gowalk-cicd 1.0.70 → 1.0.71

package/CLAUDE.md

@@ -135,6 +135,16 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   localization, global activation and builds run through the existing owned relay.
   The helper's bootstrap and command modes require only Python's standard library;
   importing the Google API client must not become an unprotected bootstrap prerequisite.
+- `android-action/flutter-setup/` owns Flutter setup. It forwards the official action's
+  inputs/cache identities while isolating restore/save from provider transport. Its step-local
+  `NODE_OPTIONS` preloader (`android-action/scripts/cache_*.cjs`) also protects CocoaPods cache
+  steps and verifies the exact pinned Actions cache entrypoint bytes and HTTPS
+  GitHub cache/Azure blob destinations before removing proxy variables in that cache process.
+  Unknown code or origins refuse; SDK setup, non-cache children and later steps retain their
+  proxy requirement. Never export this scope through `GITHUB_ENV` or add cache domains to
+  `NO_PROXY`. The preloader snapshot under `RUNNER_TEMP` also covers official post/save after
+  consumer autoupdate changes the action directory. The installer delivers this development
+  tooling for native iOS repositories too; it does not require an Android app.
 - Flutter setup scopes `SEGMENT_DOWNLOAD_TIMEOUT_MINS=1` to the composite action's optional
   SDK/pub cache restores. This bounds each cache segment, not the whole cache or SDK download.
   A cache timeout becomes a cache miss; normal proxied SDK setup remains mandatory and its

package/action/.daemux-version

@@ -1 +1 @@
-1.0.70
+1.0.71

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.70
+1.0.71

package/android-action/flutter-setup/action.yml

@@ -0,0 +1,149 @@
+name: Set up proxied Flutter
+description: Set up Flutter with protected provider transport and isolated official GitHub caches
+inputs:
+  channel:
+    description: The Flutter build release channel
+    required: false
+    default: stable
+  flutter-version:
+    description: The Flutter version to make available on the path
+    required: false
+    default: ''
+  flutter-version-file:
+    description: The pubspec.yaml or FVM config file with exact Flutter version defined
+    required: false
+    default: ''
+  architecture:
+    description: The architecture of Flutter SDK executable (x64 or arm64)
+    required: false
+    default: ${{ runner.arch }}
+  cache:
+    description: Cache the Flutter SDK
+    required: false
+    default: 'false'
+  cache-key:
+    description: Identifier for the Flutter SDK cache
+    required: false
+    default: ''
+  cache-path:
+    description: Flutter SDK cache path
+    required: false
+    default: ''
+  pub-cache:
+    description: Cache the Dart pub dependencies
+    required: false
+    default: ''
+  pub-cache-key:
+    description: Identifier for the Dart .pub-cache cache
+    required: false
+    default: ''
+  pub-cache-path:
+    description: Flutter pub cache path
+    required: false
+    default: default
+  dry-run:
+    description: If true, get outputs but do not install Flutter
+    required: false
+    default: 'false'
+  git-source:
+    description: Git clone source
+    required: false
+    default: https://github.com/flutter/flutter.git
+outputs:
+  CHANNEL:
+    value: ${{ steps.flutter-action.outputs.CHANNEL }}
+    description: The selected Flutter release channel
+  VERSION:
+    value: ${{ steps.flutter-action.outputs.VERSION }}
+    description: The selected Flutter version
+  ARCHITECTURE:
+    value: ${{ steps.flutter-action.outputs.ARCHITECTURE }}
+    description: The selected Flutter CPU architecture
+  CACHE-KEY:
+    value: ${{ steps.flutter-action.outputs.CACHE-KEY }}
+    description: Key used to cache the Flutter SDK
+  CACHE-PATH:
+    value: ${{ steps.flutter-action.outputs.CACHE-PATH }}
+    description: Path to Flutter SDK
+  PUB-CACHE-KEY:
+    value: ${{ steps.flutter-action.outputs.PUB-CACHE-KEY }}
+    description: Key used to cache the pub dependencies
+  PUB-CACHE-PATH:
+    value: ${{ steps.flutter-action.outputs.PUB-CACHE-PATH }}
+    description: Path to pub cache
+  GIT_SOURCE:
+    value: ${{ steps.flutter-action.outputs.GIT_SOURCE }}
+    description: Git source of Flutter SDK repository to clone
+  CACHE-HIT:
+    value: ${{ steps.cache-flutter.outputs.cache-hit }}
+    description: '`true` if the flutter cache was a hit'
+  PUB-CACHE-HIT:
+    value: ${{ steps.cache-pub.outputs.cache-hit }}
+    description: '`true` if the pub cache was a hit'
+runs:
+  using: composite
+  steps:
+  - name: Require provider transport
+    shell: bash
+    run: |
+      python3 "$GITHUB_ACTION_PATH/../scripts/play_store_proxy.py" --bootstrap-env
+  - name: Retain the cache process scope
+    id: scope
+    if: ${{ inputs.cache == 'true' || inputs.pub-cache == 'true' }}
+    continue-on-error: true
+    shell: bash
+    run: node "$GITHUB_ACTION_PATH/../scripts/cache_scope.cjs" --snapshot
+  - name: Resolve Flutter release and cache identities
+    id: flutter-action
+    uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
+    with:
+      channel: ${{ inputs.channel }}
+      flutter-version: ${{ inputs.flutter-version }}
+      flutter-version-file: ${{ inputs.flutter-version-file }}
+      architecture: ${{ inputs.architecture }}
+      cache: 'false'
+      cache-key: ${{ inputs.cache-key }}
+      cache-path: ${{ inputs.cache-path }}
+      pub-cache: 'false'
+      pub-cache-key: ${{ inputs.pub-cache-key }}
+      pub-cache-path: ${{ inputs.pub-cache-path }}
+      dry-run: 'true'
+      git-source: ${{ inputs.git-source }}
+  - name: Cache Flutter
+    id: cache-flutter
+    if: ${{ inputs.cache == 'true' }}
+    uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25
+    continue-on-error: true
+    env:
+      NODE_OPTIONS: --require "${{ steps.scope.outputs.preloader }}"
+      SEGMENT_DOWNLOAD_TIMEOUT_MINS: '1'
+    with:
+      path: ${{ steps.flutter-action.outputs.CACHE-PATH }}
+      key: ${{ steps.flutter-action.outputs.CACHE-KEY }}
+  - name: Cache pub dependencies
+    id: cache-pub
+    if: ${{ (inputs.pub-cache == '' && inputs.cache == 'true') || inputs.pub-cache == 'true' }}
+    uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25
+    continue-on-error: true
+    env:
+      NODE_OPTIONS: --require "${{ steps.scope.outputs.preloader }}"
+      SEGMENT_DOWNLOAD_TIMEOUT_MINS: '1'
+    with:
+      path: ${{ steps.flutter-action.outputs.PUB-CACHE-PATH }}
+      key: ${{ steps.flutter-action.outputs.PUB-CACHE-KEY }}-${{ hashFiles('**/pubspec.lock') }}
+  - name: Install or reuse the resolved Flutter SDK
+    if: ${{ inputs.dry-run != 'true' }}
+    uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
+    with:
+      channel: ${{ steps.flutter-action.outputs.CHANNEL }}
+      flutter-version: ${{ steps.flutter-action.outputs.VERSION }}
+      flutter-version-file: ''
+      architecture: ${{ steps.flutter-action.outputs.ARCHITECTURE }}
+      cache: 'false'
+      cache-key: ${{ inputs.cache-key }}
+      cache-path: ${{ steps.flutter-action.outputs.CACHE-PATH }}
+      pub-cache: 'false'
+      pub-cache-key: ${{ inputs.pub-cache-key }}
+      pub-cache-path: ${{ steps.flutter-action.outputs.PUB-CACHE-PATH }}
+      dry-run: 'false'
+      git-source: ${{ inputs.git-source }}

package/android-action/scripts/cache_env.cjs

@@ -0,0 +1,10 @@
+// NODE_OPTIONS applies this only to the cache step, including its official post/save action.
+try {
+  const scope = require('./cache_scope.cjs');
+  scope.authorize(process.argv[1], process.env);
+  scope.guardRequests();
+  for (const key of scope.proxyKeys) delete process.env[key];
+} catch {
+  process.stderr.write('github_cache_transport_scope_refused\n');
+  process.exit(1);
+}

package/android-action/scripts/cache_scope.cjs

@@ -0,0 +1,77 @@
+// Direct routing belongs only to these pinned first-party cache programs and HTTPS origins.
+const {readFileSync, copyFileSync, mkdtempSync, appendFileSync} = require('node:fs');
+const {createHash} = require('node:crypto');
+const {basename, dirname, join} = require('node:path');
+const hashes = new Map([
+  ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
+  ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
+]);
+const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];
+const refusal = () => new Error('github_cache_transport_scope_refused');
+
+function allowedHost(host) {
+  return host === 'api.github.com'
+    || /^[a-z0-9.-]+\.actions\.githubusercontent\.com$/.test(host)
+    || /^[a-z0-9]{3,24}\.blob\.core\.windows\.net$/.test(host);
+}
+
+function requireOrigin(value, service = false) {
+  let url;
+  try { url = new URL(value); } catch { throw refusal(); }
+  if (url.protocol !== 'https:' || url.port || url.username || url.password || !allowedHost(url.hostname)
+      || (service && !url.hostname.endsWith('.actions.githubusercontent.com'))) throw refusal();
+  return url;
+}
+
+function authorize(entrypoint, env) {
+  if (!entrypoint || basename(entrypoint) !== 'index.js' || basename(dirname(dirname(entrypoint))) !== 'dist') {
+    throw refusal();
+  }
+  const expected = hashes.get(basename(dirname(entrypoint)));
+  if (!expected || createHash('sha256').update(readFileSync(entrypoint)).digest('hex') !== expected) throw refusal();
+  const origins = [env.ACTIONS_RESULTS_URL, env.ACTIONS_CACHE_URL].filter(Boolean);
+  if (!origins.length) throw refusal();
+  for (const origin of origins) requireOrigin(origin, true);
+}
+
+function requireRequest(args, protocol) {
+  const [input, extra] = args;
+  const options = typeof input === 'string' || input instanceof URL
+    ? {protocol, ...require('node:url').urlToHttpOptions(requireOrigin(input)),
+      ...(typeof extra === 'object' ? extra : {})}
+    : {...input};
+  if (!options || options.socketPath || (options.protocol || protocol) !== 'https:') throw refusal();
+  for (const host of [options.hostname, options.host].filter(Boolean)) {
+    requireOrigin(`https://${host}${options.port ? ':' + options.port : ''}`);
+  }
+  if (!options.hostname && !options.host) throw refusal();
+}
+
+function guardRequests() {
+  for (const [name, protocol] of [['node:http', 'http:'], ['node:https', 'https:']]) {
+    const client = require(name);
+    for (const verb of ['request', 'get']) {
+      const original = client[verb];
+      client[verb] = function (...args) { requireRequest(args, protocol); return original.apply(this, args); };
+    }
+  }
+  if (globalThis.fetch) {
+    const original = globalThis.fetch;
+    globalThis.fetch = function (input, init) {
+      requireOrigin(typeof input === 'string' || input instanceof URL ? input : input.url);
+      return original.call(this, input, {...init, redirect: 'error'});
+    };
+  }
+}
+
+function snapshot() {
+  const target = mkdtempSync(join(process.env.RUNNER_TEMP, 'gowalk-cache-scope-'));
+  for (const file of ['cache_env.cjs', 'cache_scope.cjs']) copyFileSync(join(__dirname, file), join(target, file));
+  appendFileSync(process.env.GITHUB_OUTPUT, `preloader=${join(target, 'cache_env.cjs')}\n`);
+}
+
+module.exports = {authorize, guardRequests, proxyKeys, requireOrigin};
+if (require.main === module) {
+  try { if (process.argv[2] !== '--snapshot') throw refusal(); snapshot(); }
+  catch { process.stderr.write('github_cache_scope_snapshot_failed\n'); process.exitCode = 1; }
+}

package/android-action/scripts/test_flutter_cache_setup.py

@@ -0,0 +1,125 @@
+"""Real pinned SDK setup reuses restored bytes; cold/missed cache stays on the owned proxy."""
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tarfile
+import tempfile
+import threading
+import unittest
+import urllib.request
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+SCRIPT = Path(__file__).with_name("play_store_proxy.py")
+SETUP_SHA = "35f0cd9e9c1d7a643448223573b4a03879e63676fdc27872de3d0104d5bf89f9"
+SETUP_URL = ("https://raw.githubusercontent.com/subosito/flutter-action/"
+             "1a449444c387b1966244ae4d4f8c696479add0b2/setup.sh")
+
+
+class SdkSetupTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        fixture = os.environ.get("GOWALK_CACHE_ACTION_FIXTURES")
+        if fixture:
+            cls.source = (Path(fixture) / "flutter-setup.sh").read_bytes()
+        else:
+            with urllib.request.urlopen(SETUP_URL, timeout=30) as response:
+                cls.source = response.read(128 * 1024)
+        assert hashlib.sha256(cls.source).hexdigest() == SETUP_SHA
+
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.path = Path(self.directory.name)
+        self.setup = self.path / "setup.sh"
+        self.setup.write_bytes(self.source)
+        self.sdk = self.path / "sdk"
+        self.env = {**os.environ, "RUNNER_TEMP": str(self.path), "RUNNER_OS": "Linux", "RUNNER_ARCH": "X64",
+                    "RUNNER_TOOL_CACHE": str(self.path / "tools"), "PUB_CACHE": str(self.path / "pub"),
+                    "FLUTTER_STORAGE_BASE_URL": "http://provider.invalid", "GITHUB_ENV": str(self.path / "env"),
+                    "GITHUB_OUTPUT": str(self.path / "output"), "GITHUB_PATH": str(self.path / "path")}
+        self.calls = []
+        body = io.BytesIO()
+        with tarfile.open(fileobj=body, mode="w:gz") as archive:
+            entry = tarfile.TarInfo("flutter/bin/flutter")
+            content = b"#!/bin/sh\nexit 0\n"
+            entry.size, entry.mode = len(content), 0o755
+            archive.addfile(entry, io.BytesIO(content))
+        self.archive = body.getvalue()
+        self.server = ThreadingHTTPServer(("127.0.0.1", 0), self.handler())
+        threading.Thread(target=self.server.serve_forever, daemon=True).start()
+        self.addCleanup(self.server.server_close)
+        self.addCleanup(self.server.shutdown)
+        self.env["GOOGLE_STORE_PROXY_URL"] = f"http://127.0.0.1:{self.server.server_port}"
+
+    def handler(self):
+        owner = self
+
+        class Handler(BaseHTTPRequestHandler):
+            def do_GET(self):
+                owner.calls.append(self.path)
+                if self.path.endswith(".json"):
+                    data = json.dumps({"releases": [{"channel": "stable", "version": "3.44.0",
+                        "dart_sdk_arch": "x64", "hash": "fixture", "sha256": "fixture",
+                        "archive": "sdk.tar.gz"}]}).encode()
+                else:
+                    data = owner.archive
+                self.send_response(200)
+                self.send_header("Content-Length", str(len(data)))
+                self.end_headers()
+                self.wfile.write(data)
+
+            def log_message(self, *_args):
+                pass
+
+        return Handler
+
+    def bootstrap(self):
+        result = subprocess.run([sys.executable, "-S", str(SCRIPT), "--bootstrap-env"],
+                                env=self.env, capture_output=True, text=True, timeout=10)
+        if result.returncode == 0:
+            self.env.update(line.split("=", 1) for line in (self.path / "env").read_text().splitlines())
+        return result
+
+    def install(self):
+        return subprocess.run(["bash", str(self.setup), "-n", "3.44.0", "-a", "x64", "-c", str(self.sdk),
+                               "stable"], env=self.env, capture_output=True, text=True, timeout=10)
+
+    def test_restored_sdk_fetches_only_manifest_through_proxy(self):
+        target = self.sdk / "flutter/bin/flutter"
+        target.parent.mkdir(parents=True)
+        target.write_text("#!/bin/sh\nexit 0\n")
+        target.chmod(0o755)
+        self.assertEqual(self.bootstrap().returncode, 0)
+        result = self.install()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(self.calls, ["http://provider.invalid/flutter_infra_release/releases/releases_linux.json"])
+
+    def test_cold_cache_downloads_and_installs_sdk_through_proxy(self):
+        self.assertEqual(self.bootstrap().returncode, 0)
+        result = self.install()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual([url.rsplit("/", 1)[-1] for url in self.calls], ["releases_linux.json", "sdk.tar.gz"])
+        self.assertTrue(os.access(self.sdk / "flutter/bin/flutter", os.X_OK))
+
+    def test_provider_failure_after_cache_miss_still_fails_setup(self):
+        self.archive = b"not-a-valid-sdk-archive"
+        self.assertEqual(self.bootstrap().returncode, 0)
+        result = self.install()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertFalse((self.sdk / "flutter/bin/flutter").exists())
+        self.assertEqual(len(self.calls), 2)
+
+    def test_missing_pin_refuses_before_manifest_even_with_restored_sdk(self):
+        self.env.pop("GOOGLE_STORE_PROXY_URL")
+        result = self.bootstrap()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertFalse((self.path / "env").exists())
+        self.assertEqual(self.calls, [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_google_bootstrap_wiring.py

@@ -16,16 +16,55 @@ class BootstrapWiringTests(unittest.TestCase):
             for job in workflow["jobs"].values():
                 steps = job.get("steps", [])
                 for index, step in enumerate(steps):
-                    if not step.get("uses", "").startswith("subosito/flutter-action@"):
+                    if not step.get("uses", "").endswith("/android-app/flutter-setup"):
                         continue
                     checked += 1
-                    guard = steps[index - 1]
-                    self.assertEqual(guard.get("if"), step.get("if"))
                     self.assertEqual(job["env"]["GOOGLE_STORE_PROXY_URL"],
                                      "${{ secrets.GOOGLE_STORE_PROXY_URL }}")
-                    self.assertTrue(guard["run"].endswith("play_store_proxy.py --bootstrap-env"))
-                    self.assertNotIn("continue-on-error", guard)
+                    self.assertNotIn("continue-on-error", step)
         self.assertEqual(checked, 3)
+        setup = yaml.safe_load((ROOT / "android-action/flutter-setup/action.yml").read_text())
+        guard, scope, resolve, sdk_cache, pub_cache, install = setup["runs"]["steps"]
+        self.assertIn('play_store_proxy.py" --bootstrap-env', guard["run"])
+        self.assertNotIn("continue-on-error", guard)
+        self.assertTrue(scope["continue-on-error"])
+        self.assertIn("--snapshot", scope["run"])
+        self.assertEqual(resolve["with"]["dry-run"], "true")
+        for step in (resolve, install):
+            self.assertNotIn("env", step)
+            self.assertEqual(step["with"]["cache"], "false")
+            self.assertEqual(step["with"]["pub-cache"], "false")
+            self.assertNotIn("continue-on-error", step)
+        for step in (sdk_cache, pub_cache):
+            self.assertTrue(step["continue-on-error"])
+            self.assertIn("steps.scope.outputs.preloader", step["env"]["NODE_OPTIONS"])
+            self.assertEqual(step["env"]["SEGMENT_DOWNLOAD_TIMEOUT_MINS"], "1")
+
+    def test_official_flutter_custom_input_and_output_contract_is_preserved(self):
+        setup = yaml.safe_load((ROOT / "android-action/flutter-setup/action.yml").read_text())
+        inputs = {"channel", "flutter-version", "flutter-version-file", "architecture", "cache", "cache-key",
+                  "cache-path", "pub-cache", "pub-cache-key", "pub-cache-path", "dry-run", "git-source"}
+        self.assertEqual(set(setup["inputs"]), inputs)
+        resolve = next(step for step in setup["runs"]["steps"] if step.get("id") == "flutter-action")
+        for name in inputs - {"cache", "pub-cache", "dry-run"}:
+            self.assertEqual(resolve["with"][name], "${{ inputs." + name + " }}")
+        self.assertEqual(setup["outputs"]["CACHE-HIT"]["value"], "${{ steps.cache-flutter.outputs.cache-hit }}")
+        self.assertEqual(setup["outputs"]["PUB-CACHE-HIT"]["value"], "${{ steps.cache-pub.outputs.cache-hit }}")
+
+    def test_pods_cache_keeps_identity_and_uses_the_same_optional_scope(self):
+        workflow = yaml.safe_load((ROOT / "templates/deploy.yml").read_text())
+        steps = workflow["jobs"]["ios"]["steps"]
+        cache = next(step for step in steps if step.get("name") == "Cache CocoaPods")
+        scope = next(step for step in steps if step.get("id") == "pods-cache-scope")
+        self.assertTrue(scope["continue-on-error"])
+        self.assertTrue(cache["continue-on-error"])
+        self.assertEqual(scope["if"], cache["if"])
+        self.assertIn("scripts/cache_scope.cjs --snapshot", scope["run"])
+        self.assertIn("steps.pods-cache-scope.outputs.preloader", cache["env"]["NODE_OPTIONS"])
+        self.assertEqual(cache["uses"], "actions/cache@caa296126883cff596d87d8935842f9db880ef25")
+        self.assertEqual(cache["with"]["path"], "ios/Pods\n~/Library/Caches/CocoaPods\n")
+        self.assertEqual(cache["with"]["key"],
+                         "pods-${{ runner.os }}-${{ hashFiles('ios/Podfile.lock', 'pubspec.lock') }}")
 
     def test_remaining_flutter_commands_run_inside_the_owned_relay(self):
         groups = []

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.70
+1.0.71

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.70",
+  "version": "1.0.71",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-web.yml

@@ -30,12 +30,7 @@ jobs:
       GOOGLE_STORE_PROXY_URL: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-      - name: Require the Google proxy before Flutter SDK setup
-        shell: bash
-        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
-      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
-        env:
-          SEGMENT_DOWNLOAD_TIMEOUT_MINS: "1"
+      - uses: ./.github/actions/android-app/flutter-setup
         with:
           channel: stable
           cache: true

package/templates/deploy.yml

@@ -77,22 +77,25 @@ jobs:
           else
             echo "enabled=false" >> "$GITHUB_OUTPUT"
           fi
-      - name: Require the Google proxy before Flutter SDK setup
-        if: ${{ steps.flutter.outputs.enabled == 'true' }}
-        shell: bash
-        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
       - name: Set up Flutter
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
-        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
-        env:
-          # Optional SDK/pub cache segments must finish promptly; normal SDK setup still fails on errors.
-          SEGMENT_DOWNLOAD_TIMEOUT_MINS: "1"
+        uses: ./.github/actions/android-app/flutter-setup
         with:
           channel: stable
           cache: true
+      - name: Retain CocoaPods cache process scope
+        id: pods-cache-scope
+        if: ${{ steps.flutter.outputs.enabled == 'true' }}
+        continue-on-error: true
+        shell: bash
+        run: node .github/actions/android-app/scripts/cache_scope.cjs --snapshot
       - name: Cache CocoaPods
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5, same pinned cache process as Flutter
+        continue-on-error: true
+        env:
+          NODE_OPTIONS: --require "${{ steps.pods-cache-scope.outputs.preloader }}"
+          SEGMENT_DOWNLOAD_TIMEOUT_MINS: "1"
         with:
           path: |
             ios/Pods
@@ -335,15 +338,9 @@ jobs:
           distribution: temurin
           java-version: ${{ steps.jdk.outputs.version }}
           cache: gradle
-      - name: Require the Google proxy before Flutter SDK setup
-        if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
-        shell: bash
-        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
       - name: Set up Flutter
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
-        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
-        env:
-          SEGMENT_DOWNLOAD_TIMEOUT_MINS: "1"
+        uses: ./.github/actions/android-app/flutter-setup
         with:
           channel: stable
           cache: true