gowalk-cicd 1.0.72 → 1.0.73

package/CLAUDE.md

@@ -145,6 +145,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   `NO_PROXY`. The preloader snapshot under `RUNNER_TEMP` also covers official post/save after
   consumer autoupdate changes the action directory. The installer delivers this development
   tooling for native iOS repositories too; it does not require an Android app.
+- Flutter manifest GET recovery is scoped to the two pinned setup invocations through `BASH_ENV`.
+  It retains the account proxy, retries transient TLS/transport errors within 60 seconds, and emits
+  only complete JSON. Partial responses and private curl stderr never enter action outputs;
+  authentication/certificate failures remain terminal. SDK archive calls retain upstream behavior.
 - Flutter setup scopes `SEGMENT_DOWNLOAD_TIMEOUT_MINS=1` to the composite action's optional
   SDK/pub cache restores. This bounds each cache segment, not the whole cache or SDK download.
   A cache timeout becomes a cache miss; normal proxied SDK setup remains mandatory and its

package/action/.daemux-version

@@ -1 +1 @@
-1.0.72
+1.0.73

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.72
+1.0.73

package/android-action/flutter-setup/action.yml

@@ -84,9 +84,13 @@ runs:
   using: composite
   steps:
   - name: Require provider transport
+    id: transport
     shell: bash
     run: |
       python3 "$GITHUB_ACTION_PATH/../scripts/play_store_proxy.py" --bootstrap-env
+      printf 'manifest_env=%s\nmanifest_helper=%s\n' \
+        "$GITHUB_ACTION_PATH/../scripts/flutter_manifest_env.sh" \
+        "$GITHUB_ACTION_PATH/../scripts/flutter_manifest.py" >> "$GITHUB_OUTPUT"
   - name: Retain the cache process scope
     id: scope
     if: ${{ inputs.cache == 'true' || inputs.pub-cache == 'true' }}
@@ -96,6 +100,9 @@ runs:
   - name: Resolve Flutter release and cache identities
     id: flutter-action
     uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
+    env:
+      BASH_ENV: ${{ steps.transport.outputs.manifest_env }}
+      GOWALK_FLUTTER_MANIFEST_HELPER: ${{ steps.transport.outputs.manifest_helper }}
     with:
       channel: ${{ inputs.channel }}
       flutter-version: ${{ inputs.flutter-version }}
@@ -134,6 +141,9 @@ runs:
   - name: Install or reuse the resolved Flutter SDK
     if: ${{ inputs.dry-run != 'true' }}
     uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
+    env:
+      BASH_ENV: ${{ steps.transport.outputs.manifest_env }}
+      GOWALK_FLUTTER_MANIFEST_HELPER: ${{ steps.transport.outputs.manifest_helper }}
     with:
       channel: ${{ steps.flutter-action.outputs.CHANNEL }}
       flutter-version: ${{ steps.flutter-action.outputs.VERSION }}

package/android-action/scripts/flutter_manifest.py

@@ -0,0 +1,76 @@
+"""Retry the official Flutter manifest GET without exposing partial JSON or proxy secrets."""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import sys
+import tempfile
+import time
+from urllib.parse import urlsplit
+
+RETRY_CODES = {5, 6, 7, 18, 28, 35, 52, 55, 56, 92, 95}
+RETRY_HTTP = {408, 429, 500, 502, 503, 504}
+
+
+def download(arguments: list[str], directory: Path) -> int:
+    # This is the exact GET made by the pinned upstream setup.sh. Refuse new semantics.
+    if arguments[:-1] != ["--silent", "--connect-timeout", "15", "--retry", "5"]:
+        raise ValueError("flutter_manifest_arguments_unrecognized")
+    url = urlsplit(arguments[-1])
+    if (url.scheme != "https" or not url.hostname or url.username or url.password
+            or url.query or url.fragment or not re.fullmatch(
+                r"/flutter_infra_release/releases/releases_(linux|macos|windows)\.json", url.path)):
+        raise ValueError("flutter_manifest_url_unrecognized")
+    if not (os.environ.get("HTTPS_PROXY") or os.environ.get("https_proxy")):
+        raise ValueError("flutter_manifest_proxy_required")
+    child_env = {**os.environ, "NO_PROXY": "", "no_proxy": ""}
+    deadline, code, http, proxy_http = time.monotonic() + 60, 1, 0, 0
+    for attempt in range(1, 5):
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            break
+        destination = directory / f"manifest-{attempt}.json"
+        destination.touch(mode=0o600, exist_ok=False)
+        destination.chmod(0o600)
+        try:
+            result = subprocess.run([
+                "curl", "--disable", "--silent", "--show-error", "--fail", "--retry", "0",
+                "--connect-timeout", "15", "--max-time", str(min(20, remaining)),
+                "--max-filesize", "16777216", "--output", str(destination),
+                "--write-out", "%{http_code} %{http_connect}", arguments[-1],
+            ], capture_output=True, timeout=remaining, env=child_env)
+            code = result.returncode
+            status = result.stdout.split()
+            http, proxy_http = (map(int, status) if len(status) == 2 and all(part.isdigit() for part in status)
+                                else (0, 0))
+        except subprocess.TimeoutExpired:
+            code, http, proxy_http = 28, 0, 0
+        if code == 0 and http == 200:
+            body = destination.read_bytes()
+            json.loads(body)  # A successful transport must deliver complete JSON.
+            sys.stdout.buffer.write(body)
+            if attempt > 1:
+                print(f"flutter_manifest_recovered attempts={attempt}", file=sys.stderr)
+            return 0
+        if attempt == 4 or proxy_http in {401, 403, 407} or (code not in RETRY_CODES and http not in RETRY_HTTP):
+            break
+        time.sleep(min(2 ** (attempt - 1), max(0, deadline - time.monotonic())))
+    print(f"flutter_manifest_transport_failed curl_exit={code} http_status={http} "
+          f"proxy_status={proxy_http} attempts={attempt}", file=sys.stderr)
+    return code or 1
+
+
+def main() -> int:
+    try:
+        with tempfile.TemporaryDirectory(prefix="flutter-manifest-", dir=os.environ["RUNNER_TEMP"]) as scratch:
+            return download(sys.argv[1:], Path(scratch))
+    except (ValueError, OSError, KeyError):
+        print("flutter_manifest_invalid_request_or_response", file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/android-action/scripts/flutter_manifest_env.sh

@@ -0,0 +1,9 @@
+# Loaded only by the two pinned Flutter setup invocations, never the whole job.
+curl() {
+  case "${!#}" in
+    */flutter_infra_release/releases/releases_*.json)
+      python3 "${GOWALK_FLUTTER_MANIFEST_HELPER:?}" "$@"
+      ;;
+    *) command curl "$@" ;;
+  esac
+}

package/android-action/scripts/flutter_manifest_fixture.py

@@ -0,0 +1,85 @@
+"""An owned CONNECT proxy terminates only fixture TLS; it never dials a destination."""
+from contextlib import contextmanager
+import hashlib
+import json
+import os
+from pathlib import Path
+import socket
+import socketserver
+import ssl
+import struct
+import subprocess
+import threading
+import urllib.request
+
+from test_flutter_cache_setup import SETUP_SHA, SETUP_URL
+
+HOST = "manifest.fixture.invalid"
+MANIFEST = json.dumps({"releases": [{"channel": "stable", "version": "3.44.0", "dart_sdk_arch": "x64",
+    "hash": "a" * 40, "sha256": "b" * 64, "archive": "owned-sdk.tar.xz"}]}).encode()
+
+
+def official_setup() -> bytes:
+    fixture = os.environ.get("GOWALK_CACHE_ACTION_FIXTURES")
+    if fixture:
+        source = (Path(fixture) / "flutter-setup.sh").read_bytes()
+    else:
+        with urllib.request.urlopen(SETUP_URL, timeout=30) as response:
+            source = response.read(128 * 1024)
+    assert hashlib.sha256(source).hexdigest() == SETUP_SHA
+    return source
+
+
+class Proxy(socketserver.StreamRequestHandler):
+    def handle(self):
+        first = self.rfile.readline(4096).split()
+        while self.rfile.readline(4096) not in (b"\r\n", b"\n", b""):
+            pass
+        if first != [b"CONNECT", (HOST + ":443").encode(), b"HTTP/1.1"]:
+            return
+        with self.server.lock:
+            self.server.connects += 1
+            mode = self.server.modes.pop(0)
+        if mode == "proxy_auth":
+            self.wfile.write(b"HTTP/1.1 407 Proxy Authentication Required\r\nContent-Length: 0\r\n\r\n")
+            return
+        self.wfile.write(b"HTTP/1.1 200 Connection established\r\n\r\n")
+        self.wfile.flush()
+        if mode == "reset":
+            self.connection.setsockopt(socket.SOL_SOCKET, socket.SO_LINGER, struct.pack("ii", 1, 0))
+            return
+        try:
+            with self.server.context.wrap_socket(self.connection, server_side=True) as stream:
+                stream.settimeout(3)
+                with stream.makefile("rb") as reader:
+                    request = reader.readline(4096).split()
+                    while reader.readline(4096) not in (b"\r\n", b"\n", b""):
+                        pass
+                    self.server.requests.append(request[1].decode())
+                    status = b"401 Unauthorized" if mode == "origin_auth" else b"200 OK"
+                    body = MANIFEST[:31] if mode == "partial" else MANIFEST
+                    stream.sendall(b"HTTP/1.1 " + status + b"\r\nContent-Length: "
+                                   + str(len(MANIFEST)).encode() + b"\r\nConnection: close\r\n\r\n" + body)
+        except (OSError, ssl.SSLError):
+            pass  # An untrusted fixture certificate must be rejected by the real client.
+
+
+@contextmanager
+def tls_proxy(root: Path, modes: list[str]):
+    cert, key = root / "cert.pem", root / "key.pem"
+    command = ["openssl", "req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "1",
+               "-keyout", str(key), "-out", str(cert), "-subj", "/CN=" + HOST,
+               "-addext", "subjectAltName=DNS:" + HOST]
+    subprocess.run(command, check=True, capture_output=True, timeout=10)
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    context.load_cert_chain(cert, key)
+    server = socketserver.ThreadingTCPServer(("127.0.0.1", 0), Proxy)
+    server.daemon_threads = True
+    server.context, server.modes = context, list(modes)
+    server.connects, server.requests, server.lock = 0, [], threading.Lock()
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        yield server, cert
+    finally:
+        server.shutdown(); server.server_close(); thread.join(3)

package/android-action/scripts/test_flutter_manifest.py

@@ -0,0 +1,119 @@
+"""Real curl and jq execute the byte-identical official setup through owned TLS failures."""
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+from flutter_manifest_fixture import HOST, MANIFEST, official_setup, tls_proxy
+
+ROOT = Path(__file__).parent
+
+
+class ManifestRecoveryTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.source = official_setup()
+
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.root = Path(self.directory.name)
+        self.setup = self.root / "setup.sh"
+        self.setup.write_bytes(self.source)
+        (self.root / "test").mkdir()
+        (self.root / "test/releases_linux.json").write_bytes(MANIFEST)
+        # Local curl preferences may never disable the assigned proxy or certificate checks.
+        (self.root / ".curlrc").write_text('noproxy = "*"\ninsecure\n')
+
+    def invoke(self, server, cert, *, hooked=True, trusted=True, test_mode=False, bound=True):
+        proxy = f"http://fixture-user:fixture-secret@127.0.0.1:{server.server_address[1]}"
+        env = {**os.environ, "HOME": str(self.root), "RUNNER_TEMP": str(self.root), "RUNNER_OS": "Linux",
+               "RUNNER_ARCH": "X64", "RUNNER_TOOL_CACHE": str(self.root / "tools"),
+               "PUB_CACHE": str(self.root / "pub"), "FLUTTER_STORAGE_BASE_URL": "https://" + HOST,
+               "GITHUB_OUTPUT": str(self.root / "output"), "HTTPS_PROXY": proxy, "https_proxy": proxy,
+               "NO_PROXY": "*", "no_proxy": "*"}
+        for key in ("BASH_ENV", "CURL_CA_BUNDLE", "SSL_CERT_FILE", "SSL_CERT_DIR"):
+            env.pop(key, None)
+        if not bound:
+            env.pop("HTTPS_PROXY"); env.pop("https_proxy")
+        if trusted:
+            env["CURL_CA_BUNDLE"] = str(cert)
+        if hooked:
+            env.update(BASH_ENV=str(ROOT / "flutter_manifest_env.sh"),
+                       GOWALK_FLUTTER_MANIFEST_HELPER=str(ROOT / "flutter_manifest.py"))
+        else:
+            # The baseline deliberately runs the original curl defaults, without stale local bypass settings.
+            env.update(HOME=str(self.root / "absent-home"), NO_PROXY="", no_proxy="")
+        args = ["bash", str(self.setup), "-p", "-n", "3.44.0", "-a", "x64", "-k", "custom-:version:-:hash:"]
+        result = subprocess.run([*args, *(["-t"] if test_mode else []), "stable"], env=env,
+                                capture_output=True, text=True, timeout=20)
+        self.assertNotIn("fixture-secret", result.stdout + result.stderr)
+        self.assertFalse(list(self.root.glob("flutter-manifest-*")))
+        return result
+
+    def test_original_tls_exit35_recovers_without_changing_official_cache_identity(self):
+        with tls_proxy(self.root, ["reset"]) as (server, cert):
+            original = self.invoke(server, cert, hooked=False)
+            self.assertEqual(original.returncode, 35)
+            self.assertEqual((server.connects, server.requests), (1, []))
+        with tls_proxy(self.root, ["reset", "ok"]) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertEqual((server.connects, len(server.requests)), (2, 1))
+            self.assertIn("flutter_manifest_recovered attempts=2", result.stderr)
+            baseline = self.invoke(server, cert, test_mode=True)
+        self.assertEqual((self.root / "output").read_text(), baseline.stdout)
+        self.assertEqual(result.stdout, "")
+
+    def test_partial_body_is_discarded_before_the_next_complete_json(self):
+        with tls_proxy(self.root, ["partial", "ok"]) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertEqual((server.connects, len(server.requests)), (2, 2))
+        self.assertIn("VERSION=3.44.0", (self.root / "output").read_text())
+        self.assertEqual(result.stdout, "")
+
+    def test_proxy_auth_refuses_once_without_any_destination_request(self):
+        with tls_proxy(self.root, ["proxy_auth"]) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertEqual((server.connects, server.requests), (1, []))
+        self.assertIn("proxy_status=407 attempts=1", result.stderr)
+        self.assertEqual(result.stdout, "")
+
+    def test_untrusted_certificate_never_retries_or_uses_curlrc_insecure(self):
+        with tls_proxy(self.root, ["ok"]) as (server, cert):
+            result = self.invoke(server, cert, trusted=False)
+            self.assertEqual(result.returncode, 60)
+            self.assertEqual((server.connects, server.requests), (1, []))
+        self.assertIn("attempts=1", result.stderr)
+        self.assertEqual(result.stdout, "")
+
+    def test_origin_auth_is_terminal_without_exposing_its_body(self):
+        with tls_proxy(self.root, ["origin_auth"]) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertEqual(result.returncode, 22)
+            self.assertEqual((server.connects, len(server.requests)), (1, 1))
+        self.assertIn("http_status=401", result.stderr)
+        self.assertIn("attempts=1", result.stderr)
+        self.assertEqual(result.stdout, "")
+
+    def test_repeated_tls_resets_stop_after_four_private_attempts(self):
+        with tls_proxy(self.root, ["reset"] * 4) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertEqual(result.returncode, 35)
+            self.assertEqual((server.connects, server.requests), (4, []))
+        self.assertIn("attempts=4", result.stderr)
+        self.assertEqual(result.stdout, "")
+
+    def test_missing_proxy_refuses_before_any_connection(self):
+        with tls_proxy(self.root, []) as (server, cert):
+            result = self.invoke(server, cert, bound=False)
+            self.assertEqual(result.returncode, 1)
+            self.assertEqual((server.connects, server.requests), (0, []))
+        self.assertEqual(result.stdout, "")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_flutter_manifest_scope.py

@@ -0,0 +1,41 @@
+"""The parent composite freezes helper paths before a nested action changes its context."""
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+class ManifestPathScopeTests(unittest.TestCase):
+    def test_real_transport_step_captures_parent_paths_without_exporting_a_job_hook(self):
+        action = yaml.safe_load((ROOT / "android-action/flutter-setup/action.yml").read_text())
+        guard = action["runs"]["steps"][0]
+        with tempfile.TemporaryDirectory(prefix="manifest parent ") as directory:
+            root = Path(directory)
+            parent = root / "parent/flutter-setup"
+            scripts = parent.parent / "scripts"
+            parent.mkdir(parents=True); scripts.mkdir()
+            for name in ("play_store_proxy.py", "flutter_manifest.py", "flutter_manifest_env.sh"):
+                shutil.copyfile(ROOT / "android-action/scripts" / name, scripts / name)
+            env_file, output = root / "env", root / "output"
+            env = {**os.environ, "GITHUB_ACTION_PATH": str(parent), "GITHUB_ENV": str(env_file),
+                   "GITHUB_OUTPUT": str(output), "RUNNER_TEMP": str(root),
+                   "GOOGLE_STORE_PROXY_URL": "http://fixture-user:fixture-secret@127.0.0.1:9"}
+            result = subprocess.run(["bash", "-e", "-o", "pipefail", "-c", guard["run"]], env=env,
+                                    capture_output=True, text=True, timeout=10)
+            self.assertEqual((result.returncode, result.stdout, result.stderr), (0, "", ""))
+            paths = dict(line.split("=", 1) for line in output.read_text().splitlines())
+            self.assertEqual(Path(paths["manifest_env"]).resolve(), (scripts / "flutter_manifest_env.sh").resolve())
+            self.assertEqual(Path(paths["manifest_helper"]).resolve(), (scripts / "flutter_manifest.py").resolve())
+            self.assertNotIn("BASH_ENV", env_file.read_text())
+            self.assertNotIn("GOWALK_FLUTTER_MANIFEST_HELPER", env_file.read_text())
+            self.assertNotIn("fixture-secret", output.read_text())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_google_bootstrap_wiring.py

@@ -31,10 +31,18 @@ class BootstrapWiringTests(unittest.TestCase):
         self.assertIn("--snapshot", scope["run"])
         self.assertEqual(resolve["with"]["dry-run"], "true")
         for step in (resolve, install):
-            self.assertNotIn("env", step)
+            self.assertEqual(step["uses"], "subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2")
+            self.assertEqual(step["env"], {
+                "BASH_ENV": "${{ steps.transport.outputs.manifest_env }}",
+                "GOWALK_FLUTTER_MANIFEST_HELPER": "${{ steps.transport.outputs.manifest_helper }}"})
             self.assertEqual(step["with"]["cache"], "false")
             self.assertEqual(step["with"]["pub-cache"], "false")
             self.assertNotIn("continue-on-error", step)
+        self.assertNotIn("BASH_ENV", setup.get("env", {}))
+        for step in (guard, scope, sdk_cache, pub_cache):
+            self.assertNotIn("BASH_ENV", step.get("env", {}))
+        self.assertEqual(guard["id"], "transport")
+        self.assertIn('>> "$GITHUB_OUTPUT"', guard["run"])
         for step in (sdk_cache, pub_cache):
             self.assertTrue(step["continue-on-error"])
             self.assertIn("steps.scope.outputs.preloader", step["env"]["NODE_OPTIONS"])

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.72
+1.0.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.72",
+  "version": "1.0.73",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {