gowalk-cicd 1.0.70 → 1.0.72

package/CLAUDE.md

@@ -135,12 +135,30 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   localization, global activation and builds run through the existing owned relay.
   The helper's bootstrap and command modes require only Python's standard library;
   importing the Google API client must not become an unprotected bootstrap prerequisite.
+- `android-action/flutter-setup/` owns Flutter setup. It forwards the official action's
+  inputs/cache identities while isolating restore/save from provider transport. Its step-local
+  `NODE_OPTIONS` preloader (`android-action/scripts/cache_*.cjs`) also protects CocoaPods cache
+  steps and verifies the exact pinned Actions cache entrypoint bytes and HTTPS
+  GitHub cache/Azure blob destinations before removing proxy variables in that cache process.
+  Unknown code or origins refuse; SDK setup, non-cache children and later steps retain their
+  proxy requirement. Never export this scope through `GITHUB_ENV` or add cache domains to
+  `NO_PROXY`. The preloader snapshot under `RUNNER_TEMP` also covers official post/save after
+  consumer autoupdate changes the action directory. The installer delivers this development
+  tooling for native iOS repositories too; it does not require an Android app.
 - Flutter setup scopes `SEGMENT_DOWNLOAD_TIMEOUT_MINS=1` to the composite action's optional
   SDK/pub cache restores. This bounds each cache segment, not the whole cache or SDK download.
   A cache timeout becomes a cache miss; normal proxied SDK setup remains mandatory and its
   errors still fail the job. Never use `continue-on-error` or a timeout around all SDK setup
   to hide an optional cache failure. Do not alter cache keys or disable caches as part of
   this timeout handling.
+- GitHub artifact uploads have their own checksum-pinned `artifact_env.cjs` process scope.
+  It reuses the cache transport's approved HTTPS request guard, then removes inherited proxy
+  variables only inside the official `upload-artifact` process. Unknown programs/origins refuse;
+  later Apple/Google clients retain their proxies and artifact failures remain job failures.
+  The iOS action reads this helper from its immutable `SWIFT_APP_ACTION` snapshot. Its shared
+  `cache_scope.cjs` and `artifact_env.cjs` copies match the Android distribution byte for byte,
+  enforced by `test/artifact-wiring.test.mjs`; update both when changing that common guard.
+  Update existing consumer workflow artifact steps as well as action directories on adoption.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and
   supplies it to Compose after the generated `.env`; never print its content.
@@ -155,6 +173,13 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie
   because a Flutter app also carries `android/settings.gradle`.
+- iOS plist stamping reads complete JSON build settings through `resolve_info_plist.py`,
+  preserving Xcode's exit status and bounded sanitized stderr. Select exactly the configured
+  bundle's application target and resolve paths from that target's source root; never take
+  the first dependency plist or stop reading Xcode output early. The encryption step reuses
+  the validated source path. Missing/ambiguous source plists fail; positively generated
+  plists retain the existing build-setting version path. Queries disable signing and package
+  updates, retain inherited proxies, and never enable provisioning network operations.
 - Version stamping is per-build-system: Flutter takes `--build-number`, Gradle
   has no equivalent, so `set_gradle_version()` rewrites the literal in the
   checkout the way the iOS action patches the pbxproj. Never commit that edit.

package/README.md

@@ -647,6 +647,15 @@ without the repository secret cannot start provider downloads through these work
 The Apple uploader retains `apple-upload-<run>-<attempt>` receipts with IPA SHA-256,
 upload ID and processing readback, and resumes matching bytes after interruption.
 
+GitHub artifact traffic uses a separate, per-action transport scope. The exact pinned
+`actions/upload-artifact` client can reach approved GitHub Results and artifact-storage
+HTTPS origins without inheriting the store proxy; unknown programs and destinations are
+refused. The scope ends with that Node process. Apple/Google calls retain their assigned
+exit, and a failed artifact creation, transfer or finalization still fails delivery.
+Adoption requires updating workflow upload steps as well as the distributed actions while
+preserving each app's custom checks and artifact retention settings. This fixes the proven
+inherited-proxy path; an isolated `ECONNRESET` does not identify every possible network fault.
+
 1. **Auto-detects** your `.xcodeproj` / `.xcworkspace`, scheme, bundle ID,
    and `team_id` (from the ASC API key). No `ci.config.yaml` required —
    override via action inputs only if auto-detection fails.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.70
+1.0.72

package/action/action.yml

@@ -601,51 +601,14 @@ runs:
         WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
         SCHEME: ${{ inputs.scheme || env.CFG_SCHEME }}
         CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
+        BUNDLE_ID: ${{ inputs.bundle-id || env.CFG_BUNDLE_ID }}
       run: |
         set -o pipefail
-        # Some Xcode projects hardcode CFBundleVersion / CFBundleShortVersionString
-        # as literal values in Info.plist instead of using $(CURRENT_PROJECT_VERSION)
-        # and $(MARKETING_VERSION) substitution. When that's the case, passing
-        # CURRENT_PROJECT_VERSION=N on the xcodebuild CLI has no effect on the
-        # archived plist and altool rejects the upload with
-        # `previousBundleVersion`. Stamp the resolved source Info.plist directly
-        # so the archive ships with the computed values regardless of whether
-        # the plist uses substitutions or hardcoded literals.
-        if [ -n "$WORKSPACE" ]; then
-          PROJ_ARGS=(-workspace "$WORKSPACE")
-          PROJ_BASE=$(dirname "$WORKSPACE")
-        else
-          PROJ_ARGS=(-project "$PROJECT")
-          PROJ_BASE=$(dirname "$PROJECT")
-        fi
-        # Try agvtool first — it's Apple's official tool and handles projects
-        # using the generic versioning system. Harmless no-op on projects
-        # without VERSIONING_SYSTEM set. Run from the project directory.
-        # Marketing version is intentionally NOT stamped here: the project's
-        # MARKETING_VERSION build setting is the single source of truth and
-        # was already resolved into env earlier; CI must never mutate it.
-        (
-          cd "$PROJ_BASE" 2>/dev/null || exit 0
-          xcrun agvtool new-version -all "$BUILD_NUMBER" >/dev/null 2>&1 || true
-        )
-        # Now resolve the actual Info.plist path and stamp literal values.
-        # This is idempotent with agvtool and also covers projects where the
-        # plist has hardcoded numbers (the sample1 failure mode).
-        INFOPLIST=$(xcodebuild "${PROJ_ARGS[@]}" -scheme "$SCHEME" -configuration "${CONFIGURATION:-Release}" \
-                      -showBuildSettings 2>/dev/null \
-                    | awk -F' = ' '/^[[:space:]]*INFOPLIST_FILE/ {
-                        gsub(/^[[:space:]]+|[[:space:]]+$/,"",$2); print $2; exit
-                      }')
-        if [ -z "$INFOPLIST" ]; then
-          echo "::warning::INFOPLIST_FILE not set for scheme $SCHEME; skipping version stamping"
-          exit 0
-        fi
-        INFOPLIST_PATH="$PROJ_BASE/$INFOPLIST"
-        if [ ! -f "$INFOPLIST_PATH" ]; then
-          INFOPLIST_PATH="$INFOPLIST"
-        fi
-        if [ ! -f "$INFOPLIST_PATH" ]; then
-          echo "::warning::Info.plist not found at $INFOPLIST_PATH; skipping version stamping"
+        # Read every target's complete settings and preserve Xcode's actual status/error.
+        # The selected application's source root can differ from its containing workspace.
+        INFOPLIST_PATH=$(python3 "$SWIFT_APP_ACTION/scripts/resolve_info_plist.py")
+        if [ -z "$INFOPLIST_PATH" ]; then
+          echo "Generated Info.plist: Archive supplies CURRENT_PROJECT_VERSION and MARKETING_VERSION"
           exit 0
         fi
         /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $BUILD_NUMBER" "$INFOPLIST_PATH" 2>/dev/null \
@@ -665,29 +628,15 @@ runs:
         VALUE: ${{ inputs.uses-non-exempt-encryption || env.CFG_USES_NON_EXEMPT }}
       run: |
         set -o pipefail
-        if [ -n "$WORKSPACE" ]; then
-          PROJ_ARGS=(-workspace "$WORKSPACE")
-          PROJ_BASE=$(dirname "$WORKSPACE")
-        else
-          PROJ_ARGS=(-project "$PROJECT")
-          PROJ_BASE=$(dirname "$PROJECT")
-        fi
-        INFOPLIST=$(xcodebuild "${PROJ_ARGS[@]}" -scheme "$SCHEME" -configuration "${CONFIGURATION:-Release}" \
-                      -showBuildSettings 2>/dev/null \
-                    | awk -F' = ' '/^[[:space:]]*INFOPLIST_FILE/ {
-                        gsub(/^[[:space:]]+|[[:space:]]+$/,"",$2); print $2; exit
-                      }')
-        if [ -z "$INFOPLIST" ]; then
-          echo "::warning::INFOPLIST_FILE not set for scheme $SCHEME; skipping ITSAppUsesNonExemptEncryption"
+        # Reuse the validated application path from version stamping; no second Xcode query.
+        INFOPLIST_PATH="${SWIFT_APP_SOURCE_INFOPLIST?Source plist resolution did not complete}"
+        if [ -z "$INFOPLIST_PATH" ]; then
+          echo "::warning::The application generates Info.plist; no source plist to edit for encryption"
           exit 0
         fi
-        INFOPLIST_PATH="$PROJ_BASE/$INFOPLIST"
-        if [ ! -f "$INFOPLIST_PATH" ]; then
-          INFOPLIST_PATH="$INFOPLIST"
-        fi
         if [ ! -f "$INFOPLIST_PATH" ]; then
-          echo "::warning::Info.plist not found at $INFOPLIST_PATH; skipping"
-          exit 0
+          echo "::error::The resolved application Info.plist is no longer present"
+          exit 1
         fi
         /usr/libexec/PlistBuddy -c "Set :ITSAppUsesNonExemptEncryption $VALUE" "$INFOPLIST_PATH" 2>/dev/null \
           || /usr/libexec/PlistBuddy -c "Add :ITSAppUsesNonExemptEncryption bool $VALUE" "$INFOPLIST_PATH"
@@ -815,6 +764,8 @@ runs:
     - name: Preserve the Firebase console upload artifact
       if: ${{ always() && inputs.archive == 'true' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      env:
+        NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
       with:
         name: ios-crashlytics-symbols-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/firebase-symbols/
@@ -834,6 +785,8 @@ runs:
     - name: Retain Apple upload receipt
       if: ${{ always() && inputs.archive == 'true' && inputs.upload == 'true' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      env:
+        NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
       with:
         name: apple-upload-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/apple-build-upload.json
@@ -845,6 +798,8 @@ runs:
     - name: Retain the exported IPA for upload recovery
       if: ${{ always() && inputs.archive == 'true' && inputs.upload == 'true' && steps.upload.outcome != 'success' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      env:
+        NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
       with:
         name: apple-ipa-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/export/*.ipa

package/action/scripts/artifact_env.cjs

@@ -0,0 +1,10 @@
+// Only the exact pinned upload-artifact process receives this GitHub-specific transport.
+try {
+  const scope = require('./cache_scope.cjs');
+  scope.authorize(process.argv[1], process.env, 'artifact');
+  scope.guardRequests();
+  for (const key of scope.proxyKeys) delete process.env[key];
+} catch {
+  process.stderr.write('github_artifact_transport_scope_refused\n');
+  process.exit(1);
+}

package/action/scripts/cache_scope.cjs

@@ -0,0 +1,81 @@
+// Direct routing belongs only to pinned first-party Actions programs and approved HTTPS origins.
+const {readFileSync, copyFileSync, mkdtempSync, appendFileSync} = require('node:fs');
+const {createHash} = require('node:crypto');
+const {basename, dirname, join} = require('node:path');
+const hashes = new Map([
+  ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
+  ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
+]);
+const artifactHash = '168c44946cba03564808c19b83a72601e6d1d6f57081dbd2d6e2ea1cedc522f5';
+const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];
+const refusal = () => new Error('github_cache_transport_scope_refused');
+
+function allowedHost(host) {
+  return host === 'api.github.com'
+    || /^[a-z0-9.-]+\.actions\.githubusercontent\.com$/.test(host)
+    || /^[a-z0-9]{3,24}\.blob\.core\.windows\.net$/.test(host);
+}
+
+function requireOrigin(value, service = false) {
+  let url;
+  try { url = new URL(value); } catch { throw refusal(); }
+  if (url.protocol !== 'https:' || url.port || url.username || url.password || !allowedHost(url.hostname)
+      || (service && !url.hostname.endsWith('.actions.githubusercontent.com'))) throw refusal();
+  return url;
+}
+
+function authorize(entrypoint, env, kind = 'cache') {
+  if (!entrypoint || basename(entrypoint) !== 'index.js' || basename(dirname(dirname(entrypoint))) !== 'dist') {
+    throw refusal();
+  }
+  if (!['cache', 'artifact'].includes(kind)) throw refusal();
+  const program = basename(dirname(entrypoint));
+  const expected = kind === 'artifact' ? (program === 'upload' && artifactHash) : hashes.get(program);
+  if (!expected || createHash('sha256').update(readFileSync(entrypoint)).digest('hex') !== expected) throw refusal();
+  const origins = (kind === 'artifact' ? [env.ACTIONS_RESULTS_URL]
+    : [env.ACTIONS_RESULTS_URL, env.ACTIONS_CACHE_URL]).filter(Boolean);
+  if (!origins.length) throw refusal();
+  for (const origin of origins) requireOrigin(origin, true);
+}
+
+function requireRequest(args, protocol) {
+  const [input, extra] = args;
+  const options = typeof input === 'string' || input instanceof URL
+    ? {protocol, ...require('node:url').urlToHttpOptions(requireOrigin(input)),
+      ...(typeof extra === 'object' ? extra : {})}
+    : {...input};
+  if (!options || options.socketPath || (options.protocol || protocol) !== 'https:') throw refusal();
+  for (const host of [options.hostname, options.host].filter(Boolean)) {
+    requireOrigin(`https://${host}${options.port ? ':' + options.port : ''}`);
+  }
+  if (!options.hostname && !options.host) throw refusal();
+}
+
+function guardRequests() {
+  for (const [name, protocol] of [['node:http', 'http:'], ['node:https', 'https:']]) {
+    const client = require(name);
+    for (const verb of ['request', 'get']) {
+      const original = client[verb];
+      client[verb] = function (...args) { requireRequest(args, protocol); return original.apply(this, args); };
+    }
+  }
+  if (globalThis.fetch) {
+    const original = globalThis.fetch;
+    globalThis.fetch = function (input, init) {
+      requireOrigin(typeof input === 'string' || input instanceof URL ? input : input.url);
+      return original.call(this, input, {...init, redirect: 'error'});
+    };
+  }
+}
+
+function snapshot() {
+  const target = mkdtempSync(join(process.env.RUNNER_TEMP, 'gowalk-cache-scope-'));
+  for (const file of ['cache_env.cjs', 'cache_scope.cjs']) copyFileSync(join(__dirname, file), join(target, file));
+  appendFileSync(process.env.GITHUB_OUTPUT, `preloader=${join(target, 'cache_env.cjs')}\n`);
+}
+
+module.exports = {authorize, guardRequests, proxyKeys, requireOrigin};
+if (require.main === module) {
+  try { if (process.argv[2] !== '--snapshot') throw refusal(); snapshot(); }
+  catch { process.stderr.write('github_cache_scope_snapshot_failed\n'); process.exitCode = 1; }
+}

package/action/scripts/resolve_info_plist.py

@@ -0,0 +1,128 @@
+#!/usr/bin/env python3
+"""Read complete Xcode settings once and select the requested application's source plist."""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+
+APP_TYPE = "com.apple.product-type.application"
+_VARIABLE = re.compile(r"\$\(([^)]+)\)|\$\{([^}]+)\}")
+
+
+class SettingsFailed(RuntimeError):
+    def __init__(self, message: str, code: int = 1):
+        super().__init__(message)
+        self.code = code
+
+
+def diagnostic(text: str) -> str:
+    for key, value in os.environ.items():
+        if len(value) >= 4 and re.search(r"SECRET|TOKEN|PASSWORD|PROXY|PRIVATE_KEY", key, re.I):
+            text = text.replace(value, "[redacted]")
+    text = re.sub(r"https?://[^\s]+", "[URL redacted]", text)
+    text = re.sub(r"\x1b\[[0-?]*[ -/]*[@-~]", "", text)
+    return "\n".join("xcodebuild: " + line for line in text[-8000:].splitlines()[-60:])
+
+
+def read_settings(project: str, workspace: str, scheme: str, configuration: str, logs: Path) -> list:
+    if not scheme or not (workspace or project):
+        raise SettingsFailed("Project/workspace and scheme are required for source plist resolution")
+    command = ["xcodebuild", "-workspace" if workspace else "-project", workspace or project,
+               "-scheme", scheme, "-configuration", configuration or "Release", "-sdk", "iphoneos",
+               "-destination", "generic/platform=iOS", "-disableAutomaticPackageResolution", "-skipPackageUpdates",
+               "CODE_SIGNING_ALLOWED=NO", "CODE_SIGNING_REQUIRED=NO", "CODE_SIGN_IDENTITY=", "DEVELOPMENT_TEAM=",
+               "-showBuildSettings", "-json"]
+    logs.mkdir(parents=True, exist_ok=True, mode=0o700)
+    os.chmod(logs, 0o700)
+    output, errors = logs / "build-settings.json", logs / "build-settings.stderr"
+    # File sinks consume the entire producer output. An early pipe reader can hide its actual status.
+    with output.open("wb") as stdout, errors.open("wb") as stderr:
+        os.chmod(output, 0o600)
+        os.chmod(errors, 0o600)
+        timed_out = False
+        try:
+            result = subprocess.run(command, stdout=stdout, stderr=stderr, timeout=300, check=False)
+            code = result.returncode if result.returncode >= 0 else 128 - result.returncode
+        except subprocess.TimeoutExpired:
+            timed_out, code = True, 124
+    if code:
+        detail = diagnostic(errors.read_text(errors="replace"))
+        if detail:
+            print(detail, file=sys.stderr)
+        reason = "timed out after 300 seconds" if timed_out else f"failed with exit {code}"
+        raise SettingsFailed(f"xcodebuild -showBuildSettings {reason}", code)
+    try:
+        settings = json.loads(output.read_text())
+    except (ValueError, UnicodeError):
+        raise SettingsFailed("xcodebuild returned invalid build-settings JSON") from None
+    if not isinstance(settings, list):
+        raise SettingsFailed("xcodebuild build-settings response must be a target list")
+    return settings
+
+
+def application(settings: list, bundle_id: str) -> dict:
+    candidates = []
+    for row in settings:
+        values = row.get("buildSettings") if isinstance(row, dict) else None
+        if not isinstance(values, dict) or values.get("PRODUCT_TYPE") != APP_TYPE:
+            continue
+        if not bundle_id or values.get("PRODUCT_BUNDLE_IDENTIFIER") == bundle_id:
+            candidates.append(values)
+    if len(candidates) != 1:
+        raise SettingsFailed("Expected exactly one application target matching the configured bundle identifier")
+    return candidates[0]
+
+
+def source_plist(settings: dict, checkout: Path) -> Path | None:
+    value = str(settings.get("INFOPLIST_FILE") or "").strip()
+    if not value:
+        if settings.get("GENERATE_INFOPLIST_FILE") == "YES":
+            return None
+        raise SettingsFailed("The application has no source Info.plist and does not enable generated Info.plist")
+    for _ in range(5):
+        expanded = _VARIABLE.sub(lambda match: str(settings.get(match[1] or match[2], match[0])), value)
+        if expanded == value:
+            break
+        value = expanded
+    if _VARIABLE.search(value) or "\n" in value or "\r" in value:
+        raise SettingsFailed("The application's Info.plist path contains an unresolved or invalid setting")
+    path = Path(value)
+    if not path.is_absolute():
+        source = settings.get("SRCROOT") or settings.get("PROJECT_DIR")
+        if not source:
+            raise SettingsFailed("The application target did not provide its source root")
+        path = Path(source) / path
+    path = path.resolve()
+    if "\n" in str(path) or "\r" in str(path):
+        raise SettingsFailed("The resolved source plist cannot be represented in the job environment")
+    if not path.is_relative_to(checkout.resolve()) or not path.is_file():
+        raise SettingsFailed("The application source Info.plist is missing or outside the checkout")
+    return path
+
+
+def main() -> int:
+    try:
+        logs = Path(os.environ["RUNNER_TEMP"]) / "swift-app-build-settings"
+        rows = read_settings(os.environ.get("PROJECT", ""), os.environ.get("WORKSPACE", ""),
+                             os.environ.get("SCHEME", ""), os.environ.get("CONFIGURATION", "Release"), logs)
+        selected = source_plist(application(rows, os.environ.get("BUNDLE_ID", "")), Path.cwd())
+        value = str(selected) if selected else ""
+        with Path(os.environ["GITHUB_ENV"]).open("a") as stream:
+            stream.write(f"SWIFT_APP_SOURCE_INFOPLIST={value}\n")
+        print(value)
+        return 0
+    except SettingsFailed as exc:
+        print(f"::error title=Application build settings::{exc}", file=sys.stderr)
+        return exc.code
+    except (KeyError, OSError):
+        print("::error title=Application build settings::Required settings tooling or private output is unavailable",
+              file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/action/scripts/test_resolve_info_plist.py

@@ -0,0 +1,120 @@
+"""Consume real producer output/status, then select only the app's own source plist."""
+from contextlib import redirect_stderr
+import io
+import json
+import os
+from pathlib import Path
+import tempfile
+import unittest
+from unittest.mock import patch
+
+import resolve_info_plist as subject
+
+
+class ResolveInfoPlistTest(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.source = self.root / 'Nested Project' / 'Application Info.plist'
+        self.source.parent.mkdir()
+        self.source.write_text('<plist/>')
+        self.values = {'PRODUCT_TYPE': subject.APP_TYPE, 'PRODUCT_BUNDLE_IDENTIFIER': 'test.local.app',
+                       'SRCROOT': str(self.source.parent), 'INFOPLIST_FILE': self.source.name}
+
+    def producer(self, body):
+        tool = self.root / 'xcodebuild'
+        tool.write_text('#!/usr/bin/env python3\n' + body)
+        tool.chmod(0o700)
+        return patch.dict(os.environ, {'PATH': str(self.root) + os.pathsep + os.environ['PATH']})
+
+    def test_drains_large_output_and_preserves_arguments_and_inherited_proxy(self):
+        record = self.root / 'invocation.json'
+        rows = [{'buildSettings': dict(self.values, LARGE='x' * 500000)}]
+        body = ("import json,os,sys\n"
+                f"open({str(record)!r},'w').write(json.dumps([sys.argv[1:],os.getenv('HTTPS_PROXY')]))\n"
+                f"sys.stdout.write({json.dumps(rows)!r})\n")
+        with self.producer(body), patch.dict(os.environ, {'HTTPS_PROXY': 'http://fixture-proxy.invalid:9000'}):
+            result = subject.read_settings('App.xcodeproj', '', 'App', 'Release', self.root / 'logs')
+        self.assertEqual(result, rows)
+        args, proxy = json.loads(record.read_text())
+        self.assertEqual(proxy, 'http://fixture-proxy.invalid:9000')
+        self.assertIn('-disableAutomaticPackageResolution', args)
+        self.assertIn('-skipPackageUpdates', args)
+        self.assertIn('CODE_SIGNING_ALLOWED=NO', args)
+        self.assertEqual(args[-2:], ['-showBuildSettings', '-json'])
+        self.assertNotIn('-allowProvisioningUpdates', args)
+
+    def test_exit_74_is_not_an_empty_success_and_error_is_bounded_private(self):
+        stderr = io.StringIO()
+        error = 'x' * 20000 + '\nCould not resolve package: https://private.invalid/token-secret token-secret\n'
+        body = f"import sys\nsys.stderr.write({error!r})\nsys.stdout.write('[]')\nsys.exit(74)\n"
+        with self.producer(body), patch.dict(os.environ, {'APP_SECRET': 'token-secret'}), redirect_stderr(stderr):
+            with self.assertRaises(subject.SettingsFailed) as raised:
+                subject.read_settings('App.xcodeproj', '', 'App', 'Release', self.root / 'logs')
+        self.assertEqual(raised.exception.code, 74)
+        self.assertIn('Could not resolve package', stderr.getvalue())
+        self.assertNotIn('token-secret', stderr.getvalue())
+        self.assertNotIn('private.invalid', stderr.getvalue())
+        self.assertLess(len(stderr.getvalue()), 8200)
+        self.assertTrue((self.root / 'logs' / 'build-settings.stderr').is_file())
+        for output in ['not-json', '{}']:
+            with self.producer(f"print({output!r})\n"):
+                with self.assertRaises(subject.SettingsFailed):
+                    subject.read_settings('App.xcodeproj', '', 'App', 'Release', self.root / 'logs')
+
+    def test_selects_bundle_matched_application_not_first_dependency_or_other_app(self):
+        dependency = dict(self.values, PRODUCT_TYPE='com.apple.product-type.framework', INFOPLIST_FILE='Other.plist')
+        other = dict(self.values, PRODUCT_BUNDLE_IDENTIFIER='test.local.other')
+        rows = [{'buildSettings': row} for row in [dependency, other, self.values]]
+        chosen = subject.application(rows, 'test.local.app')
+        self.assertEqual(subject.source_plist(chosen, self.root), self.source.resolve())
+        with self.assertRaises(subject.SettingsFailed):
+            subject.application(rows, '')
+        with self.assertRaises(subject.SettingsFailed):
+            subject.application(rows, 'test.local.absent')
+
+    def test_ambiguous_same_bundle_and_malformed_targets_refuse(self):
+        for rows in [[{'buildSettings': self.values}] * 2, [{'buildSettings': []}], [None]]:
+            with self.assertRaises(subject.SettingsFailed):
+                subject.application(rows, 'test.local.app')
+
+    def test_relative_and_variable_plist_paths_use_the_target_root(self):
+        values = dict(self.values, INFOPLIST_FILE='$(SRCROOT)/Application Info.plist')
+        self.assertEqual(subject.source_plist(values, self.root), self.source.resolve())
+        values['INFOPLIST_FILE'] = '${UNKNOWN}/Info.plist'
+        with self.assertRaises(subject.SettingsFailed):
+            subject.source_plist(values, self.root)
+        newline_root = self.root / 'project\nname'
+        newline_root.mkdir()
+        (newline_root / self.source.name).write_text('<plist/>')
+        values = dict(self.values, SRCROOT=str(newline_root))
+        with self.assertRaises(subject.SettingsFailed):
+            subject.source_plist(values, self.root)
+
+    def test_missing_outside_and_generated_paths_are_distinct(self):
+        for values in [dict(self.values, INFOPLIST_FILE='Missing.plist'),
+                       dict(self.values, INFOPLIST_FILE='/etc/hosts'),
+                       dict(self.values, INFOPLIST_FILE='')]:
+            with self.assertRaises(subject.SettingsFailed):
+                subject.source_plist(values, self.root)
+        generated = dict(self.values, INFOPLIST_FILE='', GENERATE_INFOPLIST_FILE='YES')
+        self.assertIsNone(subject.source_plist(generated, self.root))
+
+    def test_timeout_keeps_error_evidence_and_does_not_retry(self):
+        import subprocess
+
+        stderr = io.StringIO()
+        def timed_out(command, **kwargs):
+            kwargs['stderr'].write(b'package graph was unavailable')
+            raise subprocess.TimeoutExpired(command, 300)
+        with patch.object(subject.subprocess, 'run', side_effect=timed_out) as run, redirect_stderr(stderr):
+            with self.assertRaises(subject.SettingsFailed) as raised:
+                subject.read_settings('App.xcodeproj', '', 'App', 'Release', self.root / 'logs')
+        self.assertEqual(raised.exception.code, 124)
+        self.assertEqual(run.call_count, 1)
+        self.assertIn('package graph was unavailable', stderr.getvalue())
+
+
+if __name__ == '__main__':
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.70
+1.0.72

package/android-action/action.yml

@@ -191,6 +191,8 @@ runs:
     - name: Retain Dart symbol files
       if: ${{ steps.config.outputs.project_kind == 'flutter' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      env:
+        NODE_OPTIONS: --require "${{ github.action_path }}/scripts/artifact_env.cjs"
       with:
         name: android-symbols-${{ steps.config.outputs.package_name }}-${{ steps.config.outputs.build_number }}
         path: ${{ steps.flutter_build.outputs.symbols_path }}

package/android-action/flutter-setup/action.yml

@@ -0,0 +1,149 @@
+name: Set up proxied Flutter
+description: Set up Flutter with protected provider transport and isolated official GitHub caches
+inputs:
+  channel:
+    description: The Flutter build release channel
+    required: false
+    default: stable
+  flutter-version:
+    description: The Flutter version to make available on the path
+    required: false
+    default: ''
+  flutter-version-file:
+    description: The pubspec.yaml or FVM config file with exact Flutter version defined
+    required: false
+    default: ''
+  architecture:
+    description: The architecture of Flutter SDK executable (x64 or arm64)
+    required: false
+    default: ${{ runner.arch }}
+  cache:
+    description: Cache the Flutter SDK
+    required: false
+    default: 'false'
+  cache-key:
+    description: Identifier for the Flutter SDK cache
+    required: false
+    default: ''
+  cache-path:
+    description: Flutter SDK cache path
+    required: false
+    default: ''
+  pub-cache:
+    description: Cache the Dart pub dependencies
+    required: false
+    default: ''
+  pub-cache-key:
+    description: Identifier for the Dart .pub-cache cache
+    required: false
+    default: ''
+  pub-cache-path:
+    description: Flutter pub cache path
+    required: false
+    default: default
+  dry-run:
+    description: If true, get outputs but do not install Flutter
+    required: false
+    default: 'false'
+  git-source:
+    description: Git clone source
+    required: false
+    default: https://github.com/flutter/flutter.git
+outputs:
+  CHANNEL:
+    value: ${{ steps.flutter-action.outputs.CHANNEL }}
+    description: The selected Flutter release channel
+  VERSION:
+    value: ${{ steps.flutter-action.outputs.VERSION }}
+    description: The selected Flutter version
+  ARCHITECTURE:
+    value: ${{ steps.flutter-action.outputs.ARCHITECTURE }}
+    description: The selected Flutter CPU architecture
+  CACHE-KEY:
+    value: ${{ steps.flutter-action.outputs.CACHE-KEY }}
+    description: Key used to cache the Flutter SDK
+  CACHE-PATH:
+    value: ${{ steps.flutter-action.outputs.CACHE-PATH }}
+    description: Path to Flutter SDK
+  PUB-CACHE-KEY:
+    value: ${{ steps.flutter-action.outputs.PUB-CACHE-KEY }}
+    description: Key used to cache the pub dependencies
+  PUB-CACHE-PATH:
+    value: ${{ steps.flutter-action.outputs.PUB-CACHE-PATH }}
+    description: Path to pub cache
+  GIT_SOURCE:
+    value: ${{ steps.flutter-action.outputs.GIT_SOURCE }}
+    description: Git source of Flutter SDK repository to clone
+  CACHE-HIT:
+    value: ${{ steps.cache-flutter.outputs.cache-hit }}
+    description: '`true` if the flutter cache was a hit'
+  PUB-CACHE-HIT:
+    value: ${{ steps.cache-pub.outputs.cache-hit }}
+    description: '`true` if the pub cache was a hit'
+runs:
+  using: composite
+  steps:
+  - name: Require provider transport
+    shell: bash
+    run: |
+      python3 "$GITHUB_ACTION_PATH/../scripts/play_store_proxy.py" --bootstrap-env
+  - name: Retain the cache process scope
+    id: scope
+    if: ${{ inputs.cache == 'true' || inputs.pub-cache == 'true' }}
+    continue-on-error: true
+    shell: bash
+    run: node "$GITHUB_ACTION_PATH/../scripts/cache_scope.cjs" --snapshot
+  - name: Resolve Flutter release and cache identities
+    id: flutter-action
+    uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
+    with:
+      channel: ${{ inputs.channel }}
+      flutter-version: ${{ inputs.flutter-version }}
+      flutter-version-file: ${{ inputs.flutter-version-file }}
+      architecture: ${{ inputs.architecture }}
+      cache: 'false'
+      cache-key: ${{ inputs.cache-key }}
+      cache-path: ${{ inputs.cache-path }}
+      pub-cache: 'false'
+      pub-cache-key: ${{ inputs.pub-cache-key }}
+      pub-cache-path: ${{ inputs.pub-cache-path }}
+      dry-run: 'true'
+      git-source: ${{ inputs.git-source }}
+  - name: Cache Flutter
+    id: cache-flutter
+    if: ${{ inputs.cache == 'true' }}
+    uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25
+    continue-on-error: true
+    env:
+      NODE_OPTIONS: --require "${{ steps.scope.outputs.preloader }}"
+      SEGMENT_DOWNLOAD_TIMEOUT_MINS: '1'
+    with:
+      path: ${{ steps.flutter-action.outputs.CACHE-PATH }}
+      key: ${{ steps.flutter-action.outputs.CACHE-KEY }}
+  - name: Cache pub dependencies
+    id: cache-pub
+    if: ${{ (inputs.pub-cache == '' && inputs.cache == 'true') || inputs.pub-cache == 'true' }}
+    uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25
+    continue-on-error: true
+    env:
+      NODE_OPTIONS: --require "${{ steps.scope.outputs.preloader }}"
+      SEGMENT_DOWNLOAD_TIMEOUT_MINS: '1'
+    with:
+      path: ${{ steps.flutter-action.outputs.PUB-CACHE-PATH }}
+      key: ${{ steps.flutter-action.outputs.PUB-CACHE-KEY }}-${{ hashFiles('**/pubspec.lock') }}
+  - name: Install or reuse the resolved Flutter SDK
+    if: ${{ inputs.dry-run != 'true' }}
+    uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
+    with:
+      channel: ${{ steps.flutter-action.outputs.CHANNEL }}
+      flutter-version: ${{ steps.flutter-action.outputs.VERSION }}
+      flutter-version-file: ''
+      architecture: ${{ steps.flutter-action.outputs.ARCHITECTURE }}
+      cache: 'false'
+      cache-key: ${{ inputs.cache-key }}
+      cache-path: ${{ steps.flutter-action.outputs.CACHE-PATH }}
+      pub-cache: 'false'
+      pub-cache-key: ${{ inputs.pub-cache-key }}
+      pub-cache-path: ${{ steps.flutter-action.outputs.PUB-CACHE-PATH }}
+      dry-run: 'false'
+      git-source: ${{ inputs.git-source }}

package/android-action/scripts/artifact_env.cjs

@@ -0,0 +1,10 @@
+// Only the exact pinned upload-artifact process receives this GitHub-specific transport.
+try {
+  const scope = require('./cache_scope.cjs');
+  scope.authorize(process.argv[1], process.env, 'artifact');
+  scope.guardRequests();
+  for (const key of scope.proxyKeys) delete process.env[key];
+} catch {
+  process.stderr.write('github_artifact_transport_scope_refused\n');
+  process.exit(1);
+}

package/android-action/scripts/cache_env.cjs

@@ -0,0 +1,10 @@
+// NODE_OPTIONS applies this only to the cache step, including its official post/save action.
+try {
+  const scope = require('./cache_scope.cjs');
+  scope.authorize(process.argv[1], process.env);
+  scope.guardRequests();
+  for (const key of scope.proxyKeys) delete process.env[key];
+} catch {
+  process.stderr.write('github_cache_transport_scope_refused\n');
+  process.exit(1);
+}

package/android-action/scripts/cache_scope.cjs

@@ -0,0 +1,81 @@
+// Direct routing belongs only to pinned first-party Actions programs and approved HTTPS origins.
+const {readFileSync, copyFileSync, mkdtempSync, appendFileSync} = require('node:fs');
+const {createHash} = require('node:crypto');
+const {basename, dirname, join} = require('node:path');
+const hashes = new Map([
+  ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
+  ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
+]);
+const artifactHash = '168c44946cba03564808c19b83a72601e6d1d6f57081dbd2d6e2ea1cedc522f5';
+const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];
+const refusal = () => new Error('github_cache_transport_scope_refused');
+
+function allowedHost(host) {
+  return host === 'api.github.com'
+    || /^[a-z0-9.-]+\.actions\.githubusercontent\.com$/.test(host)
+    || /^[a-z0-9]{3,24}\.blob\.core\.windows\.net$/.test(host);
+}
+
+function requireOrigin(value, service = false) {
+  let url;
+  try { url = new URL(value); } catch { throw refusal(); }
+  if (url.protocol !== 'https:' || url.port || url.username || url.password || !allowedHost(url.hostname)
+      || (service && !url.hostname.endsWith('.actions.githubusercontent.com'))) throw refusal();
+  return url;
+}
+
+function authorize(entrypoint, env, kind = 'cache') {
+  if (!entrypoint || basename(entrypoint) !== 'index.js' || basename(dirname(dirname(entrypoint))) !== 'dist') {
+    throw refusal();
+  }
+  if (!['cache', 'artifact'].includes(kind)) throw refusal();
+  const program = basename(dirname(entrypoint));
+  const expected = kind === 'artifact' ? (program === 'upload' && artifactHash) : hashes.get(program);
+  if (!expected || createHash('sha256').update(readFileSync(entrypoint)).digest('hex') !== expected) throw refusal();
+  const origins = (kind === 'artifact' ? [env.ACTIONS_RESULTS_URL]
+    : [env.ACTIONS_RESULTS_URL, env.ACTIONS_CACHE_URL]).filter(Boolean);
+  if (!origins.length) throw refusal();
+  for (const origin of origins) requireOrigin(origin, true);
+}
+
+function requireRequest(args, protocol) {
+  const [input, extra] = args;
+  const options = typeof input === 'string' || input instanceof URL
+    ? {protocol, ...require('node:url').urlToHttpOptions(requireOrigin(input)),
+      ...(typeof extra === 'object' ? extra : {})}
+    : {...input};
+  if (!options || options.socketPath || (options.protocol || protocol) !== 'https:') throw refusal();
+  for (const host of [options.hostname, options.host].filter(Boolean)) {
+    requireOrigin(`https://${host}${options.port ? ':' + options.port : ''}`);
+  }
+  if (!options.hostname && !options.host) throw refusal();
+}
+
+function guardRequests() {
+  for (const [name, protocol] of [['node:http', 'http:'], ['node:https', 'https:']]) {
+    const client = require(name);
+    for (const verb of ['request', 'get']) {
+      const original = client[verb];
+      client[verb] = function (...args) { requireRequest(args, protocol); return original.apply(this, args); };
+    }
+  }
+  if (globalThis.fetch) {
+    const original = globalThis.fetch;
+    globalThis.fetch = function (input, init) {
+      requireOrigin(typeof input === 'string' || input instanceof URL ? input : input.url);
+      return original.call(this, input, {...init, redirect: 'error'});
+    };
+  }
+}
+
+function snapshot() {
+  const target = mkdtempSync(join(process.env.RUNNER_TEMP, 'gowalk-cache-scope-'));
+  for (const file of ['cache_env.cjs', 'cache_scope.cjs']) copyFileSync(join(__dirname, file), join(target, file));
+  appendFileSync(process.env.GITHUB_OUTPUT, `preloader=${join(target, 'cache_env.cjs')}\n`);
+}
+
+module.exports = {authorize, guardRequests, proxyKeys, requireOrigin};
+if (require.main === module) {
+  try { if (process.argv[2] !== '--snapshot') throw refusal(); snapshot(); }
+  catch { process.stderr.write('github_cache_scope_snapshot_failed\n'); process.exitCode = 1; }
+}

