gowalk-cicd 1.0.78 → 1.0.79

package/action/scripts/native_pods_process.py

@@ -0,0 +1,93 @@
+"""Drain one retained child session before reaping its leader; never target another process group."""
+import os
+import select
+import signal
+import subprocess
+import time
+
+
+class Interrupted(RuntimeError):
+    pass
+
+
+class Exit:
+    def __init__(self, pid: int):
+        self.pid, self.queue, self.done = pid, None, False
+        if hasattr(os, "waitid"):
+            return
+        self.queue = select.kqueue()
+        event = select.kevent(pid, filter=select.KQ_FILTER_PROC, flags=select.KQ_EV_ADD | select.KQ_EV_ONESHOT,
+                              fflags=select.KQ_NOTE_EXIT)
+        self.queue.control([event], 0, 0)
+
+    def __call__(self) -> bool:
+        if self.queue is None:
+            return os.waitid(os.P_PID, self.pid, os.WEXITED | os.WNOHANG | os.WNOWAIT) is not None
+        if not self.done:
+            events = self.queue.control(None, 1, 0)
+            if events:
+                if events[0].ident != self.pid or not events[0].fflags & select.KQ_NOTE_EXIT:
+                    raise RuntimeError("native_pods_process_readback_failed")
+                self.done = True
+        return self.done
+
+    def close(self):
+        if self.queue:
+            self.queue.close()
+
+
+def members(pid: int) -> bool:
+    result = subprocess.run(["ps", "-axo", "pid=,pgid=,stat="], capture_output=True, text=True, timeout=2, check=False)
+    if result.returncode:
+        raise RuntimeError("native_pods_process_readback_failed")
+    for line in result.stdout.splitlines():
+        fields = line.split()
+        if len(fields) != 3 or not fields[0].isdigit() or not fields[1].isdigit():
+            raise RuntimeError("native_pods_process_readback_failed")
+        if int(fields[1]) == pid and int(fields[0]) != pid and not fields[2].startswith("Z"):
+            return True
+    return False
+
+
+def drain(pid: int, exited: Exit) -> None:
+    for sig, duration in ((signal.SIGTERM, 3), (signal.SIGKILL, 2)):
+        if exited() and not members(pid):
+            return
+        os.killpg(pid, sig)
+        deadline = time.monotonic() + duration
+        while time.monotonic() < deadline:
+            if exited() and not members(pid):
+                return
+            time.sleep(0.02)
+    raise RuntimeError("native_pods_process_cleanup_unverified")
+
+
+def command(argv: list[str], cwd, log, *, timeout: float = 900) -> int:
+    if not hasattr(os, "waitid") and not hasattr(select, "kqueue"):
+        raise RuntimeError("native_pods_process_readback_unsupported")
+    child = subprocess.Popen(argv, cwd=cwd, stdout=log, stderr=subprocess.STDOUT, start_new_session=True)
+    observer, interrupted = None, False
+    try:
+        observer = Exit(child.pid)
+        deadline = time.monotonic() + timeout
+        try:
+            while not observer():
+                if time.monotonic() >= deadline:
+                    interrupted = True
+                    break
+                time.sleep(0.02)
+        except KeyboardInterrupt:
+            interrupted = True
+        # WNOWAIT/kqueue retains the PID until the last group member is verified stopped.
+        drain(child.pid, observer)
+    except BaseException:
+        # Retained PID still owns this group even when readback itself failed.
+        os.killpg(child.pid, signal.SIGKILL)
+        raise
+    finally:
+        if observer:
+            observer.close()
+        code = child.wait(timeout=5)
+    if interrupted:
+        raise Interrupted("native_pods_operation_interrupted")
+    return code

package/action/scripts/native_project_graph.py

@@ -0,0 +1,148 @@
+"""Bounded local Xcode graph traversal; no Xcode process or provider requests."""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import plistlib
+import subprocess
+import xml.etree.ElementTree as ET
+
+PACKAGES = {"XCRemoteSwiftPackageReference", "XCLocalSwiftPackageReference", "XCSwiftPackageProductDependency"}
+
+
+class Refused(ValueError):
+    """Only fixed codes cross the guard's public boundary."""
+
+
+def owned(root: Path, path: Path, *, missing: bool = False) -> Path:
+    result = path.resolve(strict=not missing)
+    if not result.is_relative_to(root):
+        raise Refused("native_workspace_reference_unverified")
+    return result
+
+
+def selected(root: Path, container: str, before_pods: bool) -> Path:
+    if not container:
+        choices = sorted(root.glob("*.xcworkspace")) or sorted(root.glob("*.xcodeproj"))
+        if len(choices) != 1:
+            raise Refused("native_project_selection_required")
+        return owned(root, choices[0])
+    path = owned(root, root / container, missing=before_pods)
+    if not path.exists() and before_pods and path.suffix == ".xcworkspace":
+        path = path.with_suffix(".xcodeproj")
+    return owned(root, path)
+
+
+def document(path: Path, maximum: int) -> bytes:
+    if path.is_symlink() or not path.is_file() or path.stat().st_size > maximum:
+        raise Refused("native_project_parse_unverified")
+    return path.read_bytes()
+
+
+def workspace(root: Path, path: Path, before_pods: bool, initial_pods_lock: bool) -> list[Path]:
+    try:
+        tree = ET.fromstring(document(path / "contents.xcworkspacedata", 1048576))
+    except ET.ParseError:
+        raise Refused("native_workspace_reference_unverified") from None
+    pending, found, count = [(tree, path.parent, 0)], [], 0
+    while pending:
+        node, parent, depth = pending.pop()
+        count += 1
+        if count > 10000 or depth > 20:
+            raise Refused("native_workspace_reference_unverified")
+        kind, sep, value = node.get("location", "group:").partition(":")
+        if not sep or kind not in {"group", "container", "self", "absolute"}:
+            raise Refused("native_workspace_reference_unverified")
+        target = owned(root, (parent if kind == "group" else path.parent) / value, missing=True)
+        if node.tag == "FileRef" and (target.name == "Package.swift" or (target / "Package.swift").is_file()):
+            raise Refused("native_package_proxy_transport_required")
+        if node.tag == "FileRef" and target.suffix in {".xcodeproj", ".xcworkspace"}:
+            pods = path.parent / "Pods/Pods.xcodeproj"
+            deferred = (before_pods and target == pods and not target.exists()
+                        and (path.parent / "Podfile").is_file()
+                        and (initial_pods_lock or (path.parent / "Podfile.lock").is_file()))
+            if not deferred:
+                found.append(owned(root, target))
+        pending.extend((child, target, depth + 1) for child in node)
+    return found + schemes(root, path)
+
+
+def objects(path: Path) -> dict:
+    body = document(path / "project.pbxproj", 16 * 1024 * 1024)
+    try:
+        value = plistlib.loads(body)
+    except (ValueError, plistlib.InvalidFileException):
+        try:
+            result = subprocess.run(["plutil", "-convert", "json", "-o", "-", "--", str(path / "project.pbxproj")],
+                                    capture_output=True, timeout=15, check=False)
+            value = json.loads(result.stdout) if result.returncode == 0 else None
+        except (OSError, ValueError, subprocess.SubprocessError):
+            value = None
+    rows = value.get("objects") if isinstance(value, dict) else None
+    if (not isinstance(rows, dict) or not rows or len(rows) > 100000
+            or not all(isinstance(r, dict) for r in rows.values())):
+        raise Refused("native_project_parse_unverified")
+    return rows
+
+
+def reference(root: Path, path: Path, rows: dict, key: str, parents: dict, chain: tuple = ()) -> Path:
+    if key in chain or len(chain) > 20 or key not in rows:
+        raise Refused("native_workspace_reference_unverified")
+    row = rows[key]
+    tree, value = row.get("sourceTree", "<group>"), row.get("path", "")
+    if not isinstance(value, str) or "$" in value:
+        raise Refused("native_workspace_reference_unverified")
+    if tree in {"SOURCE_ROOT", "<absolute>"}:
+        base = path.parent
+    elif tree == "<group>":
+        candidates = parents.get(key, [])
+        if len(candidates) > 1:
+            raise Refused("native_workspace_reference_unverified")
+        base = reference(root, path, rows, candidates[0], parents, (*chain, key)) if candidates else path.parent
+    else:
+        raise Refused("native_workspace_reference_unverified")
+    return owned(root, base / value, missing=True)
+
+
+def project(root: Path, path: Path) -> list[Path]:
+    rows, parents, found = objects(path), {}, []
+    for key, row in rows.items():
+        if not isinstance(row.get("isa"), str):
+            raise Refused("native_project_parse_unverified")
+        if row.get("isa") in PACKAGES or row.get("packageReferences") or row.get("packageProductDependencies"):
+            raise Refused("native_package_proxy_transport_required")
+        if row.get("isa") == "PBXProject" and any(row.get(key, "") not in ("", ".")
+                                                 for key in ("projectDirPath", "projectRoot")):
+            raise Refused("native_workspace_reference_unverified")
+        children = row.get("children", [])
+        if not isinstance(children, list) or not all(isinstance(child, str) for child in children):
+            raise Refused("native_project_parse_unverified")
+        for child in children:
+            parents.setdefault(child, []).append(key)
+    for key, row in rows.items():
+        is_project = (str(row.get("path", "")).endswith(".xcodeproj")
+                      or row.get("lastKnownFileType") == "wrapper.pb-project")
+        if row.get("isa") == "PBXFileReference" and is_project:
+            found.append(owned(root, reference(root, path, rows, key, parents)))
+    embedded = path / "project.xcworkspace"
+    if embedded.exists():
+        found.append(owned(root, embedded))
+    return found + schemes(root, path)
+
+
+def schemes(root: Path, container: Path) -> list[Path]:
+    paths = list(container.glob("xcshareddata/xcschemes/*.xcscheme"))
+    if len(paths) > 200:
+        raise Refused("native_workspace_reference_unverified")
+    found = []
+    for path in paths:
+        try:
+            tree = ET.fromstring(document(owned(root, path), 1048576))
+        except ET.ParseError:
+            raise Refused("native_workspace_reference_unverified") from None
+        for node in tree.iter("BuildableReference"):
+            kind, sep, value = node.get("ReferencedContainer", "").partition(":")
+            if kind != "container" or not sep:
+                raise Refused("native_workspace_reference_unverified")
+            found.append(owned(root, container.parent / value))
+    return found

package/action/scripts/source_maintenance.py

@@ -0,0 +1,93 @@
+"""Preserve staged CI source for the app session without mutating its build checkout."""
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+import sys
+
+
+def git(*args: str, data: str | None = None, allowed: tuple[int, ...] = (0,)) -> str:
+    result = subprocess.run(["git", *args], input=data, text=True, capture_output=True, check=False)
+    if result.returncode not in allowed:
+        raise ValueError("source_maintenance_git_failed")
+    return result.stdout.strip()
+
+
+def source_paths() -> list[str]:
+    names = git("diff", "--cached", "--name-only", "-z").split("\0")
+    names = [name for name in names if name]
+    for name in names:
+        if (name.startswith("creds/") or "\n" in name or "\r" in name
+                or re.search(r"\.(?:p8|p12|pfx|pem|key|keystore|jks|mobileprovision)$", name, re.I)):
+            raise ValueError("source_maintenance_secret_path_refused")
+        managed = name.startswith((".github/actions/swift-app/", ".github/actions/android-app/"))
+        version = re.search(r"(?:\.pbxproj|\.plist|(?:^|/)[Pp]roject\.ya?ml|\.xcconfig)$", name)
+        if not (managed or version):
+            raise ValueError("source_maintenance_unexpected_path")
+    return names
+
+
+def remote_commit(branch: str) -> str:
+    rows = git("ls-remote", "--heads", "origin", f"refs/heads/{branch}").splitlines()
+    if not rows:
+        return ""
+    if len(rows) != 1 or not re.fullmatch(r"[0-9a-f]{40}\trefs/heads/" + re.escape(branch), rows[0]):
+        raise ValueError("source_maintenance_remote_identity_invalid")
+    return rows[0].split()[0]
+
+
+def validate_origin(repo: str, base: str) -> None:
+    origin = git("config", "--get", "remote.origin.url")
+    match = re.fullmatch(r"(?:https://github\.com/|git@github\.com:)([\w.-]+/[\w.-]+?)(?:\.git)?", origin)
+    if not match or match[1].casefold() != repo.casefold():
+        raise ValueError("source_maintenance_repository_mismatch")
+    if os.environ.get("GITHUB_SHA", base) != base:
+        raise ValueError("source_maintenance_build_head_changed")
+
+
+def preserve(base: str, tree: str, branch: str, subject: str) -> str:
+    head = remote_commit(branch)
+    if not head:
+        head = git("commit-tree", tree, "-p", base, data=subject.replace(" [skip ci]", "") + "\n")
+        # A transport refusal is ambiguous: settle by exact remote readback, never force or rebase.
+        git("push", "origin", f"{head}:refs/heads/{branch}", allowed=(0, 1, 128))
+        remote = remote_commit(branch)
+        if not remote:
+            raise ValueError("source_maintenance_push_unconfirmed")
+        head = remote
+    git("fetch", "--no-tags", "origin", f"refs/heads/{branch}")
+    if git("rev-parse", "FETCH_HEAD") != head:
+        raise ValueError("source_maintenance_remote_changed")
+    if git("show", "-s", "--format=%P %T", head) != f"{base} {tree}":
+        raise ValueError("source_maintenance_candidate_mismatch")
+    return head
+
+
+def main() -> int:
+    names = source_paths()
+    if not names:
+        print("source maintenance: nothing staged")
+        return 0
+    repo, run_id = os.environ.get("GITHUB_REPOSITORY", ""), os.environ.get("GITHUB_RUN_ID", "")
+    if not re.fullmatch(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+", repo) or not run_id.isdecimal():
+        raise ValueError("source_maintenance_run_identity_required")
+    base, tree = git("rev-parse", "HEAD"), git("write-tree")
+    validate_origin(repo, base)
+    branch = f"task/ci-maintenance-{run_id}-{tree[:16]}"
+    head = preserve(base, tree, branch, sys.argv[1] if len(sys.argv) > 1 else "Preserve CI source maintenance")
+    receipt = {"schema": "gowalk-cicd/source-maintenance-pending.v1", "repo": repo,
+               "base_sha": base, "head_sha": head, "branch": branch, "run_id": run_id}
+    # Clear only the preserved index entries. Worktree bytes and HEAD stay exactly as the build expects.
+    git("reset", "--quiet", "HEAD", "--", *names)
+    print("::notice title=source_maintenance_pending::" + json.dumps(receipt, separators=(",", ":")))
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except ValueError as exc:
+        print("::error::" + str(exc), file=sys.stderr)
+        raise SystemExit(1) from None

package/action/scripts/source_maintenance_fixture.py

@@ -0,0 +1,58 @@
+"""Exercise maintenance delivery against an actual protected bare Git remote."""
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+
+SCRIPT = Path(os.environ.get("MAINTENANCE_SCRIPT", Path(__file__).with_name("commit_bot_changes.sh")))
+
+
+class MaintenanceFixture(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="source-maintenance-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.repo, self.remote = self.root / "repo", self.root / "remote.git"
+        self.repo.mkdir()
+        self.env = {**os.environ, "GITHUB_REPOSITORY": "example/app", "GITHUB_RUN_ID": "1234",
+                    "GITHUB_REF_NAME": "main", "GIT_TERMINAL_PROMPT": "0"}
+        self.git("init", "--bare", str(self.remote))
+        self.git("init", "-b", "main")
+        self.git("config", "user.name", "Fixture")
+        self.git("config", "user.email", "fixture@example.test")
+        (self.repo / "project.yml").write_text("version: 1.0\n")
+        (self.repo / "unrelated.txt").write_text("original\n")
+        self.git("add", ".")
+        self.git("commit", "-m", "Initial fixture")
+        self.git("remote", "add", "origin", "https://github.com/example/app.git")
+        self.git("config", f"url.{self.remote}.insteadOf", "https://github.com/example/app.git")
+        self.git("push", "-u", "origin", "main")
+        self.base = self.git("rev-parse", "HEAD").strip()
+        self.env["GITHUB_SHA"] = self.base
+        self.hook = self.remote / "hooks/pre-receive"
+        self.hook.write_text("#!/bin/sh\nwhile read old new ref; do\n"
+                             "  [ \"$ref\" != refs/heads/main ] || exit 1\ndone\n")
+        self.hook.chmod(0o755)
+
+    def git(self, *args):
+        return subprocess.check_output(["git", *args], cwd=self.repo, env=self.env,
+                                       stderr=subprocess.DEVNULL, text=True)
+
+    def stage(self):
+        (self.repo / "project.yml").write_text("version: 1.1\n")
+        self.git("add", "project.yml")
+        (self.repo / "unrelated.txt").write_text("unfinished build change\n")
+
+    def run_script(self):
+        return subprocess.run(["bash", str(getattr(self, "script", SCRIPT))], cwd=self.repo, env=self.env,
+                              text=True, capture_output=True, timeout=15)
+
+    def receipt(self, result):
+        self.assertEqual(result.returncode, 0, result.stderr)
+        lines = [line for line in result.stdout.splitlines()
+                 if line.startswith("::notice title=source_maintenance_pending::")]
+        self.assertEqual(len(lines), 1, result.stdout + result.stderr)
+        return json.loads(lines[0].split("::", 2)[2])

package/action/scripts/test_auto_detect.py

@@ -22,6 +22,17 @@ sys.path.insert(0, str(Path(__file__).resolve().parent))
 import auto_detect  # noqa: E402
 
 
+# These discovery tests fake Xcode output; the graph guard has separate actual project/CLI tests.
+def setUpModule():
+    global _graph_guard
+    _graph_guard = mock.patch.object(auto_detect.native_dependency_guard, "check", return_value={"ok": True})
+    _graph_guard.start()
+
+
+def tearDownModule():
+    _graph_guard.stop()
+
+
 APP_TYPE = "com.apple.product-type.application"
 EXT_TYPE = "com.apple.product-type.app-extension"
 TUN_TYPE = "com.apple.product-type.tunnel-provider"

package/action/scripts/test_native_dependency_guard.py

@@ -0,0 +1,116 @@
+"""Actual local graph boundaries precede any mocked Xcode command."""
+import json
+from pathlib import Path
+import plistlib
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+import auto_detect
+import native_dependency_guard as guard
+
+
+def project(root, name="App.xcodeproj", extra=None):
+    path = root / name
+    path.mkdir(parents=True, exist_ok=True)
+    rows = {"root": {"isa": "PBXProject", "mainGroup": "group"},
+            "group": {"isa": "PBXGroup", "children": [], "sourceTree": "<group>"}}
+    rows.update(extra or {})
+    (path / "project.pbxproj").write_bytes(plistlib.dumps({"objects": rows}))
+    return path
+
+
+class GuardTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="app-robot-native-guard-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name).resolve()
+        auto_detect._clear_caches()
+
+    def test_selected_local_source_ignores_unselected_remote_sample(self):
+        project(self.root)
+        project(self.root, "sample/Remote.xcodeproj", {"bad": {"isa": "XCRemoteSwiftPackageReference"}})
+        self.assertEqual(guard.check(self.root, "App.xcodeproj")["projects"], 1)
+
+    def test_nested_group_dependency_is_checked(self):
+        rows = {"group": {"isa": "PBXGroup", "children": ["nested"]},
+                "nested": {"isa": "PBXGroup", "path": "vendor", "children": ["ref"]},
+                "ref": {"isa": "PBXFileReference", "path": "Child.xcodeproj", "sourceTree": "<group>"}}
+        project(self.root, extra=rows)
+        project(self.root, "vendor/Child.xcodeproj")
+        self.assertEqual(guard.check(self.root, "App.xcodeproj")["projects"], 2)
+        project(self.root, "vendor/Child.xcodeproj", {"bad": {"isa": "XCLocalSwiftPackageReference"}})
+        with self.assertRaisesRegex(guard.Refused, "native_package_proxy_transport_required"):
+            guard.check(self.root, "App.xcodeproj")
+
+    def test_workspace_pods_deferral_is_exact_and_preinstallation_only(self):
+        project(self.root)
+        workspace = self.root / "App.xcworkspace"
+        workspace.mkdir()
+        xml = ('<Workspace><FileRef location="group:App.xcodeproj"/>'
+               '<FileRef location="group:Pods/Pods.xcodeproj"/></Workspace>')
+        (workspace / "contents.xcworkspacedata").write_text(xml)
+        (self.root / "Podfile").write_text("fixture")
+        with self.assertRaises(OSError):
+            guard.check(self.root, "App.xcworkspace", before_pods=True)
+        self.assertEqual(guard.check(self.root, "App.xcworkspace", before_pods=True,
+                                     initial_pods_lock=True)["projects"], 1)
+        with self.assertRaisesRegex(guard.Refused, "native_initial_lock_phase_required"):
+            guard.check(self.root, "App.xcworkspace", initial_pods_lock=True)
+        (self.root / "Podfile.lock").write_text("fixture")
+        self.assertEqual(guard.check(self.root, "App.xcworkspace", before_pods=True)["phase"], "before_pods")
+        with self.assertRaises(OSError):
+            guard.check(self.root, "App.xcworkspace")
+        project(self.root, "Pods/Pods.xcodeproj")
+        self.assertEqual(guard.check(self.root, "App.xcworkspace")["projects"], 2)
+
+    def test_scheme_cannot_import_an_unexamined_project(self):
+        path = project(self.root)
+        project(self.root, "Other.xcodeproj", {"bad": {"isa": "XCRemoteSwiftPackageReference"}})
+        schemes = path / "xcshareddata/xcschemes"
+        schemes.mkdir(parents=True)
+        (schemes / "App.xcscheme").write_text(
+            '<Scheme><BuildableReference ReferencedContainer="container:Other.xcodeproj"/></Scheme>')
+        with self.assertRaisesRegex(guard.Refused, "native_package_proxy_transport_required"):
+            guard.check(self.root, "App.xcodeproj")
+
+    def test_outside_symlink_and_ambiguous_selection_refuse(self):
+        project(self.root)
+        project(self.root, "Other.xcodeproj")
+        with self.assertRaisesRegex(guard.Refused, "native_project_selection_required"):
+            guard.check(self.root)
+        (self.root / "Outside.xcodeproj").symlink_to(self.root.parent)
+        with self.assertRaisesRegex(guard.Refused, "native_workspace_reference_unverified"):
+            guard.check(self.root, "Outside.xcodeproj")
+
+    def test_remote_graph_refuses_each_actual_xcode_entry_before_subprocess(self):
+        project(self.root, extra={"bad": {"isa": "XCRemoteSwiftPackageReference",
+                                          "repositoryURL": "https://secret.invalid"}})
+        calls = [lambda: auto_detect._list_schemes(self.root, "App.xcodeproj", ""),
+                 lambda: auto_detect._show_build_settings(self.root, "App.xcodeproj", "", "App", "Debug"),
+                 lambda: auto_detect._resolve_package_dependencies(self.root, "App.xcodeproj", "")]
+        with patch.object(auto_detect.subprocess, "run") as run:
+            for call in calls:
+                with self.assertRaisesRegex(guard.Refused, "native_package_proxy_transport_required"):
+                    call()
+        run.assert_not_called()
+        result = subprocess.run([sys.executable, guard.__file__, str(self.root), "--container", "App.xcodeproj"],
+                                capture_output=True, text=True)
+        self.assertEqual(result.returncode, 1)
+        self.assertNotIn("secret.invalid", result.stdout + result.stderr)
+        self.assertIn("CocoaPods", json.loads(result.stdout)["next"])
+
+    def test_workspace_package_folder_is_not_treated_as_an_ordinary_document(self):
+        project(self.root)
+        package = self.root / "LocalPackage"
+        package.mkdir()
+        (package / "Package.swift").write_text("// owns a potentially remote SwiftPM graph")
+        workspace = self.root / "App.xcworkspace"
+        workspace.mkdir()
+        (workspace / "contents.xcworkspacedata").write_text(
+            '<Workspace><FileRef location="group:App.xcodeproj"/>'
+            '<FileRef location="group:LocalPackage"/></Workspace>')
+        with self.assertRaisesRegex(guard.Refused, "native_package_proxy_transport_required"):
+            guard.check(self.root, "App.xcworkspace")

