gowalk-cicd 1.0.66 → 1.0.68

package/CLAUDE.md

@@ -128,6 +128,13 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Crashlytics Buildtools reads them first and rejects authenticated proxy URLs. HTTPS is tunneled
   without TLS interception; no upstream failure may fall back to the destination.
   The wrapper disables Gradle daemons and closes its relay when the command ends.
+- Flutter bootstrap is part of that boundary: before the Flutter setup action,
+  `play_store_proxy.py --bootstrap-env` validates the Google account pin and writes
+  both proxy/bypass spellings to the private job environment without console output.
+  SDK manifest/archive curl requests use that pin. Subsequent pub, analysis, tests,
+  localization, global activation and builds run through the existing owned relay.
+  The helper's bootstrap and command modes require only Python's standard library;
+  importing the Google API client must not become an unprotected bootstrap prerequisite.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and
   supplies it to Compose after the generated `.env`; never print its content.
@@ -192,9 +199,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   delivery request. This requires no human handoff. A green CI run alone is not
   evidence that the deferred symbols reached Firebase. Android retains its Dart
   symbols and uploads them before the store bundle, using the configured proxy.
-- Play readiness retries only OAuth transport and cleanup of its known edit. Never
-  replay an ambiguous `edits.insert`; error annotations carry safe phase/category
-  evidence and the edit ID when cleanup remains, without raw provider exceptions.
+- Play readiness and AAB/APK version inventory share one prebuild edit. Retry OAuth
+  transport, inventory reads and cleanup of that known edit; never replay an ambiguous
+  `edits.insert`. Only an explicit package-404 allows first-release defaults; failed
+  inventory is not an empty account. The action exposes `play-api-ready` so current
+  workflows skip the redundant postbuild check. Error annotations carry safe
+  phase/category evidence and any cleanup edit ID without raw provider exceptions.
 - The iOS action reads every script and prompt from the snapshot it takes of
   itself in its first step (`$SWIFT_APP_ACTION`, under `RUNNER_TEMP`), never
   from `${{ github.action_path }}` after that step. The plugin self-update

package/README.md

@@ -298,13 +298,23 @@ and prompt from that copy.
 
 ### Google Play upload retry
 
+Android resolves Play readiness and existing AAB/APK version codes together, in one
+owned edit before compilation or Crashlytics work. Auth, permission, transport and
+invalid inventory failures stop there; they never select a fallback version as though
+the package were new. A positively absent package (edit creation returns 404) keeps
+the first-release path: build and retain the signed AAB for the app session's console
+upload. Explicit version pins are preserved and still require the readiness check.
+The action exports `play-api-ready`; current workflows consume that result without
+another store call. A newer workflow with an older action copy retains the original
+standalone preflight. Refreshing the workflow alongside actions removes that late call.
+
 The API readiness preflight retries transient OAuth transport failures and cleanup of
 its own known edit up to three times, with one- and two-second delays. It never
 replays an edit creation whose outcome is unknown. Every request keeps the assigned
 Google proxy; an absent edit after cleanup is already closed. Exhausted recovery
 emits the `play_preflight_failed` error annotation with schema
-`gowalk-cicd/play-preflight-failure.v1`, phase (`oauth_refresh`, `edit_create` or
-`edit_cleanup`), classified code and attempt count. Provider bodies, credential
+`gowalk-cicd/play-preflight-failure.v1`, phase (`oauth_refresh`, `edit_create`,
+`version_inventory` or `edit_cleanup`), classified code and attempt count. Provider bodies, credential
 values and raw network errors are omitted. A cleanup failure also records the known
 edit ID and `cleanup_required: true` so recovery targets that edit.
 
@@ -624,6 +634,10 @@ metadata and binary transfer. Provision `APPLE_STORE_PROXY_URL` and
 `GOOGLE_STORE_PROXY_URL` as encrypted repository secrets before deployment. A missing
 proxy refuses provider calls; there is no direct fallback. Refresh existing workflow
 files with the released installer while preserving application-specific build inputs.
+The Google pin also covers Flutter SDK manifest/archive downloads and early `pub`
+operations in iOS, Android and web workflows. Bootstrap validates it before SDK setup;
+subsequent Dart and JVM operations use the same owned relay as release builds. A fork
+without the repository secret cannot start provider downloads through these workflows.
 The Apple uploader retains `apple-upload-<run>-<attempt>` receipts with IPA SHA-256,
 upload ID and processing readback, and resumes matching bytes after interruption.
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.66
+1.0.68

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.66
+1.0.68

package/android-action/action.yml

@@ -63,6 +63,9 @@ outputs:
   play-service-account:
     description: Path to the discovered Google Play service-account JSON
     value: ${{ steps.config.outputs.service_account }}
+  play-api-ready:
+    description: Prebuild readiness from the same owned edit used to read existing version codes
+    value: ${{ steps.config.outputs.play_api_ready }}
   project-kind:
     description: Detected build system — `flutter` or `gradle`
     value: ${{ steps.config.outputs.project_kind }}
@@ -76,12 +79,14 @@ outputs:
 runs:
   using: composite
   steps:
-    # resolve_android.py asks Google Play for the highest versionCode already
-    # uploaded, so it needs these. Installing them here (rather than relying on the
-    # caller) keeps the action self-contained.
+    # Resolve readiness and highest versionCode together before any compilation.
+    # Missing dependencies or an indeterminate store read must fail here; they are
+    # not evidence of a new package with no existing version codes.
     - name: Install Play API dependencies
-      shell: bash
-      run: python3 -m pip install --disable-pip-version-check -q 'google-auth>=2.40,<3' 'requests>=2.32,<3' || true
+      shell: >-
+        python3 ${{ github.action_path }}/scripts/play_store_proxy.py
+        -- bash --noprofile --norc -e -o pipefail {0}
+      run: python3 -m pip install --disable-pip-version-check -q 'google-auth>=2.40,<3' 'requests>=2.32,<3'
 
     - name: Resolve Android app and credentials
       id: config
@@ -95,19 +100,25 @@ runs:
     # --- Flutter --------------------------------------------------------
     - name: Get Flutter dependencies
       if: ${{ steps.config.outputs.project_kind == 'flutter' }}
-      shell: bash
+      shell: >-
+        python3 ${{ github.action_path }}/scripts/play_store_proxy.py
+        -- bash --noprofile --norc -e -o pipefail {0}
       run: flutter pub get
 
     - name: Analyze Flutter app
       if: ${{ steps.config.outputs.project_kind == 'flutter' && inputs.run-tests == 'true' }}
-      shell: bash
+      shell: >-
+        python3 ${{ github.action_path }}/scripts/play_store_proxy.py
+        -- bash --noprofile --norc -e -o pipefail {0}
       run: flutter analyze
 
     # `flutter test` hard-fails with "Test directory \"test\" not found" when a repo
     # has no tests, which is not a real failure. Skip instead of blowing up the deploy.
     - name: Test Flutter app
       if: ${{ steps.config.outputs.project_kind == 'flutter' && inputs.run-tests == 'true' }}
-      shell: bash
+      shell: >-
+        python3 ${{ github.action_path }}/scripts/play_store_proxy.py
+        -- bash --noprofile --norc -e -o pipefail {0}
       run: |
         if [ -d test ]; then
           flutter test

package/android-action/scripts/play_inventory.py

@@ -0,0 +1,50 @@
+"""Resolve readiness and version inventory in one owned, proxy-bound Play edit."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+
+from play_preflight import opened_edit
+from play_preflight_transport import call, fail
+from play_store_proxy import session
+
+
+@dataclass(frozen=True)
+class PlayInventory:
+    ready: bool
+    highest_version: int | None
+
+
+def version_codes(response, kind: str) -> list[int]:
+    try:
+        payload = response.json()
+        if not isinstance(payload, dict) or "error" in payload:
+            raise ValueError("invalid inventory")
+        rows = payload.get(kind, [])
+        if not isinstance(rows, list):
+            raise ValueError("invalid inventory")
+        values = []
+        for row in rows:
+            raw = row["versionCode"]
+            if isinstance(raw, bool) or not isinstance(raw, (int, str)):
+                raise ValueError("invalid version")
+            value = int(raw)
+            if not 1 <= value <= 2_100_000_000:
+                raise ValueError("invalid version")
+            values.append(value)
+        return values
+    except (ValueError, TypeError, KeyError):
+        fail("version_inventory", "invalid_response", 1)
+
+
+def read_inventory(package: str, account: Path) -> PlayInventory:
+    with session() as client, opened_edit(client, package, account) as edit:
+        if edit is None:
+            return PlayInventory(ready=False, highest_version=None)
+        url, headers = edit
+        codes = []
+        for kind in ("bundles", "apks"):
+            response = call("version_inventory", lambda: client.get(f"{url}/{kind}", headers=headers, timeout=30),
+                            retry=True, accepted=(200,))
+            codes.extend(version_codes(response, kind))
+        return PlayInventory(ready=True, highest_version=max(codes) if codes else None)

package/android-action/scripts/play_preflight.py

@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import argparse
+from contextlib import contextmanager
 from functools import partial
 import json
 import os
@@ -37,6 +38,16 @@ def main() -> None:
 
 
 def check_ready(client, package: str, account: Path) -> None:
+    with opened_edit(client, package, account) as edit:
+        ready = edit is not None
+    write_ready(ready)
+    if ready:
+        print("Google Play package is ready for automated uploads")
+
+
+@contextmanager
+def opened_edit(client, package: str, account: Path):
+    """Own one preflight edit; callers may perform reads before its verified cleanup."""
     credentials = service_account.Credentials.from_service_account_file(
         account, scopes=[SCOPE]
     )
@@ -48,12 +59,12 @@ def check_ready(client, package: str, account: Path) -> None:
     response = call("edit_create", lambda: client.post(url, headers=headers, json={}, timeout=30),
                     accepted=(200, 404))
     if response.status_code == 404:
-        write_ready(False)
         print(
             "::warning::Google Play package is not API-ready. The app session must upload the "
-            "retained android-first-release artifact through its assigned Play Console and "
-            "verify the resulting release before retrying API delivery."
+            "signed Android artifact retained by this build through its assigned Play Console "
+            "and verify the resulting release before retrying API delivery."
         )
+        yield None
         return
     try:
         edit_id = json.loads(response.text)["id"]
@@ -62,10 +73,11 @@ def check_ready(client, package: str, account: Path) -> None:
     except (ValueError, TypeError, KeyError):
         fail("edit_create", "invalid_response", 1)
     delete_url = f"{url}/{quote(edit_id, safe='')}"
-    call("edit_cleanup", lambda: client.delete(delete_url, headers=headers, timeout=30),
-         retry=True, edit_id=edit_id, accepted=(200, 204, 404))
-    write_ready(True)
-    print("Google Play package is ready for automated uploads")
+    try:
+        yield (delete_url, headers)
+    finally:
+        call("edit_cleanup", lambda: client.delete(delete_url, headers=headers, timeout=30),
+             retry=True, edit_id=edit_id, accepted=(200, 204, 404))
 
 
 if __name__ == "__main__":

package/android-action/scripts/play_store_proxy.py

@@ -1,6 +1,6 @@
 """Google CI transport uses only the account-pinned proxy, including OAuth exchanges.
 
-Three entry points, all from the one validated ``GOOGLE_STORE_PROXY_URL``:
+Four entry points, all from the one validated ``GOOGLE_STORE_PROXY_URL``:
 
 * ``python3 play_store_proxy.py`` refuses a missing or malformed proxy.
 * ``python3 play_store_proxy.py -- <command …>`` runs a build tool with the explicit
@@ -10,6 +10,8 @@ Three entry points, all from the one validated ``GOOGLE_STORE_PROXY_URL``:
 * ``python3 play_store_proxy.py --github-env`` clears the lower-case ambient bypass
   (``no_proxy``) for the rest of the job, so a JavaScript upload step that can only
   carry upper-case ``env`` keys cannot be bypassed by a runner's ambient value.
+* ``python3 play_store_proxy.py --bootstrap-env`` protects the curl-based Flutter
+  SDK setup through its private job environment, before Python dependencies exist.
 """
 from __future__ import annotations
 
@@ -18,16 +20,16 @@ import subprocess
 import sys
 from urllib.parse import urlsplit
 
-import requests
-
 LOWERCASE_BYPASS = ("no_proxy",)
+BOOTSTRAP_VARIABLES = ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy", "NO_PROXY", "no_proxy")
 
 
 def proxy_url() -> str:
     value = os.environ.get("GOOGLE_STORE_PROXY_URL", "").strip()
     try:
         parsed = urlsplit(value)
-        valid = parsed.scheme in {"http", "https"} and parsed.hostname and parsed.port
+        valid = (parsed.scheme in {"http", "https"} and parsed.hostname and parsed.port
+                 and not any(char in value for char in "\r\n\0"))
     except ValueError:
         valid = False
     if not valid:
@@ -41,8 +43,10 @@ def environment() -> dict[str, str]:
             "http_proxy": value, "https_proxy": value, "NO_PROXY": "", "no_proxy": ""}
 
 
-def session() -> requests.Session:
+def session():
     value = proxy_url()
+    import requests
+
     client = requests.Session()
     client.trust_env = False
     client.proxies = {"http": value, "https": value}
@@ -72,14 +76,31 @@ def clear_github_env_bypass(path: str | None = None) -> list[str]:
     return lines
 
 
+def bootstrap_github_env() -> None:
+    """Protect curl-based SDK setup before Python dependencies or a JVM exist.
+
+    GITHUB_ENV is a runner-owned environment file, never console output. Dart
+    and JVM commands still use ``--`` and its credential-free owned relay.
+    """
+    env = environment()
+    target = os.environ.get("GITHUB_ENV", "")
+    if not target:
+        raise SystemExit("GITHUB_ENV is not set; run this inside a GitHub Actions step")
+    with open(target, "a", encoding="utf-8") as handle:
+        handle.writelines(f"{name}={env[name]}\n" for name in BOOTSTRAP_VARIABLES)
+
+
 def main(args: list[str]) -> int:
+    if args == ["--bootstrap-env"]:
+        bootstrap_github_env()
+        return 0
     if args[:1] == ["--github-env"]:
         clear_github_env_bypass()
         return 0
     if args[:1] == ["--"]:
         return run(args[1:])
     if args:
-        raise SystemExit("usage: play_store_proxy.py [--github-env | -- <command …>]")
+        raise SystemExit("usage: play_store_proxy.py [--bootstrap-env | --github-env | -- <command …>]")
     proxy_url()
     return 0
 

package/android-action/scripts/resolve_android.py

@@ -9,7 +9,7 @@ import sys
 from pathlib import Path
 
 import gradle_wrapper
-from play_store_proxy import session
+from play_inventory import read_inventory
 from android_config import (
     ConfigError,
     detect_package_name,
@@ -36,74 +36,13 @@ def resolve_build_number(raw: str) -> int:
     return number
 
 
-def highest_play_version_code(package_name: str, service_account: Path) -> int | None:
-    """Highest versionCode Google Play already holds for this package, or None.
-
-    Best-effort: any failure (offline, no permission, app not yet created) returns
-    None so the caller falls back to GITHUB_RUN_NUMBER.
-    """
-    client = session()
-    try:
-        import google.auth.transport.requests  # noqa: PLC0415
-        import requests  # noqa: PLC0415
-        from google.oauth2 import service_account as gsa  # noqa: PLC0415
-
-        creds = gsa.Credentials.from_service_account_file(
-            str(service_account),
-            scopes=["https://www.googleapis.com/auth/androidpublisher"],
-        )
-        creds.refresh(google.auth.transport.requests.Request(session=client))
-        base = "https://androidpublisher.googleapis.com/androidpublisher/v3"
-        headers = {"Authorization": f"Bearer {creds.token}"}
-
-        edit = client.post(
-            f"{base}/applications/{package_name}/edits", headers=headers, timeout=60
-        )
-        edit.raise_for_status()
-        edit_id = edit.json()["id"]
-        try:
-            listed = client.get(
-                f"{base}/applications/{package_name}/edits/{edit_id}/bundles",
-                headers=headers,
-                timeout=60,
-            )
-            listed.raise_for_status()
-            codes = [
-                int(b["versionCode"])
-                for b in listed.json().get("bundles", [])
-                if b.get("versionCode") is not None
-            ]
-        finally:
-            client.delete(
-                f"{base}/applications/{package_name}/edits/{edit_id}",
-                headers=headers,
-                timeout=60,
-            )
-        return max(codes) if codes else None
-    except Exception as exc:  # noqa: BLE001 - never fail the build over this
-        print("::warning::Could not read existing Play versionCodes through the configured proxy; "
-              f"falling back to GITHUB_RUN_NUMBER")
-        return None
-
-
-def auto_build_number(package_name: str, service_account: Path) -> int:
-    """versionCode to use when the caller did not pin one.
-
-    GITHUB_RUN_NUMBER alone is wrong: it restarts at 1 on a freshly-onboarded repo,
-    so it collides with versionCodes Play already holds and every upload is rejected
-    ("Version code N has already been used"). Take whichever is higher: the run
-    number, or one past the highest code Play knows about.
-    """
+def auto_build_number(highest: int | None) -> int:
+    """Choose the next version only from a successfully read Play inventory."""
     run_number = resolve_build_number(os.environ.get("GITHUB_RUN_NUMBER", "1"))
-    highest = highest_play_version_code(package_name, service_account)
-    if highest is None:
-        return run_number
-    candidate = max(run_number, highest + 1)
+    candidate = resolve_build_number(str(max(run_number, (highest or 0) + 1)))
     if candidate != run_number:
-        print(
-            f"Play already holds versionCode {highest}; using {candidate} "
-            f"instead of GITHUB_RUN_NUMBER {run_number}"
-        )
+        print(f"Play already holds versionCode {highest}; using {candidate} "
+              f"instead of GITHUB_RUN_NUMBER {run_number}")
     return candidate
 
 
@@ -148,10 +87,19 @@ def flutter_root() -> Path | None:
     return Path(binary).resolve().parent.parent
 
 
+def prepare_flutter_toolchain(workspace: Path) -> None:
+    # Flutter stable can raise its Gradle/AGP/Kotlin floor. Repair the ephemeral
+    # checkout only after the store inventory has been read successfully.
+    root = flutter_root()
+    if root is None:
+        print("::warning::Flutter SDK not found; skipping the build toolchain check")
+    else:
+        for message in gradle_wrapper.ensure_toolchain(workspace, root):
+            print(message)
+
+
 def main() -> None:
     workspace = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
-    env_path = Path(os.environ["GITHUB_ENV"])
-    output_path = Path(os.environ["GITHUB_OUTPUT"])
     gradle_root = ""
     gradle_module = ""
     try:
@@ -162,11 +110,12 @@ def main() -> None:
         package_name = os.environ.get("INPUT_PACKAGE_NAME") or detect_package_name(
             workspace, project.build_file if project else None
         )
+        inventory = read_inventory(package_name, service_account)
         pinned = os.environ.get("INPUT_BUILD_NUMBER") or ""
         if pinned:
             build_number = resolve_build_number(pinned)
         else:
-            build_number = auto_build_number(package_name, service_account)
+            build_number = auto_build_number(inventory.highest_version)
         if project is not None:
             gradle_root = str(project.root)
             gradle_module = project.module
@@ -174,45 +123,43 @@ def main() -> None:
                 project, build_number, os.environ.get("INPUT_BUILD_NAME") or ""
             )
         else:
-            # Flutter refuses to apply its Gradle plugin when the project's
-            # Gradle, AGP or Kotlin plugin is older than the SDK's floor, and CI
-            # tracks `stable`, so those floors rise without the app changing.
-            # Raise them in the checkout rather than letting every app in the
-            # fleet break on Flutter's release day.
-            root = flutter_root()
-            if root is None:
-                print("::warning::Flutter SDK not found; skipping the build toolchain check")
-            else:
-                for message in gradle_wrapper.ensure_toolchain(workspace, root):
-                    print(message)
+            prepare_flutter_toolchain(workspace)
     except (ConfigError, KeyError, OSError) as exc:
         print(f"::error::{exc}")
         raise SystemExit(1) from exc
 
-    for secret in (signing.store_password, signing.key_password):
-        print(f"::add-mask::{secret}")
     values = {
         "ANDROID_PACKAGE_NAME": package_name,
         "ANDROID_BUILD_NUMBER": str(build_number),
         "ANDROID_SIGNING_PROPERTIES": str(signing.properties_path),
         "ANDROID_KEYSTORE_PATH": str(signing.keystore_path),
         "ANDROID_PLAY_SERVICE_ACCOUNT": str(service_account),
+        "ANDROID_PLAY_API_READY": "true" if inventory.ready else "false",
         "ANDROID_PROJECT_KIND": kind,
         "ANDROID_GRADLE_ROOT": gradle_root,
         "ANDROID_GRADLE_MODULE": gradle_module,
     }
+    write_config(values, signing)
+    print(f"Resolved {kind} Android package {package_name}, build {build_number}")
+
+
+def write_config(values: dict[str, str], signing) -> None:
+    env_path = Path(os.environ["GITHUB_ENV"])
+    output_path = Path(os.environ["GITHUB_OUTPUT"])
+    for secret in (signing.store_password, signing.key_password):
+        print(f"::add-mask::{secret}")
     for name, value in values.items():
         append_value(env_path, name, value)
-    for name, value in (
-        ("package_name", package_name),
-        ("service_account", str(service_account)),
-        ("build_number", str(build_number)),
-        ("project_kind", kind),
-        ("gradle_root", gradle_root),
-        ("gradle_module", gradle_module),
+    for name, source in (
+        ("package_name", "ANDROID_PACKAGE_NAME"),
+        ("service_account", "ANDROID_PLAY_SERVICE_ACCOUNT"),
+        ("build_number", "ANDROID_BUILD_NUMBER"),
+        ("play_api_ready", "ANDROID_PLAY_API_READY"),
+        ("project_kind", "ANDROID_PROJECT_KIND"),
+        ("gradle_root", "ANDROID_GRADLE_ROOT"),
+        ("gradle_module", "ANDROID_GRADLE_MODULE"),
     ):
-        append_value(output_path, name, value)
-    print(f"Resolved {kind} Android package {package_name}, build {build_number}")
+        append_value(output_path, name, values[source])
 
 
 if __name__ == "__main__":

package/android-action/scripts/test_android_config.py

@@ -265,30 +265,17 @@ class AutoBuildNumberTest(unittest.TestCase):
     def test_uses_play_high_water_mark_when_run_number_is_lower(self) -> None:
         import resolve_android
 
-        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=173):
-            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "1"}):
-                # A freshly-onboarded repo starts at run 1; Play already has 173.
-                self.assertEqual(
-                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
-                    174,
-                )
+        with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "1"}):
+            self.assertEqual(resolve_android.auto_build_number(173), 174)
 
     def test_uses_run_number_when_it_is_already_higher(self) -> None:
         import resolve_android
 
-        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=5):
-            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "42"}):
-                self.assertEqual(
-                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
-                    42,
-                )
+        with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "42"}):
+            self.assertEqual(resolve_android.auto_build_number(5), 42)
 
