gowalk-cicd 1.0.66 → 1.0.67

package/CLAUDE.md

@@ -192,9 +192,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   delivery request. This requires no human handoff. A green CI run alone is not
   evidence that the deferred symbols reached Firebase. Android retains its Dart
   symbols and uploads them before the store bundle, using the configured proxy.
-- Play readiness retries only OAuth transport and cleanup of its known edit. Never
-  replay an ambiguous `edits.insert`; error annotations carry safe phase/category
-  evidence and the edit ID when cleanup remains, without raw provider exceptions.
+- Play readiness and AAB/APK version inventory share one prebuild edit. Retry OAuth
+  transport, inventory reads and cleanup of that known edit; never replay an ambiguous
+  `edits.insert`. Only an explicit package-404 allows first-release defaults; failed
+  inventory is not an empty account. The action exposes `play-api-ready` so current
+  workflows skip the redundant postbuild check. Error annotations carry safe
+  phase/category evidence and any cleanup edit ID without raw provider exceptions.
 - The iOS action reads every script and prompt from the snapshot it takes of
   itself in its first step (`$SWIFT_APP_ACTION`, under `RUNNER_TEMP`), never
   from `${{ github.action_path }}` after that step. The plugin self-update

package/README.md

@@ -298,13 +298,23 @@ and prompt from that copy.
 
 ### Google Play upload retry
 
+Android resolves Play readiness and existing AAB/APK version codes together, in one
+owned edit before compilation or Crashlytics work. Auth, permission, transport and
+invalid inventory failures stop there; they never select a fallback version as though
+the package were new. A positively absent package (edit creation returns 404) keeps
+the first-release path: build and retain the signed AAB for the app session's console
+upload. Explicit version pins are preserved and still require the readiness check.
+The action exports `play-api-ready`; current workflows consume that result without
+another store call. A newer workflow with an older action copy retains the original
+standalone preflight. Refreshing the workflow alongside actions removes that late call.
+
 The API readiness preflight retries transient OAuth transport failures and cleanup of
 its own known edit up to three times, with one- and two-second delays. It never
 replays an edit creation whose outcome is unknown. Every request keeps the assigned
 Google proxy; an absent edit after cleanup is already closed. Exhausted recovery
 emits the `play_preflight_failed` error annotation with schema
-`gowalk-cicd/play-preflight-failure.v1`, phase (`oauth_refresh`, `edit_create` or
-`edit_cleanup`), classified code and attempt count. Provider bodies, credential
+`gowalk-cicd/play-preflight-failure.v1`, phase (`oauth_refresh`, `edit_create`,
+`version_inventory` or `edit_cleanup`), classified code and attempt count. Provider bodies, credential
 values and raw network errors are omitted. A cleanup failure also records the known
 edit ID and `cleanup_required: true` so recovery targets that edit.
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.66
+1.0.67

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.66
+1.0.67

package/android-action/action.yml

@@ -63,6 +63,9 @@ outputs:
   play-service-account:
     description: Path to the discovered Google Play service-account JSON
     value: ${{ steps.config.outputs.service_account }}
+  play-api-ready:
+    description: Prebuild readiness from the same owned edit used to read existing version codes
+    value: ${{ steps.config.outputs.play_api_ready }}
   project-kind:
     description: Detected build system — `flutter` or `gradle`
     value: ${{ steps.config.outputs.project_kind }}
@@ -76,12 +79,12 @@ outputs:
 runs:
   using: composite
   steps:
-    # resolve_android.py asks Google Play for the highest versionCode already
-    # uploaded, so it needs these. Installing them here (rather than relying on the
-    # caller) keeps the action self-contained.
+    # Resolve readiness and highest versionCode together before any compilation.
+    # Missing dependencies or an indeterminate store read must fail here; they are
+    # not evidence of a new package with no existing version codes.
     - name: Install Play API dependencies
       shell: bash
-      run: python3 -m pip install --disable-pip-version-check -q 'google-auth>=2.40,<3' 'requests>=2.32,<3' || true
+      run: python3 -m pip install --disable-pip-version-check -q 'google-auth>=2.40,<3' 'requests>=2.32,<3'
 
     - name: Resolve Android app and credentials
       id: config

package/android-action/scripts/play_inventory.py

@@ -0,0 +1,50 @@
+"""Resolve readiness and version inventory in one owned, proxy-bound Play edit."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+
+from play_preflight import opened_edit
+from play_preflight_transport import call, fail
+from play_store_proxy import session
+
+
+@dataclass(frozen=True)
+class PlayInventory:
+    ready: bool
+    highest_version: int | None
+
+
+def version_codes(response, kind: str) -> list[int]:
+    try:
+        payload = response.json()
+        if not isinstance(payload, dict) or "error" in payload:
+            raise ValueError("invalid inventory")
+        rows = payload.get(kind, [])
+        if not isinstance(rows, list):
+            raise ValueError("invalid inventory")
+        values = []
+        for row in rows:
+            raw = row["versionCode"]
+            if isinstance(raw, bool) or not isinstance(raw, (int, str)):
+                raise ValueError("invalid version")
+            value = int(raw)
+            if not 1 <= value <= 2_100_000_000:
+                raise ValueError("invalid version")
+            values.append(value)
+        return values
+    except (ValueError, TypeError, KeyError):
+        fail("version_inventory", "invalid_response", 1)
+
+
+def read_inventory(package: str, account: Path) -> PlayInventory:
+    with session() as client, opened_edit(client, package, account) as edit:
+        if edit is None:
+            return PlayInventory(ready=False, highest_version=None)
+        url, headers = edit
+        codes = []
+        for kind in ("bundles", "apks"):
+            response = call("version_inventory", lambda: client.get(f"{url}/{kind}", headers=headers, timeout=30),
+                            retry=True, accepted=(200,))
+            codes.extend(version_codes(response, kind))
+        return PlayInventory(ready=True, highest_version=max(codes) if codes else None)

package/android-action/scripts/play_preflight.py

@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import argparse
+from contextlib import contextmanager
 from functools import partial
 import json
 import os
@@ -37,6 +38,16 @@ def main() -> None:
 
 
 def check_ready(client, package: str, account: Path) -> None:
+    with opened_edit(client, package, account) as edit:
+        ready = edit is not None
+    write_ready(ready)
+    if ready:
+        print("Google Play package is ready for automated uploads")
+
+
+@contextmanager
+def opened_edit(client, package: str, account: Path):
+    """Own one preflight edit; callers may perform reads before its verified cleanup."""
     credentials = service_account.Credentials.from_service_account_file(
         account, scopes=[SCOPE]
     )
@@ -48,12 +59,12 @@ def check_ready(client, package: str, account: Path) -> None:
     response = call("edit_create", lambda: client.post(url, headers=headers, json={}, timeout=30),
                     accepted=(200, 404))
     if response.status_code == 404:
-        write_ready(False)
         print(
             "::warning::Google Play package is not API-ready. The app session must upload the "
-            "retained android-first-release artifact through its assigned Play Console and "
-            "verify the resulting release before retrying API delivery."
+            "signed Android artifact retained by this build through its assigned Play Console "
+            "and verify the resulting release before retrying API delivery."
         )
+        yield None
         return
     try:
         edit_id = json.loads(response.text)["id"]
@@ -62,10 +73,11 @@ def check_ready(client, package: str, account: Path) -> None:
     except (ValueError, TypeError, KeyError):
         fail("edit_create", "invalid_response", 1)
     delete_url = f"{url}/{quote(edit_id, safe='')}"
-    call("edit_cleanup", lambda: client.delete(delete_url, headers=headers, timeout=30),
-         retry=True, edit_id=edit_id, accepted=(200, 204, 404))
-    write_ready(True)
-    print("Google Play package is ready for automated uploads")
+    try:
+        yield (delete_url, headers)
+    finally:
+        call("edit_cleanup", lambda: client.delete(delete_url, headers=headers, timeout=30),
+             retry=True, edit_id=edit_id, accepted=(200, 204, 404))
 
 
 if __name__ == "__main__":

package/android-action/scripts/resolve_android.py

@@ -9,7 +9,7 @@ import sys
 from pathlib import Path
 
 import gradle_wrapper
-from play_store_proxy import session
+from play_inventory import read_inventory
 from android_config import (
     ConfigError,
     detect_package_name,
@@ -36,74 +36,13 @@ def resolve_build_number(raw: str) -> int:
     return number
 
 
-def highest_play_version_code(package_name: str, service_account: Path) -> int | None:
-    """Highest versionCode Google Play already holds for this package, or None.
-
-    Best-effort: any failure (offline, no permission, app not yet created) returns
-    None so the caller falls back to GITHUB_RUN_NUMBER.
-    """
-    client = session()
-    try:
-        import google.auth.transport.requests  # noqa: PLC0415
-        import requests  # noqa: PLC0415
-        from google.oauth2 import service_account as gsa  # noqa: PLC0415
-
-        creds = gsa.Credentials.from_service_account_file(
-            str(service_account),
-            scopes=["https://www.googleapis.com/auth/androidpublisher"],
-        )
-        creds.refresh(google.auth.transport.requests.Request(session=client))
-        base = "https://androidpublisher.googleapis.com/androidpublisher/v3"
-        headers = {"Authorization": f"Bearer {creds.token}"}
-
-        edit = client.post(
-            f"{base}/applications/{package_name}/edits", headers=headers, timeout=60
-        )
-        edit.raise_for_status()
-        edit_id = edit.json()["id"]
-        try:
-            listed = client.get(
-                f"{base}/applications/{package_name}/edits/{edit_id}/bundles",
-                headers=headers,
-                timeout=60,
-            )
-            listed.raise_for_status()
-            codes = [
-                int(b["versionCode"])
-                for b in listed.json().get("bundles", [])
-                if b.get("versionCode") is not None
-            ]
-        finally:
-            client.delete(
-                f"{base}/applications/{package_name}/edits/{edit_id}",
-                headers=headers,
-                timeout=60,
-            )
-        return max(codes) if codes else None
-    except Exception as exc:  # noqa: BLE001 - never fail the build over this
-        print("::warning::Could not read existing Play versionCodes through the configured proxy; "
-              f"falling back to GITHUB_RUN_NUMBER")
-        return None
-
-
-def auto_build_number(package_name: str, service_account: Path) -> int:
-    """versionCode to use when the caller did not pin one.
-
-    GITHUB_RUN_NUMBER alone is wrong: it restarts at 1 on a freshly-onboarded repo,
-    so it collides with versionCodes Play already holds and every upload is rejected
-    ("Version code N has already been used"). Take whichever is higher: the run
-    number, or one past the highest code Play knows about.
-    """
+def auto_build_number(highest: int | None) -> int:
+    """Choose the next version only from a successfully read Play inventory."""
     run_number = resolve_build_number(os.environ.get("GITHUB_RUN_NUMBER", "1"))
-    highest = highest_play_version_code(package_name, service_account)
-    if highest is None:
-        return run_number
-    candidate = max(run_number, highest + 1)
+    candidate = resolve_build_number(str(max(run_number, (highest or 0) + 1)))
     if candidate != run_number:
-        print(
-            f"Play already holds versionCode {highest}; using {candidate} "
-            f"instead of GITHUB_RUN_NUMBER {run_number}"
-        )
+        print(f"Play already holds versionCode {highest}; using {candidate} "
+              f"instead of GITHUB_RUN_NUMBER {run_number}")
     return candidate
 
 
@@ -148,10 +87,19 @@ def flutter_root() -> Path | None:
     return Path(binary).resolve().parent.parent
 
 
+def prepare_flutter_toolchain(workspace: Path) -> None:
+    # Flutter stable can raise its Gradle/AGP/Kotlin floor. Repair the ephemeral
+    # checkout only after the store inventory has been read successfully.
+    root = flutter_root()
+    if root is None:
+        print("::warning::Flutter SDK not found; skipping the build toolchain check")
+    else:
+        for message in gradle_wrapper.ensure_toolchain(workspace, root):
+            print(message)
+
+
 def main() -> None:
     workspace = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
-    env_path = Path(os.environ["GITHUB_ENV"])
-    output_path = Path(os.environ["GITHUB_OUTPUT"])
     gradle_root = ""
     gradle_module = ""
     try:
@@ -162,11 +110,12 @@ def main() -> None:
         package_name = os.environ.get("INPUT_PACKAGE_NAME") or detect_package_name(
             workspace, project.build_file if project else None
         )
+        inventory = read_inventory(package_name, service_account)
         pinned = os.environ.get("INPUT_BUILD_NUMBER") or ""
         if pinned:
             build_number = resolve_build_number(pinned)
         else:
-            build_number = auto_build_number(package_name, service_account)
+            build_number = auto_build_number(inventory.highest_version)
         if project is not None:
             gradle_root = str(project.root)
             gradle_module = project.module
@@ -174,45 +123,43 @@ def main() -> None:
                 project, build_number, os.environ.get("INPUT_BUILD_NAME") or ""
             )
         else:
-            # Flutter refuses to apply its Gradle plugin when the project's
-            # Gradle, AGP or Kotlin plugin is older than the SDK's floor, and CI
-            # tracks `stable`, so those floors rise without the app changing.
-            # Raise them in the checkout rather than letting every app in the
-            # fleet break on Flutter's release day.
-            root = flutter_root()
-            if root is None:
-                print("::warning::Flutter SDK not found; skipping the build toolchain check")
-            else:
-                for message in gradle_wrapper.ensure_toolchain(workspace, root):
-                    print(message)
+            prepare_flutter_toolchain(workspace)
     except (ConfigError, KeyError, OSError) as exc:
         print(f"::error::{exc}")
         raise SystemExit(1) from exc
 
-    for secret in (signing.store_password, signing.key_password):
-        print(f"::add-mask::{secret}")
     values = {
         "ANDROID_PACKAGE_NAME": package_name,
         "ANDROID_BUILD_NUMBER": str(build_number),
         "ANDROID_SIGNING_PROPERTIES": str(signing.properties_path),
         "ANDROID_KEYSTORE_PATH": str(signing.keystore_path),
         "ANDROID_PLAY_SERVICE_ACCOUNT": str(service_account),
+        "ANDROID_PLAY_API_READY": "true" if inventory.ready else "false",
         "ANDROID_PROJECT_KIND": kind,
         "ANDROID_GRADLE_ROOT": gradle_root,
         "ANDROID_GRADLE_MODULE": gradle_module,
     }
+    write_config(values, signing)
+    print(f"Resolved {kind} Android package {package_name}, build {build_number}")
+
+
+def write_config(values: dict[str, str], signing) -> None:
+    env_path = Path(os.environ["GITHUB_ENV"])
+    output_path = Path(os.environ["GITHUB_OUTPUT"])
+    for secret in (signing.store_password, signing.key_password):
+        print(f"::add-mask::{secret}")
     for name, value in values.items():
         append_value(env_path, name, value)
-    for name, value in (
-        ("package_name", package_name),
-        ("service_account", str(service_account)),
-        ("build_number", str(build_number)),
-        ("project_kind", kind),
-        ("gradle_root", gradle_root),
-        ("gradle_module", gradle_module),
+    for name, source in (
+        ("package_name", "ANDROID_PACKAGE_NAME"),
+        ("service_account", "ANDROID_PLAY_SERVICE_ACCOUNT"),
+        ("build_number", "ANDROID_BUILD_NUMBER"),
+        ("play_api_ready", "ANDROID_PLAY_API_READY"),
+        ("project_kind", "ANDROID_PROJECT_KIND"),
+        ("gradle_root", "ANDROID_GRADLE_ROOT"),
+        ("gradle_module", "ANDROID_GRADLE_MODULE"),
     ):
-        append_value(output_path, name, value)
-    print(f"Resolved {kind} Android package {package_name}, build {build_number}")
+        append_value(output_path, name, values[source])
 
 
 if __name__ == "__main__":

package/android-action/scripts/test_android_config.py

@@ -265,30 +265,17 @@ class AutoBuildNumberTest(unittest.TestCase):
     def test_uses_play_high_water_mark_when_run_number_is_lower(self) -> None:
         import resolve_android
 
-        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=173):
-            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "1"}):
-                # A freshly-onboarded repo starts at run 1; Play already has 173.
-                self.assertEqual(
-                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
-                    174,
-                )
+        with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "1"}):
+            self.assertEqual(resolve_android.auto_build_number(173), 174)
 
     def test_uses_run_number_when_it_is_already_higher(self) -> None:
         import resolve_android
 
-        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=5):
-            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "42"}):
-                self.assertEqual(
-                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
-                    42,
-                )
+        with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "42"}):
+            self.assertEqual(resolve_android.auto_build_number(5), 42)
 
-    def test_falls_back_to_run_number_when_play_is_unreachable(self) -> None:
+    def test_uses_run_number_for_a_successfully_read_empty_inventory(self) -> None:
         import resolve_android
 
-        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=None):
-            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "7"}):
-                self.assertEqual(
-                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
-                    7,
-                )
+        with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "7"}):
+            self.assertEqual(resolve_android.auto_build_number(None), 7)

package/android-action/scripts/test_early_play_workflow.py

@@ -0,0 +1,77 @@
+"""Current actions avoid late store calls while older action copies remain compatible."""
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[2]
+ACTION = (ROOT / "android-action/action.yml").read_text()
+WORKFLOW = (ROOT / "templates/deploy.yml").read_text()
+
+
+def readiness_step() -> str:
+    start = WORKFLOW.index("      - name: Check Google Play API readiness")
+    finish = WORKFLOW.index("      # Play edits", start)
+    return WORKFLOW[start:finish]
+
+
+class EarlyPlayWorkflowTests(unittest.TestCase):
+    def run_step(self, readiness: str):
+        step = readiness_step().split("        run: |\n", 1)[1]
+        script = "\n".join(line[10:] for line in step.splitlines())
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            fake = root / "python3"
+            fake.write_text('#!/bin/sh\necho called >> "$TRACE"\necho ready=true >> "$GITHUB_OUTPUT"\n')
+            fake.chmod(0o700)
+            env = {**os.environ, "PATH": f"{root}:{os.environ['PATH']}", "EARLY_READINESS": readiness,
+                   "TRACE": str(root / "trace"), "GITHUB_OUTPUT": str(root / "output"),
+                   "PACKAGE_NAME": "com.example.app", "SERVICE_ACCOUNT": "fixture.json"}
+            result = subprocess.run(["bash", "-e", "-o", "pipefail", "-c", script], env=env,
+                                    capture_output=True, text=True, check=False)
+            output = (root / "output").read_text() if (root / "output").exists() else ""
+            return result, output, (root / "trace").exists()
+
+    def test_resolver_precedes_both_build_systems_and_dependency_failures_stop_it(self):
+        resolver = ACTION.index("- name: Resolve Android app and credentials")
+        for step in ("Get Flutter dependencies", "Analyze Flutter app", "Test Android app",
+                     "Build release Android App Bundle", "Upload Dart symbols to Crashlytics"):
+            self.assertLess(resolver, ACTION.index(f"- name: {step}"))
+        dependencies = ACTION[ACTION.index("- name: Install Play API dependencies"):resolver]
+        self.assertNotIn("|| true", dependencies)
+        self.assertIn("value: ${{ steps.config.outputs.play_api_ready }}", ACTION)
+
+    def test_verified_readiness_does_not_make_another_store_request(self):
+        result, output, called = self.run_step("true")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(output, "ready=true\n")
+        self.assertFalse(called)
+
+    def test_first_release_is_retained_and_false_readiness_only_skips_upload(self):
+        result, output, called = self.run_step("false")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(output, "ready=false\n")
+        self.assertFalse(called)
+        start = WORKFLOW.index("- name: Build and sign Android release")
+        end = WORKFLOW.index("- name: Install Google Play preflight dependencies", start)
+        self.assertNotIn("ready ==", WORKFLOW[start:end])
+        self.assertIn("- name: Retain signed Android App Bundle", WORKFLOW[start:end])
+        self.assertIn("steps.play.outputs.ready == 'true'", WORKFLOW)
+
+    def test_older_action_without_new_output_uses_original_cli_contract(self):
+        result, output, called = self.run_step("")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(output, "ready=true\n")
+        self.assertTrue(called)
+        self.assertRegex(readiness_step(), r'--package "\$PACKAGE_NAME"\s*\\\s*--service-account "\$SERVICE_ACCOUNT"')
+
+    def test_invalid_output_cannot_silently_skip_preflight(self):
+        result, output, called = self.run_step("unknown")
+        self.assertEqual(result.returncode, 1)
+        self.assertEqual(output, "")
+        self.assertFalse(called)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_inventory.py

@@ -0,0 +1,98 @@
+"""A single early edit verifies readiness and inventories AAB/APK version codes."""
+import io
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+import requests
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_inventory as inventory
+import play_preflight as preflight
+import play_preflight_transport as transport
+
+
+class PlayInventoryTests(unittest.TestCase):
+    def setUp(self):
+        self.client = mock.MagicMock()
+        self.client.__enter__.return_value = self.client
+        self.client.post.return_value = mock.Mock(status_code=200, text='{"id":"edit-123"}')
+        self.client.delete.return_value = mock.Mock(status_code=204)
+        self.client.get.side_effect = [mock.Mock(status_code=200, json=lambda: {"bundles": [{"versionCode": 41}]}),
+                                       mock.Mock(status_code=200, json=lambda: {"apks": [{"versionCode": 55}]})]
+        self.credentials = mock.Mock(token="private-token")
+        self.enterContext(mock.patch.object(preflight.service_account.Credentials,
+                                           "from_service_account_file", return_value=self.credentials))
+        self.enterContext(mock.patch.object(inventory, "session", return_value=self.client))
+        self.sleep = self.enterContext(mock.patch.object(transport.time, "sleep"))
+        self.output = self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def read(self):
+        return inventory.read_inventory("com.example.app", Path("account.json"))
+
+    def test_bundles_and_apks_share_one_edit_and_highest_code(self):
+        result = self.read()
+        self.assertTrue(result.ready)
+        self.assertEqual(result.highest_version, 55)
+        self.credentials.refresh.assert_called_once()
+        self.client.post.assert_called_once()
+        self.client.delete.assert_called_once()
+        self.assertEqual([c.args[0].rsplit("/", 1)[-1] for c in self.client.get.call_args_list], ["bundles", "apks"])
+
+    def test_positive_package_absence_skips_inventory_and_allows_first_artifact(self):
+        self.client.post.return_value.status_code = 404
+        self.assertEqual(self.read(), inventory.PlayInventory(False, None))
+        self.assertIn("assigned Play Console", self.output.getvalue())
+        self.client.get.assert_not_called()
+        self.client.delete.assert_not_called()
+
+    def test_successful_empty_inventory_is_distinct_from_package_absence(self):
+        self.client.get.side_effect = [mock.Mock(status_code=200, json=lambda: {}),
+                                       mock.Mock(status_code=200, json=lambda: {})]
+        self.assertEqual(self.read(), inventory.PlayInventory(True, None))
+        self.client.delete.assert_called_once()
+
+    def test_inventory_get_retry_keeps_the_same_edit(self):
+        good = mock.Mock(status_code=200, json=lambda: {})
+        self.client.get.side_effect = [requests.exceptions.ReadTimeout(), good, good]
+        self.assertTrue(self.read().ready)
+        self.assertEqual(self.client.get.call_count, 3)
+        self.client.post.assert_called_once()
+        self.client.delete.assert_called_once()
+
+    def test_permission_denial_is_fatal_and_closes_the_owned_edit(self):
+        self.client.get.side_effect = [mock.Mock(status_code=403, text="private-provider-body")]
+        with self.assertRaises(SystemExit) as caught:
+            self.read()
+        self.assertIn('"phase": "version_inventory"', str(caught.exception))
+        self.assertIn('"status": 403', str(caught.exception))
+        self.assertNotIn("private", str(caught.exception) + self.output.getvalue())
+        self.client.delete.assert_called_once()
+
+    def test_lost_edit_is_not_misclassified_as_absent_package(self):
+        self.client.get.side_effect = [mock.Mock(status_code=404)]
+        with self.assertRaises(SystemExit):
+            self.read()
+        self.client.post.assert_called_once()
+        self.client.delete.assert_called_once()
+
+    def test_invalid_inventory_is_fatal_and_cleanup_still_runs(self):
+        self.client.get.side_effect = [mock.Mock(status_code=200, json=lambda: {"bundles": [{"versionCode": "bad"}]})]
+        with self.assertRaises(SystemExit) as caught:
+            self.read()
+        self.assertIn('"code": "invalid_response"', str(caught.exception))
+        self.client.delete.assert_called_once()
+
+    def test_cleanup_failure_prevents_success_and_retains_its_edit_identifier(self):
+        self.client.delete.side_effect = requests.exceptions.ConnectionError("private-proxy")
+        with self.assertRaises(SystemExit) as caught:
+            self.read()
+        self.assertIn('"cleanup_required": true', str(caught.exception))
+        self.assertIn('"edit_id": "edit-123"', str(caught.exception))
+        self.client.post.assert_called_once()
+        self.assertEqual(self.client.delete.call_count, 3)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_resolve_play_readiness.py

@@ -0,0 +1,83 @@
+"""Store evidence must exist before configuration enables compilation or version writes."""
+import io
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import resolve_android as resolve
+from play_inventory import PlayInventory
+
+
+class ResolvePlayReadinessTests(unittest.TestCase):
+    def setUp(self):
+        self.root = Path(self.enterContext(tempfile.TemporaryDirectory())).resolve()
+        (self.root / "creds").mkdir()
+        (self.root / "pubspec.yaml").write_text("name: fixture\n")
+        app = self.root / "android/app"
+        app.mkdir(parents=True)
+        (app / "build.gradle").write_text('android { defaultConfig { applicationId "com.example.app" } }')
+        (self.root / "creds/key.jks").write_bytes(b"fixture")
+        (self.root / "creds/signing.properties").write_text(
+            "storeFile=key.jks\nstorePassword=fixture\nkeyPassword=fixture\nkeyAlias=fixture\n")
+        (self.root / "creds/account.json").write_text(json.dumps(
+            {"type": "service_account", "client_email": "fixture@example.invalid", "private_key": "fixture"}))
+        self.env_file, self.outputs = self.root / "env", self.root / "output"
+        self.enterContext(mock.patch.dict(os.environ, {"GITHUB_WORKSPACE": str(self.root),
+            "GITHUB_OUTPUT": str(self.outputs), "GITHUB_ENV": str(self.env_file), "GITHUB_RUN_NUMBER": "1",
+            "INPUT_BUILD_NUMBER": "", "INPUT_PACKAGE_NAME": "", "INPUT_BUILD_NAME": ""}))
+        self.read = self.enterContext(mock.patch.object(
+            resolve, "read_inventory", return_value=PlayInventory(True, 173)))
+        self.prepare = self.enterContext(mock.patch.object(resolve, "prepare_flutter_toolchain"))
+        self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def test_known_inventory_is_read_once_and_prevents_a_version_collision(self):
+        resolve.main()
+        self.read.assert_called_once_with("com.example.app", self.root / "creds/account.json")
+        self.assertIn("build_number=174\n", self.outputs.read_text())
+        self.assertIn("play_api_ready=true\n", self.outputs.read_text())
+        self.assertIn("ANDROID_PLAY_API_READY=true\n", self.env_file.read_text())
+        self.prepare.assert_called_once_with(self.root)
+
+    def test_absent_package_keeps_configuration_for_a_first_release_artifact(self):
+        self.read.return_value = PlayInventory(False, None)
+        resolve.main()
+        self.assertIn("build_number=1\n", self.outputs.read_text())
+        self.assertIn("play_api_ready=false\n", self.outputs.read_text())
+        self.assertIn("ANDROID_SIGNING_PROPERTIES=", self.env_file.read_text())
+        self.prepare.assert_called_once()
+
+    def test_indeterminate_inventory_never_enables_a_build_or_mutates_toolchain(self):
+        self.read.side_effect = SystemExit("classified transport failure")
+        with self.assertRaises(SystemExit):
+            resolve.main()
+        self.prepare.assert_not_called()
+        self.assertFalse(self.env_file.exists())
+        self.assertFalse(self.outputs.exists())
+
+    def test_explicit_version_is_preserved_after_the_same_readiness_check(self):
+        with mock.patch.dict(os.environ, {"INPUT_BUILD_NUMBER": "200"}):
+            resolve.main()
+        self.read.assert_called_once()
+        self.assertIn("build_number=200\n", self.outputs.read_text())
+
+    def test_explicit_version_does_not_bypass_a_failed_store_read(self):
+        self.read.side_effect = SystemExit("classified auth failure")
+        with mock.patch.dict(os.environ, {"INPUT_BUILD_NUMBER": "200"}), self.assertRaises(SystemExit):
+            resolve.main()
+        self.prepare.assert_not_called()
+        self.assertFalse(self.outputs.exists())
+
+    def test_exhausted_version_space_does_not_overflow_or_fall_back(self):
+        self.read.return_value = PlayInventory(True, 2_100_000_000)
+        with self.assertRaises(SystemExit):
+            resolve.main()
+        self.assertFalse(self.outputs.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.66
+1.0.67

