                (requests.exceptions.ReadTimeout("private"), "timed_out")):
+            wrapped = TransportError(error)
+            self.assertEqual(transport.transport_code(wrapped), expected)
+
+    def test_safe_operation_has_bounded_retry_and_sanitized_terminal_error(self):
+        operation = mock.Mock(side_effect=TransportError(requests.exceptions.ProxyError("private")))
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("oauth_refresh", operation, retry=True)
+        self.assertEqual(operation.call_count, 3)
+        self.assertEqual(self.sleep.call_args_list, [mock.call(1), mock.call(2)])
+        self.assertIn('"code": "proxy_connection_failed"', str(caught.exception))
+        self.assertNotIn("private", str(caught.exception) + self.output.getvalue())
+
+    def test_oauth_provider_error_is_sanitized_without_an_extra_retry(self):
+        operation = mock.Mock(side_effect=RefreshError("private-provider-body"))
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("oauth_refresh", operation, retry=True)
+        operation.assert_called_once()
+        self.assertIn("oauth_refresh_failed", str(caught.exception))
+        self.assertNotIn("private", str(caught.exception))
+
+    def test_cleanup_retries_server_failure_then_returns_the_success(self):
+        good = mock.Mock(status_code=204)
+        operation = mock.Mock(side_effect=[mock.Mock(status_code=503), good])
+        self.assertIs(transport.call("edit_cleanup", operation, retry=True, edit_id="123"), good)
+        self.assertEqual(operation.call_count, 2)
+
+    def test_ambiguous_server_error_on_insert_is_never_retried(self):
+        response = mock.Mock(status_code=503)
+        operation = mock.Mock(return_value=response)
+        self.assertIs(transport.call("edit_create", operation), response)
+        operation.assert_called_once()
+        self.sleep.assert_not_called()
+
+    def test_cleanup_server_failure_exhaustion_preserves_classified_evidence(self):
+        operation = mock.Mock(return_value=mock.Mock(status_code=503))
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_cleanup", operation, retry=True, edit_id="123")
+        self.assertIn('"code": "provider_unavailable"', str(caught.exception))
+        self.assertIn('"status": 503', str(caught.exception))
+        self.assertIn('"edit_id": "123"', str(caught.exception))
+        self.assertEqual(operation.call_count, 3)
+
+    def test_refusal_after_retry_records_the_actual_attempt_in_a_safe_annotation(self):
+        operation = mock.Mock(side_effect=[mock.Mock(status_code=503), mock.Mock(status_code=403)])
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_cleanup", operation, retry=True, edit_id="123", accepted=(200, 204, 404))
+        self.assertIn('"attempts": 2', str(caught.exception))
+        self.assertIn("::error title=play_preflight_failed::", self.output.getvalue())
+        self.assertIn('"cleanup_required": true', self.output.getvalue())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_resolve_play_readiness.py

@@ -0,0 +1,83 @@
+"""Store evidence must exist before configuration enables compilation or version writes."""
+import io
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import resolve_android as resolve
+from play_inventory import PlayInventory
+
+
+class ResolvePlayReadinessTests(unittest.TestCase):
+    def setUp(self):
+        self.root = Path(self.enterContext(tempfile.TemporaryDirectory())).resolve()
+        (self.root / "creds").mkdir()
+        (self.root / "pubspec.yaml").write_text("name: fixture\n")
+        app = self.root / "android/app"
+        app.mkdir(parents=True)
+        (app / "build.gradle").write_text('android { defaultConfig { applicationId "com.example.app" } }')
+        (self.root / "creds/key.jks").write_bytes(b"fixture")
+        (self.root / "creds/signing.properties").write_text(
+            "storeFile=key.jks\nstorePassword=fixture\nkeyPassword=fixture\nkeyAlias=fixture\n")
+        (self.root / "creds/account.json").write_text(json.dumps(
+            {"type": "service_account", "client_email": "fixture@example.invalid", "private_key": "fixture"}))
+        self.env_file, self.outputs = self.root / "env", self.root / "output"
+        self.enterContext(mock.patch.dict(os.environ, {"GITHUB_WORKSPACE": str(self.root),
+            "GITHUB_OUTPUT": str(self.outputs), "GITHUB_ENV": str(self.env_file), "GITHUB_RUN_NUMBER": "1",
+            "INPUT_BUILD_NUMBER": "", "INPUT_PACKAGE_NAME": "", "INPUT_BUILD_NAME": ""}))
+        self.read = self.enterContext(mock.patch.object(
+            resolve, "read_inventory", return_value=PlayInventory(True, 173)))
+        self.prepare = self.enterContext(mock.patch.object(resolve, "prepare_flutter_toolchain"))
+        self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def test_known_inventory_is_read_once_and_prevents_a_version_collision(self):
+        resolve.main()
+        self.read.assert_called_once_with("com.example.app", self.root / "creds/account.json")
+        self.assertIn("build_number=174\n", self.outputs.read_text())
+        self.assertIn("play_api_ready=true\n", self.outputs.read_text())
+        self.assertIn("ANDROID_PLAY_API_READY=true\n", self.env_file.read_text())
+        self.prepare.assert_called_once_with(self.root)
+
+    def test_absent_package_keeps_configuration_for_a_first_release_artifact(self):
+        self.read.return_value = PlayInventory(False, None)
+        resolve.main()
+        self.assertIn("build_number=1\n", self.outputs.read_text())
+        self.assertIn("play_api_ready=false\n", self.outputs.read_text())
+        self.assertIn("ANDROID_SIGNING_PROPERTIES=", self.env_file.read_text())
+        self.prepare.assert_called_once()
+
+    def test_indeterminate_inventory_never_enables_a_build_or_mutates_toolchain(self):
+        self.read.side_effect = SystemExit("classified transport failure")
+        with self.assertRaises(SystemExit):
+            resolve.main()
+        self.prepare.assert_not_called()
+        self.assertFalse(self.env_file.exists())
+        self.assertFalse(self.outputs.exists())
+
+    def test_explicit_version_is_preserved_after_the_same_readiness_check(self):
+        with mock.patch.dict(os.environ, {"INPUT_BUILD_NUMBER": "200"}):
+            resolve.main()
+        self.read.assert_called_once()
+        self.assertIn("build_number=200\n", self.outputs.read_text())
+
+    def test_explicit_version_does_not_bypass_a_failed_store_read(self):
+        self.read.side_effect = SystemExit("classified auth failure")
+        with mock.patch.dict(os.environ, {"INPUT_BUILD_NUMBER": "200"}), self.assertRaises(SystemExit):
+            resolve.main()
+        self.prepare.assert_not_called()
+        self.assertFalse(self.outputs.exists())
+
+    def test_exhausted_version_space_does_not_overflow_or_fall_back(self):
+        self.read.return_value = PlayInventory(True, 2_100_000_000)
+        with self.assertRaises(SystemExit):
+            resolve.main()
+        self.assertFalse(self.outputs.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.65
+1.0.67

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.65",
+  "version": "1.0.67",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -431,7 +431,7 @@ jobs:
       # the action autoupdates on consumers while this file does not, and the
       # flag and its safety net must never be split across that boundary.
       - name: Install Google Play preflight dependencies
-        if: ${{ steps.mode.outputs.mode == 'local' }}
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.android.outputs.play-api-ready == '' }}
         shell: bash
         run: python3 -m pip install --disable-pip-version-check 'google-auth>=2.40,<3' 'requests>=2.32,<3'
       - name: Check Google Play API readiness
@@ -441,7 +441,15 @@ jobs:
         env:
           PACKAGE_NAME: ${{ steps.android.outputs.package-name }}
           SERVICE_ACCOUNT: ${{ steps.android.outputs.play-service-account }}
+          EARLY_READINESS: ${{ steps.android.outputs.play-api-ready }}
         run: |
+          # Current actions verify readiness before compiling. Older action copies
+          # have no output, so retain their standalone preflight compatibility.
+          case "$EARLY_READINESS" in
+            true|false) echo "ready=$EARLY_READINESS" >> "$GITHUB_OUTPUT"; exit 0 ;;
+            '') ;;
+            *) echo "::error::Invalid Android readiness output"; exit 1 ;;
+          esac
           python3 .github/actions/android-app/scripts/play_preflight.py \
             --package "$PACKAGE_NAME" \
             --service-account "$SERVICE_ACCOUNT"