gowalk-cicd 1.0.71 → 1.0.73

package/CLAUDE.md

@@ -145,12 +145,24 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   `NO_PROXY`. The preloader snapshot under `RUNNER_TEMP` also covers official post/save after
   consumer autoupdate changes the action directory. The installer delivers this development
   tooling for native iOS repositories too; it does not require an Android app.
+- Flutter manifest GET recovery is scoped to the two pinned setup invocations through `BASH_ENV`.
+  It retains the account proxy, retries transient TLS/transport errors within 60 seconds, and emits
+  only complete JSON. Partial responses and private curl stderr never enter action outputs;
+  authentication/certificate failures remain terminal. SDK archive calls retain upstream behavior.
 - Flutter setup scopes `SEGMENT_DOWNLOAD_TIMEOUT_MINS=1` to the composite action's optional
   SDK/pub cache restores. This bounds each cache segment, not the whole cache or SDK download.
   A cache timeout becomes a cache miss; normal proxied SDK setup remains mandatory and its
   errors still fail the job. Never use `continue-on-error` or a timeout around all SDK setup
   to hide an optional cache failure. Do not alter cache keys or disable caches as part of
   this timeout handling.
+- GitHub artifact uploads have their own checksum-pinned `artifact_env.cjs` process scope.
+  It reuses the cache transport's approved HTTPS request guard, then removes inherited proxy
+  variables only inside the official `upload-artifact` process. Unknown programs/origins refuse;
+  later Apple/Google clients retain their proxies and artifact failures remain job failures.
+  The iOS action reads this helper from its immutable `SWIFT_APP_ACTION` snapshot. Its shared
+  `cache_scope.cjs` and `artifact_env.cjs` copies match the Android distribution byte for byte,
+  enforced by `test/artifact-wiring.test.mjs`; update both when changing that common guard.
+  Update existing consumer workflow artifact steps as well as action directories on adoption.
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and
   supplies it to Compose after the generated `.env`; never print its content.
@@ -165,6 +177,13 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie
   because a Flutter app also carries `android/settings.gradle`.
+- iOS plist stamping reads complete JSON build settings through `resolve_info_plist.py`,
+  preserving Xcode's exit status and bounded sanitized stderr. Select exactly the configured
+  bundle's application target and resolve paths from that target's source root; never take
+  the first dependency plist or stop reading Xcode output early. The encryption step reuses
+  the validated source path. Missing/ambiguous source plists fail; positively generated
+  plists retain the existing build-setting version path. Queries disable signing and package
+  updates, retain inherited proxies, and never enable provisioning network operations.
 - Version stamping is per-build-system: Flutter takes `--build-number`, Gradle
   has no equivalent, so `set_gradle_version()` rewrites the literal in the
   checkout the way the iOS action patches the pbxproj. Never commit that edit.

package/README.md

@@ -647,6 +647,15 @@ without the repository secret cannot start provider downloads through these work
 The Apple uploader retains `apple-upload-<run>-<attempt>` receipts with IPA SHA-256,
 upload ID and processing readback, and resumes matching bytes after interruption.
 
+GitHub artifact traffic uses a separate, per-action transport scope. The exact pinned
+`actions/upload-artifact` client can reach approved GitHub Results and artifact-storage
+HTTPS origins without inheriting the store proxy; unknown programs and destinations are
+refused. The scope ends with that Node process. Apple/Google calls retain their assigned
+exit, and a failed artifact creation, transfer or finalization still fails delivery.
+Adoption requires updating workflow upload steps as well as the distributed actions while
+preserving each app's custom checks and artifact retention settings. This fixes the proven
+inherited-proxy path; an isolated `ECONNRESET` does not identify every possible network fault.
+
 1. **Auto-detects** your `.xcodeproj` / `.xcworkspace`, scheme, bundle ID,
    and `team_id` (from the ASC API key). No `ci.config.yaml` required —
    override via action inputs only if auto-detection fails.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.71
+1.0.73

package/action/action.yml

@@ -601,51 +601,14 @@ runs:
         WORKSPACE: ${{ inputs.workspace || env.CFG_WORKSPACE }}
         SCHEME: ${{ inputs.scheme || env.CFG_SCHEME }}
         CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
+        BUNDLE_ID: ${{ inputs.bundle-id || env.CFG_BUNDLE_ID }}
       run: |
         set -o pipefail
-        # Some Xcode projects hardcode CFBundleVersion / CFBundleShortVersionString
-        # as literal values in Info.plist instead of using $(CURRENT_PROJECT_VERSION)
-        # and $(MARKETING_VERSION) substitution. When that's the case, passing
-        # CURRENT_PROJECT_VERSION=N on the xcodebuild CLI has no effect on the
-        # archived plist and altool rejects the upload with
-        # `previousBundleVersion`. Stamp the resolved source Info.plist directly
-        # so the archive ships with the computed values regardless of whether
-        # the plist uses substitutions or hardcoded literals.
-        if [ -n "$WORKSPACE" ]; then
-          PROJ_ARGS=(-workspace "$WORKSPACE")
-          PROJ_BASE=$(dirname "$WORKSPACE")
-        else
-          PROJ_ARGS=(-project "$PROJECT")
-          PROJ_BASE=$(dirname "$PROJECT")
-        fi
-        # Try agvtool first — it's Apple's official tool and handles projects
-        # using the generic versioning system. Harmless no-op on projects
-        # without VERSIONING_SYSTEM set. Run from the project directory.
-        # Marketing version is intentionally NOT stamped here: the project's
-        # MARKETING_VERSION build setting is the single source of truth and
-        # was already resolved into env earlier; CI must never mutate it.
-        (
-          cd "$PROJ_BASE" 2>/dev/null || exit 0
-          xcrun agvtool new-version -all "$BUILD_NUMBER" >/dev/null 2>&1 || true
-        )
-        # Now resolve the actual Info.plist path and stamp literal values.
-        # This is idempotent with agvtool and also covers projects where the
-        # plist has hardcoded numbers (the sample1 failure mode).
-        INFOPLIST=$(xcodebuild "${PROJ_ARGS[@]}" -scheme "$SCHEME" -configuration "${CONFIGURATION:-Release}" \
-                      -showBuildSettings 2>/dev/null \
-                    | awk -F' = ' '/^[[:space:]]*INFOPLIST_FILE/ {
-                        gsub(/^[[:space:]]+|[[:space:]]+$/,"",$2); print $2; exit
-                      }')
-        if [ -z "$INFOPLIST" ]; then
-          echo "::warning::INFOPLIST_FILE not set for scheme $SCHEME; skipping version stamping"
-          exit 0
-        fi
-        INFOPLIST_PATH="$PROJ_BASE/$INFOPLIST"
-        if [ ! -f "$INFOPLIST_PATH" ]; then
-          INFOPLIST_PATH="$INFOPLIST"
-        fi
-        if [ ! -f "$INFOPLIST_PATH" ]; then
-          echo "::warning::Info.plist not found at $INFOPLIST_PATH; skipping version stamping"
+        # Read every target's complete settings and preserve Xcode's actual status/error.
+        # The selected application's source root can differ from its containing workspace.
+        INFOPLIST_PATH=$(python3 "$SWIFT_APP_ACTION/scripts/resolve_info_plist.py")
+        if [ -z "$INFOPLIST_PATH" ]; then
+          echo "Generated Info.plist: Archive supplies CURRENT_PROJECT_VERSION and MARKETING_VERSION"
           exit 0
         fi
         /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $BUILD_NUMBER" "$INFOPLIST_PATH" 2>/dev/null \
@@ -665,29 +628,15 @@ runs:
         VALUE: ${{ inputs.uses-non-exempt-encryption || env.CFG_USES_NON_EXEMPT }}
       run: |
         set -o pipefail
-        if [ -n "$WORKSPACE" ]; then
-          PROJ_ARGS=(-workspace "$WORKSPACE")
-          PROJ_BASE=$(dirname "$WORKSPACE")
-        else
-          PROJ_ARGS=(-project "$PROJECT")
-          PROJ_BASE=$(dirname "$PROJECT")
-        fi
-        INFOPLIST=$(xcodebuild "${PROJ_ARGS[@]}" -scheme "$SCHEME" -configuration "${CONFIGURATION:-Release}" \
-                      -showBuildSettings 2>/dev/null \
-                    | awk -F' = ' '/^[[:space:]]*INFOPLIST_FILE/ {
-                        gsub(/^[[:space:]]+|[[:space:]]+$/,"",$2); print $2; exit
-                      }')
-        if [ -z "$INFOPLIST" ]; then
-          echo "::warning::INFOPLIST_FILE not set for scheme $SCHEME; skipping ITSAppUsesNonExemptEncryption"
+        # Reuse the validated application path from version stamping; no second Xcode query.
+        INFOPLIST_PATH="${SWIFT_APP_SOURCE_INFOPLIST?Source plist resolution did not complete}"
+        if [ -z "$INFOPLIST_PATH" ]; then
+          echo "::warning::The application generates Info.plist; no source plist to edit for encryption"
           exit 0
         fi
-        INFOPLIST_PATH="$PROJ_BASE/$INFOPLIST"
-        if [ ! -f "$INFOPLIST_PATH" ]; then
-          INFOPLIST_PATH="$INFOPLIST"
-        fi
         if [ ! -f "$INFOPLIST_PATH" ]; then
-          echo "::warning::Info.plist not found at $INFOPLIST_PATH; skipping"
-          exit 0
+          echo "::error::The resolved application Info.plist is no longer present"
+          exit 1
         fi
         /usr/libexec/PlistBuddy -c "Set :ITSAppUsesNonExemptEncryption $VALUE" "$INFOPLIST_PATH" 2>/dev/null \
           || /usr/libexec/PlistBuddy -c "Add :ITSAppUsesNonExemptEncryption bool $VALUE" "$INFOPLIST_PATH"
@@ -815,6 +764,8 @@ runs:
     - name: Preserve the Firebase console upload artifact
       if: ${{ always() && inputs.archive == 'true' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      env:
+        NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
       with:
         name: ios-crashlytics-symbols-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/firebase-symbols/
@@ -834,6 +785,8 @@ runs:
     - name: Retain Apple upload receipt
       if: ${{ always() && inputs.archive == 'true' && inputs.upload == 'true' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      env:
+        NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
       with:
         name: apple-upload-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/apple-build-upload.json
@@ -845,6 +798,8 @@ runs:
     - name: Retain the exported IPA for upload recovery
       if: ${{ always() && inputs.archive == 'true' && inputs.upload == 'true' && steps.upload.outcome != 'success' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4
+      env:
+        NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
       with:
         name: apple-ipa-${{ github.run_id }}-${{ github.run_attempt }}
         path: ${{ runner.temp }}/export/*.ipa

package/action/scripts/artifact_env.cjs

@@ -0,0 +1,10 @@
+// Only the exact pinned upload-artifact process receives this GitHub-specific transport.
+try {
+  const scope = require('./cache_scope.cjs');
+  scope.authorize(process.argv[1], process.env, 'artifact');
+  scope.guardRequests();
+  for (const key of scope.proxyKeys) delete process.env[key];
+} catch {
+  process.stderr.write('github_artifact_transport_scope_refused\n');
+  process.exit(1);
+}

package/action/scripts/cache_scope.cjs

@@ -0,0 +1,81 @@
+// Direct routing belongs only to pinned first-party Actions programs and approved HTTPS origins.
+const {readFileSync, copyFileSync, mkdtempSync, appendFileSync} = require('node:fs');
+const {createHash} = require('node:crypto');
+const {basename, dirname, join} = require('node:path');
+const hashes = new Map([
+  ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
+  ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
+]);
+const artifactHash = '168c44946cba03564808c19b83a72601e6d1d6f57081dbd2d6e2ea1cedc522f5';
+const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];
+const refusal = () => new Error('github_cache_transport_scope_refused');
+
+function allowedHost(host) {
+  return host === 'api.github.com'
+    || /^[a-z0-9.-]+\.actions\.githubusercontent\.com$/.test(host)
+    || /^[a-z0-9]{3,24}\.blob\.core\.windows\.net$/.test(host);
+}
+
+function requireOrigin(value, service = false) {
+  let url;
+  try { url = new URL(value); } catch { throw refusal(); }
+  if (url.protocol !== 'https:' || url.port || url.username || url.password || !allowedHost(url.hostname)
+      || (service && !url.hostname.endsWith('.actions.githubusercontent.com'))) throw refusal();
+  return url;
+}
+
+function authorize(entrypoint, env, kind = 'cache') {
+  if (!entrypoint || basename(entrypoint) !== 'index.js' || basename(dirname(dirname(entrypoint))) !== 'dist') {
+    throw refusal();
+  }
+  if (!['cache', 'artifact'].includes(kind)) throw refusal();
+  const program = basename(dirname(entrypoint));
+  const expected = kind === 'artifact' ? (program === 'upload' && artifactHash) : hashes.get(program);
+  if (!expected || createHash('sha256').update(readFileSync(entrypoint)).digest('hex') !== expected) throw refusal();
+  const origins = (kind === 'artifact' ? [env.ACTIONS_RESULTS_URL]
+    : [env.ACTIONS_RESULTS_URL, env.ACTIONS_CACHE_URL]).filter(Boolean);
+  if (!origins.length) throw refusal();
+  for (const origin of origins) requireOrigin(origin, true);
+}
+
+function requireRequest(args, protocol) {
+  const [input, extra] = args;
+  const options = typeof input === 'string' || input instanceof URL
+    ? {protocol, ...require('node:url').urlToHttpOptions(requireOrigin(input)),
+      ...(typeof extra === 'object' ? extra : {})}
+    : {...input};
+  if (!options || options.socketPath || (options.protocol || protocol) !== 'https:') throw refusal();
+  for (const host of [options.hostname, options.host].filter(Boolean)) {
+    requireOrigin(`https://${host}${options.port ? ':' + options.port : ''}`);
+  }
+  if (!options.hostname && !options.host) throw refusal();
+}
+
+function guardRequests() {
+  for (const [name, protocol] of [['node:http', 'http:'], ['node:https', 'https:']]) {
+    const client = require(name);
+    for (const verb of ['request', 'get']) {
+      const original = client[verb];
+      client[verb] = function (...args) { requireRequest(args, protocol); return original.apply(this, args); };
+    }
+  }
+  if (globalThis.fetch) {
+    const original = globalThis.fetch;
+    globalThis.fetch = function (input, init) {
+      requireOrigin(typeof input === 'string' || input instanceof URL ? input : input.url);
+      return original.call(this, input, {...init, redirect: 'error'});
+    };
+  }
+}
+
+function snapshot() {
+  const target = mkdtempSync(join(process.env.RUNNER_TEMP, 'gowalk-cache-scope-'));
+  for (const file of ['cache_env.cjs', 'cache_scope.cjs']) copyFileSync(join(__dirname, file), join(target, file));
+  appendFileSync(process.env.GITHUB_OUTPUT, `preloader=${join(target, 'cache_env.cjs')}\n`);
+}
+
+module.exports = {authorize, guardRequests, proxyKeys, requireOrigin};
+if (require.main === module) {
+  try { if (process.argv[2] !== '--snapshot') throw refusal(); snapshot(); }
+  catch { process.stderr.write('github_cache_scope_snapshot_failed\n'); process.exitCode = 1; }
+}

package/action/scripts/resolve_info_plist.py

@@ -0,0 +1,128 @@
+#!/usr/bin/env python3
+"""Read complete Xcode settings once and select the requested application's source plist."""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+
+APP_TYPE = "com.apple.product-type.application"
+_VARIABLE = re.compile(r"\$\(([^)]+)\)|\$\{([^}]+)\}")
+
+
+class SettingsFailed(RuntimeError):
+    def __init__(self, message: str, code: int = 1):
+        super().__init__(message)
+        self.code = code
+
+
+def diagnostic(text: str) -> str:
+    for key, value in os.environ.items():
+        if len(value) >= 4 and re.search(r"SECRET|TOKEN|PASSWORD|PROXY|PRIVATE_KEY", key, re.I):
+            text = text.replace(value, "[redacted]")
+    text = re.sub(r"https?://[^\s]+", "[URL redacted]", text)
+    text = re.sub(r"\x1b\[[0-?]*[ -/]*[@-~]", "", text)
+    return "\n".join("xcodebuild: " + line for line in text[-8000:].splitlines()[-60:])
+
+
+def read_settings(project: str, workspace: str, scheme: str, configuration: str, logs: Path) -> list:
+    if not scheme or not (workspace or project):
+        raise SettingsFailed("Project/workspace and scheme are required for source plist resolution")
+    command = ["xcodebuild", "-workspace" if workspace else "-project", workspace or project,
+               "-scheme", scheme, "-configuration", configuration or "Release", "-sdk", "iphoneos",
+               "-destination", "generic/platform=iOS", "-disableAutomaticPackageResolution", "-skipPackageUpdates",
+               "CODE_SIGNING_ALLOWED=NO", "CODE_SIGNING_REQUIRED=NO", "CODE_SIGN_IDENTITY=", "DEVELOPMENT_TEAM=",
+               "-showBuildSettings", "-json"]
+    logs.mkdir(parents=True, exist_ok=True, mode=0o700)
+    os.chmod(logs, 0o700)
+    output, errors = logs / "build-settings.json", logs / "build-settings.stderr"
+    # File sinks consume the entire producer output. An early pipe reader can hide its actual status.
+    with output.open("wb") as stdout, errors.open("wb") as stderr:
+        os.chmod(output, 0o600)
+        os.chmod(errors, 0o600)
+        timed_out = False
+        try:
+            result = subprocess.run(command, stdout=stdout, stderr=stderr, timeout=300, check=False)
+            code = result.returncode if result.returncode >= 0 else 128 - result.returncode
+        except subprocess.TimeoutExpired:
+            timed_out, code = True, 124
+    if code:
+        detail = diagnostic(errors.read_text(errors="replace"))
+        if detail:
+            print(detail, file=sys.stderr)
+        reason = "timed out after 300 seconds" if timed_out else f"failed with exit {code}"
+        raise SettingsFailed(f"xcodebuild -showBuildSettings {reason}", code)
+    try:
+        settings = json.loads(output.read_text())
+    except (ValueError, UnicodeError):
+        raise SettingsFailed("xcodebuild returned invalid build-settings JSON") from None
+    if not isinstance(settings, list):
+        raise SettingsFailed("xcodebuild build-settings response must be a target list")
+    return settings
+
+
+def application(settings: list, bundle_id: str) -> dict:
+    candidates = []
+    for row in settings:
+        values = row.get("buildSettings") if isinstance(row, dict) else None
+        if not isinstance(values, dict) or values.get("PRODUCT_TYPE") != APP_TYPE:
+            continue
+        if not bundle_id or values.get("PRODUCT_BUNDLE_IDENTIFIER") == bundle_id:
+            candidates.append(values)
+    if len(candidates) != 1:
+        raise SettingsFailed("Expected exactly one application target matching the configured bundle identifier")
+    return candidates[0]
+
+
+def source_plist(settings: dict, checkout: Path) -> Path | None:
+    value = str(settings.get("INFOPLIST_FILE") or "").strip()
+    if not value:
+        if settings.get("GENERATE_INFOPLIST_FILE") == "YES":
+            return None
+        raise SettingsFailed("The application has no source Info.plist and does not enable generated Info.plist")
+    for _ in range(5):
+        expanded = _VARIABLE.sub(lambda match: str(settings.get(match[1] or match[2], match[0])), value)
+        if expanded == value:
+            break
+        value = expanded
+    if _VARIABLE.search(value) or "\n" in value or "\r" in value:
+        raise SettingsFailed("The application's Info.plist path contains an unresolved or invalid setting")
+    path = Path(value)
+    if not path.is_absolute():
+        source = settings.get("SRCROOT") or settings.get("PROJECT_DIR")
+        if not source:
+            raise SettingsFailed("The application target did not provide its source root")
+        path = Path(source) / path
+    path = path.resolve()
+    if "\n" in str(path) or "\r" in str(path):
+        raise SettingsFailed("The resolved source plist cannot be represented in the job environment")
+    if not path.is_relative_to(checkout.resolve()) or not path.is_file():
+        raise SettingsFailed("The application source Info.plist is missing or outside the checkout")
+    return path
+
+
+def main() -> int:
+    try:
+        logs = Path(os.environ["RUNNER_TEMP"]) / "swift-app-build-settings"
+        rows = read_settings(os.environ.get("PROJECT", ""), os.environ.get("WORKSPACE", ""),
+                             os.environ.get("SCHEME", ""), os.environ.get("CONFIGURATION", "Release"), logs)
+        selected = source_plist(application(rows, os.environ.get("BUNDLE_ID", "")), Path.cwd())
+        value = str(selected) if selected else ""
+        with Path(os.environ["GITHUB_ENV"]).open("a") as stream:
+            stream.write(f"SWIFT_APP_SOURCE_INFOPLIST={value}\n")
+        print(value)
+        return 0
+    except SettingsFailed as exc:
+        print(f"::error title=Application build settings::{exc}", file=sys.stderr)
+        return exc.code
+    except (KeyError, OSError):
+        print("::error title=Application build settings::Required settings tooling or private output is unavailable",
+              file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/action/scripts/test_resolve_info_plist.py

@@ -0,0 +1,120 @@
+"""Consume real producer output/status, then select only the app's own source plist."""
+from contextlib import redirect_stderr
+import io
+import json
+import os
+from pathlib import Path
+import tempfile
+import unittest
+from unittest.mock import patch
+
+import resolve_info_plist as subject
+
+
+class ResolveInfoPlistTest(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.source = self.root / 'Nested Project' / 'Application Info.plist'
+        self.source.parent.mkdir()
+        self.source.write_text('<plist/>')
+        self.values = {'PRODUCT_TYPE': subject.APP_TYPE, 'PRODUCT_BUNDLE_IDENTIFIER': 'test.local.app',
+                       'SRCROOT': str(self.source.parent), 'INFOPLIST_FILE': self.source.name}
+
+    def producer(self, body):
+        tool = self.root / 'xcodebuild'
+        tool.write_text('#!/usr/bin/env python3\n' + body)
+        tool.chmod(0o700)
+        return patch.dict(os.environ, {'PATH': str(self.root) + os.pathsep + os.environ['PATH']})
+
+    def test_drains_large_output_and_preserves_arguments_and_inherited_proxy(self):
+        record = self.root / 'invocation.json'
+        rows = [{'buildSettings': dict(self.values, LARGE='x' * 500000)}]
+        body = ("import json,os,sys\n"
+                f"open({str(record)!r},'w').write(json.dumps([sys.argv[1:],os.getenv('HTTPS_PROXY')]))\n"
+                f"sys.stdout.write({json.dumps(rows)!r})\n")
+        with self.producer(body), patch.dict(os.environ, {'HTTPS_PROXY': 'http://fixture-proxy.invalid:9000'}):
+            result = subject.read_settings('App.xcodeproj', '', 'App', 'Release', self.root / 'logs')
+        self.assertEqual(result, rows)
+        args, proxy = json.loads(record.read_text())
+        self.assertEqual(proxy, 'http://fixture-proxy.invalid:9000')
+        self.assertIn('-disableAutomaticPackageResolution', args)
+        self.assertIn('-skipPackageUpdates', args)
+        self.assertIn('CODE_SIGNING_ALLOWED=NO', args)
+        self.assertEqual(args[-2:], ['-showBuildSettings', '-json'])
+        self.assertNotIn('-allowProvisioningUpdates', args)
+
+    def test_exit_74_is_not_an_empty_success_and_error_is_bounded_private(self):
+        stderr = io.StringIO()
+        error = 'x' * 20000 + '\nCould not resolve package: https://private.invalid/token-secret token-secret\n'
+        body = f"import sys\nsys.stderr.write({error!r})\nsys.stdout.write('[]')\nsys.exit(74)\n"
+        with self.producer(body), patch.dict(os.environ, {'APP_SECRET': 'token-secret'}), redirect_stderr(stderr):
+            with self.assertRaises(subject.SettingsFailed) as raised:
+                subject.read_settings('App.xcodeproj', '', 'App', 'Release', self.root / 'logs')
+        self.assertEqual(raised.exception.code, 74)
+        self.assertIn('Could not resolve package', stderr.getvalue())
+        self.assertNotIn('token-secret', stderr.getvalue())
+        self.assertNotIn('private.invalid', stderr.getvalue())
+        self.assertLess(len(stderr.getvalue()), 8200)
+        self.assertTrue((self.root / 'logs' / 'build-settings.stderr').is_file())
+        for output in ['not-json', '{}']:
+            with self.producer(f"print({output!r})\n"):
+                with self.assertRaises(subject.SettingsFailed):
+                    subject.read_settings('App.xcodeproj', '', 'App', 'Release', self.root / 'logs')
+
+    def test_selects_bundle_matched_application_not_first_dependency_or_other_app(self):
+        dependency = dict(self.values, PRODUCT_TYPE='com.apple.product-type.framework', INFOPLIST_FILE='Other.plist')
+        other = dict(self.values, PRODUCT_BUNDLE_IDENTIFIER='test.local.other')
+        rows = [{'buildSettings': row} for row in [dependency, other, self.values]]
+        chosen = subject.application(rows, 'test.local.app')
+        self.assertEqual(subject.source_plist(chosen, self.root), self.source.resolve())
+        with self.assertRaises(subject.SettingsFailed):
+            subject.application(rows, '')
+        with self.assertRaises(subject.SettingsFailed):
+            subject.application(rows, 'test.local.absent')
+
+    def test_ambiguous_same_bundle_and_malformed_targets_refuse(self):
+        for rows in [[{'buildSettings': self.values}] * 2, [{'buildSettings': []}], [None]]:
+            with self.assertRaises(subject.SettingsFailed):
+                subject.application(rows, 'test.local.app')
+
+    def test_relative_and_variable_plist_paths_use_the_target_root(self):
+        values = dict(self.values, INFOPLIST_FILE='$(SRCROOT)/Application Info.plist')
+        self.assertEqual(subject.source_plist(values, self.root), self.source.resolve())
+        values['INFOPLIST_FILE'] = '${UNKNOWN}/Info.plist'
+        with self.assertRaises(subject.SettingsFailed):
+            subject.source_plist(values, self.root)
+        newline_root = self.root / 'project\nname'
+        newline_root.mkdir()
+        (newline_root / self.source.name).write_text('<plist/>')
+        values = dict(self.values, SRCROOT=str(newline_root))
+        with self.assertRaises(subject.SettingsFailed):
+            subject.source_plist(values, self.root)
+
+    def test_missing_outside_and_generated_paths_are_distinct(self):
+        for values in [dict(self.values, INFOPLIST_FILE='Missing.plist'),
+                       dict(self.values, INFOPLIST_FILE='/etc/hosts'),
+                       dict(self.values, INFOPLIST_FILE='')]:
+            with self.assertRaises(subject.SettingsFailed):
+                subject.source_plist(values, self.root)
+        generated = dict(self.values, INFOPLIST_FILE='', GENERATE_INFOPLIST_FILE='YES')
+        self.assertIsNone(subject.source_plist(generated, self.root))
+
+    def test_timeout_keeps_error_evidence_and_does_not_retry(self):
+        import subprocess
+
+        stderr = io.StringIO()
+        def timed_out(command, **kwargs):
+            kwargs['stderr'].write(b'package graph was unavailable')
+            raise subprocess.TimeoutExpired(command, 300)
+        with patch.object(subject.subprocess, 'run', side_effect=timed_out) as run, redirect_stderr(stderr):
+            with self.assertRaises(subject.SettingsFailed) as raised:
+                subject.read_settings('App.xcodeproj', '', 'App', 'Release', self.root / 'logs')
+        self.assertEqual(raised.exception.code, 124)
+        self.assertEqual(run.call_count, 1)
+        self.assertIn('package graph was unavailable', stderr.getvalue())
+
+
+if __name__ == '__main__':
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.71
+1.0.73

package/android-action/action.yml

@@ -191,6 +191,8 @@ runs:
     - name: Retain Dart symbol files
       if: ${{ steps.config.outputs.project_kind == 'flutter' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      env:
+        NODE_OPTIONS: --require "${{ github.action_path }}/scripts/artifact_env.cjs"
       with:
         name: android-symbols-${{ steps.config.outputs.package_name }}-${{ steps.config.outputs.build_number }}
         path: ${{ steps.flutter_build.outputs.symbols_path }}

package/android-action/flutter-setup/action.yml

@@ -84,9 +84,13 @@ runs:
   using: composite
   steps:
   - name: Require provider transport
+    id: transport
     shell: bash
     run: |
       python3 "$GITHUB_ACTION_PATH/../scripts/play_store_proxy.py" --bootstrap-env
+      printf 'manifest_env=%s\nmanifest_helper=%s\n' \
+        "$GITHUB_ACTION_PATH/../scripts/flutter_manifest_env.sh" \
+        "$GITHUB_ACTION_PATH/../scripts/flutter_manifest.py" >> "$GITHUB_OUTPUT"
   - name: Retain the cache process scope
     id: scope
     if: ${{ inputs.cache == 'true' || inputs.pub-cache == 'true' }}
@@ -96,6 +100,9 @@ runs:
   - name: Resolve Flutter release and cache identities
     id: flutter-action
     uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
+    env:
+      BASH_ENV: ${{ steps.transport.outputs.manifest_env }}
+      GOWALK_FLUTTER_MANIFEST_HELPER: ${{ steps.transport.outputs.manifest_helper }}
     with:
       channel: ${{ inputs.channel }}
       flutter-version: ${{ inputs.flutter-version }}
@@ -134,6 +141,9 @@ runs:
   - name: Install or reuse the resolved Flutter SDK
     if: ${{ inputs.dry-run != 'true' }}
     uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
+    env:
+      BASH_ENV: ${{ steps.transport.outputs.manifest_env }}
+      GOWALK_FLUTTER_MANIFEST_HELPER: ${{ steps.transport.outputs.manifest_helper }}
     with:
       channel: ${{ steps.flutter-action.outputs.CHANNEL }}
       flutter-version: ${{ steps.flutter-action.outputs.VERSION }}

package/android-action/scripts/artifact_env.cjs

@@ -0,0 +1,10 @@
+// Only the exact pinned upload-artifact process receives this GitHub-specific transport.
+try {
+  const scope = require('./cache_scope.cjs');
+  scope.authorize(process.argv[1], process.env, 'artifact');
+  scope.guardRequests();
+  for (const key of scope.proxyKeys) delete process.env[key];
+} catch {
+  process.stderr.write('github_artifact_transport_scope_refused\n');
+  process.exit(1);
+}

package/android-action/scripts/cache_scope.cjs

@@ -1,4 +1,4 @@
-// Direct routing belongs only to these pinned first-party cache programs and HTTPS origins.
+// Direct routing belongs only to pinned first-party Actions programs and approved HTTPS origins.
 const {readFileSync, copyFileSync, mkdtempSync, appendFileSync} = require('node:fs');
 const {createHash} = require('node:crypto');
 const {basename, dirname, join} = require('node:path');
@@ -6,6 +6,7 @@ const hashes = new Map([
   ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
   ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
 ]);
+const artifactHash = '168c44946cba03564808c19b83a72601e6d1d6f57081dbd2d6e2ea1cedc522f5';
 const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];
 const refusal = () => new Error('github_cache_transport_scope_refused');
 
@@ -23,13 +24,16 @@ function requireOrigin(value, service = false) {
   return url;
 }
 
-function authorize(entrypoint, env) {
+function authorize(entrypoint, env, kind = 'cache') {
   if (!entrypoint || basename(entrypoint) !== 'index.js' || basename(dirname(dirname(entrypoint))) !== 'dist') {
     throw refusal();
   }
-  const expected = hashes.get(basename(dirname(entrypoint)));
+  if (!['cache', 'artifact'].includes(kind)) throw refusal();
+  const program = basename(dirname(entrypoint));
+  const expected = kind === 'artifact' ? (program === 'upload' && artifactHash) : hashes.get(program);
   if (!expected || createHash('sha256').update(readFileSync(entrypoint)).digest('hex') !== expected) throw refusal();
-  const origins = [env.ACTIONS_RESULTS_URL, env.ACTIONS_CACHE_URL].filter(Boolean);
+  const origins = (kind === 'artifact' ? [env.ACTIONS_RESULTS_URL]
+    : [env.ACTIONS_RESULTS_URL, env.ACTIONS_CACHE_URL]).filter(Boolean);
   if (!origins.length) throw refusal();
   for (const origin of origins) requireOrigin(origin, true);
 }

package/android-action/scripts/flutter_manifest.py

@@ -0,0 +1,76 @@
+"""Retry the official Flutter manifest GET without exposing partial JSON or proxy secrets."""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+import tempfile
+import time
+from urllib.parse import urlsplit
+
+RETRY_CODES = {5, 6, 7, 18, 28, 35, 52, 55, 56, 92, 95}
+RETRY_HTTP = {408, 429, 500, 502, 503, 504}
+
+
+def download(arguments: list[str], directory: Path) -> int:
+    # This is the exact GET made by the pinned upstream setup.sh. Refuse new semantics.
+    if arguments[:-1] != ["--silent", "--connect-timeout", "15", "--retry", "5"]:
+        raise ValueError("flutter_manifest_arguments_unrecognized")
+    url = urlsplit(arguments[-1])
+    if (url.scheme != "https" or not url.hostname or url.username or url.password
+            or url.query or url.fragment or not re.fullmatch(
+                r"/flutter_infra_release/releases/releases_(linux|macos|windows)\.json", url.path)):
+        raise ValueError("flutter_manifest_url_unrecognized")
+    if not (os.environ.get("HTTPS_PROXY") or os.environ.get("https_proxy")):
+        raise ValueError("flutter_manifest_proxy_required")
+    child_env = {**os.environ, "NO_PROXY": "", "no_proxy": ""}
+    deadline, code, http, proxy_http = time.monotonic() + 60, 1, 0, 0
+    for attempt in range(1, 5):
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            break
+        destination = directory / f"manifest-{attempt}.json"
+        destination.touch(mode=0o600, exist_ok=False)
+        destination.chmod(0o600)
+        try:
+            result = subprocess.run([
+                "curl", "--disable", "--silent", "--show-error", "--fail", "--retry", "0",
+                "--connect-timeout", "15", "--max-time", str(min(20, remaining)),
+                "--max-filesize", "16777216", "--output", str(destination),
+                "--write-out", "%{http_code} %{http_connect}", arguments[-1],
+            ], capture_output=True, timeout=remaining, env=child_env)
+            code = result.returncode
+            status = result.stdout.split()
+            http, proxy_http = (map(int, status) if len(status) == 2 and all(part.isdigit() for part in status)
+                                else (0, 0))
+        except subprocess.TimeoutExpired:
+            code, http, proxy_http = 28, 0, 0
+        if code == 0 and http == 200:
+            body = destination.read_bytes()
+            json.loads(body)  # A successful transport must deliver complete JSON.
+            sys.stdout.buffer.write(body)
+            if attempt > 1:
+                print(f"flutter_manifest_recovered attempts={attempt}", file=sys.stderr)
+            return 0
+        if attempt == 4 or proxy_http in {401, 403, 407} or (code not in RETRY_CODES and http not in RETRY_HTTP):
+            break
+        time.sleep(min(2 ** (attempt - 1), max(0, deadline - time.monotonic())))
+    print(f"flutter_manifest_transport_failed curl_exit={code} http_status={http} "
+          f"proxy_status={proxy_http} attempts={attempt}", file=sys.stderr)
+    return code or 1
+
+
+def main() -> int:
+    try:
+        with tempfile.TemporaryDirectory(prefix="flutter-manifest-", dir=os.environ["RUNNER_TEMP"]) as scratch:
+            return download(sys.argv[1:], Path(scratch))
+    except (ValueError, OSError, KeyError):
+        print("flutter_manifest_invalid_request_or_response", file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/android-action/scripts/flutter_manifest_env.sh

@@ -0,0 +1,9 @@
+# Loaded only by the two pinned Flutter setup invocations, never the whole job.
+curl() {
+  case "${!#}" in
+    */flutter_infra_release/releases/releases_*.json)
+      python3 "${GOWALK_FLUTTER_MANIFEST_HELPER:?}" "$@"
+      ;;
+    *) command curl "$@" ;;
+  esac
+}

package/android-action/scripts/flutter_manifest_fixture.py

@@ -0,0 +1,85 @@
+"""An owned CONNECT proxy terminates only fixture TLS; it never dials a destination."""
+from contextlib import contextmanager
+import hashlib
+import json
+import os
+from pathlib import Path
+import socket
+import socketserver
+import ssl
+import struct
+import subprocess
+import threading
+import urllib.request
+
+from test_flutter_cache_setup import SETUP_SHA, SETUP_URL
+
+HOST = "manifest.fixture.invalid"
+MANIFEST = json.dumps({"releases": [{"channel": "stable", "version": "3.44.0", "dart_sdk_arch": "x64",
+    "hash": "a" * 40, "sha256": "b" * 64, "archive": "owned-sdk.tar.xz"}]}).encode()
+
+
+def official_setup() -> bytes:
+    fixture = os.environ.get("GOWALK_CACHE_ACTION_FIXTURES")
+    if fixture:
+        source = (Path(fixture) / "flutter-setup.sh").read_bytes()
+    else:
+        with urllib.request.urlopen(SETUP_URL, timeout=30) as response:
+            source = response.read(128 * 1024)
+    assert hashlib.sha256(source).hexdigest() == SETUP_SHA
+    return source
+
+
+class Proxy(socketserver.StreamRequestHandler):
+    def handle(self):
+        first = self.rfile.readline(4096).split()
+        while self.rfile.readline(4096) not in (b"\r\n", b"\n", b""):
+            pass
+        if first != [b"CONNECT", (HOST + ":443").encode(), b"HTTP/1.1"]:
+            return
+        with self.server.lock:
+            self.server.connects += 1
+            mode = self.server.modes.pop(0)
+        if mode == "proxy_auth":
+            self.wfile.write(b"HTTP/1.1 407 Proxy Authentication Required\r\nContent-Length: 0\r\n\r\n")
+            return
+        self.wfile.write(b"HTTP/1.1 200 Connection established\r\n\r\n")
+        self.wfile.flush()
+        if mode == "reset":
+            self.connection.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER, struct.pack("ii", 1, 0))
+            return
+        try:
+            with self.server.context.wrap_socket(self.connection, server_side=True) as stream:
+                stream.settimeout(3)
+                with stream.makefile("rb") as reader:
+                    request = reader.readline(4096).split()
+                    while reader.readline(4096) not in (b"\r\n", b"\n", b""):
+                        pass
+                    self.server.requests.append(request[1].decode())
+                    status = b"401 Unauthorized" if mode == "origin_auth" else b"200 OK"
+                    body = MANIFEST[:31] if mode == "partial" else MANIFEST
+                    stream.sendall(b"HTTP/1.1 " + status + b"\r\nContent-Length: "
+                                   + str(len(MANIFEST)).encode() + b"\r\nConnection: close\r\n\r\n" + body)
+        except (OSError, ssl.SSLError):
+            pass  # An untrusted fixture certificate must be rejected by the real client.
+
+
+@contextmanager
+def tls_proxy(root: Path, modes: list[str]):
+    cert, key = root / "cert.pem", root / "key.pem"
+    command = ["openssl", "req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "1",
+               "-keyout", str(key), "-out", str(cert), "-subj", "/CN=" + HOST,
+               "-addext", "subjectAltName=DNS:" + HOST]
+    subprocess.run(command, check=True, capture_output=True, timeout=10)
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    context.load_cert_chain(cert, key)
+    server = socketserver.ThreadingTCPServer(("127.0.0.1", 0), Proxy)
+    server.daemon_threads = True
+    server.context, server.modes = context, list(modes)
+    server.connects, server.requests, server.lock = 0, [], threading.Lock()
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        yield server, cert
+    finally:
+        server.shutdown(); server.server_close(); thread.join(3)

package/android-action/scripts/test_flutter_manifest.py

@@ -0,0 +1,119 @@
+"""Real curl and jq execute the byte-identical official setup through owned TLS failures."""
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+from flutter_manifest_fixture import HOST, MANIFEST, official_setup, tls_proxy
+
+ROOT = Path(__file__).parent
+
+
+class ManifestRecoveryTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.source = official_setup()
+
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.root = Path(self.directory.name)
+        self.setup = self.root / "setup.sh"
+        self.setup.write_bytes(self.source)
+        (self.root / "test").mkdir()
+        (self.root / "test/releases_linux.json").write_bytes(MANIFEST)
+        # Local curl preferences may never disable the assigned proxy or certificate checks.
+        (self.root / ".curlrc").write_text('noproxy = "*"\ninsecure\n')
+
+    def invoke(self, server, cert, *, hooked=True, trusted=True, test_mode=False, bound=True):
+        proxy = f"http://fixture-user:fixture-secret@127.0.0.1:{server.server_address[1]}"
+        env = {**os.environ, "HOME": str(self.root), "RUNNER_TEMP": str(self.root), "RUNNER_OS": "Linux",
+               "RUNNER_ARCH": "X64", "RUNNER_TOOL_CACHE": str(self.root / "tools"),
+               "PUB_CACHE": str(self.root / "pub"), "FLUTTER_STORAGE_BASE_URL": "https://" + HOST,
+               "GITHUB_OUTPUT": str(self.root / "output"), "HTTPS_PROXY": proxy, "https_proxy": proxy,
+               "NO_PROXY": "*", "no_proxy": "*"}
+        for key in ("BASH_ENV", "CURL_CA_BUNDLE", "SSL_CERT_FILE", "SSL_CERT_DIR"):
+            env.pop(key, None)
+        if not bound:
+            env.pop("HTTPS_PROXY"); env.pop("https_proxy")
+        if trusted:
+            env["CURL_CA_BUNDLE"] = str(cert)
+        if hooked:
+            env.update(BASH_ENV=str(ROOT / "flutter_manifest_env.sh"),
+                       GOWALK_FLUTTER_MANIFEST_HELPER=str(ROOT / "flutter_manifest.py"))
+        else:
+            # The baseline deliberately runs the original curl defaults, without stale local bypass settings.
+            env.update(HOME=str(self.root / "absent-home"), NO_PROXY="", no_proxy="")
+        args = ["bash", str(self.setup), "-p", "-n", "3.44.0", "-a", "x64", "-k", "custom-:version:-:hash:"]
+        result = subprocess.run([*args, *(["-t"] if test_mode else []), "stable"], env=env,
+                                capture_output=True, text=True, timeout=20)
+        self.assertNotIn("fixture-secret", result.stdout + result.stderr)
+        self.assertFalse(list(self.root.glob("flutter-manifest-*")))
+        return result
+
+    def test_original_tls_exit35_recovers_without_changing_official_cache_identity(self):
+        with tls_proxy(self.root, ["reset"]) as (server, cert):
+            original = self.invoke(server, cert, hooked=False)
+            self.assertEqual(original.returncode, 35)
+            self.assertEqual((server.connects, server.requests), (1, []))
+        with tls_proxy(self.root, ["reset", "ok"]) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertEqual((server.connects, len(server.requests)), (2, 1))
+            self.assertIn("flutter_manifest_recovered attempts=2", result.stderr)
+            baseline = self.invoke(server, cert, test_mode=True)
+        self.assertEqual((self.root / "output").read_text(), baseline.stdout)
+        self.assertEqual(result.stdout, "")
+
+    def test_partial_body_is_discarded_before_the_next_complete_json(self):
+        with tls_proxy(self.root, ["partial", "ok"]) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertEqual((server.connects, len(server.requests)), (2, 2))
+        self.assertIn("VERSION=3.44.0", (self.root / "output").read_text())
+        self.assertEqual(result.stdout, "")
+
+    def test_proxy_auth_refuses_once_without_any_destination_request(self):
+        with tls_proxy(self.root, ["proxy_auth"]) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertEqual((server.connects, server.requests), (1, []))
+        self.assertIn("proxy_status=407 attempts=1", result.stderr)
+        self.assertEqual(result.stdout, "")
+
+    def test_untrusted_certificate_never_retries_or_uses_curlrc_insecure(self):
+        with tls_proxy(self.root, ["ok"]) as (server, cert):
+            result = self.invoke(server, cert, trusted=False)
+            self.assertEqual(result.returncode, 60)
+            self.assertEqual((server.connects, server.requests), (1, []))
+        self.assertIn("attempts=1", result.stderr)
+        self.assertEqual(result.stdout, "")
+
+    def test_origin_auth_is_terminal_without_exposing_its_body(self):
+        with tls_proxy(self.root, ["origin_auth"]) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertEqual(result.returncode, 22)
+            self.assertEqual((server.connects, len(server.requests)), (1, 1))
+        self.assertIn("http_status=401", result.stderr)
+        self.assertIn("attempts=1", result.stderr)
+        self.assertEqual(result.stdout, "")
+
+    def test_repeated_tls_resets_stop_after_four_private_attempts(self):
+        with tls_proxy(self.root, ["reset"] * 4) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertEqual(result.returncode, 35)
+            self.assertEqual((server.connects, server.requests), (4, []))
+        self.assertIn("attempts=4", result.stderr)
+        self.assertEqual(result.stdout, "")
+
+    def test_missing_proxy_refuses_before_any_connection(self):
+        with tls_proxy(self.root, []) as (server, cert):
+            result = self.invoke(server, cert, bound=False)
+            self.assertEqual(result.returncode, 1)
+            self.assertEqual((server.connects, server.requests), (0, []))
+        self.assertEqual(result.stdout, "")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_flutter_manifest_scope.py

@@ -0,0 +1,41 @@
+"""The parent composite freezes helper paths before a nested action changes its context."""
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+class ManifestPathScopeTests(unittest.TestCase):
+    def test_real_transport_step_captures_parent_paths_without_exporting_a_job_hook(self):
+        action = yaml.safe_load((ROOT / "android-action/flutter-setup/action.yml").read_text())
+        guard = action["runs"]["steps"][0]
+        with tempfile.TemporaryDirectory(prefix="manifest parent ") as directory:
+            root = Path(directory)
+            parent = root / "parent/flutter-setup"
+            scripts = parent.parent / "scripts"
+            parent.mkdir(parents=True); scripts.mkdir()
+            for name in ("play_store_proxy.py", "flutter_manifest.py", "flutter_manifest_env.sh"):
+                shutil.copyfile(ROOT / "android-action/scripts" / name, scripts / name)
+            env_file, output = root / "env", root / "output"
+            env = {**os.environ, "GITHUB_ACTION_PATH": str(parent), "GITHUB_ENV": str(env_file),
+                   "GITHUB_OUTPUT": str(output), "RUNNER_TEMP": str(root),
+                   "GOOGLE_STORE_PROXY_URL": "http://fixture-user:fixture-secret@127.0.0.1:9"}
+            result = subprocess.run(["bash", "-e", "-o", "pipefail", "-c", guard["run"]], env=env,
+                                    capture_output=True, text=True, timeout=10)
+            self.assertEqual((result.returncode, result.stdout, result.stderr), (0, "", ""))
+            paths = dict(line.split("=", 1) for line in output.read_text().splitlines())
+            self.assertEqual(Path(paths["manifest_env"]).resolve(), (scripts / "flutter_manifest_env.sh").resolve())
+            self.assertEqual(Path(paths["manifest_helper"]).resolve(), (scripts / "flutter_manifest.py").resolve())
+            self.assertNotIn("BASH_ENV", env_file.read_text())
+            self.assertNotIn("GOWALK_FLUTTER_MANIFEST_HELPER", env_file.read_text())
+            self.assertNotIn("fixture-secret", output.read_text())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_google_bootstrap_wiring.py

@@ -31,10 +31,18 @@ class BootstrapWiringTests(unittest.TestCase):
         self.assertIn("--snapshot", scope["run"])
         self.assertEqual(resolve["with"]["dry-run"], "true")
         for step in (resolve, install):
-            self.assertNotIn("env", step)
+            self.assertEqual(step["uses"], "subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2")
+            self.assertEqual(step["env"], {
+                "BASH_ENV": "${{ steps.transport.outputs.manifest_env }}",
+                "GOWALK_FLUTTER_MANIFEST_HELPER": "${{ steps.transport.outputs.manifest_helper }}"})
             self.assertEqual(step["with"]["cache"], "false")
             self.assertEqual(step["with"]["pub-cache"], "false")
             self.assertNotIn("continue-on-error", step)
+        self.assertNotIn("BASH_ENV", setup.get("env", {}))
+        for step in (guard, scope, sdk_cache, pub_cache):
+            self.assertNotIn("BASH_ENV", step.get("env", {}))
+        self.assertEqual(guard["id"], "transport")
+        self.assertIn('>> "$GITHUB_OUTPUT"', guard["run"])
         for step in (sdk_cache, pub_cache):
             self.assertTrue(step["continue-on-error"])
             self.assertIn("steps.scope.outputs.preloader", step["env"]["NODE_OPTIONS"])

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.71
+1.0.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.71",
+  "version": "1.0.73",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-web.yml

@@ -56,6 +56,8 @@ jobs:
           flutter build web --release --build-number="${GITHUB_RUN_NUMBER}"
       - name: Retain Flutter web release
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ github.workspace }}/.github/actions/android-app/scripts/artifact_env.cjs"
         with:
           name: web-${{ github.event.repository.name }}-${{ github.run_number }}
           path: build/web

package/templates/deploy.yml

@@ -215,6 +215,8 @@ jobs:
       - name: Retain Dart symbol files
         if: ${{ !cancelled() && steps.ios_symbols.outputs.present == 'true' }}
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ env.SWIFT_APP_ACTION }}/scripts/artifact_env.cjs"
         with:
           name: ios-symbols-${{ github.event.repository.name }}-${{ env.BUILD_NUMBER || github.run_number }}
           path: ${{ runner.temp }}/dart-symbols/ios
@@ -435,6 +437,8 @@ jobs:
       - name: Retain signed Android App Bundle
         if: ${{ steps.mode.outputs.mode == 'local' }}
         uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        env:
+          NODE_OPTIONS: --require "${{ github.workspace }}/.github/actions/android-app/scripts/artifact_env.cjs"
         with:
           name: android-${{ steps.android.outputs.package-name }}-${{ steps.android.outputs.build-number }}
           path: ${{ steps.android.outputs.bundle-path }}