package/android-action/scripts/test_flutter_cache_setup.py

@@ -0,0 +1,125 @@
+"""Real pinned SDK setup reuses restored bytes; cold/missed cache stays on the owned proxy."""
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tarfile
+import tempfile
+import threading
+import unittest
+import urllib.request
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+SCRIPT = Path(__file__).with_name("play_store_proxy.py")
+SETUP_SHA = "35f0cd9e9c1d7a643448223573b4a03879e63676fdc27872de3d0104d5bf89f9"
+SETUP_URL = ("https://raw.githubusercontent.com/subosito/flutter-action/"
+             "1a449444c387b1966244ae4d4f8c696479add0b2/setup.sh")
+
+
+class SdkSetupTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        fixture = os.environ.get("GOWALK_CACHE_ACTION_FIXTURES")
+        if fixture:
+            cls.source = (Path(fixture) / "flutter-setup.sh").read_bytes()
+        else:
+            with urllib.request.urlopen(SETUP_URL, timeout=30) as response:
+                cls.source = response.read(128 * 1024)
+        assert hashlib.sha256(cls.source).hexdigest() == SETUP_SHA
+
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.path = Path(self.directory.name)
+        self.setup = self.path / "setup.sh"
+        self.setup.write_bytes(self.source)
+        self.sdk = self.path / "sdk"
+        self.env = {**os.environ, "RUNNER_TEMP": str(self.path), "RUNNER_OS": "Linux", "RUNNER_ARCH": "X64",
+                    "RUNNER_TOOL_CACHE": str(self.path / "tools"), "PUB_CACHE": str(self.path / "pub"),
+                    "FLUTTER_STORAGE_BASE_URL": "http://provider.invalid", "GITHUB_ENV": str(self.path / "env"),
+                    "GITHUB_OUTPUT": str(self.path / "output"), "GITHUB_PATH": str(self.path / "path")}
+        self.calls = []
+        body = io.BytesIO()
+        with tarfile.open(fileobj=body, mode="w:gz") as archive:
+            entry = tarfile.TarInfo("flutter/bin/flutter")
+            content = b"#!/bin/sh\nexit 0\n"
+            entry.size, entry.mode = len(content), 0o755
+            archive.addfile(entry, io.BytesIO(content))
+        self.archive = body.getvalue()
+        self.server = ThreadingHTTPServer(("127.0.0.1", 0), self.handler())
+        threading.Thread(target=self.server.serve_forever, daemon=True).start()
+        self.addCleanup(self.server.server_close)
+        self.addCleanup(self.server.shutdown)
+        self.env["GOOGLE_STORE_PROXY_URL"] = f"http://127.0.0.1:{self.server.server_port}"
+
+    def handler(self):
+        owner = self
+
+        class Handler(BaseHTTPRequestHandler):
+            def do_GET(self):
+                owner.calls.append(self.path)
+                if self.path.endswith(".json"):
+                    data = json.dumps({"releases": [{"channel": "stable", "version": "3.44.0",
+                        "dart_sdk_arch": "x64", "hash": "fixture", "sha256": "fixture",
+                        "archive": "sdk.tar.gz"}]}).encode()
+                else:
+                    data = owner.archive
+                self.send_response(200)
+                self.send_header("Content-Length", str(len(data)))
+                self.end_headers()
+                self.wfile.write(data)
+
+            def log_message(self, *_args):
+                pass
+
+        return Handler
+
+    def bootstrap(self):
+        result = subprocess.run([sys.executable, "-S", str(SCRIPT), "--bootstrap-env"],
+                                env=self.env, capture_output=True, text=True, timeout=10)
+        if result.returncode == 0:
+            self.env.update(line.split("=", 1) for line in (self.path / "env").read_text().splitlines())
+        return result
+
+    def install(self):
+        return subprocess.run(["bash", str(self.setup), "-n", "3.44.0", "-a", "x64", "-c", str(self.sdk),
+                               "stable"], env=self.env, capture_output=True, text=True, timeout=10)
+
+    def test_restored_sdk_fetches_only_manifest_through_proxy(self):
+        target = self.sdk / "flutter/bin/flutter"
+        target.parent.mkdir(parents=True)
+        target.write_text("#!/bin/sh\nexit 0\n")
+        target.chmod(0o755)
+        self.assertEqual(self.bootstrap().returncode, 0)
+        result = self.install()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(self.calls, ["http://provider.invalid/flutter_infra_release/releases/releases_linux.json"])
+
+    def test_cold_cache_downloads_and_installs_sdk_through_proxy(self):
+        self.assertEqual(self.bootstrap().returncode, 0)
+        result = self.install()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual([url.rsplit("/", 1)[-1] for url in self.calls], ["releases_linux.json", "sdk.tar.gz"])
+        self.assertTrue(os.access(self.sdk / "flutter/bin/flutter", os.X_OK))
+
+    def test_provider_failure_after_cache_miss_still_fails_setup(self):
+        self.archive = b"not-a-valid-sdk-archive"
+        self.assertEqual(self.bootstrap().returncode, 0)
+        result = self.install()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertFalse((self.sdk / "flutter/bin/flutter").exists())
+        self.assertEqual(len(self.calls), 2)
+
+    def test_missing_pin_refuses_before_manifest_even_with_restored_sdk(self):
+        self.env.pop("GOOGLE_STORE_PROXY_URL")
+        result = self.bootstrap()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertFalse((self.path / "env").exists())
+        self.assertEqual(self.calls, [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_google_bootstrap_wiring.py

@@ -16,16 +16,55 @@ class BootstrapWiringTests(unittest.TestCase):
             for job in workflow["jobs"].values():
                 steps = job.get("steps", [])
                 for index, step in enumerate(steps):
-                    if not step.get("uses", "").startswith("subosito/flutter-action@"):
+                    if not step.get("uses", "").endswith("/android-app/flutter-setup"):
                         continue
                     checked += 1
-                    guard = steps[index - 1]
-                    self.assertEqual(guard.get("if"), step.get("if"))
                     self.assertEqual(job["env"]["GOOGLE_STORE_PROXY_URL"],
                                      "${{ secrets.GOOGLE_STORE_PROXY_URL }}")
-                    self.assertTrue(guard["run"].endswith("play_store_proxy.py --bootstrap-env"))
-                    self.assertNotIn("continue-on-error", guard)
+                    self.assertNotIn("continue-on-error", step)
         self.assertEqual(checked, 3)
+        setup = yaml.safe_load((ROOT / "android-action/flutter-setup/action.yml").read_text())
+        guard, scope, resolve, sdk_cache, pub_cache, install = setup["runs"]["steps"]
+        self.assertIn('play_store_proxy.py" --bootstrap-env', guard["run"])
+        self.assertNotIn("continue-on-error", guard)
+        self.assertTrue(scope["continue-on-error"])
+        self.assertIn("--snapshot", scope["run"])
+        self.assertEqual(resolve["with"]["dry-run"], "true")
+        for step in (resolve, install):
+            self.assertNotIn("env", step)
+            self.assertEqual(step["with"]["cache"], "false")
+            self.assertEqual(step["with"]["pub-cache"], "false")
+            self.assertNotIn("continue-on-error", step)
+        for step in (sdk_cache, pub_cache):
+            self.assertTrue(step["continue-on-error"])
+            self.assertIn("steps.scope.outputs.preloader", step["env"]["NODE_OPTIONS"])
+            self.assertEqual(step["env"]["SEGMENT_DOWNLOAD_TIMEOUT_MINS"], "1")
+
+    def test_official_flutter_custom_input_and_output_contract_is_preserved(self):
+        setup = yaml.safe_load((ROOT / "android-action/flutter-setup/action.yml").read_text())
+        inputs = {"channel", "flutter-version", "flutter-version-file", "architecture", "cache", "cache-key",
+                  "cache-path", "pub-cache", "pub-cache-key", "pub-cache-path", "dry-run", "git-source"}
+        self.assertEqual(set(setup["inputs"]), inputs)
+        resolve = next(step for step in setup["runs"]["steps"] if step.get("id") == "flutter-action")
+        for name in inputs - {"cache", "pub-cache", "dry-run"}:
+            self.assertEqual(resolve["with"][name], "${{ inputs." + name + " }}")
+        self.assertEqual(setup["outputs"]["CACHE-HIT"]["value"], "${{ steps.cache-flutter.outputs.cache-hit }}")
+        self.assertEqual(setup["outputs"]["PUB-CACHE-HIT"]["value"], "${{ steps.cache-pub.outputs.cache-hit }}")
+
+    def test_pods_cache_keeps_identity_and_uses_the_same_optional_scope(self):
+        workflow = yaml.safe_load((ROOT / "templates/deploy.yml").read_text())
+        steps = workflow["jobs"]["ios"]["steps"]
+        cache = next(step for step in steps if step.get("name") == "Cache CocoaPods")
+        scope = next(step for step in steps if step.get("id") == "pods-cache-scope")
+        self.assertTrue(scope["continue-on-error"])
+        self.assertTrue(cache["continue-on-error"])
+        self.assertEqual(scope["if"], cache["if"])
+        self.assertIn("scripts/cache_scope.cjs --snapshot", scope["run"])
+        self.assertIn("steps.pods-cache-scope.outputs.preloader", cache["env"]["NODE_OPTIONS"])
+        self.assertEqual(cache["uses"], "actions/cache@caa296126883cff596d87d8935842f9db880ef25")
+        self.assertEqual(cache["with"]["path"], "ios/Pods\n~/Library/Caches/CocoaPods\n")
+        self.assertEqual(cache["with"]["key"],
+                         "pods-${{ runner.os }}-${{ hashFiles('ios/Podfile.lock', 'pubspec.lock') }}")
 
     def test_remaining_flutter_commands_run_inside_the_owned_relay(self):
         groups = []

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.70
+1.0.72

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.70",
+  "version": "1.0.72",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-web.yml

@@ -30,12 +30,7 @@ jobs:
       GOOGLE_STORE_PROXY_URL: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-      - name: Require the Google proxy before Flutter SDK setup
-        shell: bash
-        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
-      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
-        env:
-          SEGMENT_DOWNLOAD_TIMEOUT_MINS: "1"
+      - uses: ./.github/actions/android-app/flutter-setup
         with:
           channel: stable
           cache: true
@@ -61,6 +56,8 @@ jobs:
           flutter build web --release --build-number="${GITHUB_RUN_NUMBER}"
       - name: Retain Flutter web release
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ github.workspace }}/.github/actions/android-app/scripts/artifact_env.cjs"
         with:
           name: web-${{ github.event.repository.name }}-${{ github.run_number }}
           path: build/web

package/templates/deploy.yml

@@ -77,22 +77,25 @@ jobs:
           else
             echo "enabled=false" >> "$GITHUB_OUTPUT"
           fi
-      - name: Require the Google proxy before Flutter SDK setup
-        if: ${{ steps.flutter.outputs.enabled == 'true' }}
-        shell: bash
-        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
       - name: Set up Flutter
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
-        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
-        env:
-          # Optional SDK/pub cache segments must finish promptly; normal SDK setup still fails on errors.
-          SEGMENT_DOWNLOAD_TIMEOUT_MINS: "1"
+        uses: ./.github/actions/android-app/flutter-setup
         with:
           channel: stable
           cache: true
+      - name: Retain CocoaPods cache process scope
+        id: pods-cache-scope
+        if: ${{ steps.flutter.outputs.enabled == 'true' }}
+        continue-on-error: true
+        shell: bash
+        run: node .github/actions/android-app/scripts/cache_scope.cjs --snapshot
       - name: Cache CocoaPods
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5, same pinned cache process as Flutter
+        continue-on-error: true
+        env:
+          NODE_OPTIONS: --require "${{ steps.pods-cache-scope.outputs.preloader }}"
+          SEGMENT_DOWNLOAD_TIMEOUT_MINS: "1"
         with:
           path: |
             ios/Pods
@@ -212,6 +215,8 @@ jobs:
       - name: Retain Dart symbol files
         if: ${{ !cancelled() && steps.ios_symbols.outputs.present == 'true' }}
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
         with:
           name: ios-symbols-${{ github.event.repository.name }}-${{ env.BUILD_NUMBER || github.run_number }}
           path: ${{ runner.temp }}/dart-symbols/ios
@@ -335,15 +340,9 @@ jobs:
           distribution: temurin
           java-version: ${{ steps.jdk.outputs.version }}
           cache: gradle
-      - name: Require the Google proxy before Flutter SDK setup
-        if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
-        shell: bash
-        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --bootstrap-env
       - name: Set up Flutter
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
-        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
-        env:
-          SEGMENT_DOWNLOAD_TIMEOUT_MINS: "1"
+        uses: ./.github/actions/android-app/flutter-setup
         with:
           channel: stable
           cache: true
@@ -438,6 +437,8 @@ jobs:
       - name: Retain signed Android App Bundle
         if: ${{ steps.mode.outputs.mode == 'local' }}
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ github.workspace }}/.github/actions/android-app/scripts/artifact_env.cjs"
         with:
           name: android-${{ steps.android.outputs.package-name }}-${{ steps.android.outputs.build-number }}
           path: ${{ steps.android.outputs.bundle-path }}