gowalk-cicd 1.0.74 → 1.0.75

package/CLAUDE.md

@@ -176,6 +176,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   public HTTPS health probe. `select_certbot_account.sh` chooses one existing
   Let's Encrypt ACME v2 account deterministically so multi-account hosts stay
   non-interactive; legacy v1 account directories are not valid candidates.
+  `ensure_certificate.sh` preserves failed inventory status and retries only Certbot's
+  explicit lock-busy response (six attempts, 75 seconds total backoff). Every retry reads
+  inventory before issuance; absence needs recognized complete SAN records or Certbot's explicit
+  no-certificate sentinel. Empty/malformed output and arbitrary errors never mean absence. Raw command
+  output stays in an owned private temporary directory removed on exit. Do not remove
+  Certbot locks, stop other processes, force renewal or bypass the public HTTPS health gate.
 - The Android action serves two build systems. `android_config.project_kind()`
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie

package/action/.daemux-version

@@ -1 +1 @@
-1.0.74
+1.0.75

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.74
+1.0.75

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.74
+1.0.75

package/backend-action/action.yml

@@ -122,11 +122,12 @@ runs:
           rsync -az -e "$SSH" "$COMPOSE_FILE" \
             "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/docker-compose.yml"
         fi
-        # Ship remote helpers after the application mirror. Both are package
+        # Ship remote helpers after the application mirror. They are package
         # owned and kept out of the consumer's source tree.
         rsync -az -e "$SSH" \
           "${{ github.action_path }}/remote_deploy.sh" \
           "${{ github.action_path }}/select_certbot_account.sh" \
+          "${{ github.action_path }}/ensure_certificate.sh" \
           "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
 
     - name: Deploy on the host

package/backend-action/ensure_certificate.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Sourced by remote_deploy.sh. Only a proven Certbot lock conflict may be retried.
+
+certbot_lock_busy() {
+  grep -Fxq 'Another instance of Certbot is already running.' \
+    "$CERTBOT_WORK/stdout" "$CERTBOT_WORK/stderr"
+}
+
+certbot_attempt() {
+  local phase="$1" attempt="$2" status
+  shift 2
+  if certbot "$@" > "$CERTBOT_WORK/stdout" 2> "$CERTBOT_WORK/stderr"; then
+    log "certificate phase=$phase attempt=$attempt state=ok exit=0"
+    return 0
+  else
+    status=$?
+  fi
+  if certbot_lock_busy; then
+    log "certificate phase=$phase attempt=$attempt state=lock_busy exit=$status"
+  else
+    log "certificate phase=$phase attempt=$attempt state=error exit=$status"
+  fi
+  return "$status"
+}
+
+certificate_present() {
+  # 0=present, 1=confirmed absent, 2=unrecognized/partial inventory; preserve other awk failures.
+  awk -v domain="$1" '
+    function valid_san(value, labels, count, i, compressed, groups) {
+      if (index(value, ":")) {
+        count = split(value, labels, "::"); if (count > 2) return 0
+        compressed = count == 2
+        if (value ~ /^:[^:]/ || value ~ /[^:]:$/ || value ~ /:::/) return 0
+        count = split(value, labels, ":"); groups = 0
+        for (i = 1; i <= count; i++) if (labels[i] != "") {
+          if (labels[i] !~ /^[0-9A-Fa-f]+$/ || length(labels[i]) > 4) return 0
+          groups++
+        }
+        return compressed ? groups < 8 : groups == 8
+      }
+      sub(/^[*][.]/, "", value); count = split(value, labels, ".")
+      if (count < 2 || length(value) > 253) return 0
+      for (i = 1; i <= count; i++)
+        if (labels[i] !~ /^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?$/ || length(labels[i]) > 63) return 0
+      return 1
+    }
+    /^[[:space:]-]*$/ { next }
+    /^No certificates found[.]$/ { if (mode) bad = 1; mode = 2; next }
+    /^Found the following certs:$/ { if (mode) bad = 1; mode = 1; next }
+    $1 == "Certificate" && $2 == "Name:" {
+      if (mode != 1 || NF < 3 || (records && sans != 1)) bad = 1
+      records++; sans = 0; next
+    }
+    $1 == "Domains:" || $1 == "Identifiers:" {
+      if (mode != 1 || !records || sans || NF < 2) bad = 1
+      sans++
+      for (i = 2; i <= NF; i++) { if (!valid_san($i)) bad = 1; if ($i == domain) found = 1 }
+      next
+    }
+    /^[[:space:]]+(Serial Number|Key Type|Expiry Date|Certificate Path|Private Key Path):/ {
+      if (mode != 1 || !records) bad = 1
+      next
+    }
+    { bad = 1 }
+    END {
+      if (bad || !mode || (mode == 1 && (!records || sans != 1))) exit 2
+      exit !found
+    }
+  ' "$CERTBOT_WORK/stdout"
+}
+
+request_certificate() {
+  local domain="$1" email="$2" attempt="$3" account
+  set -- --nginx -d "$domain" --non-interactive --agree-tos --email "$email" --redirect
+  account="$(select_certbot_account)" || return $?
+  if [ -n "$account" ]; then
+    log "using an existing Let's Encrypt account"
+    set -- "$@" --account "$account"
+  fi
+  certbot_attempt issuance "$attempt" "$@"
+}
+
+ensure_certificate() (
+  local domain="$1" email="$2" delay attempt=0 status=1 CERTBOT_WORK
+  CERTBOT_WORK="$(mktemp -d "${TMPDIR:-/tmp}/gowalk-certbot.XXXXXXXX")" || return $?
+  trap 'rm -rf -- "$CERTBOT_WORK"' EXIT
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+  # Six attempts, 75 seconds total backoff. Commands retain the deployment job's bound.
+  for delay in 0 5 10 15 20 25; do
+    attempt=$((attempt + 1))
+    if [ "$delay" -gt 0 ]; then
+      log "certificate state=lock_retry attempt=$attempt backoff_seconds=$delay"
+      sleep "$delay" || return $?
+    fi
+    if certbot_attempt inventory "$attempt" certificates; then
+      if certificate_present "$domain"; then
+        log "cert for $domain already present"
+        return 0
+      else
+        status=$?
+        if [ "$status" -ne 1 ]; then
+          log "certificate phase=inventory_parse state=error exit=$status"
+          return "$status"
+        fi
+      fi
+    else
+      status=$?
+      certbot_lock_busy && continue
+      return "$status"
+    fi
+    log "requesting LE cert for $domain"
+    if request_certificate "$domain" "$email" "$attempt"; then
+      return 0
+    else
+      status=$?
+      certbot_lock_busy || return "$status"
+    fi
+    # A contender may have created this certificate. Re-read before another issuance.
+  done
+  log "certificate state=lock_retry_exhausted attempts=$attempt exit=$status"
+  return "$status"
+)

package/backend-action/remote_deploy.sh

@@ -11,6 +11,7 @@ CERT_EMAIL="${4:-admin@gowalk.com}"
 DIR="/opt/gowalk-backends/$APP"
 cd "$DIR"
 source "$DIR/select_certbot_account.sh"
+source "$DIR/ensure_certificate.sh"
 
 log() { echo "[deploy $APP] $*"; }
 
@@ -93,22 +94,13 @@ NGINX
   nginx -t && systemctl reload nginx
 fi
 
-# ── Let's Encrypt cert (idempotent; certbot skips if current)
-if ! certbot certificates 2>/dev/null | grep -q "Domains: $DOMAIN\b"; then
-  log "requesting LE cert for $DOMAIN"
-  CERTBOT_ACCOUNT="$(select_certbot_account)"
-  CERTBOT_ARGS=()
-  if [ -n "$CERTBOT_ACCOUNT" ]; then
-    log "using an existing Let's Encrypt account"
-    CERTBOT_ARGS+=(--account "$CERTBOT_ACCOUNT")
-  fi
-  if ! certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
-    --email "$CERT_EMAIL" --redirect "${CERTBOT_ARGS[@]}"; then
-    log "ERROR: certbot failed for $DOMAIN"
-    exit 1
-  fi
+# ── Let's Encrypt cert: failed inventory is never absence; only lock contention retries.
+if ensure_certificate "$DOMAIN" "$CERT_EMAIL"; then
+  log "certificate ready for $DOMAIN"
 else
-  log "cert for $DOMAIN already present"
+  status=$?
+  log "ERROR: certbot failed for $DOMAIN (exit=$status)"
+  exit "$status"
 fi
 
 # ── public health-check. This validates DNS, the certificate, nginx routing,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.74",
+  "version": "1.0.75",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {