gowalk-cicd 1.0.77 → 1.0.79

package/CLAUDE.md

@@ -197,6 +197,15 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   the validated source path. Missing/ambiguous source plists fail; positively generated
   plists retain the existing build-setting version path. Queries disable signing and package
   updates, retain inherited proxies, and never enable provisioning network operations.
+- Native Xcode validation and archives first check the selected project/workspace graph with
+  `native_dependency_guard.py ROOT --container PATH`. Xcode-managed Swift packages remain refused:
+  proxy environment variables do not protect SwiftPM downloads. The same app session preserves
+  source and uses the vendor's official CocoaPods distribution or verified local XCFrameworks.
+  `native_pods.py` installs a committed, unchanged `Podfile.lock` with `pod install --deployment`
+  through the existing Google relay, then checks the completed workspace. No Podfile means no
+  dependency download or Google proxy requirement. Initial local lock resolution may use the
+  explicit `--before-pods --initial-pods-lock` guard; CI never uses that development exception.
+  These checks cover the declared native dependency graph, not arbitrary custom build-script traffic.
 - Version stamping is per-build-system: Flutter takes `--build-number`, Gradle
   has no equivalent, so `set_gradle_version()` rewrites the literal in the
   checkout the way the iOS action patches the pbxproj. Never commit that edit.
@@ -256,12 +265,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - The iOS action reads every script and prompt from the snapshot it takes of
   itself in its first step (`$SWIFT_APP_ACTION`, under `RUNNER_TEMP`), never
   from `${{ github.action_path }}` after that step. The plugin self-update
-  (`autoupdate_check.sh`) runs right after the snapshot and commits on its own,
+  (`autoupdate_check.sh`) runs right after the snapshot and preserves its own source candidate,
   before the version/signing/archive steps, so a red deploy still receives the
   release that fixes it; the snapshot is what keeps that run on one version.
   `test_action_step_order.py` pins both. A new script reference in
   `action/action.yml` therefore uses `"$SWIFT_APP_ACTION/scripts/..."`.
-- Three situations end a green job with work for the panel, and each is a typed
+- Delivery dependencies may remain after a green job; each is a typed
   check-run annotation (`::notice title=<name>::<one-line JSON with a versioned
   schema>`), never prose in a `::warning::`: `play_review_pending`
   (`templates/deploy.yml`, Play refused auto-submit and the bundle landed
@@ -271,9 +280,33 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   version and metadata was skipped), and `firebase_symbols_pending` (the dSYM
   archive awaits the session's proxied console upload). The README lists the schemas; add a
   field by bumping the version.
+- `android-action/play-upload/` verifies unchanged SHA/checksum-pinned official uploader
+  bytes before running Node24. It classifies immediate private child output, never live
+  GitHub annotations: expired/deleted retries normally; only the exact cannot-auto-submit
+  refusal permits a review hold. Unknown/transport/post-commit uncertainty does not replay.
+  The existing signed AAB, proxy, track/status/rollout and notes survive one bounded retry;
+  only a successful hold emits `play_review_pending`. Keep raw child output out of receipts.
 - The JDK is chosen by `scripts/select_jdk.py`, called from the workflow before
   `setup-java`. The `JAVA_VERSION` repo variable always wins; otherwise Flutter
   gets 17 and native Gradle gets 21, except that a positively-detected Kotlin
   Gradle plugin below 1.9.20 drops to 17 (older kapt cannot run under JDK 21).
   Detection logic belongs in that script, where it is unit-tested — not inline
   in the workflow template, where nothing can test it.
+
+- CI-generated source is preserved by `source_maintenance.py` on a deterministic
+  `task/ci-maintenance-*` branch, with remote parent/tree/SHA readback. It never changes
+  the build HEAD, rebases a dirty checkout, force-pushes or pushes to the default branch.
+  Only managed action/version source is accepted; credential-shaped staging refuses.
+  `source_maintenance_pending` identifies the exact source for the same app session's
+  checked PR. Unconfirmed preservation is a job failure; a receipt is not a completed merge.
+- Play preflight, version inventory and the pinned uploader share the panel's package edit owner.
+  The binding's nonsecret `principal_sha256` must match the selected service account's
+  `client_email` fingerprint before provider work. A mismatch requires supported CI-secret
+  provisioning; never accept the account ID or a caller-supplied fingerprint alone.
+  `APP_ROBOT_PLAY_EDIT_BINDING` is panel-provisioned repository data; workflows pass it as
+  `PLAY_EDIT_BINDING` with the repo-local GitHub token and `contents:write`/`actions:read`.
+  `play-upload/owner_run.cjs` protects Python entrypoints; `run.cjs` holds the same owner across
+  its permitted upload retry. Missing/retired bindings, unknown write outcomes and active owners
+  refuse before provider work; only exact terminal run/attempt/source proof permits recovery.
+  Other packages stay parallel. The GitHub coordination request is fixed-origin and does not
+  change the Google account proxy. Update workflow wiring as well as action directories.

package/README.md

@@ -228,8 +228,8 @@ already at or below those numbers are left untouched. Linux only.
 
 ### When Play will not accept a release for review
 
-Once an app has changes that Google requires a person to submit — most often
-after a policy rejection — the API refuses to commit them:
+Some Play changes require a separate console review submission. The ordinary API
+commit then returns this explicit refusal:
 
 ```
 Changes cannot be sent for review automatically. Please set the query parameter
@@ -237,10 +237,10 @@ changesNotSentForReview to true. Once committed, the changes in this edit can be
 sent for review from the Google Play Console UI.
 ```
 
-That fails the whole upload, so the bundle you just built never reaches Play at
-all. The retry re-uploads with `changesNotSentForReview`, which lands the bundle
-and leaves it waiting, then records that fact as a typed check-run annotation on
-the job (see [Check-run annotations](#check-run-annotations-the-panel-reads)):
+The uncommitted edit has not published the release. Only this exact refusal lets
+the upload wrapper retry the same signed artifact with `changesNotSentForReview`.
+A successful retry records the separate review submission that remains, using a
+typed check-run annotation (see [Check-run annotations](#check-run-annotations-the-panel-reads)):
 
 ```
 ::notice title=play_review_pending::{"schema":"gowalk-cicd/play-review-pending.v1",
@@ -289,8 +289,10 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | title | schema | fields |
 | --- | --- | --- |
 | `play_review_pending` | `gowalk-cicd/play-review-pending.v1` | `package`, `track`, `version_code` |
+| `play_upload_result` | `gowalk-cicd/play-upload.v1` | `ok`, `code`, `attempts`, `review_pending`, upstream identity |
 | `store_version_locked` | `gowalk-cicd/store-version-locked.v1` | `version`, `state`, `build_number` |
 | `firebase_symbols_pending` | `gowalk-cicd/firebase-symbols-pending.v1` | `platform`, `app_id`, `source_sha`, `artifact`, `file`, `sha256`, `status` |
+| `source_maintenance_pending` | `gowalk-cicd/source-maintenance-pending.v1` | `repo`, `base_sha`, `head_sha`, `branch`, `run_id` |
 | `apple_build_upload_failed` (error) | `gowalk-cicd/apple-build-upload-failed.v2` | `category`, `stage`, `receipt_available`, receipt identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`, `provider_status`, `provider_code`, `provider_pointer`), `action` |
 
 Add a field by bumping the schema version; never change the meaning of an
@@ -299,10 +301,12 @@ existing one.
 ### The plugin self-update runs first
 
 The vendored iOS action checks npm for a newer `gowalk-cicd` at the **start** of
-every default-branch run and commits the refreshed action directories in their
-own commit, before the version, signing and archive steps. A deploy that is red
-in one of those steps therefore still picks up the plugin release that fixes it,
-on the very run that fails, and the next push runs the fixed plugin. The run that
+every default-branch run and preserves the refreshed action directories on a verified
+task branch before the version, signing and archive steps. The
+`source_maintenance_pending` receipt lets the same app session adopt that exact commit
+into its current task branch and land it through the normal checked PR, including
+when later deploy steps fail. CI never pushes to the default branch or rebases its
+dirty build checkout; a failed preservation is a job failure. The run that
 performed the update keeps executing the version it started with: the action
 snapshots itself to `$RUNNER_TEMP` before anything mutates and reads every script
 and prompt from that copy.
@@ -329,23 +333,32 @@ emits the `play_preflight_failed` error annotation with schema
 values and raw network errors are omitted. A cleanup failure also records the known
 edit ID and `cleanup_required: true` so recovery targets that edit.
 
-A Play edit is a short-lived server-side object, and an AAB upload that runs
-long enough outlives one:
-
-```
-##[error]This edit has expired, please create a new Edit.
-##[error]This Edit has been deleted.
-```
-
-Neither says anything about the build, which is signed and retained by that
-point. The upload step therefore runs with `continue-on-error` and a second
-attempt follows when the first fails — a fresh edit succeeds. Both attempts
-failing still fails the job.
-
-One caveat this makes explicit: **nothing else should hold an edit open on the
-same package while a deploy runs.** A script that polls `edits.insert` /
-`edits.delete` to inspect track state will invalidate the edit the upload is
-using, and the deploy fails for a reason that has nothing to do with the app.
+The upload wrapper at `android-action/play-upload/` runs the unchanged official
+`r0adkll/upload-google-play` revision `e738b9dd8f2476ea806d921b64aacd24f34515a5` in
+Node24. Its fixed GitHub download is checked against the recorded size and SHA256
+before execution; an absent or changed program refuses upload. Both proxy spellings
+and bypass variables are explicitly set for only that provider subprocess.
+
+The wrapper permits at most two attempts within one hour, reusing the existing
+signed bundle, track, status, rollout fraction and release notes:
+
+| First result | Recovery |
+| --- | --- |
+| Exact expired/deleted-edit refusal | Fresh edit with the original normal review behavior |
+| Exact cannot-auto-submit refusal quoted above | Fresh edit with the explicit review-hold flag |
+| Missing, multiple, unknown, transport or post-commit-uncertain failure | Fail without replay |
+
+Raw uploader output and exception text are private to the wrapper. It emits a
+`play_upload_result` annotation with schema `gowalk-cicd/play-upload.v1`, a fixed
+code, attempt count, review-pending boolean and verified upstream identity. Only a
+successful review-hold retry emits the existing `play_review_pending` receipt.
+Ordinary retry success never misreports an unsubmitted release. The wrapper does
+not depend on check-run annotations becoming visible while its job is running.
+
+An expired/deleted edit does not identify its cause. Another edit opened with the
+same API user/package can invalidate it; avoid competing read edits while uploading.
+An external actor is not proven by an expired-edit error alone. Ambiguous outcomes
+require a fresh authoritative inventory/track readback before another mutation.
 
 ### Runner disk space
 
@@ -879,8 +892,9 @@ and configure that one in the Apple Developer portal, then re-run.
 
 When the ASC combined floor (max of pending review, `preReleaseVersions`,
 or builds-via-`preReleaseVersion`) exceeds your project's
-`MARKETING_VERSION`, the action auto-bumps and commits the new value as
-part of the same bot commit that handles cert refresh / autoupdate.
+`MARKETING_VERSION`, the action auto-bumps and preserves the staged source on a
+verified task branch. The app session resolves its `source_maintenance_pending`
+receipt through its normal checked PR before source delivery is complete.
 
 Default policy is `rollover` — patch with carry: at `.9` it rolls into
 the next minor (`1.0.9` → `1.1.0`), and at minor=9 it cascades into the
@@ -917,8 +931,8 @@ do not override the input.
 In `'none'` mode, the floor check fails the build and you must bump
 `MARKETING_VERSION` manually before retrying.
 
-**Side effect:** the bot commit subject reflects what was changed, e.g.
-`ci: refresh signing identity + bump MARKETING_VERSION [skip ci]`.
+**Side effect:** the retained source commit identifies the version change.
+Signing credentials are refused from maintenance commits; use encrypted repository secrets.
 
 **Source-of-truth resolution.** The auto-bump writes the new value
 into the file your project actually reads from, in this order:
@@ -946,8 +960,8 @@ The vendored action ships with a per-run autoupdate check. On every
 push to your default branch, the action queries npm for the latest
 `gowalk-cicd`, compares against the local marker at
 `.github/actions/swift-app/.daemux-version`, and if newer, re-vendors
-the package via `npx --yes` and commits the refreshed action files
-back (under both `.github/actions/swift-app/` and
+the package via `npx --yes` and preserves the refreshed action files
+on a verified task branch (under both `.github/actions/swift-app/` and
 `.github/actions/android-app/`).
 `.github/workflows/deploy.yml` is NEVER auto-committed — see
 "deploy.yml is not auto-updated" below.
@@ -955,15 +969,15 @@ back (under both `.github/actions/swift-app/` and
 | Aspect | Behaviour |
 |--------|-----------|
 | Trigger | Push to default branch only (PR / branch runs do nothing) |
-| Lag | One run — the *next* push after a new release picks up the update |
-| Suppression | `[skip ci]` in the commit subject + `paths-ignore` for both action directories |
-| Combined commit | Cert refresh + autoupdate share a single commit when both fire in the same run |
-| Failure mode | Non-fatal: a failed `npm view` or `npx` emits `::warning::` and the build continues |
+| Landing | The app session adopts the exact receipt on its current task branch and uses the protected PR |
+| Isolation | CI leaves HEAD and worktree bytes intact; no default-branch push or rebase |
+| Candidates | Action updates and later version changes have separate verified receipts |
+| Failure mode | npm discovery remains optional; unconfirmed source preservation fails the job |
 
 The shipped `deploy.yml` template already includes the required
 `paths-ignore` entries for both action directories. If you have an
 older `deploy.yml` checked in, add both entries to prevent the
-autoupdate commit-back from re-triggering the workflow.
+tooling-only source landing from re-triggering the mobile workflow.
 
 ### deploy.yml is not auto-updated
 
@@ -973,9 +987,9 @@ of `contents: write` — this is a built-in safeguard against CI
 self-modification. When a new version of `gowalk-cicd`
 requires `deploy.yml` schema changes (e.g., new permissions, new
 paths-ignore entries), the action's release notes will call this out
-and you must run `npx --yes gowalk-cicd` manually once to
-sync your `deploy.yml`. Existing deploy.yml stays untouched on every
-auto-update cycle until you do.
+and the app session runs the pinned `npx --yes gowalk-cicd` adoption in its task
+workspace, preserving app-specific workflow inputs and landing the full change through
+its checked PR. The CI-side update does not commit the workflow.
 
 Changes that need that manual run:
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.77
+1.0.79

package/action/action.yml

@@ -182,8 +182,8 @@ inputs:
       re-vendors the package via `npx --yes` if the published version is
       newer than the marker at .github/actions/swift-app/.daemux-version.
       The refreshed action files (NOT deploy.yml, which GITHUB_TOKEN
-      cannot push) are committed alongside any cert refresh in a single
-      combined commit. Set to 'false' to pin the vendored copy.
+      cannot push) are retained on a verified task branch for the app session's
+      checked PR. Set to 'false' to pin the vendored copy.
     required: false
     default: "true"
 
@@ -205,15 +205,23 @@ runs:
         rm -rf "$RUNNER_TEMP/swift-app-action"
         mkdir -p "$RUNNER_TEMP/swift-app-action"
         cp -R "${{ github.action_path }}/." "$RUNNER_TEMP/swift-app-action/"
+        # Native repositories receive the same canonical Google transport as Android.
+        mkdir -p "$RUNNER_TEMP/swift-app-action/google-transport"
+        for helper in play_store_proxy.py jvm_proxy_relay.py; do
+          if [ -f "$GITHUB_WORKSPACE/.github/actions/android-app/scripts/$helper" ]; then
+            cp "$GITHUB_WORKSPACE/.github/actions/android-app/scripts/$helper" \
+              "$RUNNER_TEMP/swift-app-action/google-transport/$helper"
+          fi
+        done
         echo "SWIFT_APP_ACTION=$RUNNER_TEMP/swift-app-action" >> "$GITHUB_ENV"
 
     # The plugin self-update runs BEFORE the version, signing and archive
-    # steps and lands in its own commit. It used to run after them, so a
+    # steps and preserves its own source candidate. It used to run after them, so a
     # deploy that was red in the version step (App Store Connect refusing a
     # new version while one is in review, GoVolt run 33743284641) never
     # reached the self-update, and the plugin release that fixed exactly
     # that failure could not arrive in the repository that needed it.
-    # Committing here rather than with the cert refresh below is the same
+    # Preserving here rather than after signing is the same
     # point: a red step later in this run must not take the update with it.
     - name: Stage bot-side scripts to runner temp
       if: ${{ (inputs.archive == 'true' || inputs.auto-update == 'true')
@@ -227,6 +235,8 @@ runs:
           "$RUNNER_TEMP/swift-app-bot-scripts/"
         cp "$SWIFT_APP_ACTION/scripts/commit_bot_changes.sh" \
           "$RUNNER_TEMP/swift-app-bot-scripts/"
+        cp "$SWIFT_APP_ACTION/scripts/source_maintenance.py" \
+          "$RUNNER_TEMP/swift-app-bot-scripts/"
         chmod +x "$RUNNER_TEMP/swift-app-bot-scripts/"*.sh
         echo "BOT_SCRIPTS_DIR=$RUNNER_TEMP/swift-app-bot-scripts" >> "$GITHUB_ENV"
 
@@ -243,9 +253,9 @@ runs:
       run: bash "$BOT_SCRIPTS_DIR/autoupdate_check.sh"
 
     - name: Commit + push refreshed app-ci
-      # Its own commit, immediately: the refreshed action files must reach
-      # the default branch even when the version or signing steps of this
-      # very run fail. deploy.yml is deliberately not staged (GITHUB_TOKEN
+      # Preserve a source candidate immediately, even when later version/signing
+      # fails. The app session lands it through its normal protected PR.
+      # deploy.yml is deliberately not staged (GITHUB_TOKEN
       # cannot push workflow files). No-op when the plugin was current.
       if: ${{ inputs.auto-update == 'true'
             && github.event_name == 'push'
@@ -256,11 +266,6 @@ runs:
         GITHUB_REF_NAME: ${{ github.ref_name }}
       run: |
         set -euo pipefail
-        # A shallow checkout (fetch-depth 1 for direct action callers) must
-        # be able to rebase on a moved default branch inside the push retry.
-        git fetch --unshallow 2>/dev/null \
-          || git fetch --depth=2147483647 2>/dev/null \
-          || true
         bash "$BOT_SCRIPTS_DIR/commit_bot_changes.sh"
 
     - name: Resolve credentials + auto-detect Xcode project
@@ -293,6 +298,21 @@ runs:
           echo "Installing xcodegen (project.yml present, binary missing)…"
           brew install xcodegen >/dev/null 2>&1 || HOMEBREW_NO_AUTO_UPDATE=1 brew install xcodegen
         fi
+        if ! python3 "$SWIFT_APP_ACTION/scripts/native_pods.py" "$GITHUB_WORKSPACE" \
+          --container "${INPUT_WORKSPACE:-$INPUT_PROJECT}" \
+          --proxy-helper "$SWIFT_APP_ACTION/google-transport/play_store_proxy.py" \
+          > "$RUNNER_TEMP/native-pods.json"; then
+          cat "$RUNNER_TEMP/native-pods.json"
+          exit 1
+        fi
+        # CocoaPods adds the dependency workspace even when the app supplied only its project.
+        INPUT_WORKSPACE=$(python3 - <<'PY_NATIVE_WORKSPACE'
+        import json, os
+        with open(os.environ["RUNNER_TEMP"] + "/native-pods.json") as receipt:
+            print(json.load(receipt).get("workspace", os.environ.get("INPUT_WORKSPACE", "")))
+        PY_NATIVE_WORKSPACE
+        )
+        export INPUT_WORKSPACE
         python3 "$SWIFT_APP_ACTION/scripts/read_config.py"
 
     - name: Select latest Xcode
@@ -320,6 +340,8 @@ runs:
               || 'platform=iOS Simulator,name=iPhone 15' }}
       run: |
         set -o pipefail
+        python3 "$SWIFT_APP_ACTION/scripts/native_dependency_guard.py" "$GITHUB_WORKSPACE" \
+          --container "${WORKSPACE:-$PROJECT}"
         if [ -n "$TEST_COMMAND" ]; then
           echo "Running custom test command: $TEST_COMMAND"
           bash -c "$TEST_COMMAND"
@@ -338,6 +360,7 @@ runs:
             -scheme "$SCHEME" \
             -configuration "$CONFIGURATION" \
             -destination "$TEST_DESTINATION" \
+            -disableAutomaticPackageResolution -skipPackageUpdates \
             CODE_SIGNING_ALLOWED=NO \
             CODE_SIGNING_REQUIRED=NO \
             CODE_SIGN_IDENTITY="" \
@@ -376,6 +399,8 @@ runs:
         CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
       run: |
         set -o pipefail
+        python3 "$SWIFT_APP_ACTION/scripts/native_dependency_guard.py" "$GITHUB_WORKSPACE" \
+          --container "${WORKSPACE:-$PROJECT}"
         python3 "$SWIFT_APP_ACTION/scripts/resolve_marketing_version.py" \
           | tee -a "$GITHUB_ENV"
 
@@ -487,30 +512,10 @@ runs:
           echo "::error::Signing preparation failed; preserving any generated cache before failing."
         fi
 
-    # DESIGN DECISION (intentional, not a bug):
-    # The next five steps stage + commit-back the Apple Distribution
-    # code-signing identity (.p12 + provisioning profiles) AND any
-    # autoupdate of the vendored app-ci actions into the consumer
-    # repo's default branch. This is a deliberate trade-off chosen over
-    # GitHub Secrets-based storage:
-    #   - Consumer repos already commit the ASC API key (.p8) to creds/, so
-    #     the threat model already accepts repo-stored Apple credentials.
-    #   - Each app uses a different Apple Developer account / .p8, so
-    #     org-level GitHub Secrets do not amortize setup work.
-    #   - "Drop file in creds/" remains the consistent UX for new projects.
-    # Non-negotiable mitigations (see IOS_NATIVE_CI_SETUP.md):
-    #   - Repo MUST stay private (branch protection on visibility recommended).
-    #   - permissions: contents: write is required; expands attack surface
-    #     of any compromised step in the workflow — keep workflow minimal.
-    #   - .gitignore must NOT block the new creds/ files (see setup doc).
-    #
-    # The autoupdate half runs FIRST in this action (see the top of the
-    # step list) and lands in its own commit, so a fixed plugin reaches a
-    # repository whose deploy is failing in the version or signing steps
-    # below. What remains here: (1) stage cert files, (2) commit + push
-    # whatever is staged, (3) re-raise a deferred prepare failure after
-    # preserving its cache.
-
+    # Encrypted signing material is the supported factory path and disables
+    # the legacy signing-cache staging below. Source maintenance refuses staged
+    # credential paths; it never pushes them or bypasses branch protection.
+    # A version bump is preserved separately from the earlier action update.
 
     - name: Stage refreshed signing identity
       # Only stage on push to the default branch — PR runs and feature
@@ -570,8 +575,8 @@ runs:
         fi
 
     - name: Commit + push staged bot changes
-      # The cert refresh (and any marketing-version auto-bump the version
-      # step staged). The autoupdate landed in its own commit at the top of
+      # Any marketing-version auto-bump the version step staged is preserved.
+      # The autoupdate has its own candidate at the top of
       # this action; this script is a no-op when nothing is staged, so a
       # PR / feature-branch run that somehow reaches this step does no
       # harm — but we still gate on default-branch push for clarity.
@@ -604,6 +609,8 @@ runs:
         BUNDLE_ID: ${{ inputs.bundle-id || env.CFG_BUNDLE_ID }}
       run: |
         set -o pipefail
+        python3 "$SWIFT_APP_ACTION/scripts/native_dependency_guard.py" "$GITHUB_WORKSPACE" \
+          --container "${WORKSPACE:-$PROJECT}"
         # Read every target's complete settings and preserve Xcode's actual status/error.
         # The selected application's source root can differ from its containing workspace.
         INFOPLIST_PATH=$(python3 "$SWIFT_APP_ACTION/scripts/resolve_info_plist.py")
@@ -662,6 +669,8 @@ runs:
         CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
       run: |
         set -o pipefail
+        python3 "$SWIFT_APP_ACTION/scripts/native_dependency_guard.py" "$GITHUB_WORKSPACE" \
+          --container "${WORKSPACE:-$PROJECT}"
         if [ -n "$WORKSPACE" ]; then
           PROJ_ARGS=(-workspace "$WORKSPACE")
         else
@@ -680,6 +689,7 @@ runs:
           -configuration "$CONFIGURATION" \
           -destination "generic/platform=iOS" \
           -archivePath "$RUNNER_TEMP/app.xcarchive" \
+          -disableAutomaticPackageResolution -skipPackageUpdates \
           -skipPackagePluginValidation \
           -skipMacroValidation \
           CURRENT_PROJECT_VERSION="$BUILD_NUMBER" \

package/action/scripts/auto_detect.py

@@ -47,6 +47,7 @@ from pathlib import Path
 from typing import Optional
 
 from cfg_io import log, notice
+import native_dependency_guard
 
 
 APP_PRODUCT_TYPE = "com.apple.product-type.application"
@@ -231,12 +232,8 @@ def _pick_by_basename(matches: list[Path], workspace: Path, label: str) -> Path:
 def _resolve_package_dependencies(
     workspace: Path, project: str, workspace_file: str
 ) -> bool:
-    """Resolve the SPM graph once so later xcodebuild calls are cheap.
-
-    Returns True when resolution finished (regardless of exit status — a
-    project with no packages still exits cleanly and a partial resolve may
-    be enough for ``-list``), False when it could not be run at all.
-    """
+    """Retain local Xcode recovery only after refusing an unverified package graph."""
+    native_dependency_guard.check(workspace, workspace_file or project)
     cmd = ["xcodebuild", "-resolvePackageDependencies"]
     if workspace_file:
         cmd += ["-workspace", workspace_file]
@@ -269,7 +266,8 @@ def _list_schemes(
     if key in _list_cache:
         return _list_cache[key]
 
-    cmd = ["xcodebuild", "-list", "-json"]
+    native_dependency_guard.check(workspace, workspace_file or project)
+    cmd = ["xcodebuild", "-list", "-json", "-disableAutomaticPackageResolution", "-skipPackageUpdates"]
     if workspace_file:
         cmd += ["-workspace", workspace_file]
     elif project:
@@ -343,7 +341,9 @@ def _show_build_settings(
     if key in _settings_cache:
         return _settings_cache[key]
 
-    cmd = ["xcodebuild", "-showBuildSettings", "-json", "-scheme", scheme]
+    native_dependency_guard.check(workspace, workspace_file or project)
+    cmd = ["xcodebuild", "-showBuildSettings", "-json", "-scheme", scheme,
+           "-disableAutomaticPackageResolution", "-skipPackageUpdates"]
     if configuration:
         cmd += ["-configuration", configuration]
     if workspace_file:

package/action/scripts/commit_bot_changes.sh

@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
-# Commits whatever previous steps staged (cert refresh and/or autoupdate),
-# pushes with up-to-3 attempts (rebase between). Exits 0 with ::warning::
-# on exhausted retries so the wrapping job stays green.
+# Preserve staged source on a verified task branch for the app session's normal PR.
+# The build checkout, protected default branch and unrelated dirty files stay intact.
 set -euo pipefail
 
 if git diff --cached --quiet; then
@@ -54,29 +53,4 @@ git config user.name  >/dev/null 2>&1 || git config user.name  "github-actions[b
 git config user.email >/dev/null 2>&1 || \
   git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
-git commit -m "$subject" \
-  -m "Co-Authored-By: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
-
-branch="${GITHUB_REF_NAME:-$(git rev-parse --abbrev-ref HEAD)}"
-
-attempt=1
-max=3
-while (( attempt <= max )); do
-  if git push origin "HEAD:$branch"; then
-    echo "commit_bot_changes: push succeeded on attempt $attempt"
-    exit 0
-  fi
-  echo "::warning::commit_bot_changes: push attempt $attempt failed"
-  if (( attempt < max )); then
-    git fetch origin "$branch" || true
-    git pull --rebase origin "$branch" || {
-      echo "::warning::commit_bot_changes: rebase failed, aborting"
-      git rebase --abort >/dev/null 2>&1 || true
-      exit 0
-    }
-  fi
-  attempt=$((attempt + 1))
-done
-
-echo "::warning::commit_bot_changes: exhausted $max push attempts"
-exit 0
+exec python3 "$(dirname "$0")/source_maintenance.py" "$subject"

package/action/scripts/native_dependency_guard.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Refuse unverified Xcode package networking in the selected native dependency graph."""
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import sys
+
+from native_project_graph import Refused, project, selected, workspace
+
+REMEDIATION = ("Preserve source; use the vendor's official CocoaPods distribution through the assigned Google proxy "
+               "and commit Podfile.lock, or verified local XCFrameworks; rerun the same task's build.")
+
+
+def check(root: Path, container: str = "", *, before_pods: bool = False, initial_pods_lock: bool = False) -> dict:
+    if initial_pods_lock and not before_pods:
+        raise Refused("native_initial_lock_phase_required")
+    root = root.resolve(strict=True)
+    pending, visited, count = [selected(root, container, before_pods)], set(), 0
+    while pending:
+        path = pending.pop()
+        if path in visited:
+            continue
+        visited.add(path)
+        if len(visited) > 200:
+            raise Refused("native_project_inventory_unverified")
+        if path.suffix == ".xcworkspace":
+            pending.extend(workspace(root, path, before_pods, initial_pods_lock))
+        elif path.suffix == ".xcodeproj":
+            pending.extend(project(root, path))
+            count += 1
+        else:
+            raise Refused("native_workspace_reference_unverified")
+    if not count:
+        raise Refused("native_project_inventory_missing")
+    return {"ok": True, "projects": count, "xcode_package_resolution": "unused",
+            "phase": "before_pods" if before_pods else "complete"}
+
+
+def main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("root", type=Path)
+    parser.add_argument("--container", default="")
+    parser.add_argument("--before-pods", action="store_true")
+    parser.add_argument("--initial-pods-lock", action="store_true")
+    args = parser.parse_args(argv)
+    try:
+        answer = check(args.root, args.container, before_pods=args.before_pods,
+                       initial_pods_lock=args.initial_pods_lock)
+    except (Refused, OSError) as exc:
+        code = str(exc) if isinstance(exc, Refused) else "native_project_inventory_unverified"
+        answer = {"ok": False, "code": code, "next": REMEDIATION}
+    print(json.dumps(answer, sort_keys=True))
+    return 0 if answer["ok"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))