gowalk-cicd 1.0.7 → 1.0.9

package/README.md

@@ -206,15 +206,23 @@ Provisioning profile "CI-com.example.app" doesn't include the App Attest capabil
 
 Before creating a profile, the action reads the target's
 `CODE_SIGN_ENTITLEMENTS` plist and enables the matching capabilities on the App
-ID — Push Notifications, App Attest, Associated Domains, Sign in with Apple,
-HealthKit, SiriKit, NFC, HomeKit, network extensions and the other plain
-on/off toggles. If it had to turn anything on, it regenerates the profile
-rather than reusing the cached one, which predates the change.
-
-Capabilities that carry values an entitlements file cannot supply — App Groups,
-iCloud containers, Apple Pay merchant IDs, Wallet pass types, Data Protection —
-are **not** enabled automatically. The action emits a `::warning::` naming what
-it saw and leaves those for you to configure in the Apple Developer portal.
+ID — Push Notifications, Associated Domains, HealthKit, SiriKit, HomeKit,
+network extensions and the other plain on/off toggles. Whenever the App ID was
+missing something it regenerates the profile rather than reusing the cached
+one, which was issued before the capability existed.
+
+Two classes of capability are **not** enabled automatically, and each gets a
+`::warning::` naming what was seen:
+
+- **Values the action cannot infer** — App Groups, iCloud containers, Apple Pay
+  merchant IDs, Wallet pass types, Data Protection. Configure these on the App
+  ID yourself.
+- **App Attest** — a real App ID capability in the developer portal, but absent
+  from the ASC API's `capabilityType` enum, so *no* API call can turn it on.
+  Any app using Firebase App Check's `AppAttestProvider` must have App Attest
+  ticked once by hand under **Certificates, Identifiers & Profiles → Identifiers
+  → <your App ID>**. Until then the archive fails with `Provisioning profile
+  "CI-<bundle>" doesn't include the App Attest capability`.
 
 ## AI metadata auto-fill
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.7
+1.0.9

package/action/scripts/capabilities.py

@@ -41,7 +41,6 @@ _API_FAILURES = (Exception, SystemExit)
 # capability at all.
 CAPABILITY_BY_ENTITLEMENT = {
     "aps-environment": "PUSH_NOTIFICATIONS",
-    "com.apple.developer.devicecheck.appattest-environment": "APP_ATTEST",
     "com.apple.developer.associated-domains": "ASSOCIATED_DOMAINS",
     "com.apple.developer.applesignin": "APPLE_ID_AUTH",
     "com.apple.developer.networking.wifi-info": "ACCESS_WIFI_INFORMATION",
@@ -66,6 +65,14 @@ CAPABILITY_BY_ENTITLEMENT = {
 # unambiguously. Enabling these blind would create a half-configured App ID,
 # so we say what is missing and stop.
 MANUAL_ENTITLEMENTS = {
+    # App Attest is a real App ID capability in the developer portal, but it is
+    # absent from the ASC API's capabilityType enum entirely — POSTing it
+    # returns 409 ENTITY_ERROR.ATTRIBUTE.TYPE listing the valid values, which
+    # do not include it. There is no API to turn this one on.
+    "com.apple.developer.devicecheck.appattest-environment": (
+        "App Attest, which the App Store Connect API cannot enable — tick it "
+        "on the App ID under Certificates, Identifiers & Profiles"
+    ),
     "com.apple.security.application-groups": "App Groups",
     "com.apple.developer.icloud-container-identifiers": "iCloud",
     "com.apple.developer.icloud-services": "iCloud",
@@ -118,6 +125,7 @@ def enabled_capabilities(token: str, bundle_pk: str) -> set[str]:
         capability = (item.get("attributes") or {}).get("capabilityType")
         if capability:
             found.add(capability)
+    print(f"App ID {bundle_pk} capabilities: {', '.join(sorted(found)) or '(none)'}")
     return found
 
 
@@ -132,7 +140,6 @@ def enable_capability(token: str, bundle_pk: str, capability: str) -> bool:
         }
     }
     try:
-        # 409 means another writer got there first — the desired end state.
         response = request(
             "POST", "/bundleIdCapabilities", token,
             json_body=body, allow_status={200, 201, 409},
@@ -141,6 +148,17 @@ def enable_capability(token: str, bundle_pk: str, capability: str) -> bool:
         print(f"::warning::could not enable {capability}: {exc!r}")
         return False
     if response.status_code == 409:
+        # Could be "already on" — or Apple refusing outright, which reads
+        # identically from the status code alone. Surface the body: without it
+        # the run just reports a profile missing a capability we claimed to
+        # have enabled, and there is nothing in the log to explain why.
+        # Untruncated enough to show Apple's full list of valid capabilityType
+        # values, which is the only way to learn that a name is simply not
+        # API-manageable (see App Attest in MANUAL_ENTITLEMENTS).
+        print(
+            f"::warning::App Store Connect returned 409 for {capability}: "
+            f"{response.text[:2000]}"
+        )
         return False
     print(f"Enabled {capability} on the App ID")
     return True
@@ -149,9 +167,13 @@ def enable_capability(token: str, bundle_pk: str, capability: str) -> bool:
 def reconcile(token: str, bundle_pk: str, bundle_id: str, entitlement_keys: set[str]) -> bool:
     """Enable every simple capability the entitlements imply.
 
-    Returns True when something was actually turned on — the caller must then
-    regenerate the profile, because a cached one predates the change and still
-    lacks the capability.
+    Returns True when the caller must regenerate the profile — which is
+    whenever the App ID was missing something, NOT merely when a POST
+    succeeded. A cached profile was issued while the App ID lacked these, so
+    reusing it reproduces the same archive failure either way; regenerating at
+    least picks up the App ID's current state, and if the capability is still
+    absent the error comes from Apple describing the real problem rather than
+    from a stale cache.
     """
     warn_about_manual_entitlements(entitlement_keys, bundle_id)
     wanted = required_capabilities(entitlement_keys)
@@ -164,9 +186,6 @@ def reconcile(token: str, bundle_pk: str, bundle_id: str, entitlement_keys: set[
         f"{bundle_id}: entitlements require {', '.join(sorted(missing))} "
         f"but the App ID does not have them; enabling"
     )
-    # List, not a generator: `any` short-circuits, and every missing capability
-    # must be attempted, not just up to the first success.
-    return any([
+    for capability in sorted(missing):
         enable_capability(token, bundle_pk, capability)
-        for capability in sorted(missing)
-    ])
+    return True

package/action/scripts/test_capabilities.py

@@ -19,6 +19,7 @@ import capabilities
 
 ENTITLEMENTS = {
     "aps-environment": "production",
+    "com.apple.developer.associated-domains": ["applinks:gowalk.example"],
     "com.apple.developer.devicecheck.appattest-environment": "production",
     "keychain-access-groups": ["$(AppIdentifierPrefix)com.gowalk.form"],
 }
@@ -46,12 +47,26 @@ class ReadEntitlementsTest(unittest.TestCase):
 
 class RequiredCapabilitiesTest(unittest.TestCase):
     def test_maps_only_known_toggles(self) -> None:
-        # keychain-access-groups needs no App ID capability at all.
+        # keychain-access-groups needs no App ID capability at all, and App
+        # Attest is not in the ASC API's capabilityType enum, so neither can
+        # produce a POST.
         self.assertEqual(
             capabilities.required_capabilities(set(ENTITLEMENTS)),
-            {"PUSH_NOTIFICATIONS", "APP_ATTEST"},
+            {"PUSH_NOTIFICATIONS", "ASSOCIATED_DOMAINS"},
         )
 
+    def test_app_attest_is_reported_not_attempted(self) -> None:
+        key = "com.apple.developer.devicecheck.appattest-environment"
+
+        self.assertNotIn(key, capabilities.CAPABILITY_BY_ENTITLEMENT)
+        self.assertIn(key, capabilities.MANUAL_ENTITLEMENTS)
+
+        with mock.patch("builtins.print") as printed:
+            capabilities.warn_about_manual_entitlements({key}, "com.gowalk.form")
+
+        messages = [c.args[0] for c in printed.call_args_list if c.args]
+        self.assertTrue(any("App Attest" in m for m in messages), messages)
+
     def test_ignores_entitlements_with_no_capability(self) -> None:
         self.assertEqual(
             capabilities.required_capabilities({"get-task-allow", "com.apple.security.get-task-allow"}),
@@ -78,13 +93,13 @@ class ReconcileTest(unittest.TestCase):
             changed = capabilities.reconcile("tok", "PK", "com.gowalk.form", set(ENTITLEMENTS))
 
         self.assertTrue(changed)
-        self.assertEqual(posted, ["APP_ATTEST"])
+        self.assertEqual(posted, ["ASSOCIATED_DOMAINS"])
 
     def test_no_op_when_the_app_id_already_has_everything(self) -> None:
         listed = {
             "data": [
                 {"attributes": {"capabilityType": "PUSH_NOTIFICATIONS"}},
-                {"attributes": {"capabilityType": "APP_ATTEST"}},
+                {"attributes": {"capabilityType": "ASSOCIATED_DOMAINS"}},
             ]
         }
         with mock.patch.object(capabilities, "get_json", return_value=listed), \
@@ -107,39 +122,62 @@ class ReconcileTest(unittest.TestCase):
                 mock.patch.object(capabilities, "request", side_effect=fake_request):
             capabilities.reconcile("tok", "PK", "com.gowalk.form", set(ENTITLEMENTS))
 
-        self.assertEqual(sorted(posted), ["APP_ATTEST", "PUSH_NOTIFICATIONS"])
+        self.assertEqual(sorted(posted), ["ASSOCIATED_DOMAINS", "PUSH_NOTIFICATIONS"])
 
-    def test_existing_capability_race_is_not_a_change(self) -> None:
+    def test_regenerates_even_when_the_capability_could_not_be_enabled(self) -> None:
+        # A 409 (or any refusal) still means the cached profile was issued
+        # while the App ID lacked the capability. Reusing it reproduces the
+        # archive failure and hides Apple's real error behind a stale cache.
+        response = self._response(409)
+        response.text = '{"errors":[{"detail":"nope"}]}'
         with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
-                mock.patch.object(capabilities, "request", return_value=self._response(409)):
+                mock.patch.object(capabilities, "request", return_value=response):
             changed = capabilities.reconcile(
                 "tok", "PK", "com.gowalk.form",
-                {"com.apple.developer.devicecheck.appattest-environment"},
+                {"com.apple.developer.associated-domains"},
             )
 
-        self.assertFalse(changed)
+        self.assertTrue(changed)
+
+    def test_surfaces_the_409_body(self) -> None:
+        response = self._response(409)
+        response.text = '{"errors":[{"detail":"capability is not modifiable"}]}'
+        with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
+                mock.patch.object(capabilities, "request", return_value=response), \
+                mock.patch("builtins.print") as printed:
+            capabilities.reconcile(
+                "tok", "PK", "com.gowalk.form",
+                {"com.apple.developer.associated-domains"},
+            )
+
+        messages = [c.args[0] for c in printed.call_args_list if c.args]
+        self.assertTrue(
+            any("capability is not modifiable" in m for m in messages), messages
+        )
 
     def test_api_failure_does_not_raise(self) -> None:
         with mock.patch.object(capabilities, "get_json", return_value={"data": []}), \
                 mock.patch.object(capabilities, "request", side_effect=RuntimeError("boom")):
             changed = capabilities.reconcile(
                 "tok", "PK", "com.gowalk.form",
-                {"com.apple.developer.devicecheck.appattest-environment"},
+                {"com.apple.developer.associated-domains"},
             )
 
-        self.assertFalse(changed)
+        self.assertTrue(changed)
 
     def test_systemexit_from_asc_does_not_kill_signing(self) -> None:
         # asc_common.request raises SystemExit, not Exception, so a bare
         # `except Exception` would let an Apple 4xx abort the whole run.
+        # An unreadable App ID is also unknown state, so the profile is
+        # regenerated rather than trusted from cache.
         with mock.patch.object(capabilities, "get_json", side_effect=SystemExit("400")), \
                 mock.patch.object(capabilities, "request", side_effect=SystemExit("400")):
             changed = capabilities.reconcile(
                 "tok", "PK", "com.gowalk.form",
-                {"com.apple.developer.devicecheck.appattest-environment"},
+                {"com.apple.developer.associated-domains"},
             )
 
-        self.assertFalse(changed)
+        self.assertTrue(changed)
 
     def test_capability_listing_sends_no_limit_parameter(self) -> None:
         # /bundleIds/{id}/bundleIdCapabilities rejects `limit` with

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.7
+1.0.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {