gowalk-cicd 1.0.71 → 1.0.72

package/CLAUDE.md

@@ -151,6 +151,14 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   errors still fail the job. Never use `continue-on-error` or a timeout around all SDK setup
   to hide an optional cache failure. Do not alter cache keys or disable caches as part of
   this timeout handling.
+- GitHub artifact uploads have their own checksum-pinned `artifact_env.cjs` process scope.
+  It reuses the cache transport's approved HTTPS request guard, then removes inherited proxy
+  variables only inside the official `upload-artifact` process. Unknown programs/origins refuse;
+  later Apple/Google clients retain their proxies and artifact failures remain job failures.
+  The iOS action reads this helper from its immutable `SWIFT_APP_ACTION` snapshot. Its shared
+  `cache_scope.cjs` and `artifact_env.cjs` copies match the Android distribution byte for byte,
+  enforced by `test/artifact-wiring.test.mjs`; update both when changing that common guard.
+  Update existing consumer workflow artifact steps as well as action directories on adoption.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and
   supplies it to Compose after the generated `.env`; never print its content.
@@ -165,6 +173,13 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie
   because a Flutter app also carries `android/settings.gradle`.
+- iOS plist stamping reads complete JSON build settings through `resolve_info_plist.py`,
+  preserving Xcode's exit status and bounded sanitized stderr. Select exactly the configured
+  bundle's application target and resolve paths from that target's source root; never take
+  the first dependency plist or stop reading Xcode output early. The encryption step reuses
+  the validated source path. Missing/ambiguous source plists fail; positively generated
+  plists retain the existing build-setting version path. Queries disable signing and package
+  updates, retain inherited proxies, and never enable provisioning network operations.
 - Version stamping is per-build-system: Flutter takes `--build-number`, Gradle
   has no equivalent, so `set_gradle_version()` rewrites the literal in the
   checkout the way the iOS action patches the pbxproj. Never commit that edit.

package/README.md

@@ -647,6 +647,15 @@ without the repository secret cannot start provider downloads through these work
 The Apple uploader retains `apple-upload-<run>-<attempt>` receipts with IPA SHA-256,
 upload ID and processing readback, and resumes matching bytes after interruption.
 
+GitHub artifact traffic uses a separate, per-action transport scope. The exact pinned
+`actions/upload-artifact` client can reach approved GitHub Results and artifact-storage
+HTTPS origins without inheriting the store proxy; unknown programs and destinations are
+refused. The scope ends with that Node process. Apple/Google calls retain their assigned
+exit, and a failed artifact creation, transfer or finalization still fails delivery.
+Adoption requires updating workflow upload steps as well as the distributed actions while
+preserving each app's custom checks and artifact retention settings. This fixes the proven
+inherited-proxy path; an isolated `ECONNRESET` does not identify every possible network fault.
+
 1. **Auto-detects** your `.xcodeproj` / `.xcworkspace`, scheme, bundle ID,
    and `team_id` (from the ASC API key). No `ci.config.yaml` required —
    override via action inputs only if auto-detection fails.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.71
+1.0.72

package/action/action.yml

@@ -601,51 +601,14 @@ runs:
         WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
         SCHEME: ${{ inputs.scheme || env.CFG_SCHEME }}
         CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
+        BUNDLE_ID: ${{ inputs.bundle-id || env.CFG_BUNDLE_ID }}
       run: |
         set -o pipefail
-        # Some Xcode projects hardcode CFBundleVersion / CFBundleShortVersionString
-        # as literal values in Info.plist instead of using $(CURRENT_PROJECT_VERSION)
-        # and $(MARKETING_VERSION) substitution. When that's the case, passing
-        # CURRENT_PROJECT_VERSION=N on the xcodebuild CLI has no effect on the
-        # archived plist and altool rejects the upload with
-        # `previousBundleVersion`. Stamp the resolved source Info.plist directly
-        # so the archive ships with the computed values regardless of whether
-        # the plist uses substitutions or hardcoded literals.
-        if [ -n "$WORKSPACE" ]; then
-          PROJ_ARGS=(-workspace "$WORKSPACE")
-          PROJ_BASE=$(dirname "$WORKSPACE")
-        else
-          PROJ_ARGS=(-project "$PROJECT")
-          PROJ_BASE=$(dirname "$PROJECT")
-        fi
-        # Try agvtool first — it's Apple's official tool and handles projects
-        # using the generic versioning system. Harmless no-op on projects
-        # without VERSIONING_SYSTEM set. Run from the project directory.
-        # Marketing version is intentionally NOT stamped here: the project's
-        # MARKETING_VERSION build setting is the single source of truth and
-        # was already resolved into env earlier; CI must never mutate it.
-        (
-          cd "$PROJ_BASE" 2>/dev/null || exit 0
-          xcrun agvtool new-version -all "$BUILD_NUMBER" >/dev/null 2>&1 || true
-        )
-        # Now resolve the actual Info.plist path and stamp literal values.
-        # This is idempotent with agvtool and also covers projects where the
-        # plist has hardcoded numbers (the sample1 failure mode).
-        INFOPLIST=$(xcodebuild "${PROJ_ARGS[@]}" -scheme "$SCHEME" -configuration "${CONFIGURATION:-Release}" \
-                      -showBuildSettings 2>/dev/null \
-                    | awk -F' = ' '/^[[:space:]]*INFOPLIST_FILE/ {
-                        gsub(/^[[:space:]]+|[[:space:]]+$/,"",$2); print $2; exit
-                      }')
-        if [ -z "$INFOPLIST" ]; then
-          echo "::warning::INFOPLIST_FILE not set for scheme $SCHEME; skipping version stamping"
-          exit 0
-        fi
-        INFOPLIST_PATH="$PROJ_BASE/$INFOPLIST"
-        if [ ! -f "$INFOPLIST_PATH" ]; then
-          INFOPLIST_PATH="$INFOPLIST"
-        fi
-        if [ ! -f "$INFOPLIST_PATH" ]; then
-          echo "::warning::Info.plist not found at $INFOPLIST_PATH; skipping version stamping"
+        # Read every target's complete settings and preserve Xcode's actual status/error.
+        # The selected application's source root can differ from its containing workspace.
+        INFOPLIST_PATH=$(python3 "$SWIFT_APP_ACTION/scripts/resolve_info_plist.py")
+        if [ -z "$INFOPLIST_PATH" ]; then
+          echo "Generated Info.plist: Archive supplies CURRENT_PROJECT_VERSION and MARKETING_VERSION"
           exit 0
         fi
         /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $BUILD_NUMBER" "$INFOPLIST_PATH" 2>/dev/null \
@@ -665,29 +628,15 @@ runs:
         VALUE: ${{ inputs.uses-non-exempt-encryption || env.CFG_USES_NON_EXEMPT }}
       run: |
         set -o pipefail
-        if [ -n "$WORKSPACE" ]; then
-          PROJ_ARGS=(-workspace "$WORKSPACE")
-          PROJ_BASE=$(dirname "$WORKSPACE")
-        else
-          PROJ_ARGS=(-project "$PROJECT")
-          PROJ_BASE=$(dirname "$PROJECT")
-        fi
-        INFOPLIST=$(xcodebuild "${PROJ_ARGS[@]}" -scheme "$SCHEME" -configuration "${CONFIGURATION:-Release}" \
-                      -showBuildSettings 2>/dev/null \
-                    | awk -F' = ' '/^[[:space:]]*INFOPLIST_FILE/ {
-                        gsub(/^[[:space:]]+|[[:space:]]+$/,"",$2); print $2; exit
-                      }')
-        if [ -z "$INFOPLIST" ]; then
-          echo "::warning::INFOPLIST_FILE not set for scheme $SCHEME; skipping ITSAppUsesNonExemptEncryption"
+        # Reuse the validated application path from version stamping; no second Xcode query.
+        INFOPLIST_PATH="${SWIFT_APP_SOURCE_INFOPLIST?Source plist resolution did not complete}"
+        if [ -z "$INFOPLIST_PATH" ]; then
+          echo "::warning::The application generates Info.plist; no source plist to edit for encryption"
           exit 0
         fi
-        INFOPLIST_PATH="$PROJ_BASE/$INFOPLIST"
-        if [ ! -f "$INFOPLIST_PATH" ]; then
-          INFOPLIST_PATH="$INFOPLIST"
-        fi
         if [ ! -f "$INFOPLIST_PATH" ]; then
-          echo "::warning::Info.plist not found at $INFOPLIST_PATH; skipping"
-          exit 0
+          echo "::error::The resolved application Info.plist is no longer present"
+          exit 1
         fi
         /usr/libexec/PlistBuddy -c "Set :ITSAppUsesNonExemptEncryption $VALUE" "$INFOPLIST_PATH" 2>/dev/null \
           || /usr/libexec/PlistBuddy -c "Add :ITSAppUsesNonExemptEncryption bool $VALUE" "$INFOPLIST_PATH"
@@ -815,6 +764,8 @@ runs:
     - name: Preserve the Firebase console upload artifact
       if: ${{ always() && inputs.archive == 'true' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      env:
+        NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
       with:
         name: ios-crashlytics-symbols-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/firebase-symbols/
@@ -834,6 +785,8 @@ runs:
     - name: Retain Apple upload receipt
       if: ${{ always() && inputs.archive == 'true' && inputs.upload == 'true' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      env:
+        NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
       with:
         name: apple-upload-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/apple-build-upload.json
@@ -845,6 +798,8 @@ runs:
     - name: Retain the exported IPA for upload recovery
       if: ${{ always() && inputs.archive == 'true' && inputs.upload == 'true' && steps.upload.outcome != 'success' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      env:
+        NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
       with:
         name: apple-ipa-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/export/*.ipa

package/action/scripts/artifact_env.cjs

@@ -0,0 +1,10 @@
+// Only the exact pinned upload-artifact process receives this GitHub-specific transport.
+try {
+  const scope = require('./cache_scope.cjs');
+  scope.authorize(process.argv[1], process.env, 'artifact');
+  scope.guardRequests();
+  for (const key of scope.proxyKeys) delete process.env[key];
+} catch {
+  process.stderr.write('github_artifact_transport_scope_refused\n');
+  process.exit(1);
+}

package/action/scripts/cache_scope.cjs

@@ -0,0 +1,81 @@
+// Direct routing belongs only to pinned first-party Actions programs and approved HTTPS origins.
+const {readFileSync, copyFileSync, mkdtempSync, appendFileSync} = require('node:fs');
+const {createHash} = require('node:crypto');
+const {basename, dirname, join} = require('node:path');
+const hashes = new Map([
+  ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
+  ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
+]);
+const artifactHash = '168c44946cba03564808c19b83a72601e6d1d6f57081dbd2d6e2ea1cedc522f5';
+const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];
+const refusal = () => new Error('github_cache_transport_scope_refused');
+
+function allowedHost(host) {
+  return host === 'api.github.com'
+    || /^[a-z0-9.-]+\.actions\.githubusercontent\.com$/.test(host)
+    || /^[a-z0-9]{3,24}\.blob\.core\.windows\.net$/.test(host);
+}
+
+function requireOrigin(value, service = false) {
+  let url;
+  try { url = new URL(value); } catch { throw refusal(); }
+  if (url.protocol !== 'https:' || url.port || url.username || url.password || !allowedHost(url.hostname)
+      || (service && !url.hostname.endsWith('.actions.githubusercontent.com'))) throw refusal();
+  return url;
+}
+
+function authorize(entrypoint, env, kind = 'cache') {
+  if (!entrypoint || basename(entrypoint) !== 'index.js' || basename(dirname(dirname(entrypoint))) !== 'dist') {
+    throw refusal();
+  }
+  if (!['cache', 'artifact'].includes(kind)) throw refusal();
+  const program = basename(dirname(entrypoint));
+  const expected = kind === 'artifact' ? (program === 'upload' && artifactHash) : hashes.get(program);
+  if (!expected || createHash('sha256').update(readFileSync(entrypoint)).digest('hex') !== expected) throw refusal();
+  const origins = (kind === 'artifact' ? [env.ACTIONS_RESULTS_URL]
+    : [env.ACTIONS_RESULTS_URL, env.ACTIONS_CACHE_URL]).filter(Boolean);
+  if (!origins.length) throw refusal();
+  for (const origin of origins) requireOrigin(origin, true);
+}
+
+function requireRequest(args, protocol) {
+  const [input, extra] = args;
+  const options = typeof input === 'string' || input instanceof URL
+    ? {protocol, ...require('node:url').urlToHttpOptions(requireOrigin(input)),
+      ...(typeof extra === 'object' ? extra : {})}
+    : {...input};
+  if (!options || options.socketPath || (options.protocol || protocol) !== 'https:') throw refusal();
+  for (const host of [options.hostname, options.host].filter(Boolean)) {
+    requireOrigin(`https://${host}${options.port ? ':' + options.port : ''}`);
+  }
+  if (!options.hostname && !options.host) throw refusal();
+}
+
+function guardRequests() {
+  for (const [name, protocol] of [['node:http', 'http:'], ['node:https', 'https:']]) {
+    const client = require(name);
+    for (const verb of ['request', 'get']) {
+      const original = client[verb];
+      client[verb] = function (...args) { requireRequest(args, protocol); return original.apply(this, args); };
+    }
+  }
+  if (globalThis.fetch) {
+    const original = globalThis.fetch;
+    globalThis.fetch = function (input, init) {
+      requireOrigin(typeof input === 'string' || input instanceof URL ? input : input.url);
+      return original.call(this, input, {...init, redirect: 'error'});
+    };
+  }
+}
+
+function snapshot() {
+  const target = mkdtempSync(join(process.env.RUNNER_TEMP, 'gowalk-cache-scope-'));
+  for (const file of ['cache_env.cjs', 'cache_scope.cjs']) copyFileSync(join(__dirname, file), join(target, file));
+  appendFileSync(process.env.GITHUB_OUTPUT, `preloader=${join(target, 'cache_env.cjs')}\n`);
+}
+
+module.exports = {authorize, guardRequests, proxyKeys, requireOrigin};
+if (require.main === module) {
+  try { if (process.argv[2] !== '--snapshot') throw refusal(); snapshot(); }
+  catch { process.stderr.write('github_cache_scope_snapshot_failed\n'); process.exitCode = 1; }
+}

package/action/scripts/resolve_info_plist.py

@@ -0,0 +1,128 @@
+#!/usr/bin/env python3
+"""Read complete Xcode settings once and select the requested application's source plist."""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+
+APP_TYPE = "com.apple.product-type.application"
+_VARIABLE = re.compile(r"\$\(([^)]+)\)|\$\{([^}]+)\}")
+
+
+class SettingsFailed(RuntimeError):
+    def __init__(self, message: str, code: int = 1):
+        super().__init__(message)
+        self.code = code
+
+
+def diagnostic(text: str) -> str:
+    for key, value in os.environ.items():
+        if len(value) >= 4 and re.search(r"SECRET|TOKEN|PASSWORD|PROXY|PRIVATE_KEY", key, re.I):
+            text = text.replace(value, "[redacted]")
+    text = re.sub(r"https?://[^\s]+", "[URL redacted]", text)
+    text = re.sub(r"\x1b\[[0-?]*[ -/]*[@-~]", "", text)
+    return "\n".join("xcodebuild: " + line for line in text[-8000:].splitlines()[-60:])
+
+
+def read_settings(project: str, workspace: str, scheme: str, configuration: str, logs: Path) -> list:
+    if not scheme or not (workspace or project):
+        raise SettingsFailed("Project/workspace and scheme are required for source plist resolution")
+    command = ["xcodebuild", "-workspace" if workspace else "-project", workspace or project,
+               "-scheme", scheme, "-configuration", configuration or "Release", "-sdk", "iphoneos",
+               "-destination", "generic/platform=iOS", "-disableAutomaticPackageResolution", "-skipPackageUpdates",
+               "CODE_SIGNING_ALLOWED=NO", "CODE_SIGNING_REQUIRED=NO", "CODE_SIGN_IDENTITY=", "DEVELOPMENT_TEAM=",
+               "-showBuildSettings", "-json"]
+    logs.mkdir(parents=True, exist_ok=True, mode=0o700)
+    os.chmod(logs, 0o700)
+    output, errors = logs / "build-settings.json", logs / "build-settings.stderr"
+    # File sinks consume the entire producer output. An early pipe reader can hide its actual status.
+    with output.open("wb") as stdout, errors.open("wb") as stderr:
+        os.chmod(output, 0o600)
+        os.chmod(errors, 0o600)
+        timed_out = False
+        try:
+            result = subprocess.run(command, stdout=stdout, stderr=stderr, timeout=300, check=False)
+            code = result.returncode if result.returncode >= 0 else 128 - result.returncode
+        except subprocess.TimeoutExpired:
+            timed_out, code = True, 124
+    if code:
+        detail = diagnostic(errors.read_text(errors="replace"))
+        if detail:
+            print(detail, file=sys.stderr)
+        reason = "timed out after 300 seconds" if timed_out else f"failed with exit {code}"
+        raise SettingsFailed(f"xcodebuild -showBuildSettings {reason}", code)
+    try:
+        settings = json.loads(output.read_text())
+    except (ValueError, UnicodeError):
+        raise SettingsFailed("xcodebuild returned invalid build-settings JSON") from None
+    if not isinstance(settings, list):
+        raise SettingsFailed("xcodebuild build-settings response must be a target list")
+    return settings
+
+
+def application(settings: list, bundle_id: str) -> dict:
+    candidates = []
+    for row in settings:
+        values = row.get("buildSettings") if isinstance(row, dict) else None
+        if not isinstance(values, dict) or values.get("PRODUCT_TYPE") != APP_TYPE:
+            continue
+        if not bundle_id or values.get("PRODUCT_BUNDLE_IDENTIFIER") == bundle_id:
+            candidates.append(values)
+    if len(candidates) != 1:
+        raise SettingsFailed("Expected exactly one application target matching the configured bundle identifier")
+    return candidates[0]
+
+
+def source_plist(settings: dict, checkout: Path) -> Path | None:
+    value = str(settings.get("INFOPLIST_FILE") or "").strip()
+    if not value:
+        if settings.get("GENERATE_INFOPLIST_FILE") == "YES":
+            return None
+        raise SettingsFailed("The application has no source Info.plist and does not enable generated Info.plist")
+    for _ in range(5):
+        expanded = _VARIABLE.sub(lambda match: str(settings.get(match[1] or match[2], match[0])), value)
+        if expanded == value:
+            break
+        value = expanded
+    if _VARIABLE.search(value) or "\n" in value or "\r" in value:
+        raise SettingsFailed("The application's Info.plist path contains an unresolved or invalid setting")
+    path = Path(value)
+    if not path.is_absolute():
+        source = settings.get("SRCROOT") or settings.get("PROJECT_DIR")
+        if not source:
+            raise SettingsFailed("The application target did not provide its source root")
+        path = Path(source) / path
+    path = path.resolve()
+    if "\n" in str(path) or "\r" in str(path):
+        raise SettingsFailed("The resolved source plist cannot be represented in the job environment")
+    if not path.is_relative_to(checkout.resolve()) or not path.is_file():
+        raise SettingsFailed("The application source Info.plist is missing or outside the checkout")
+    return path
+
+
+def main() -> int:
+    try:
+        logs = Path(os.environ["RUNNER_TEMP"]) / "swift-app-build-settings"
+        rows = read_settings(os.environ.get("PROJECT", ""), os.environ.get("WORKSPACE", ""),
+                             os.environ.get("SCHEME", ""), os.environ.get("CONFIGURATION", "Release"), logs)
+        selected = source_plist(application(rows, os.environ.get("BUNDLE_ID", "")), Path.cwd())
+        value = str(selected) if selected else ""
+        with Path(os.environ["GITHUB_ENV"]).open("a") as stream:
+            stream.write(f"SWIFT_APP_SOURCE_INFOPLIST={value}\n")
+        print(value)
+        return 0
+    except SettingsFailed as exc:
+        print(f"::error title=Application build settings::{exc}", file=sys.stderr)
+        return exc.code
+    except (KeyError, OSError):
+        print("::error title=Application build settings::Required settings tooling or private output is unavailable",
+              file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/action/scripts/test_resolve_info_plist.py

@@ -0,0 +1,120 @@
+"""Consume real producer output/status, then select only the app's own source plist."""
+from contextlib import redirect_stderr
+import io
+import json
+import os
+from pathlib import Path
+import tempfile
+import unittest
+from unittest.mock import patch
+
+import resolve_info_plist as subject
+
+
+class ResolveInfoPlistTest(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.source = self.root / 'Nested Project' / 'Application Info.plist'
+        self.source.parent.mkdir()
+        self.source.write_text('<plist/>')
+        self.values = {'PRODUCT_TYPE': subject.APP_TYPE, 'PRODUCT_BUNDLE_IDENTIFIER': 'test.local.app',
+                       'SRCROOT': str(self.source.parent), 'INFOPLIST_FILE': self.source.name}
+
+    def producer(self, body):
+        tool = self.root / 'xcodebuild'
+        tool.write_text('#!/usr/bin/env python3\n' + body)
+        tool.chmod(0o700)
+        return patch.dict(os.environ, {'PATH': str(self.root) + os.pathsep + os.environ['PATH']})
+
+    def test_drains_large_output_and_preserves_arguments_and_inherited_proxy(self):
+        record = self.root / 'invocation.json'
+        rows = [{'buildSettings': dict(self.values, LARGE='x' * 500000)}]
+        body = ("import json,os,sys\n"
+                f"open({str(record)!r},'w').write(json.dumps([sys.argv[1:],os.getenv('HTTPS_PROXY')]))\n"
+                f"sys.stdout.write({json.dumps(rows)!r})\n")
+        with self.producer(body), patch.dict(os.environ, {'HTTPS_PROXY': 'http://fixture-proxy.invalid:9000'}):
+            result = subject.read_settings('App.xcodeproj', '', 'App', 'Release', self.root / 'logs')
+        self.assertEqual(result, rows)
+        args, proxy = json.loads(record.read_text())
+        self.assertEqual(proxy, 'http://fixture-proxy.invalid:9000')
+        self.assertIn('-disableAutomaticPackageResolution', args)
+        self.assertIn('-skipPackageUpdates', args)
+        self.assertIn('CODE_SIGNING_ALLOWED=NO', args)
+        self.assertEqual(args[-2:], ['-showBuildSettings', '-json'])
+        self.assertNotIn('-allowProvisioningUpdates', args)
+
+    def test_exit_74_is_not_an_empty_success_and_error_is_bounded_private(self):
+        stderr = io.StringIO()
+        error = 'x' * 20000 + '\nCould not resolve package: https://private.invalid/token-secret token-secret\n'
+        body = f"import sys\nsys.stderr.write({error!r})\nsys.stdout.write('[]')\nsys.exit(74)\n"
+        with self.producer(body), patch.dict(os.environ, {'APP_SECRET': 'token-secret'}), redirect_stderr(stderr):
+            with self.assertRaises(subject.SettingsFailed) as raised:
+                subject.read_settings('App.xcodeproj', '', 'App', 'Release', self.root / 'logs')
+        self.assertEqual(raised.exception.code, 74)
+        self.assertIn('Could not resolve package', stderr.getvalue())
+        self.assertNotIn('token-secret', stderr.getvalue())
+        self.assertNotIn('private.invalid', stderr.getvalue())
+        self.assertLess(len(stderr.getvalue()), 8200)
+        self.assertTrue((self.root / 'logs' / 'build-settings.stderr').is_file())
+        for output in ['not-json', '{}']:
+            with self.producer(f"print({output!r})\n"):
+                with self.assertRaises(subject.SettingsFailed):
+                    subject.read_settings('App.xcodeproj', '', 'App', 'Release', self.root / 'logs')
+
+    def test_selects_bundle_matched_application_not_first_dependency_or_other_app(self):
+        dependency = dict(self.values, PRODUCT_TYPE='com.apple.product-type.framework', INFOPLIST_FILE='Other.plist')
+        other = dict(self.values, PRODUCT_BUNDLE_IDENTIFIER='test.local.other')
+        rows = [{'buildSettings': row} for row in [dependency, other, self.values]]
+        chosen = subject.application(rows, 'test.local.app')
+        self.assertEqual(subject.source_plist(chosen, self.root), self.source.resolve())
+        with self.assertRaises(subject.SettingsFailed):
+            subject.application(rows, '')
+        with self.assertRaises(subject.SettingsFailed):
+            subject.application(rows, 'test.local.absent')
+
+    def test_ambiguous_same_bundle_and_malformed_targets_refuse(self):
+        for rows in [[{'buildSettings': self.values}] * 2, [{'buildSettings': []}], [None]]:
+            with self.assertRaises(subject.SettingsFailed):
+                subject.application(rows, 'test.local.app')
+
+    def test_relative_and_variable_plist_paths_use_the_target_root(self):
+        values = dict(self.values, INFOPLIST_FILE='$(SRCROOT)/Application Info.plist')
+        self.assertEqual(subject.source_plist(values, self.root), self.source.resolve())
+        values['INFOPLIST_FILE'] = '${UNKNOWN}/Info.plist'
+        with self.assertRaises(subject.SettingsFailed):
+            subject.source_plist(values, self.root)
+        newline_root = self.root / 'project\nname'
+        newline_root.mkdir()
+        (newline_root / self.source.name).write_text('<plist/>')
+        values = dict(self.values, SRCROOT=str(newline_root))
+        with self.assertRaises(subject.SettingsFailed):
+            subject.source_plist(values, self.root)
+
+    def test_missing_outside_and_generated_paths_are_distinct(self):
+        for values in [dict(self.values, INFOPLIST_FILE='Missing.plist'),
+                       dict(self.values, INFOPLIST_FILE='/etc/hosts'),
+                       dict(self.values, INFOPLIST_FILE='')]:
+            with self.assertRaises(subject.SettingsFailed):
+                subject.source_plist(values, self.root)
+        generated = dict(self.values, INFOPLIST_FILE='', GENERATE_INFOPLIST_FILE='YES')
+        self.assertIsNone(subject.source_plist(generated, self.root))
+
+    def test_timeout_keeps_error_evidence_and_does_not_retry(self):
+        import subprocess
+
+        stderr = io.StringIO()
+        def timed_out(command, **kwargs):
+            kwargs['stderr'].write(b'package graph was unavailable')
+            raise subprocess.TimeoutExpired(command, 300)
+        with patch.object(subject.subprocess, 'run', side_effect=timed_out) as run, redirect_stderr(stderr):
+            with self.assertRaises(subject.SettingsFailed) as raised:
+                subject.read_settings('App.xcodeproj', '', 'App', 'Release', self.root / 'logs')
+        self.assertEqual(raised.exception.code, 124)
+        self.assertEqual(run.call_count, 1)
+        self.assertIn('package graph was unavailable', stderr.getvalue())
+
+
+if __name__ == '__main__':
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.71
+1.0.72

package/android-action/action.yml

@@ -191,6 +191,8 @@ runs:
     - name: Retain Dart symbol files
       if: ${{ steps.config.outputs.project_kind == 'flutter' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      env:
+        NODE_OPTIONS: --require "${{ github.action_path }}/scripts/artifact_env.cjs"
       with:
         name: android-symbols-${{ steps.config.outputs.package_name }}-${{ steps.config.outputs.build_number }}
         path: ${{ steps.flutter_build.outputs.symbols_path }}

package/android-action/scripts/artifact_env.cjs

@@ -0,0 +1,10 @@
+// Only the exact pinned upload-artifact process receives this GitHub-specific transport.
+try {
+  const scope = require('./cache_scope.cjs');
+  scope.authorize(process.argv[1], process.env, 'artifact');
+  scope.guardRequests();
+  for (const key of scope.proxyKeys) delete process.env[key];
+} catch {
+  process.stderr.write('github_artifact_transport_scope_refused\n');
+  process.exit(1);
+}

package/android-action/scripts/cache_scope.cjs

@@ -1,4 +1,4 @@
-// Direct routing belongs only to these pinned first-party cache programs and HTTPS origins.
+// Direct routing belongs only to pinned first-party Actions programs and approved HTTPS origins.
 const {readFileSync, copyFileSync, mkdtempSync, appendFileSync} = require('node:fs');
 const {createHash} = require('node:crypto');
 const {basename, dirname, join} = require('node:path');
@@ -6,6 +6,7 @@ const hashes = new Map([
   ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
   ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
 ]);
+const artifactHash = '168c44946cba03564808c19b83a72601e6d1d6f57081dbd2d6e2ea1cedc522f5';
 const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];
 const refusal = () => new Error('github_cache_transport_scope_refused');
 
@@ -23,13 +24,16 @@ function requireOrigin(value, service = false) {
   return url;
 }
 
-function authorize(entrypoint, env) {
+function authorize(entrypoint, env, kind = 'cache') {
   if (!entrypoint || basename(entrypoint) !== 'index.js' || basename(dirname(dirname(entrypoint))) !== 'dist') {
     throw refusal();
   }
-  const expected = hashes.get(basename(dirname(entrypoint)));
+  if (!['cache', 'artifact'].includes(kind)) throw refusal();
+  const program = basename(dirname(entrypoint));
+  const expected = kind === 'artifact' ? (program === 'upload' && artifactHash) : hashes.get(program);
   if (!expected || createHash('sha256').update(readFileSync(entrypoint)).digest('hex') !== expected) throw refusal();
-  const origins = [env.ACTIONS_RESULTS_URL, env.ACTIONS_CACHE_URL].filter(Boolean);
+  const origins = (kind === 'artifact' ? [env.ACTIONS_RESULTS_URL]
+    : [env.ACTIONS_RESULTS_URL, env.ACTIONS_CACHE_URL]).filter(Boolean);
   if (!origins.length) throw refusal();
   for (const origin of origins) requireOrigin(origin, true);
 }

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.71
+1.0.72

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.71",
+  "version": "1.0.72",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-web.yml

@@ -56,6 +56,8 @@ jobs:
           flutter build web --release --build-number="${GITHUB_RUN_NUMBER}"
       - name: Retain Flutter web release
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ github.workspace }}/.github/actions/android-app/scripts/artifact_env.cjs"
         with:
           name: web-${{ github.event.repository.name }}-${{ github.run_number }}
           path: build/web

package/templates/deploy.yml

@@ -215,6 +215,8 @@ jobs:
       - name: Retain Dart symbol files
         if: ${{ !cancelled() && steps.ios_symbols.outputs.present == 'true' }}
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
         with:
           name: ios-symbols-${{ github.event.repository.name }}-${{ env.BUILD_NUMBER || github.run_number }}
           path: ${{ runner.temp }}/dart-symbols/ios
@@ -435,6 +437,8 @@ jobs:
       - name: Retain signed Android App Bundle
         if: ${{ steps.mode.outputs.mode == 'local' }}
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ github.workspace }}/.github/actions/android-app/scripts/artifact_env.cjs"
         with:
           name: android-${{ steps.android.outputs.package-name }}-${{ steps.android.outputs.build-number }}
           path: ${{ steps.android.outputs.bundle-path }}