gowalk-cicd 1.0.68 → 1.0.70

package/CLAUDE.md

@@ -135,6 +135,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   localization, global activation and builds run through the existing owned relay.
   The helper's bootstrap and command modes require only Python's standard library;
   importing the Google API client must not become an unprotected bootstrap prerequisite.
+- Flutter setup scopes `SEGMENT_DOWNLOAD_TIMEOUT_MINS=1` to the composite action's optional
+  SDK/pub cache restores. This bounds each cache segment, not the whole cache or SDK download.
+  A cache timeout becomes a cache miss; normal proxied SDK setup remains mandatory and its
+  errors still fail the job. Never use `continue-on-error` or a timeout around all SDK setup
+  to hide an optional cache failure. Do not alter cache keys or disable caches as part of
+  this timeout handling.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and
   supplies it to Compose after the generated `.env`; never print its content.

package/README.md

@@ -26,6 +26,12 @@ are unaffected.
 
 Re-run the same command anytime to pull the latest version.
 
+Flutter's optional SDK and pub cache restores have a one-minute timeout per
+download segment. A slow segment becomes a cache miss and normal SDK setup
+continues through the assigned Google proxy; SDK setup errors still fail the
+job. This bounds individual cache segments, not the total cache or SDK download,
+and keeps existing cache keys and the successful restore/save behavior.
+
 ## Flutter web release
 
 The conditional `deploy-web.yml` workflow runs on changes to Flutter source,

package/action/.daemux-version

@@ -1 +1 @@
-1.0.68
+1.0.70

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.68
+1.0.70

package/android-action/action.yml

@@ -121,7 +121,8 @@ runs:
         -- bash --noprofile --norc -e -o pipefail {0}
       run: |
         if [ -d test ]; then
-          flutter test
+          # Apply only loopback exceptions after the shell's proxy wrapper; retain the exit for SDK traffic.
+          env no_proxy=localhost,127.0.0.1,::1 NO_PROXY=localhost,127.0.0.1,::1 flutter test --no-pub
         else
           echo "No test/ directory; skipping flutter test."
         fi

package/android-action/scripts/fixtures/flutter_test_loopback.dart

@@ -0,0 +1,58 @@
+// Owned sockets only: exercise Dart's real HTTP/WebSocket proxy behavior under the CI wrapper.
+import 'dart:convert';
+import 'dart:io';
+
+Future<void> serve(HttpRequest request) async {
+  if (WebSocketTransformer.isUpgradeRequest(request)) {
+    final socket = await WebSocketTransformer.upgrade(request);
+    socket.listen(socket.add);
+  } else {
+    request.response.write('owned-loopback');
+    await request.response.close();
+  }
+}
+
+void checkProviderRoutes() {
+  final expected = 'PROXY ${Uri.parse(Platform.environment['HTTPS_PROXY']!).authority}';
+  for (final host in ['storage.googleapis.com', 'pub.dev', 'oauth2.googleapis.com',
+                     'firebaseappcheck.googleapis.com', 'api.appstoreconnect.apple.com']) {
+    if (HttpClient.findProxyFromEnvironment(Uri.parse('https://$host/a')) != expected) {
+      throw StateError('provider route bypassed');
+    }
+  }
+}
+
+Future<void> main(List<String> args) async {
+  if (args.isEmpty || args.first != 'test' || !args.contains('--no-pub')) {
+    throw StateError('the rendered command must skip repeated dependency resolution');
+  }
+  final server = await HttpServer.bind(InternetAddress.loopbackIPv4, 0);
+  server.listen(serve);
+  final client = HttpClient()..connectionTimeout = const Duration(seconds: 3);
+  WebSocket? socket;
+  try {
+    checkProviderRoutes();
+    socket = await WebSocket.connect('ws://127.0.0.1:${server.port}/socket')
+        .timeout(const Duration(seconds: 3));
+    socket.add('owned-frame');
+    if (await socket.first.timeout(const Duration(seconds: 3)) != 'owned-frame') {
+      throw StateError('local frame was not echoed');
+    }
+    final local = await (await client.getUrl(Uri.parse('http://127.0.0.1:${server.port}/http'))).close();
+    if (await local.transform(utf8.decoder).join() != 'owned-loopback') {
+      throw StateError('local HTTP reached the exit');
+    }
+    final remote = await (await client.getUrl(Uri.parse('http://unresolvable.invalid/pub'))).close();
+    if (await remote.transform(utf8.decoder).join() != 'through pinned proxy') {
+      throw StateError('external HTTP did not reach the owned exit');
+    }
+    print(jsonEncode({'ok': true, 'loopback': ['http', 'websocket'], 'external': 'assigned_proxy'}));
+  } catch (error) {
+    print(jsonEncode({'ok': false, 'error': error.runtimeType.toString()}));
+    exitCode = 7;
+  } finally {
+    await socket?.close();
+    client.close(force: true);
+    await server.close(force: true);
+  }
+}

package/android-action/scripts/test_flutter_test_loopback.py

@@ -0,0 +1,73 @@
+"""The rendered Flutter test step keeps external proxying while its owned sockets stay local."""
+import json
+import os
+from pathlib import Path
+import shlex
+import subprocess
+import tempfile
+import unittest
+
+import yaml
+
+from test_jvm_proxy_relay import upstream
+
+ROOT = Path(__file__).resolve().parents[2]
+DART = os.environ.get("DART_SDK_BIN", "")
+STEP = next(step for step in yaml.safe_load((ROOT / "android-action/action.yml").read_text())["runs"]["steps"]
+            if step["name"] == "Test Flutter app")
+LOOPBACK = "env no_proxy=localhost,127.0.0.1,::1 NO_PROXY=localhost,127.0.0.1,::1 "
+
+
+def run_step(step, *, without_exception=False):
+    """Run the real wrapper and rendered shell, substituting only a socket-owning Dart probe for Flutter."""
+    with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
+        cwd = Path(directory)
+        (cwd / "test").mkdir()
+        (cwd / "test/probe_test.dart").write_text("// owned fixture\n")
+        subprocess.run(["git", "init", "-q", directory], check=True)
+        subprocess.run(["git", "add", "test"], cwd=cwd, check=True)
+        probe = ROOT / "android-action/scripts/fixtures/flutter_test_loopback.dart"
+        flutter = cwd / "flutter"
+        flutter.write_text(f'#!/bin/sh\nexec {shlex.quote(DART)} --disable-dart-dev {shlex.quote(str(probe))} "$@"\n')
+        flutter.chmod(0o700)
+        script = cwd / "step.sh"
+        run = step["run"].replace(LOOPBACK, "") if without_exception else step["run"]
+        script.write_text(run)
+        command = step["shell"].replace("${{ github.action_path }}", str(ROOT / "android-action"))
+        command = shlex.split(command.replace("{0}", str(script)))
+        env = {**os.environ, "GOOGLE_STORE_PROXY_URL": proxy, "PATH": str(cwd) + os.pathsep + os.environ["PATH"],
+               "NO_PROXY": "*", "no_proxy": "*", "HTTPS_PROXY": "http://wrong.invalid:1"}
+        result = subprocess.run(command, cwd=cwd, env=env, capture_output=True, text=True, timeout=15)
+    return result, seen
+
+
+class FlutterLoopbackTests(unittest.TestCase):
+    def test_exception_is_command_scoped_inside_the_validated_wrapper(self):
+        self.assertIn("play_store_proxy.py -- bash", STEP["shell"])
+        command = next(line.strip() for line in STEP["run"].splitlines() if line.strip().startswith("env "))
+        self.assertEqual(shlex.split(command), ["env", "no_proxy=localhost,127.0.0.1,::1",
+                                              "NO_PROXY=localhost,127.0.0.1,::1", "flutter", "test", "--no-pub"])
+        self.assertNotIn("env", STEP)
+        self.assertNotRegex(STEP["run"], r"(?:unset|env\s+-u)")
+
+    @unittest.skipUnless(DART and Path(DART).is_file(), "set DART_SDK_BIN to an installed native Dart executable")
+    def test_real_dart_http_and_websocket_survive_while_external_http_uses_the_exit(self):
+        result, seen = run_step(STEP)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        self.assertEqual(json.loads(result.stdout),
+                         {"ok": True, "loopback": ["http", "websocket"], "external": "assigned_proxy"})
+        self.assertEqual([(method, url) for method, url, _auth in seen],
+                         [("GET", "http://unresolvable.invalid/pub")])
+        self.assertNotIn("fixture-pass", result.stdout + result.stderr)
+
+    @unittest.skipUnless(DART and Path(DART).is_file(), "set DART_SDK_BIN to an installed native Dart executable")
+    def test_original_empty_bypass_routes_the_websocket_to_the_exit_and_fails(self):
+        result, seen = run_step(STEP, without_exception=True)
+        self.assertEqual(result.returncode, 7, result.stdout + result.stderr)
+        self.assertEqual(json.loads(result.stdout), {"ok": False, "error": "WebSocketException"})
+        self.assertEqual(len(seen), 1)
+        self.assertRegex(seen[0][1], r"^http://127\.0\.0\.1:\d+/socket$")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.68
+1.0.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.68",
+  "version": "1.0.70",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-web.yml

@@ -34,6 +34,8 @@ jobs:
         shell: bash
         run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
       - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        env:
+          SEGMENT_DOWNLOAD_TIMEOUT_MINS: "1"
         with:
           channel: stable
           cache: true

package/templates/deploy.yml

@@ -84,6 +84,9 @@ jobs:
       - name: Set up Flutter
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        env:
+          # Optional SDK/pub cache segments must finish promptly; normal SDK setup still fails on errors.
+          SEGMENT_DOWNLOAD_TIMEOUT_MINS: "1"
         with:
           channel: stable
           cache: true
@@ -339,6 +342,8 @@ jobs:
       - name: Set up Flutter
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
         uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        env:
+          SEGMENT_DOWNLOAD_TIMEOUT_MINS: "1"
         with:
           channel: stable
           cache: true