gowalk-cicd 1.0.67 → 1.0.68

package/CLAUDE.md

@@ -128,6 +128,13 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Crashlytics Buildtools reads them first and rejects authenticated proxy URLs. HTTPS is tunneled
   without TLS interception; no upstream failure may fall back to the destination.
   The wrapper disables Gradle daemons and closes its relay when the command ends.
+- Flutter bootstrap is part of that boundary: before the Flutter setup action,
+  `play_store_proxy.py --bootstrap-env` validates the Google account pin and writes
+  both proxy/bypass spellings to the private job environment without console output.
+  SDK manifest/archive curl requests use that pin. Subsequent pub, analysis, tests,
+  localization, global activation and builds run through the existing owned relay.
+  The helper's bootstrap and command modes require only Python's standard library;
+  importing the Google API client must not become an unprotected bootstrap prerequisite.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and
   supplies it to Compose after the generated `.env`; never print its content.

package/README.md

@@ -634,6 +634,10 @@ metadata and binary transfer. Provision `APPLE_STORE_PROXY_URL` and
 `GOOGLE_STORE_PROXY_URL` as encrypted repository secrets before deployment. A missing
 proxy refuses provider calls; there is no direct fallback. Refresh existing workflow
 files with the released installer while preserving application-specific build inputs.
+The Google pin also covers Flutter SDK manifest/archive downloads and early `pub`
+operations in iOS, Android and web workflows. Bootstrap validates it before SDK setup;
+subsequent Dart and JVM operations use the same owned relay as release builds. A fork
+without the repository secret cannot start provider downloads through these workflows.
 The Apple uploader retains `apple-upload-<run>-<attempt>` receipts with IPA SHA-256,
 upload ID and processing readback, and resumes matching bytes after interruption.
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.67
+1.0.68

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.67
+1.0.68

package/android-action/action.yml

@@ -83,7 +83,9 @@ runs:
     # Missing dependencies or an indeterminate store read must fail here; they are
     # not evidence of a new package with no existing version codes.
     - name: Install Play API dependencies
-      shell: bash
+      shell: >-
+        python3 ${{ github.action_path }}/scripts/play_store_proxy.py
+        -- bash --noprofile --norc -e -o pipefail {0}
       run: python3 -m pip install --disable-pip-version-check -q 'google-auth>=2.40,<3' 'requests>=2.32,<3'
 
     - name: Resolve Android app and credentials
@@ -98,19 +100,25 @@ runs:
     # --- Flutter --------------------------------------------------------
     - name: Get Flutter dependencies
       if: ${{ steps.config.outputs.project_kind == 'flutter' }}
-      shell: bash
+      shell: >-
+        python3 ${{ github.action_path }}/scripts/play_store_proxy.py
+        -- bash --noprofile --norc -e -o pipefail {0}
       run: flutter pub get
 
     - name: Analyze Flutter app
       if: ${{ steps.config.outputs.project_kind == 'flutter' && inputs.run-tests == 'true' }}
-      shell: bash
+      shell: >-
+        python3 ${{ github.action_path }}/scripts/play_store_proxy.py
+        -- bash --noprofile --norc -e -o pipefail {0}
       run: flutter analyze
 
     # `flutter test` hard-fails with "Test directory \"test\" not found" when a repo
     # has no tests, which is not a real failure. Skip instead of blowing up the deploy.
     - name: Test Flutter app
       if: ${{ steps.config.outputs.project_kind == 'flutter' && inputs.run-tests == 'true' }}
-      shell: bash
+      shell: >-
+        python3 ${{ github.action_path }}/scripts/play_store_proxy.py
+        -- bash --noprofile --norc -e -o pipefail {0}
       run: |
         if [ -d test ]; then
           flutter test

package/android-action/scripts/play_store_proxy.py

@@ -1,6 +1,6 @@
 """Google CI transport uses only the account-pinned proxy, including OAuth exchanges.
 
-Three entry points, all from the one validated ``GOOGLE_STORE_PROXY_URL``:
+Four entry points, all from the one validated ``GOOGLE_STORE_PROXY_URL``:
 
 * ``python3 play_store_proxy.py`` refuses a missing or malformed proxy.
 * ``python3 play_store_proxy.py -- <command …>`` runs a build tool with the explicit
@@ -10,6 +10,8 @@ Three entry points, all from the one validated ``GOOGLE_STORE_PROXY_URL``:
 * ``python3 play_store_proxy.py --github-env`` clears the lower-case ambient bypass
   (``no_proxy``) for the rest of the job, so a JavaScript upload step that can only
   carry upper-case ``env`` keys cannot be bypassed by a runner's ambient value.
+* ``python3 play_store_proxy.py --bootstrap-env`` protects the curl-based Flutter
+  SDK setup through its private job environment, before Python dependencies exist.
 """
 from __future__ import annotations
 
@@ -18,16 +20,16 @@ import subprocess
 import sys
 from urllib.parse import urlsplit
 
-import requests
-
 LOWERCASE_BYPASS = ("no_proxy",)
+BOOTSTRAP_VARIABLES = ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy", "NO_PROXY", "no_proxy")
 
 
 def proxy_url() -> str:
     value = os.environ.get("GOOGLE_STORE_PROXY_URL", "").strip()
     try:
         parsed = urlsplit(value)
-        valid = parsed.scheme in {"http", "https"} and parsed.hostname and parsed.port
+        valid = (parsed.scheme in {"http", "https"} and parsed.hostname and parsed.port
+                 and not any(char in value for char in "\r\n\0"))
     except ValueError:
         valid = False
     if not valid:
@@ -41,8 +43,10 @@ def environment() -> dict[str, str]:
             "http_proxy": value, "https_proxy": value, "NO_PROXY": "", "no_proxy": ""}
 
 
-def session() -> requests.Session:
+def session():
     value = proxy_url()
+    import requests
+
     client = requests.Session()
     client.trust_env = False
     client.proxies = {"http": value, "https": value}
@@ -72,14 +76,31 @@ def clear_github_env_bypass(path: str | None = None) -> list[str]:
     return lines
 
 
+def bootstrap_github_env() -> None:
+    """Protect curl-based SDK setup before Python dependencies or a JVM exist.
+
+    GITHUB_ENV is a runner-owned environment file, never console output. Dart
+    and JVM commands still use ``--`` and its credential-free owned relay.
+    """
+    env = environment()
+    target = os.environ.get("GITHUB_ENV", "")
+    if not target:
+        raise SystemExit("GITHUB_ENV is not set; run this inside a GitHub Actions step")
+    with open(target, "a", encoding="utf-8") as handle:
+        handle.writelines(f"{name}={env[name]}\n" for name in BOOTSTRAP_VARIABLES)
+
+
 def main(args: list[str]) -> int:
+    if args == ["--bootstrap-env"]:
+        bootstrap_github_env()
+        return 0
     if args[:1] == ["--github-env"]:
         clear_github_env_bypass()
         return 0
     if args[:1] == ["--"]:
         return run(args[1:])
     if args:
-        raise SystemExit("usage: play_store_proxy.py [--github-env | -- <command …>]")
+        raise SystemExit("usage: play_store_proxy.py [--bootstrap-env | --github-env | -- <command …>]")
     proxy_url()
     return 0
 

