gowalk-cicd 1.0.75 → 1.0.77

package/CLAUDE.md

@@ -172,6 +172,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - The mobile workflow's feature-branch-only `backend-preview` job bootstraps a
   new app before GitHub registers `deploy-backend.yml` on the default branch.
   Default-branch deploys continue through the separate backend workflow.
+- Mobile pushes exclude durable `.factory/progress` records and the separately deployed
+  backend/server/Compose paths. A mixed commit with any native/shared input still builds;
+  explicit workflow dispatch remains available. Keep backend deployment's own path filters
+  intact, and do not broadly exclude assets, root build settings or unknown app layouts.
 - Domain-backed backend deploys fail closed on certificate issuance and the
   public HTTPS health probe. `select_certbot_account.sh` chooses one existing
   Let's Encrypt ACME v2 account deterministically so multi-account hosts stay

package/action/.daemux-version

@@ -1 +1 @@
-1.0.75
+1.0.77

package/action/scripts/asc_common.py

@@ -155,21 +155,37 @@ def _request_timeouts() -> tuple[float, float]:
     )
 
 
+def _network_error_category(exc: BaseException) -> str:
+    """Closed diagnostic labels only; exception text can contain private proxy URLs."""
+    for error_type, category in (
+        (requests.exceptions.ProxyError, "proxy"),
+        (requests.exceptions.SSLError, "tls"),
+        (requests.exceptions.ConnectTimeout, "connect_timeout"),
+        (requests.exceptions.ReadTimeout, "read_timeout"),
+        (requests.exceptions.Timeout, "timeout"),
+        (requests.exceptions.ConnectionError, "connection"),
+    ):
+        if isinstance(exc, error_type):
+            return category
+    return "request"
+
+
 def _retry_network_error(
     method: str, path: str, attempt: int, total: int,
     backoffs: tuple[int, ...], exc: BaseException,
 ) -> None:
     """Network error path: sleep and return when retries remain, else
     raise SystemExit (terminal). Caller ``continue``s after return."""
+    category = _network_error_category(exc)
     if attempt >= total - 1:
         raise SystemExit(
             f"ASC {method} {path} network error after {total} "
-            "attempts through the configured proxy"
+            f"attempts through the configured proxy (category={category})"
         )
     delay = backoffs[attempt]
     print(
         f"ASC {method} {path} network error through the configured proxy; "
-        f"retrying in {delay}s ({attempt + 1}/{total - 1})",
+        f"retrying in {delay}s ({attempt + 1}/{total - 1}; category={category})",
         file=sys.stderr,
     )
     time.sleep(delay)

package/action/scripts/test_asc_network_diagnostics.py

@@ -0,0 +1,103 @@
+"""Real ASC helper and Requests preparation; only socket dispatch and sleeps are replaced."""
+import contextlib
+import io
+import os
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import asc_common
+
+PRIVATE = "SYNTHETIC_PRIVATE_MARKER"
+PROXY = f"http://account:{PRIVATE}@assigned.proxy.test:1234"
+ENV = {"APPLE_STORE_PROXY_URL": PROXY, "NO_PROXY": "*", "no_proxy": "*",
+       "HTTPS_PROXY": "http://unrelated.proxy.test:9876", "REQUESTS_CA_BUNDLE": "",
+       "CURL_CA_BUNDLE": "", "ASC_REQUEST_TIMEOUT_CONNECT_SEC": "", "ASC_REQUEST_TIMEOUT_READ_SEC": ""}
+
+
+class PrivateFailure(asc_common.requests.RequestException):
+    def __str__(self):
+        raise AssertionError("Exception text must never be inspected")
+
+
+@mock.patch.dict(os.environ, ENV)
+class NetworkDiagnosticTests(unittest.TestCase):
+    def test_terminal_categories_preserve_transport_and_privacy(self):
+        errors = asc_common.requests.exceptions
+        cases = [(errors.ProxyError, "proxy"), (errors.SSLError, "tls"),
+                 (errors.ConnectTimeout, "connect_timeout"), (errors.ReadTimeout, "read_timeout"),
+                 (errors.Timeout, "timeout"), (errors.ConnectionError, "connection"),
+                 (errors.RequestException, "request"), (PrivateFailure, "request")]
+        for error_type, category in cases:
+            with self.subTest(category=category, error_type=error_type.__name__):
+                stderr, stdout = io.StringIO(), io.StringIO()
+                with mock.patch.object(asc_common.requests.Session, "send", autospec=True,
+                                       side_effect=error_type(f"{PRIVATE} {PROXY}")) as sender, \
+                        mock.patch.object(asc_common.time, "sleep") as sleep, \
+                        contextlib.redirect_stderr(stderr), contextlib.redirect_stdout(stdout):
+                    with self.assertRaises(SystemExit) as caught:
+                        asc_common.request("GET", "/builds", PRIVATE, params={"limit": "200"})
+                self.assertEqual(sender.call_count, 3)
+                self.assertEqual(sleep.call_args_list, [mock.call(2), mock.call(8)])
+                self.assertEqual(stderr.getvalue().count(f"category={category}"), 2)
+                self.assertIn(f"after 3 attempts through the configured proxy (category={category})",
+                              str(caught.exception))
+                self.assertNotIn(PRIVATE, stdout.getvalue() + stderr.getvalue() + str(caught.exception))
+                self.assertEqual(stdout.getvalue(), "")
+                for call in sender.call_args_list:
+                    self.assertEqual(call.args[1].url, asc_common.ASC_BASE + "/builds?limit=200")
+                    self.assertEqual(call.args[1].headers["Authorization"], f"Bearer {PRIVATE}")
+                    self.assertEqual(call.kwargs["proxies"]["https"], PROXY)
+                    self.assertEqual(call.kwargs["proxies"]["http"], PROXY)
+                    self.assertEqual(call.kwargs["timeout"], (10.0, 30.0))
+                    self.assertIs(call.kwargs["verify"], True)
+
+    def test_transient_failure_returns_success_without_extra_sender_calls(self):
+        response = asc_common.requests.Response()
+        response.status_code = 200
+        stderr = io.StringIO()
+        with mock.patch.object(asc_common.requests.Session, "send", autospec=True,
+                               side_effect=[asc_common.requests.exceptions.ProxyError(PRIVATE), response]) as sender, \
+                mock.patch.object(asc_common.time, "sleep") as sleep, contextlib.redirect_stderr(stderr):
+            self.assertIs(asc_common.request("GET", "/builds", PRIVATE), response)
+        self.assertEqual(sender.call_count, 2)
+        sleep.assert_called_once_with(2)
+        self.assertIn("category=proxy", stderr.getvalue())
+        self.assertNotIn(PRIVATE, stderr.getvalue())
+
+    def test_single_attempt_does_not_sleep(self):
+        with mock.patch.object(asc_common.requests.Session, "send", autospec=True,
+                               side_effect=asc_common.requests.exceptions.ReadTimeout(PRIVATE)) as sender, \
+                mock.patch.object(asc_common.time, "sleep") as sleep:
+            with self.assertRaisesRegex(SystemExit, "after 1 attempts.*category=read_timeout"):
+                asc_common.request("GET", "/builds", PRIVATE, max_attempts=1)
+        self.assertEqual(sender.call_count, 1)
+        sleep.assert_not_called()
+
+    def test_missing_or_invalid_proxy_refuses_before_sender(self):
+        for proxy in ["", "not-a-proxy"]:
+            with self.subTest(proxy=proxy), mock.patch.dict(os.environ, {"APPLE_STORE_PROXY_URL": proxy}), \
+                    mock.patch.object(asc_common.requests.Session, "send") as sender, \
+                    mock.patch.object(asc_common.time, "sleep") as sleep:
+                with self.assertRaisesRegex(SystemExit, "direct requests are refused"):
+                    asc_common.request("GET", "/builds", PRIVATE)
+                sender.assert_not_called()
+                sleep.assert_not_called()
+
+    def test_http_refusal_is_not_reclassified_as_network_failure(self):
+        response = asc_common.requests.Response()
+        response.status_code = 401
+        response._content = b"unauthorized"
+        with mock.patch.object(asc_common.requests.Session, "send", return_value=response) as sender, \
+                mock.patch.object(asc_common.time, "sleep") as sleep:
+            with self.assertRaises(SystemExit) as caught:
+                asc_common.request("GET", "/builds", PRIVATE)
+        self.assertEqual(sender.call_count, 1)
+        sleep.assert_not_called()
+        self.assertEqual(str(caught.exception), "ASC GET /builds failed: 401\nunauthorized")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.75
+1.0.77

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.75
+1.0.77

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.75",
+  "version": "1.0.77",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -6,6 +6,13 @@ on:
       - '**/*.md'
       - '.gitignore'
       - 'creds/**'
+      # Durable task records and independently deployed backend sources do not
+      # change a native binary. Mixed commits still run when any mobile input changes.
+      - '.factory/progress/**'
+      - 'backend/**'
+      - 'server/**'
+      - 'docker-compose.yml'
+      - '.github/workflows/deploy-backend.yml'
       - '.github/actions/swift-app/**'
       - '.github/actions/android-app/**'
   workflow_dispatch: