gowalk-cicd 1.0.74 → 1.0.76

package/CLAUDE.md

@@ -176,6 +176,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   public HTTPS health probe. `select_certbot_account.sh` chooses one existing
   Let's Encrypt ACME v2 account deterministically so multi-account hosts stay
   non-interactive; legacy v1 account directories are not valid candidates.
+  `ensure_certificate.sh` preserves failed inventory status and retries only Certbot's
+  explicit lock-busy response (six attempts, 75 seconds total backoff). Every retry reads
+  inventory before issuance; absence needs recognized complete SAN records or Certbot's explicit
+  no-certificate sentinel. Empty/malformed output and arbitrary errors never mean absence. Raw command
+  output stays in an owned private temporary directory removed on exit. Do not remove
+  Certbot locks, stop other processes, force renewal or bypass the public HTTPS health gate.
 - The Android action serves two build systems. `android_config.project_kind()`
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie

package/action/.daemux-version

@@ -1 +1 @@
-1.0.74
+1.0.76

package/action/scripts/asc_common.py

@@ -155,21 +155,37 @@ def _request_timeouts() -> tuple[float, float]:
     )
 
 
+def _network_error_category(exc: BaseException) -> str:
+    """Closed diagnostic labels only; exception text can contain private proxy URLs."""
+    for error_type, category in (
+        (requests.exceptions.ProxyError, "proxy"),
+        (requests.exceptions.SSLError, "tls"),
+        (requests.exceptions.ConnectTimeout, "connect_timeout"),
+        (requests.exceptions.ReadTimeout, "read_timeout"),
+        (requests.exceptions.Timeout, "timeout"),
+        (requests.exceptions.ConnectionError, "connection"),
+    ):
+        if isinstance(exc, error_type):
+            return category
+    return "request"
+
+
 def _retry_network_error(
     method: str, path: str, attempt: int, total: int,
     backoffs: tuple[int, ...], exc: BaseException,
 ) -> None:
     """Network error path: sleep and return when retries remain, else
     raise SystemExit (terminal). Caller ``continue``s after return."""
+    category = _network_error_category(exc)
     if attempt >= total - 1:
         raise SystemExit(
             f"ASC {method} {path} network error after {total} "
-            "attempts through the configured proxy"
+            f"attempts through the configured proxy (category={category})"
         )
     delay = backoffs[attempt]
     print(
         f"ASC {method} {path} network error through the configured proxy; "
-        f"retrying in {delay}s ({attempt + 1}/{total - 1})",
+        f"retrying in {delay}s ({attempt + 1}/{total - 1}; category={category})",
         file=sys.stderr,
     )
     time.sleep(delay)

package/action/scripts/test_asc_network_diagnostics.py

@@ -0,0 +1,103 @@
+"""Real ASC helper and Requests preparation; only socket dispatch and sleeps are replaced."""
+import contextlib
+import io
+import os
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import asc_common
+
+PRIVATE = "SYNTHETIC_PRIVATE_MARKER"
+PROXY = f"http://account:{PRIVATE}@assigned.proxy.test:1234"
+ENV = {"APPLE_STORE_PROXY_URL": PROXY, "NO_PROXY": "*", "no_proxy": "*",
+       "HTTPS_PROXY": "http://unrelated.proxy.test:9876", "REQUESTS_CA_BUNDLE": "",
+       "CURL_CA_BUNDLE": "", "ASC_REQUEST_TIMEOUT_CONNECT_SEC": "", "ASC_REQUEST_TIMEOUT_READ_SEC": ""}
+
+
+class PrivateFailure(asc_common.requests.RequestException):
+    def __str__(self):
+        raise AssertionError("Exception text must never be inspected")
+
+
+@mock.patch.dict(os.environ, ENV)
+class NetworkDiagnosticTests(unittest.TestCase):
+    def test_terminal_categories_preserve_transport_and_privacy(self):
+        errors = asc_common.requests.exceptions
+        cases = [(errors.ProxyError, "proxy"), (errors.SSLError, "tls"),
+                 (errors.ConnectTimeout, "connect_timeout"), (errors.ReadTimeout, "read_timeout"),
+                 (errors.Timeout, "timeout"), (errors.ConnectionError, "connection"),
+                 (errors.RequestException, "request"), (PrivateFailure, "request")]
+        for error_type, category in cases:
+            with self.subTest(category=category, error_type=error_type.__name__):
+                stderr, stdout = io.StringIO(), io.StringIO()
+                with mock.patch.object(asc_common.requests.Session, "send", autospec=True,
+                                       side_effect=error_type(f"{PRIVATE} {PROXY}")) as sender, \
+                        mock.patch.object(asc_common.time, "sleep") as sleep, \
+                        contextlib.redirect_stderr(stderr), contextlib.redirect_stdout(stdout):
+                    with self.assertRaises(SystemExit) as caught:
+                        asc_common.request("GET", "/builds", PRIVATE, params={"limit": "200"})
+                self.assertEqual(sender.call_count, 3)
+                self.assertEqual(sleep.call_args_list, [mock.call(2), mock.call(8)])
+                self.assertEqual(stderr.getvalue().count(f"category={category}"), 2)
+                self.assertIn(f"after 3 attempts through the configured proxy (category={category})",
+                              str(caught.exception))
+                self.assertNotIn(PRIVATE, stdout.getvalue() + stderr.getvalue() + str(caught.exception))
+                self.assertEqual(stdout.getvalue(), "")
+                for call in sender.call_args_list:
+                    self.assertEqual(call.args[1].url, asc_common.ASC_BASE + "/builds?limit=200")
+                    self.assertEqual(call.args[1].headers["Authorization"], f"Bearer {PRIVATE}")
+                    self.assertEqual(call.kwargs["proxies"]["https"], PROXY)
+                    self.assertEqual(call.kwargs["proxies"]["http"], PROXY)
+                    self.assertEqual(call.kwargs["timeout"], (10.0, 30.0))
+                    self.assertIs(call.kwargs["verify"], True)
+
+    def test_transient_failure_returns_success_without_extra_sender_calls(self):
+        response = asc_common.requests.Response()
+        response.status_code = 200
+        stderr = io.StringIO()
+        with mock.patch.object(asc_common.requests.Session, "send", autospec=True,
+                               side_effect=[asc_common.requests.exceptions.ProxyError(PRIVATE), response]) as sender, \
+                mock.patch.object(asc_common.time, "sleep") as sleep, contextlib.redirect_stderr(stderr):
+            self.assertIs(asc_common.request("GET", "/builds", PRIVATE), response)
+        self.assertEqual(sender.call_count, 2)
+        sleep.assert_called_once_with(2)
+        self.assertIn("category=proxy", stderr.getvalue())
+        self.assertNotIn(PRIVATE, stderr.getvalue())
+
+    def test_single_attempt_does_not_sleep(self):
+        with mock.patch.object(asc_common.requests.Session, "send", autospec=True,
+                               side_effect=asc_common.requests.exceptions.ReadTimeout(PRIVATE)) as sender, \
+                mock.patch.object(asc_common.time, "sleep") as sleep:
+            with self.assertRaisesRegex(SystemExit, "after 1 attempts.*category=read_timeout"):
+                asc_common.request("GET", "/builds", PRIVATE, max_attempts=1)
+        self.assertEqual(sender.call_count, 1)
+        sleep.assert_not_called()
+
+    def test_missing_or_invalid_proxy_refuses_before_sender(self):
+        for proxy in ["", "not-a-proxy"]:
+            with self.subTest(proxy=proxy), mock.patch.dict(os.environ, {"APPLE_STORE_PROXY_URL": proxy}), \
+                    mock.patch.object(asc_common.requests.Session, "send") as sender, \
+                    mock.patch.object(asc_common.time, "sleep") as sleep:
+                with self.assertRaisesRegex(SystemExit, "direct requests are refused"):
+                    asc_common.request("GET", "/builds", PRIVATE)
+                sender.assert_not_called()
+                sleep.assert_not_called()
+
+    def test_http_refusal_is_not_reclassified_as_network_failure(self):
+        response = asc_common.requests.Response()
+        response.status_code = 401
+        response._content = b"unauthorized"
+        with mock.patch.object(asc_common.requests.Session, "send", return_value=response) as sender, \
+                mock.patch.object(asc_common.time, "sleep") as sleep:
+            with self.assertRaises(SystemExit) as caught:
+                asc_common.request("GET", "/builds", PRIVATE)
+        self.assertEqual(sender.call_count, 1)
+        sleep.assert_not_called()
+        self.assertEqual(str(caught.exception), "ASC GET /builds failed: 401\nunauthorized")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.74
+1.0.76

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.74
+1.0.76

package/backend-action/action.yml

@@ -122,11 +122,12 @@ runs:
           rsync -az -e "$SSH" "$COMPOSE_FILE" \
             "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/docker-compose.yml"
         fi
-        # Ship remote helpers after the application mirror. Both are package
+        # Ship remote helpers after the application mirror. They are package
         # owned and kept out of the consumer's source tree.
         rsync -az -e "$SSH" \
           "${{ github.action_path }}/remote_deploy.sh" \
           "${{ github.action_path }}/select_certbot_account.sh" \
+          "${{ github.action_path }}/ensure_certificate.sh" \
           "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
 
     - name: Deploy on the host

package/backend-action/ensure_certificate.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Sourced by remote_deploy.sh. Only a proven Certbot lock conflict may be retried.
+
+certbot_lock_busy() {
+  grep -Fxq 'Another instance of Certbot is already running.' \
+    "$CERTBOT_WORK/stdout" "$CERTBOT_WORK/stderr"
+}
+
+certbot_attempt() {
+  local phase="$1" attempt="$2" status
+  shift 2
+  if certbot "$@" > "$CERTBOT_WORK/stdout" 2> "$CERTBOT_WORK/stderr"; then
+    log "certificate phase=$phase attempt=$attempt state=ok exit=0"
+    return 0
+  else
+    status=$?
+  fi
+  if certbot_lock_busy; then
+    log "certificate phase=$phase attempt=$attempt state=lock_busy exit=$status"
+  else
+    log "certificate phase=$phase attempt=$attempt state=error exit=$status"
+  fi
+  return "$status"
+}
+
+certificate_present() {
+  # 0=present, 1=confirmed absent, 2=unrecognized/partial inventory; preserve other awk failures.
+  awk -v domain="$1" '
+    function valid_san(value, labels, count, i, compressed, groups) {
+      if (index(value, ":")) {
+        count = split(value, labels, "::"); if (count > 2) return 0
+        compressed = count == 2
+        if (value ~ /^:[^:]/ || value ~ /[^:]:$/ || value ~ /:::/) return 0
+        count = split(value, labels, ":"); groups = 0
+        for (i = 1; i <= count; i++) if (labels[i] != "") {
+          if (labels[i] !~ /^[0-9A-Fa-f]+$/ || length(labels[i]) > 4) return 0
+          groups++
+        }
+        return compressed ? groups < 8 : groups == 8
+      }
+      sub(/^[*][.]/, "", value); count = split(value, labels, ".")
+      if (count < 2 || length(value) > 253) return 0
+      for (i = 1; i <= count; i++)
+        if (labels[i] !~ /^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?$/ || length(labels[i]) > 63) return 0
+      return 1
+    }
+    /^[[:space:]-]*$/ { next }
+    /^No certificates found[.]$/ { if (mode) bad = 1; mode = 2; next }
+    /^Found the following certs:$/ { if (mode) bad = 1; mode = 1; next }
+    $1 == "Certificate" && $2 == "Name:" {
+      if (mode != 1 || NF < 3 || (records && sans != 1)) bad = 1
+      records++; sans = 0; next
+    }
+    $1 == "Domains:" || $1 == "Identifiers:" {
+      if (mode != 1 || !records || sans || NF < 2) bad = 1
+      sans++
+      for (i = 2; i <= NF; i++) { if (!valid_san($i)) bad = 1; if ($i == domain) found = 1 }
+      next
+    }
+    /^[[:space:]]+(Serial Number|Key Type|Expiry Date|Certificate Path|Private Key Path):/ {
+      if (mode != 1 || !records) bad = 1
+      next
+    }
+    { bad = 1 }
+    END {
+      if (bad || !mode || (mode == 1 && (!records || sans != 1))) exit 2
+      exit !found
+    }
+  ' "$CERTBOT_WORK/stdout"
+}
+
+request_certificate() {
+  local domain="$1" email="$2" attempt="$3" account
+  set -- --nginx -d "$domain" --non-interactive --agree-tos --email "$email" --redirect
+  account="$(select_certbot_account)" || return $?
+  if [ -n "$account" ]; then
+    log "using an existing Let's Encrypt account"
+    set -- "$@" --account "$account"
+  fi
+  certbot_attempt issuance "$attempt" "$@"
+}
+
+ensure_certificate() (
+  local domain="$1" email="$2" delay attempt=0 status=1 CERTBOT_WORK
+  CERTBOT_WORK="$(mktemp -d "${TMPDIR:-/tmp}/gowalk-certbot.XXXXXXXX")" || return $?
+  trap 'rm -rf -- "$CERTBOT_WORK"' EXIT
+  trap 'exit 130' INT
+  trap 'exit 143' TERM
+  # Six attempts, 75 seconds total backoff. Commands retain the deployment job's bound.
+  for delay in 0 5 10 15 20 25; do
+    attempt=$((attempt + 1))
+    if [ "$delay" -gt 0 ]; then
+      log "certificate state=lock_retry attempt=$attempt backoff_seconds=$delay"
+      sleep "$delay" || return $?
+    fi
+    if certbot_attempt inventory "$attempt" certificates; then
+      if certificate_present "$domain"; then
+        log "cert for $domain already present"
+        return 0
+      else
+        status=$?
+        if [ "$status" -ne 1 ]; then
+          log "certificate phase=inventory_parse state=error exit=$status"
+          return "$status"
+        fi
+      fi
+    else
+      status=$?
+      certbot_lock_busy && continue
+      return "$status"
+    fi
+    log "requesting LE cert for $domain"
+    if request_certificate "$domain" "$email" "$attempt"; then
+      return 0
+    else
+      status=$?
+      certbot_lock_busy || return "$status"
+    fi
+    # A contender may have created this certificate. Re-read before another issuance.
+  done
+  log "certificate state=lock_retry_exhausted attempts=$attempt exit=$status"
+  return "$status"
+)

package/backend-action/remote_deploy.sh

@@ -11,6 +11,7 @@ CERT_EMAIL="${4:-admin@gowalk.com}"
 DIR="/opt/gowalk-backends/$APP"
 cd "$DIR"
 source "$DIR/select_certbot_account.sh"
+source "$DIR/ensure_certificate.sh"
 
 log() { echo "[deploy $APP] $*"; }
 
@@ -93,22 +94,13 @@ NGINX
   nginx -t && systemctl reload nginx
 fi
 
-# ── Let's Encrypt cert (idempotent; certbot skips if current)
-if ! certbot certificates 2>/dev/null | grep -q "Domains: $DOMAIN\b"; then
-  log "requesting LE cert for $DOMAIN"
-  CERTBOT_ACCOUNT="$(select_certbot_account)"
-  CERTBOT_ARGS=()
-  if [ -n "$CERTBOT_ACCOUNT" ]; then
-    log "using an existing Let's Encrypt account"
-    CERTBOT_ARGS+=(--account "$CERTBOT_ACCOUNT")
-  fi
-  if ! certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
-    --email "$CERT_EMAIL" --redirect "${CERTBOT_ARGS[@]}"; then
-    log "ERROR: certbot failed for $DOMAIN"
-    exit 1
-  fi
+# ── Let's Encrypt cert: failed inventory is never absence; only lock contention retries.
+if ensure_certificate "$DOMAIN" "$CERT_EMAIL"; then
+  log "certificate ready for $DOMAIN"
 else
-  log "cert for $DOMAIN already present"
+  status=$?
+  log "ERROR: certbot failed for $DOMAIN (exit=$status)"
+  exit "$status"
 fi
 
 # ── public health-check. This validates DNS, the certificate, nginx routing,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.74",
+  "version": "1.0.76",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {