gowalk-cicd 1.0.76 → 1.0.78

package/CLAUDE.md

@@ -172,6 +172,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - The mobile workflow's feature-branch-only `backend-preview` job bootstraps a
   new app before GitHub registers `deploy-backend.yml` on the default branch.
   Default-branch deploys continue through the separate backend workflow.
+- Mobile pushes exclude durable `.factory/progress` records and the separately deployed
+  backend/server/Compose paths. A mixed commit with any native/shared input still builds;
+  explicit workflow dispatch remains available. Keep backend deployment's own path filters
+  intact, and do not broadly exclude assets, root build settings or unknown app layouts.
 - Domain-backed backend deploys fail closed on certificate issuance and the
   public HTTPS health probe. `select_certbot_account.sh` chooses one existing
   Let's Encrypt ACME v2 account deterministically so multi-account hosts stay
@@ -267,6 +271,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   version and metadata was skipped), and `firebase_symbols_pending` (the dSYM
   archive awaits the session's proxied console upload). The README lists the schemas; add a
   field by bumping the version.
+- `android-action/play-upload/` verifies unchanged SHA/checksum-pinned official uploader
+  bytes before running Node24. It classifies immediate private child output, never live
+  GitHub annotations: expired/deleted retries normally; only the exact cannot-auto-submit
+  refusal permits a review hold. Unknown/transport/post-commit uncertainty does not replay.
+  The existing signed AAB, proxy, track/status/rollout and notes survive one bounded retry;
+  only a successful hold emits `play_review_pending`. Keep raw child output out of receipts.
 - The JDK is chosen by `scripts/select_jdk.py`, called from the workflow before
   `setup-java`. The `JAVA_VERSION` repo variable always wins; otherwise Flutter
   gets 17 and native Gradle gets 21, except that a positively-detected Kotlin

package/README.md

@@ -228,8 +228,8 @@ already at or below those numbers are left untouched. Linux only.
 
 ### When Play will not accept a release for review
 
-Once an app has changes that Google requires a person to submit — most often
-after a policy rejection — the API refuses to commit them:
+Some Play changes require a separate console review submission. The ordinary API
+commit then returns this explicit refusal:
 
 ```
 Changes cannot be sent for review automatically. Please set the query parameter
@@ -237,10 +237,10 @@ changesNotSentForReview to true. Once committed, the changes in this edit can be
 sent for review from the Google Play Console UI.
 ```
 
-That fails the whole upload, so the bundle you just built never reaches Play at
-all. The retry re-uploads with `changesNotSentForReview`, which lands the bundle
-and leaves it waiting, then records that fact as a typed check-run annotation on
-the job (see [Check-run annotations](#check-run-annotations-the-panel-reads)):
+The uncommitted edit has not published the release. Only this exact refusal lets
+the upload wrapper retry the same signed artifact with `changesNotSentForReview`.
+A successful retry records the separate review submission that remains, using a
+typed check-run annotation (see [Check-run annotations](#check-run-annotations-the-panel-reads)):
 
 ```
 ::notice title=play_review_pending::{"schema":"gowalk-cicd/play-review-pending.v1",
@@ -289,6 +289,7 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | title | schema | fields |
 | --- | --- | --- |
 | `play_review_pending` | `gowalk-cicd/play-review-pending.v1` | `package`, `track`, `version_code` |
+| `play_upload_result` | `gowalk-cicd/play-upload.v1` | `ok`, `code`, `attempts`, `review_pending`, upstream identity |
 | `store_version_locked` | `gowalk-cicd/store-version-locked.v1` | `version`, `state`, `build_number` |
 | `firebase_symbols_pending` | `gowalk-cicd/firebase-symbols-pending.v1` | `platform`, `app_id`, `source_sha`, `artifact`, `file`, `sha256`, `status` |
 | `apple_build_upload_failed` (error) | `gowalk-cicd/apple-build-upload-failed.v2` | `category`, `stage`, `receipt_available`, receipt identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`, `provider_status`, `provider_code`, `provider_pointer`), `action` |
@@ -329,23 +330,32 @@ emits the `play_preflight_failed` error annotation with schema
 values and raw network errors are omitted. A cleanup failure also records the known
 edit ID and `cleanup_required: true` so recovery targets that edit.
 
-A Play edit is a short-lived server-side object, and an AAB upload that runs
-long enough outlives one:
-
-```
-##[error]This edit has expired, please create a new Edit.
-##[error]This Edit has been deleted.
-```
-
-Neither says anything about the build, which is signed and retained by that
-point. The upload step therefore runs with `continue-on-error` and a second
-attempt follows when the first fails — a fresh edit succeeds. Both attempts
-failing still fails the job.
-
-One caveat this makes explicit: **nothing else should hold an edit open on the
-same package while a deploy runs.** A script that polls `edits.insert` /
-`edits.delete` to inspect track state will invalidate the edit the upload is
-using, and the deploy fails for a reason that has nothing to do with the app.
+The upload wrapper at `android-action/play-upload/` runs the unchanged official
+`r0adkll/upload-google-play` revision `e738b9dd8f2476ea806d921b64aacd24f34515a5` in
+Node24. Its fixed GitHub download is checked against the recorded size and SHA256
+before execution; an absent or changed program refuses upload. Both proxy spellings
+and bypass variables are explicitly set for only that provider subprocess.
+
+The wrapper permits at most two attempts within one hour, reusing the existing
+signed bundle, track, status, rollout fraction and release notes:
+
+| First result | Recovery |
+| --- | --- |
+| Exact expired/deleted-edit refusal | Fresh edit with the original normal review behavior |
+| Exact cannot-auto-submit refusal quoted above | Fresh edit with the explicit review-hold flag |
+| Missing, multiple, unknown, transport or post-commit-uncertain failure | Fail without replay |
+
+Raw uploader output and exception text are private to the wrapper. It emits a
+`play_upload_result` annotation with schema `gowalk-cicd/play-upload.v1`, a fixed
+code, attempt count, review-pending boolean and verified upstream identity. Only a
+successful review-hold retry emits the existing `play_review_pending` receipt.
+Ordinary retry success never misreports an unsubmitted release. The wrapper does
+not depend on check-run annotations becoming visible while its job is running.
+
+An expired/deleted edit does not identify its cause. Another edit opened with the
+same API user/package can invalidate it; avoid competing read edits while uploading.
+An external actor is not proven by an expired-edit error alone. Ambiguous outcomes
+require a fresh authoritative inventory/track readback before another mutation.
 
 ### Runner disk space
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.76
+1.0.78

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.76
+1.0.78

package/android-action/play-upload/action.yml

@@ -0,0 +1,33 @@
+name: Publish the signed Play bundle with classified recovery
+description: Run the unchanged pinned official uploader; retry only definitive supported refusals.
+inputs:
+  serviceAccountJson:
+    description: Path to the provisioned service account file.
+    required: true
+  packageName:
+    description: App package identifier.
+    required: true
+  releaseFiles:
+    description: Existing signed APK or AAB paths, comma separated.
+    required: true
+  tracks:
+    description: Destination tracks.
+    required: true
+  status:
+    description: Requested release status.
+    default: completed
+  userFraction:
+    description: Optional staged rollout fraction.
+  whatsNewDirectory:
+    description: Existing localized release notes directory.
+  inAppUpdatePriority:
+    description: In-app update priority.
+    default: '0'
+outputs:
+  review-pending:
+    description: True only after a successful explicitly requested review-hold retry.
+  receipt:
+    description: Sanitized versioned result with attempt count and upstream identity.
+runs:
+  using: node24
+  main: run.cjs

package/android-action/play-upload/process.cjs

@@ -0,0 +1,78 @@
+// Fixed classifications only: raw child output and exceptions never reach logs or receipts.
+const {spawn} = require('node:child_process');
+const {readFileSync, writeFileSync} = require('node:fs');
+const {join} = require('node:path');
+const messages = new Map([
+  ['This edit has expired, please create a new Edit.', 'edit_expired'],
+  ['This Edit has been deleted.', 'edit_deleted'],
+  ['Changes cannot be sent for review automatically. Please set the query parameter changesNotSentForReview to true. '
+    + 'Once committed, the changes in this edit can be sent for review from the Google Play Console UI.',
+  'review_hold_required'],
+]);
+
+function environment(env) {
+  let proxy;
+  try { proxy = new URL(env.GOOGLE_STORE_PROXY_URL); } catch { throw new Error('assigned_proxy_required'); }
+  const authority = env.GOOGLE_STORE_PROXY_URL.split('://')[1]?.split(/[/?#]/)[0] || '';
+  if (!['http:', 'https:'].includes(proxy.protocol) || !proxy.hostname || !/:\d+$/.test(authority)
+      || /[\r\n\0]/.test(env.GOOGLE_STORE_PROXY_URL)) throw new Error('assigned_proxy_required');
+  const value = env.GOOGLE_STORE_PROXY_URL;
+  return {...env, HTTP_PROXY: value, HTTPS_PROXY: value, http_proxy: value, https_proxy: value,
+    NO_PROXY: '', no_proxy: '', ALL_PROXY: '', all_proxy: ''};
+}
+
+function consume(state, chunk) {
+  state.pending += chunk;
+  let end;
+  while ((end = state.pending.indexOf('\n')) !== -1) {
+    const line = state.pending.slice(0, end).replace(/\r$/, ''); state.pending = state.pending.slice(end + 1);
+    if (line.startsWith('::error::')) {
+      state.errors += 1;
+      const message = line.slice(9).replace(/%0D/g, '\r').replace(/%0A/g, '\n').replace(/%25/g, '%');
+      state.code = messages.get(message) || 'unclassified_failure';
+    } else if (line.startsWith('::error ')) { state.errors += 1; state.ambiguous = true; }
+  }
+  if (state.pending.length > 16384) { state.pending = ''; state.ambiguous = true; }
+}
+
+function execute(program, env, directory, timeout) {
+  return new Promise(resolve => {
+    const output = join(directory, 'output'), exports = join(directory, 'environment');
+    writeFileSync(output, '', {mode: 0o600}); writeFileSync(exports, '', {mode: 0o600});
+    const state = {pending: '', errors: 0, code: 'unclassified_failure', ambiguous: false};
+    const child = spawn(process.execPath, [program], {
+      env: {...env, GITHUB_OUTPUT: output, GITHUB_ENV: exports}, stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let cancelled = false, force;
+    const stop = () => {
+      cancelled = true; child.kill('SIGTERM');
+      if (!force) force = setTimeout(() => child.kill('SIGKILL'), 2000);
+    };
+    const timer = setTimeout(stop, timeout);
+    process.on('SIGTERM', stop); process.on('SIGINT', stop);
+    child.stdout.setEncoding('utf8'); child.stdout.on('data', chunk => consume(state, chunk));
+    child.stderr.resume();
+    child.on('error', () => { state.ambiguous = true; });
+    child.on('close', (status, signal) => {
+      clearTimeout(timer); clearTimeout(force); process.off('SIGTERM', stop); process.off('SIGINT', stop);
+      consume(state, '\n');
+      const committed = /(?:^|\n)committedEditId(?:=|<<)/.test(readFileSync(output, 'utf8'));
+      resolve({status, signal, cancelled, committed, errors: state.errors,
+        code: state.ambiguous ? 'unclassified_failure' : state.code});
+    });
+  });
+}
+
+function retry(result) {
+  if (result.status !== 1 || result.signal || result.cancelled || result.committed || result.errors !== 1) return null;
+  if (['edit_expired', 'edit_deleted'].includes(result.code)) return 'false';
+  return result.code === 'review_hold_required' ? 'true' : null;
+}
+
+function failure(result) {
+  if (result.cancelled) return 'upload_cancelled';
+  if (result.committed || result.signal || result.status === null) return 'upload_outcome_uncertain';
+  return result.status === 1 && result.errors === 1 ? result.code : 'unclassified_failure';
+}
+
+module.exports = {environment, execute, consume, retry, failure};

package/android-action/play-upload/run.cjs

@@ -0,0 +1,55 @@
+// Development delivery tooling; no uploader/runtime code enters the product binary.
+const {appendFileSync, mkdtempSync, mkdirSync, rmSync} = require('node:fs');
+const {join} = require('node:path');
+const source = require('./source.cjs');
+const processRunner = require('./process.cjs');
+
+async function upload(program, env, directory, execute = processRunner.execute, timeout = 3600000) {
+  const deadline = Date.now() + timeout;
+  let mode = 'false';
+  for (let attempt = 1; attempt <= 2; attempt++) {
+    const target = join(directory, String(attempt)); mkdirSync(target, {mode: 0o700});
+    const result = await execute(program, {...env, INPUT_CHANGESNOTSENTFORREVIEW: mode}, target,
+      Math.max(1, deadline - Date.now()));
+    const reviewPending = mode === 'true';
+    if (result.status === 0 && !result.signal && !result.cancelled && result.errors === 0) {
+      return {ok: true, code: reviewPending ? 'review_pending' : 'uploaded', attempts: attempt,
+        review_pending: reviewPending};
+    }
+    const next = processRunner.retry(result);
+    if (attempt === 2 || next === null || Date.now() >= deadline) {
+      return {ok: false, code: processRunner.failure(result),
+        attempts: attempt, review_pending: false};
+    }
+    mode = next;
+    console.log(`Google Play upload: retry=${result.code} changes_not_sent_for_review=${mode}`);
+  }
+}
+
+async function main() {
+  let directory, receipt;
+  try {
+    const env = processRunner.environment(process.env);
+    if (!env.RUNNER_TEMP || !env.GITHUB_OUTPUT) throw new Error('runner_context_required');
+    directory = mkdtempSync(join(env.RUNNER_TEMP, 'gowalk-play-upload-'));
+    receipt = await upload(await source.prepare(directory), env, directory);
+  } catch (error) {
+    const allowed = ['assigned_proxy_required', 'runner_context_required', 'uploader_integrity_refused',
+      'uploader_source_unavailable'];
+    receipt = {ok: false, code: allowed.includes(error.message) ? error.message : 'uploader_failed',
+      attempts: 0, review_pending: false};
+  } finally { if (directory) rmSync(directory, {recursive: true, force: true}); }
+  receipt = {schema: 'gowalk-cicd/play-upload.v1', ...receipt, upstream_revision: source.revision,
+    upstream_sha256: source.digest};
+  const encoded = JSON.stringify(receipt);
+  if (process.env.GITHUB_OUTPUT) {
+    appendFileSync(process.env.GITHUB_OUTPUT, `review-pending=${receipt.review_pending}\nreceipt=${encoded}\n`);
+  }
+  console.log(`::${receipt.ok ? 'notice' : 'error'} title=play_upload_result::${encoded}`);
+  if (!receipt.ok) process.exitCode = 1;
+}
+
+module.exports = {upload, main};
+if (require.main === module) void main().catch(() => {
+  process.stderr.write('play_upload_receipt_failed\n'); process.exitCode = 1;
+});

package/android-action/play-upload/source.cjs

@@ -0,0 +1,45 @@
+// Execute unchanged official uploader bytes, pinned independently of the source transport.
+const https = require('node:https');
+const {createHash} = require('node:crypto');
+const {writeFileSync} = require('node:fs');
+const {join} = require('node:path');
+const revision = 'e738b9dd8f2476ea806d921b64aacd24f34515a5';
+const digest = '15b27f8937f30f20d81bb585c4ad7ec7032e84491be51ac4dda330767a287f6b';
+const source = `https://raw.githubusercontent.com/r0adkll/upload-google-play/${revision}/lib/index.js`;
+
+function verify(bytes) {
+  if (bytes.length !== 1405863 || createHash('sha256').update(bytes).digest('hex') !== digest) {
+    throw new Error('uploader_integrity_refused');
+  }
+  return bytes;
+}
+
+function download() {
+  // Native HTTPS reaches only this fixed GitHub origin; no provider transport is changed.
+  return new Promise((resolve, reject) => {
+    const request = https.get(source, {timeout: 30000, agent: new https.Agent({proxyEnv: {}})}, response => {
+      if (response.statusCode !== 200) {
+        response.resume(); reject(new Error('uploader_source_unavailable')); return;
+      }
+      const chunks = []; let size = 0;
+      response.on('data', chunk => {
+        size += chunk.length;
+        if (size > 1405863) request.destroy(new Error('uploader_integrity_refused'));
+        else chunks.push(chunk);
+      });
+      response.on('end', () => resolve(Buffer.concat(chunks)));
+      response.on('error', () => reject(new Error('uploader_source_unavailable')));
+    });
+    request.on('timeout', () => request.destroy(new Error('uploader_source_unavailable')));
+    request.on('error', () => reject(new Error('uploader_source_unavailable')));
+  });
+}
+
+async function prepare(directory) {
+  const bytes = verify(await download());
+  const target = join(directory, 'official-uploader.cjs');
+  writeFileSync(target, bytes, {flag: 'wx', mode: 0o400});
+  return target;
+}
+
+module.exports = {revision, digest, source, verify, prepare};

package/android-action/scripts/test_early_play_workflow.py

@@ -12,7 +12,12 @@ WORKFLOW = (ROOT / "templates/deploy.yml").read_text()
 
 def readiness_step() -> str:
     start = WORKFLOW.index("      - name: Check Google Play API readiness")
-    finish = WORKFLOW.index("      # Play edits", start)
+    body = WORKFLOW.index("        run: |\n", start) + len("        run: |\n")
+    finish = body
+    for line in WORKFLOW[body:].splitlines(keepends=True):
+        if line.strip() and not line.startswith("          "):
+            break
+        finish += len(line)
     return WORKFLOW[start:finish]
 
 

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.76
+1.0.78

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.76",
+  "version": "1.0.78",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -6,6 +6,13 @@ on:
       - '**/*.md'
       - '.gitignore'
       - 'creds/**'
+      # Durable task records and independently deployed backend sources do not
+      # change a native binary. Mixed commits still run when any mobile input changes.
+      - '.factory/progress/**'
+      - 'backend/**'
+      - 'server/**'
+      - 'docker-compose.yml'
+      - '.github/workflows/deploy-backend.yml'
       - '.github/actions/swift-app/**'
       - '.github/actions/android-app/**'
   workflow_dispatch:
@@ -471,32 +478,15 @@ jobs:
           python3 .github/actions/android-app/scripts/play_preflight.py \
             --package "$PACKAGE_NAME" \
             --service-account "$SERVICE_ACCOUNT"
-      # Play edits are short-lived server-side objects, and an AAB upload that runs
-      # long — a 100-200 MB bundle, a slow runner, or anything else holding an edit
-      # open on the same package — outlives one. The failures read as
-      # "This edit has expired, please create a new Edit." or "This Edit has been
-      # deleted." Neither says anything about the build, which is already signed and
-      # retained by this point; a second attempt opens a fresh edit and succeeds.
-      # Note this also means nothing else should be creating edits against these
-      # packages while a deploy runs — an external poller that opens and deletes an
-      # edit will invalidate the one this step is holding.
-      # The upload action is JavaScript, so its proxy can only be the step's own
-      # upper-case env keys below. Node clients fall back to a lower-case no_proxy
-      # when NO_PROXY is empty, and GitHub refuses both spellings in one env map, so
-      # the ambient lower-case bypass is cleared through GITHUB_ENV instead.
-      - name: Clear ambient lower-case proxy bypass
-        if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' }}
-        shell: bash
-        run: python3 .github/actions/android-app/scripts/play_store_proxy.py --github-env
+      # The wrapper verifies the unchanged pinned official uploader and classifies
+      # its immediate result. Only explicit expired/deleted edits retry normally;
+      # only Play's explicit review-hold refusal changes the review flag.
       - name: Upload Android release to Google Play
         id: play-upload
-        continue-on-error: true
         if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' }}
-        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
+        uses: ./.github/actions/android-app/play-upload
         env:
-          HTTPS_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
-          HTTP_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
-          NO_PROXY: ''  # one spelling only: GitHub rejects env keys that differ by case
+          GOOGLE_STORE_PROXY_URL: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
           packageName: ${{ steps.android.outputs.package-name }}
@@ -507,36 +497,6 @@ jobs:
             ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
           whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
 
-      # The retry serves two different failures, and both need a fresh edit:
-      #   * the edit expired mid-upload (a large bundle on a slow runner), and
-      #   * Play refused to auto-submit: "Changes cannot be sent for review
-      #     automatically. Please set changesNotSentForReview to true." Play returns
-      #     this once an app has changes a human must submit — after a policy
-      #     rejection, for instance — and it fails the whole upload, so the built
-      #     bundle never lands at all.
-      - name: Retry Google Play upload without auto-submit
-        id: play-upload-retry
-        if: >-
-          ${{ steps.mode.outputs.mode == 'local'
-              && steps.play.outputs.ready == 'true'
-              && steps.play-upload.outcome == 'failure' }}
-        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
-        env:
-          HTTPS_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
-          HTTP_PROXY: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
-          NO_PROXY: ''  # one spelling only: GitHub rejects env keys that differ by case
-        with:
-          serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
-          packageName: ${{ steps.android.outputs.package-name }}
-          releaseFiles: ${{ steps.android.outputs.bundle-path }}
-          tracks: ${{ vars.GOOGLE_PLAY_TRACK || 'internal' }}
-          status: ${{ vars.GOOGLE_PLAY_STATUS || 'completed' }}
-          userFraction: >-
-            ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
-          whatsNewDirectory: >-
-            ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
-          changesNotSentForReview: true
-
       # The retry landed the bundle without submitting it. That is a fact for
       # the panel that merged this commit, not a chore for a person: the panel
       # reads this typed check-run annotation off the job (title + JSON with a
@@ -544,7 +504,7 @@ jobs:
       # step that presses "Send changes for review". Normal after a policy
       # rejection; the ordinary first upload submits and this never fires.
       - name: Record that Play holds this release for a review submission
-        if: ${{ always() && steps.play-upload-retry.outcome == 'success' }}
+        if: ${{ steps.play-upload.outcome == 'success' && steps.play-upload.outputs.review-pending == 'true' }}
         shell: bash
         env:
           PACKAGE: ${{ steps.android.outputs.package-name }}