package/android-action/scripts/test_google_bootstrap_proxy.py

@@ -0,0 +1,77 @@
+"""SDK bootstrap and real curl/Dart clients cannot silently use direct transport."""
+import base64
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+import play_store_proxy
+from test_jvm_proxy_relay import upstream
+
+SCRIPT = Path(play_store_proxy.__file__).resolve()
+DART = os.environ.get("DART_SDK_BIN", "")
+
+
+class BootstrapTests(unittest.TestCase):
+    def test_bootstrap_has_no_python_dependency_and_curl_uses_the_pinned_exit(self):
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+            target = Path(directory) / "github.env"
+            env = {**os.environ, "GOOGLE_STORE_PROXY_URL": proxy, "GITHUB_ENV": str(target),
+                   "https_proxy": "http://127.0.0.1:1", "no_proxy": "*", "NO_PROXY": "*"}
+            result = subprocess.run([sys.executable, "-S", str(SCRIPT), "--bootstrap-env"],
+                                    env=env, capture_output=True, text=True, timeout=10)
+            self.assertEqual((result.returncode, result.stdout, result.stderr), (0, "", ""))
+            env.update(line.split("=", 1) for line in target.read_text().splitlines())
+            result = subprocess.run(["curl", "--fail", "--silent", "--show-error", "--max-time", "5",
+                                     "http://unresolvable.invalid/flutter-sdk"],
+                                    env=env, capture_output=True, text=True, timeout=10)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout, "through pinned proxy")
+        auth = "Basic " + base64.b64encode(b"fixture-user:fixture-pass").decode()
+        self.assertEqual(seen, [("GET", "http://unresolvable.invalid/flutter-sdk", auth)])
+        self.assertNotIn("fixture-pass", result.stderr)
+
+    def test_missing_malformed_or_injected_proxy_refuses_before_creating_bootstrap_environment(self):
+        with tempfile.TemporaryDirectory() as directory:
+            target = Path(directory) / "github.env"
+            for proxy in ("", "private-malformed-value", "http://assigned.test:12\nNO_PROXY=*"):
+                env = {**os.environ, "GOOGLE_STORE_PROXY_URL": proxy, "GITHUB_ENV": str(target)}
+                result = subprocess.run([sys.executable, "-S", str(SCRIPT), "--bootstrap-env"],
+                                        env=env, capture_output=True, text=True, timeout=10)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertFalse(target.exists())
+                self.assertNotIn(proxy or "never-matches", result.stderr)
+
+    def test_command_wrapper_also_runs_before_requests_is_installed(self):
+        env = {**os.environ, "GOOGLE_STORE_PROXY_URL": "http://127.0.0.1:1"}
+        result = subprocess.run([sys.executable, "-S", str(SCRIPT), "--", sys.executable, "-c", "pass"],
+                                env=env, capture_output=True, text=True, timeout=10)
+        self.assertEqual((result.returncode, result.stdout, result.stderr), (0, "", ""))
+
+    @unittest.skipUnless(DART and Path(DART).is_file(), "set DART_SDK_BIN to an installed native Dart executable")
+    def test_actual_dart_http_client_uses_the_relay_and_rejects_invalid_tls(self):
+        source = ("import 'dart:io'; import 'dart:convert'; "
+                  "Future<void> main(List<String> args) async { var c=HttpClient(); "
+                  "try { var r=await (await c.getUrl(Uri.parse(args[0]))).close(); "
+                  "stdout.write(await r.transform(utf8.decoder).join()); } "
+                  "catch (_) { exitCode=7; } finally { c.close(force:true); } }")
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+            script = Path(directory) / "probe.dart"
+            script.write_text(source)
+            for scheme, expected in (("http", 0), ("https", 7)):
+                env = {"GOOGLE_STORE_PROXY_URL": proxy, "NO_PROXY": "*", "no_proxy": "*"}
+                with mock.patch.dict(os.environ, env):
+                    result = subprocess.run([sys.executable, str(SCRIPT), "--", DART, "--disable-dart-dev",
+                                             str(script), f"{scheme}://unresolvable.invalid/pub"],
+                                            env=os.environ, capture_output=True, text=True, timeout=20)
+                self.assertEqual(result.returncode, expected, result.stderr)
+                self.assertNotIn("fixture-pass", result.stdout + result.stderr)
+            self.assertEqual([(method, url) for method, url, _auth in seen], [
+                ("GET", "http://unresolvable.invalid/pub"), ("CONNECT", "unresolvable.invalid:443")])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_google_bootstrap_wiring.py

@@ -0,0 +1,50 @@
+"""Every distributed Flutter bootstrap enters the shared protected transport first."""
+from pathlib import Path
+import re
+import unittest
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+class BootstrapWiringTests(unittest.TestCase):
+    def test_each_flutter_sdk_setup_has_a_prior_mandatory_account_guard(self):
+        checked = 0
+        for name in ("deploy.yml", "deploy-web.yml"):
+            workflow = yaml.safe_load((ROOT / "templates" / name).read_text())
+            for job in workflow["jobs"].values():
+                steps = job.get("steps", [])
+                for index, step in enumerate(steps):
+                    if not step.get("uses", "").startswith("subosito/flutter-action@"):
+                        continue
+                    checked += 1
+                    guard = steps[index - 1]
+                    self.assertEqual(guard.get("if"), step.get("if"))
+                    self.assertEqual(job["env"]["GOOGLE_STORE_PROXY_URL"],
+                                     "${{ secrets.GOOGLE_STORE_PROXY_URL }}")
+                    self.assertTrue(guard["run"].endswith("play_store_proxy.py --bootstrap-env"))
+                    self.assertNotIn("continue-on-error", guard)
+        self.assertEqual(checked, 3)
+
+    def test_remaining_flutter_commands_run_inside_the_owned_relay(self):
+        groups = []
+        for name in ("deploy.yml", "deploy-web.yml"):
+            workflow = yaml.safe_load((ROOT / "templates" / name).read_text())
+            groups.extend(job.get("steps", []) for job in workflow["jobs"].values())
+        groups.append(yaml.safe_load((ROOT / "android-action/action.yml").read_text())["runs"]["steps"])
+        checked = 0
+        for steps in groups:
+            for step in steps:
+                run = step.get("run", "")
+                if not re.search(r"\b(?:flutter (?:pub|analyze|test|build|gen-l10n)|dart pub)\b", run):
+                    continue
+                if 'play_store_proxy.py" --' in run:
+                    continue
+                checked += 1
+                self.assertIn("play_store_proxy.py -- bash", step.get("shell", ""), step.get("name"))
+        self.assertEqual(checked, 6)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_store_proxy.py

@@ -4,6 +4,7 @@ from pathlib import Path
 import sys
 import unittest
 from unittest import mock
+import requests
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import play_store_proxy
@@ -12,7 +13,7 @@ import play_store_proxy
 class PlayProxyTests(unittest.TestCase):
     def test_missing_proxy_never_constructs_a_direct_session(self):
         with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": ""}), \
-                mock.patch.object(play_store_proxy.requests, "Session") as session:
+                mock.patch.object(requests, "Session") as session:
             with self.assertRaises(SystemExit):
                 play_store_proxy.session()
             session.assert_not_called()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.67
+1.0.68

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.67",
+  "version": "1.0.68",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-web.yml

@@ -26,8 +26,13 @@ jobs:
     name: Flutter Web Artifact
     runs-on: ubuntu-24.04
     timeout-minutes: 20
+    env:
+      GOOGLE_STORE_PROXY_URL: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Require the Google proxy before Flutter SDK setup
+        shell: bash
+        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
       - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
           channel: stable
@@ -45,7 +50,9 @@ jobs:
           git config --global \
             url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
       - name: Build Flutter web release
-        shell: bash
+        shell: >-
+          python3 .github/actions/android-app/scripts/play_store_proxy.py
+          -- bash --noprofile --norc -e -o pipefail {0}
         run: |
           flutter pub get
           if [ -f l10n.yaml ]; then flutter gen-l10n; fi

package/templates/deploy.yml

@@ -77,6 +77,10 @@ jobs:
           else
             echo "enabled=false" >> "$GITHUB_OUTPUT"
           fi
+      - name: Require the Google proxy before Flutter SDK setup
+        if: ${{ steps.flutter.outputs.enabled == 'true' }}
+        shell: bash
+        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
       - name: Set up Flutter
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
@@ -113,7 +117,9 @@ jobs:
           echo "Configured authenticated github.com remotes for pub."
       - name: Prepare Flutter iOS project
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
-        shell: bash
+        shell: >-
+          python3 .github/actions/android-app/scripts/play_store_proxy.py
+          -- bash --noprofile --norc -e -o pipefail {0}
         env:
           ONBOARDING_PUBLIC_ORIGIN: ${{ vars.ONBOARDING_PUBLIC_ORIGIN }}
         run: |
@@ -326,6 +332,10 @@ jobs:
           distribution: temurin
           java-version: ${{ steps.jdk.outputs.version }}
           cache: gradle
+      - name: Require the Google proxy before Flutter SDK setup
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
+        shell: bash
+        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
       - name: Set up Flutter
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
@@ -393,7 +403,9 @@ jobs:
       # before anything analyses or compiles them. No-op for apps without l10n.
       - name: Generate localizations
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
-        shell: bash
+        shell: >-
+          python3 .github/actions/android-app/scripts/play_store_proxy.py
+          -- bash --noprofile --norc -e -o pipefail {0}
         run: |
           if [ -f l10n.yaml ]; then
             flutter pub get