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.66",
+  "version": "1.0.67",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -431,7 +431,7 @@ jobs:
       # the action autoupdates on consumers while this file does not, and the
       # flag and its safety net must never be split across that boundary.
       - name: Install Google Play preflight dependencies
-        if: ${{ steps.mode.outputs.mode == 'local' }}
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.android.outputs.play-api-ready == '' }}
         shell: bash
         run: python3 -m pip install --disable-pip-version-check 'google-auth>=2.40,<3' 'requests>=2.32,<3'
       - name: Check Google Play API readiness
@@ -441,7 +441,15 @@ jobs:
         env:
           PACKAGE_NAME: ${{ steps.android.outputs.package-name }}
           SERVICE_ACCOUNT: ${{ steps.android.outputs.play-service-account }}
+          EARLY_READINESS: ${{ steps.android.outputs.play-api-ready }}
         run: |
+          # Current actions verify readiness before compiling. Older action copies
+          # have no output, so retain their standalone preflight compatibility.
+          case "$EARLY_READINESS" in
+            true|false) echo "ready=$EARLY_READINESS" >> "$GITHUB_OUTPUT"; exit 0 ;;
+            '') ;;
+            *) echo "::error::Invalid Android readiness output"; exit 1 ;;
+          esac
           python3 .github/actions/android-app/scripts/play_preflight.py \
             --package "$PACKAGE_NAME" \
             --service-account "$SERVICE_ACCOUNT"