-    def test_falls_back_to_run_number_when_play_is_unreachable(self) -> None:
+    def test_uses_run_number_for_a_successfully_read_empty_inventory(self) -> None:
         import resolve_android
 
-        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=None):
-            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "7"}):
-                self.assertEqual(
-                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
-                    7,
-                )
+        with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "7"}):
+            self.assertEqual(resolve_android.auto_build_number(None), 7)

package/android-action/scripts/test_early_play_workflow.py

@@ -0,0 +1,77 @@
+"""Current actions avoid late store calls while older action copies remain compatible."""
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[2]
+ACTION = (ROOT / "android-action/action.yml").read_text()
+WORKFLOW = (ROOT / "templates/deploy.yml").read_text()
+
+
+def readiness_step() -> str:
+    start = WORKFLOW.index("      - name: Check Google Play API readiness")
+    finish = WORKFLOW.index("      # Play edits", start)
+    return WORKFLOW[start:finish]
+
+
+class EarlyPlayWorkflowTests(unittest.TestCase):
+    def run_step(self, readiness: str):
+        step = readiness_step().split("        run: |\n", 1)[1]
+        script = "\n".join(line[10:] for line in step.splitlines())
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            fake = root / "python3"
+            fake.write_text('#!/bin/sh\necho called >> "$TRACE"\necho ready=true >> "$GITHUB_OUTPUT"\n')
+            fake.chmod(0o700)
+            env = {**os.environ, "PATH": f"{root}:{os.environ['PATH']}", "EARLY_READINESS": readiness,
+                   "TRACE": str(root / "trace"), "GITHUB_OUTPUT": str(root / "output"),
+                   "PACKAGE_NAME": "com.example.app", "SERVICE_ACCOUNT": "fixture.json"}
+            result = subprocess.run(["bash", "-e", "-o", "pipefail", "-c", script], env=env,
+                                    capture_output=True, text=True, check=False)
+            output = (root / "output").read_text() if (root / "output").exists() else ""
+            return result, output, (root / "trace").exists()
+
+    def test_resolver_precedes_both_build_systems_and_dependency_failures_stop_it(self):
+        resolver = ACTION.index("- name: Resolve Android app and credentials")
+        for step in ("Get Flutter dependencies", "Analyze Flutter app", "Test Android app",
+                     "Build release Android App Bundle", "Upload Dart symbols to Crashlytics"):
+            self.assertLess(resolver, ACTION.index(f"- name: {step}"))
+        dependencies = ACTION[ACTION.index("- name: Install Play API dependencies"):resolver]
+        self.assertNotIn("|| true", dependencies)
+        self.assertIn("value: ${{ steps.config.outputs.play_api_ready }}", ACTION)
+
+    def test_verified_readiness_does_not_make_another_store_request(self):
+        result, output, called = self.run_step("true")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(output, "ready=true\n")
+        self.assertFalse(called)
+
+    def test_first_release_is_retained_and_false_readiness_only_skips_upload(self):
+        result, output, called = self.run_step("false")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(output, "ready=false\n")
+        self.assertFalse(called)
+        start = WORKFLOW.index("- name: Build and sign Android release")
+        end = WORKFLOW.index("- name: Install Google Play preflight dependencies", start)
+        self.assertNotIn("ready ==", WORKFLOW[start:end])
+        self.assertIn("- name: Retain signed Android App Bundle", WORKFLOW[start:end])
+        self.assertIn("steps.play.outputs.ready == 'true'", WORKFLOW)
+
+    def test_older_action_without_new_output_uses_original_cli_contract(self):
+        result, output, called = self.run_step("")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(output, "ready=true\n")
+        self.assertTrue(called)
+        self.assertRegex(readiness_step(), r'--package "\$PACKAGE_NAME"\s*\\\s*--service-account "\$SERVICE_ACCOUNT"')
+
+    def test_invalid_output_cannot_silently_skip_preflight(self):
+        result, output, called = self.run_step("unknown")
+        self.assertEqual(result.returncode, 1)
+        self.assertEqual(output, "")
+        self.assertFalse(called)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_google_bootstrap_proxy.py

@@ -0,0 +1,77 @@
+"""SDK bootstrap and real curl/Dart clients cannot silently use direct transport."""
+import base64
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+import play_store_proxy
+from test_jvm_proxy_relay import upstream
+
+SCRIPT = Path(play_store_proxy.__file__).resolve()
+DART = os.environ.get("DART_SDK_BIN", "")
+
+
+class BootstrapTests(unittest.TestCase):
+    def test_bootstrap_has_no_python_dependency_and_curl_uses_the_pinned_exit(self):
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+            target = Path(directory) / "github.env"
+            env = {**os.environ, "GOOGLE_STORE_PROXY_URL": proxy, "GITHUB_ENV": str(target),
+                   "https_proxy": "http://127.0.0.1:1", "no_proxy": "*", "NO_PROXY": "*"}
+            result = subprocess.run([sys.executable, "-S", str(SCRIPT), "--bootstrap-env"],
+                                    env=env, capture_output=True, text=True, timeout=10)
+            self.assertEqual((result.returncode, result.stdout, result.stderr), (0, "", ""))
+            env.update(line.split("=", 1) for line in target.read_text().splitlines())
+            result = subprocess.run(["curl", "--fail", "--silent", "--show-error", "--max-time", "5",
+                                     "http://unresolvable.invalid/flutter-sdk"],
+                                    env=env, capture_output=True, text=True, timeout=10)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout, "through pinned proxy")
+        auth = "Basic " + base64.b64encode(b"fixture-user:fixture-pass").decode()
+        self.assertEqual(seen, [("GET", "http://unresolvable.invalid/flutter-sdk", auth)])
+        self.assertNotIn("fixture-pass", result.stderr)
+
+    def test_missing_malformed_or_injected_proxy_refuses_before_creating_bootstrap_environment(self):
+        with tempfile.TemporaryDirectory() as directory:
+            target = Path(directory) / "github.env"
+            for proxy in ("", "private-malformed-value", "http://assigned.test:12\nNO_PROXY=*"):
+                env = {**os.environ, "GOOGLE_STORE_PROXY_URL": proxy, "GITHUB_ENV": str(target)}
+                result = subprocess.run([sys.executable, "-S", str(SCRIPT), "--bootstrap-env"],
+                                        env=env, capture_output=True, text=True, timeout=10)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertFalse(target.exists())
+                self.assertNotIn(proxy or "never-matches", result.stderr)
+
+    def test_command_wrapper_also_runs_before_requests_is_installed(self):
+        env = {**os.environ, "GOOGLE_STORE_PROXY_URL": "http://127.0.0.1:1"}
+        result = subprocess.run([sys.executable, "-S", str(SCRIPT), "--", sys.executable, "-c", "pass"],
+                                env=env, capture_output=True, text=True, timeout=10)
+        self.assertEqual((result.returncode, result.stdout, result.stderr), (0, "", ""))
+
+    @unittest.skipUnless(DART and Path(DART).is_file(), "set DART_SDK_BIN to an installed native Dart executable")
+    def test_actual_dart_http_client_uses_the_relay_and_rejects_invalid_tls(self):
+        source = ("import 'dart:io'; import 'dart:convert'; "
+                  "Future<void> main(List<String> args) async { var c=HttpClient(); "
+                  "try { var r=await (await c.getUrl(Uri.parse(args[0]))).close(); "
+                  "stdout.write(await r.transform(utf8.decoder).join()); } "
+                  "catch (_) { exitCode=7; } finally { c.close(force:true); } }")
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+            script = Path(directory) / "probe.dart"
+            script.write_text(source)
+            for scheme, expected in (("http", 0), ("https", 7)):
+                env = {"GOOGLE_STORE_PROXY_URL": proxy, "NO_PROXY": "*", "no_proxy": "*"}
+                with mock.patch.dict(os.environ, env):
+                    result = subprocess.run([sys.executable, str(SCRIPT), "--", DART, "--disable-dart-dev",
+                                             str(script), f"{scheme}://unresolvable.invalid/pub"],
+                                            env=os.environ, capture_output=True, text=True, timeout=20)
+                self.assertEqual(result.returncode, expected, result.stderr)
+                self.assertNotIn("fixture-pass", result.stdout + result.stderr)
+            self.assertEqual([(method, url) for method, url, _auth in seen], [
+                ("GET", "http://unresolvable.invalid/pub"), ("CONNECT", "unresolvable.invalid:443")])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_google_bootstrap_wiring.py

@@ -0,0 +1,50 @@
+"""Every distributed Flutter bootstrap enters the shared protected transport first."""
+from pathlib import Path
+import re
+import unittest
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+class BootstrapWiringTests(unittest.TestCase):
+    def test_each_flutter_sdk_setup_has_a_prior_mandatory_account_guard(self):
+        checked = 0
+        for name in ("deploy.yml", "deploy-web.yml"):
+            workflow = yaml.safe_load((ROOT / "templates" / name).read_text())
+            for job in workflow["jobs"].values():
+                steps = job.get("steps", [])
+                for index, step in enumerate(steps):
+                    if not step.get("uses", "").startswith("subosito/flutter-action@"):
+                        continue
+                    checked += 1
+                    guard = steps[index - 1]
+                    self.assertEqual(guard.get("if"), step.get("if"))
+                    self.assertEqual(job["env"]["GOOGLE_STORE_PROXY_URL"],
+                                     "${{ secrets.GOOGLE_STORE_PROXY_URL }}")
+                    self.assertTrue(guard["run"].endswith("play_store_proxy.py --bootstrap-env"))
+                    self.assertNotIn("continue-on-error", guard)
+        self.assertEqual(checked, 3)
+
+    def test_remaining_flutter_commands_run_inside_the_owned_relay(self):
+        groups = []
+        for name in ("deploy.yml", "deploy-web.yml"):
+            workflow = yaml.safe_load((ROOT / "templates" / name).read_text())
+            groups.extend(job.get("steps", []) for job in workflow["jobs"].values())
+        groups.append(yaml.safe_load((ROOT / "android-action/action.yml").read_text())["runs"]["steps"])
+        checked = 0
+        for steps in groups:
+            for step in steps:
+                run = step.get("run", "")
+                if not re.search(r"\b(?:flutter (?:pub|analyze|test|build|gen-l10n)|dart pub)\b", run):
+                    continue
+                if 'play_store_proxy.py" --' in run:
+                    continue
+                checked += 1
+                self.assertIn("play_store_proxy.py -- bash", step.get("shell", ""), step.get("name"))
+        self.assertEqual(checked, 6)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_inventory.py

@@ -0,0 +1,98 @@
+"""A single early edit verifies readiness and inventories AAB/APK version codes."""
+import io
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+import requests
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_inventory as inventory
+import play_preflight as preflight
+import play_preflight_transport as transport
+
+
+class PlayInventoryTests(unittest.TestCase):
+    def setUp(self):
+        self.client = mock.MagicMock()
+        self.client.__enter__.return_value = self.client
+        self.client.post.return_value = mock.Mock(status_code=200, text='{"id":"edit-123"}')
+        self.client.delete.return_value = mock.Mock(status_code=204)
+        self.client.get.side_effect = [mock.Mock(status_code=200, json=lambda: {"bundles": [{"versionCode": 41}]}),
+                                       mock.Mock(status_code=200, json=lambda: {"apks": [{"versionCode": 55}]})]
+        self.credentials = mock.Mock(token="private-token")
+        self.enterContext(mock.patch.object(preflight.service_account.Credentials,
+                                           "from_service_account_file", return_value=self.credentials))
+        self.enterContext(mock.patch.object(inventory, "session", return_value=self.client))
+        self.sleep = self.enterContext(mock.patch.object(transport.time, "sleep"))
+        self.output = self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def read(self):
+        return inventory.read_inventory("com.example.app", Path("account.json"))
+
+    def test_bundles_and_apks_share_one_edit_and_highest_code(self):
+        result = self.read()
+        self.assertTrue(result.ready)
+        self.assertEqual(result.highest_version, 55)
+        self.credentials.refresh.assert_called_once()
+        self.client.post.assert_called_once()
+        self.client.delete.assert_called_once()
+        self.assertEqual([c.args[0].rsplit("/", 1)[-1] for c in self.client.get.call_args_list], ["bundles", "apks"])
+
+    def test_positive_package_absence_skips_inventory_and_allows_first_artifact(self):
+        self.client.post.return_value.status_code = 404
+        self.assertEqual(self.read(), inventory.PlayInventory(False, None))
+        self.assertIn("assigned Play Console", self.output.getvalue())
+        self.client.get.assert_not_called()
+        self.client.delete.assert_not_called()
+
+    def test_successful_empty_inventory_is_distinct_from_package_absence(self):
+        self.client.get.side_effect = [mock.Mock(status_code=200, json=lambda: {}),
+                                       mock.Mock(status_code=200, json=lambda: {})]
+        self.assertEqual(self.read(), inventory.PlayInventory(True, None))
+        self.client.delete.assert_called_once()
+
+    def test_inventory_get_retry_keeps_the_same_edit(self):
+        good = mock.Mock(status_code=200, json=lambda: {})
+        self.client.get.side_effect = [requests.exceptions.ReadTimeout(), good, good]
+        self.assertTrue(self.read().ready)
+        self.assertEqual(self.client.get.call_count, 3)
+        self.client.post.assert_called_once()
+        self.client.delete.assert_called_once()
+
+    def test_permission_denial_is_fatal_and_closes_the_owned_edit(self):
+        self.client.get.side_effect = [mock.Mock(status_code=403, text="private-provider-body")]
+        with self.assertRaises(SystemExit) as caught:
+            self.read()
+        self.assertIn('"phase": "version_inventory"', str(caught.exception))
+        self.assertIn('"status": 403', str(caught.exception))
+        self.assertNotIn("private", str(caught.exception) + self.output.getvalue())
+        self.client.delete.assert_called_once()
+
+    def test_lost_edit_is_not_misclassified_as_absent_package(self):
+        self.client.get.side_effect = [mock.Mock(status_code=404)]
+        with self.assertRaises(SystemExit):
+            self.read()
+        self.client.post.assert_called_once()
+        self.client.delete.assert_called_once()
+
+    def test_invalid_inventory_is_fatal_and_cleanup_still_runs(self):
+        self.client.get.side_effect = [mock.Mock(status_code=200, json=lambda: {"bundles": [{"versionCode": "bad"}]})]
+        with self.assertRaises(SystemExit) as caught:
+            self.read()
+        self.assertIn('"code": "invalid_response"', str(caught.exception))
+        self.client.delete.assert_called_once()
+
+    def test_cleanup_failure_prevents_success_and_retains_its_edit_identifier(self):
+        self.client.delete.side_effect = requests.exceptions.ConnectionError("private-proxy")
+        with self.assertRaises(SystemExit) as caught:
+            self.read()
+        self.assertIn('"cleanup_required": true', str(caught.exception))
+        self.assertIn('"edit_id": "edit-123"', str(caught.exception))
+        self.client.post.assert_called_once()
+        self.assertEqual(self.client.delete.call_count, 3)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_store_proxy.py

@@ -4,6 +4,7 @@ from pathlib import Path
 import sys
 import unittest
 from unittest import mock
+import requests
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import play_store_proxy
@@ -12,7 +13,7 @@ import play_store_proxy
 class PlayProxyTests(unittest.TestCase):
     def test_missing_proxy_never_constructs_a_direct_session(self):
         with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": ""}), \
-                mock.patch.object(play_store_proxy.requests, "Session") as session:
+                mock.patch.object(requests, "Session") as session:
             with self.assertRaises(SystemExit):
                 play_store_proxy.session()
             session.assert_not_called()

package/android-action/scripts/test_resolve_play_readiness.py

@@ -0,0 +1,83 @@
+"""Store evidence must exist before configuration enables compilation or version writes."""
+import io
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import resolve_android as resolve
+from play_inventory import PlayInventory
+
+
+class ResolvePlayReadinessTests(unittest.TestCase):
+    def setUp(self):
+        self.root = Path(self.enterContext(tempfile.TemporaryDirectory())).resolve()
+        (self.root / "creds").mkdir()
+        (self.root / "pubspec.yaml").write_text("name: fixture\n")
+        app = self.root / "android/app"
+        app.mkdir(parents=True)
+        (app / "build.gradle").write_text('android { defaultConfig { applicationId "com.example.app" } }')
+        (self.root / "creds/key.jks").write_bytes(b"fixture")
+        (self.root / "creds/signing.properties").write_text(
+            "storeFile=key.jks\nstorePassword=fixture\nkeyPassword=fixture\nkeyAlias=fixture\n")
+        (self.root / "creds/account.json").write_text(json.dumps(
+            {"type": "service_account", "client_email": "fixture@example.invalid", "private_key": "fixture"}))
+        self.env_file, self.outputs = self.root / "env", self.root / "output"
+        self.enterContext(mock.patch.dict(os.environ, {"GITHUB_WORKSPACE": str(self.root),
+            "GITHUB_OUTPUT": str(self.outputs), "GITHUB_ENV": str(self.env_file), "GITHUB_RUN_NUMBER": "1",
+            "INPUT_BUILD_NUMBER": "", "INPUT_PACKAGE_NAME": "", "INPUT_BUILD_NAME": ""}))
+        self.read = self.enterContext(mock.patch.object(
+            resolve, "read_inventory", return_value=PlayInventory(True, 173)))
+        self.prepare = self.enterContext(mock.patch.object(resolve, "prepare_flutter_toolchain"))
+        self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def test_known_inventory_is_read_once_and_prevents_a_version_collision(self):
+        resolve.main()
+        self.read.assert_called_once_with("com.example.app", self.root / "creds/account.json")
+        self.assertIn("build_number=174\n", self.outputs.read_text())
+        self.assertIn("play_api_ready=true\n", self.outputs.read_text())
+        self.assertIn("ANDROID_PLAY_API_READY=true\n", self.env_file.read_text())
+        self.prepare.assert_called_once_with(self.root)
+
+    def test_absent_package_keeps_configuration_for_a_first_release_artifact(self):
+        self.read.return_value = PlayInventory(False, None)
+        resolve.main()
+        self.assertIn("build_number=1\n", self.outputs.read_text())
+        self.assertIn("play_api_ready=false\n", self.outputs.read_text())
+        self.assertIn("ANDROID_SIGNING_PROPERTIES=", self.env_file.read_text())
+        self.prepare.assert_called_once()
+
+    def test_indeterminate_inventory_never_enables_a_build_or_mutates_toolchain(self):
+        self.read.side_effect = SystemExit("classified transport failure")
+        with self.assertRaises(SystemExit):
+            resolve.main()
+        self.prepare.assert_not_called()
+        self.assertFalse(self.env_file.exists())
+        self.assertFalse(self.outputs.exists())
+
+    def test_explicit_version_is_preserved_after_the_same_readiness_check(self):
+        with mock.patch.dict(os.environ, {"INPUT_BUILD_NUMBER": "200"}):
+            resolve.main()
+        self.read.assert_called_once()
+        self.assertIn("build_number=200\n", self.outputs.read_text())
+
+    def test_explicit_version_does_not_bypass_a_failed_store_read(self):
+        self.read.side_effect = SystemExit("classified auth failure")
+        with mock.patch.dict(os.environ, {"INPUT_BUILD_NUMBER": "200"}), self.assertRaises(SystemExit):
+            resolve.main()
+        self.prepare.assert_not_called()
+        self.assertFalse(self.outputs.exists())
+
+    def test_exhausted_version_space_does_not_overflow_or_fall_back(self):
+        self.read.return_value = PlayInventory(True, 2_100_000_000)
+        with self.assertRaises(SystemExit):
+            resolve.main()
+        self.assertFalse(self.outputs.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.66
+1.0.68

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.66",
+  "version": "1.0.68",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-web.yml

@@ -26,8 +26,13 @@ jobs:
     name: Flutter Web Artifact
     runs-on: ubuntu-24.04
     timeout-minutes: 20
+    env:
+      GOOGLE_STORE_PROXY_URL: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Require the Google proxy before Flutter SDK setup
+        shell: bash
+        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
       - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
           channel: stable
@@ -45,7 +50,9 @@ jobs:
           git config --global \
             url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
       - name: Build Flutter web release
-        shell: bash
+        shell: >-
+          python3 .github/actions/android-app/scripts/play_store_proxy.py
+          -- bash --noprofile --norc -e -o pipefail {0}
         run: |
           flutter pub get
           if [ -f l10n.yaml ]; then flutter gen-l10n; fi

package/templates/deploy.yml

@@ -77,6 +77,10 @@ jobs:
           else
             echo "enabled=false" >> "$GITHUB_OUTPUT"
           fi
+      - name: Require the Google proxy before Flutter SDK setup
+        if: ${{ steps.flutter.outputs.enabled == 'true' }}
+        shell: bash
+        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
       - name: Set up Flutter
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
@@ -113,7 +117,9 @@ jobs:
           echo "Configured authenticated github.com remotes for pub."
       - name: Prepare Flutter iOS project
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
-        shell: bash
+        shell: >-
+          python3 .github/actions/android-app/scripts/play_store_proxy.py
+          -- bash --noprofile --norc -e -o pipefail {0}
         env:
           ONBOARDING_PUBLIC_ORIGIN: ${{ vars.ONBOARDING_PUBLIC_ORIGIN }}
         run: |
@@ -326,6 +332,10 @@ jobs:
           distribution: temurin
           java-version: ${{ steps.jdk.outputs.version }}
           cache: gradle
+      - name: Require the Google proxy before Flutter SDK setup
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
+        shell: bash
+        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
       - name: Set up Flutter
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
@@ -393,7 +403,9 @@ jobs:
       # before anything analyses or compiles them. No-op for apps without l10n.
       - name: Generate localizations
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
-        shell: bash
+        shell: >-
+          python3 .github/actions/android-app/scripts/play_store_proxy.py
+          -- bash --noprofile --norc -e -o pipefail {0}
         run: |
           if [ -f l10n.yaml ]; then
             flutter pub get
@@ -431,7 +443,7 @@ jobs:
       # the action autoupdates on consumers while this file does not, and the
       # flag and its safety net must never be split across that boundary.
       - name: Install Google Play preflight dependencies
-        if: ${{ steps.mode.outputs.mode == 'local' }}
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.android.outputs.play-api-ready == '' }}
         shell: bash
         run: python3 -m pip install --disable-pip-version-check 'google-auth>=2.40,<3' 'requests>=2.32,<3'
       - name: Check Google Play API readiness
@@ -441,7 +453,15 @@ jobs:
         env:
           PACKAGE_NAME: ${{ steps.android.outputs.package-name }}
           SERVICE_ACCOUNT: ${{ steps.android.outputs.play-service-account }}
+          EARLY_READINESS: ${{ steps.android.outputs.play-api-ready }}
         run: |
+          # Current actions verify readiness before compiling. Older action copies
+          # have no output, so retain their standalone preflight compatibility.
+          case "$EARLY_READINESS" in
+            true|false) echo "ready=$EARLY_READINESS" >> "$GITHUB_OUTPUT"; exit 0 ;;
+            '') ;;
+            *) echo "::error::Invalid Android readiness output"; exit 1 ;;
+          esac
           python3 .github/actions/android-app/scripts/play_preflight.py \
             --package "$PACKAGE_NAME" \
             --service-account "$SERVICE_ACCOUNT"