package/action/scripts/test_native_dependency_wiring.py

@@ -0,0 +1,59 @@
+"""Validate the actual action guards and immutable transport snapshot boundaries."""
+from pathlib import Path
+import unittest
+
+from test_action_step_order import step_block, step_names
+
+ACTION = Path(__file__).resolve().parents[1] / "action.yml"
+
+
+class WiringTests(unittest.TestCase):
+    def test_every_selected_xcode_step_has_its_own_preflight(self):
+        source = ACTION.read_text()
+        names = {name: step_block(source, name) for name in step_names(source)}
+        for name, operation in (("Run simulator tests", "xcodebuild "),
+                                ("Resolve marketing version (project source of truth)", "resolve_marketing_version.py"),
+                                ("Stamp Info.plist versions (CFBundleVersion + CFBundleShortVersionString)",
+                                 "resolve_info_plist.py"), ("Archive", "xcodebuild ")):
+            body = names[name]
+            self.assertLess(body.index("native_dependency_guard.py"), body.index(operation))
+            self.assertIn('--container "${WORKSPACE:-$PROJECT}"', body)
+        resolve = names["Resolve credentials + auto-detect Xcode project"]
+        read_config = 'python3 "$SWIFT_APP_ACTION/scripts/read_config.py"'
+        self.assertLess(resolve.index("native_pods.py"), resolve.index(read_config))
+        self.assertIn('export INPUT_WORKSPACE', resolve)
+        snapshot = names["Snapshot this action for the whole run"]
+        self.assertIn("play_store_proxy.py jvm_proxy_relay.py", snapshot)
+        self.assertIn("swift-app-action/google-transport", snapshot)
+
+    def test_shell_blocks_parse_without_exec(self):
+        import subprocess
+        import textwrap
+        source = ACTION.read_text()
+        for name in step_names(source):
+            body = step_block(source, name)
+            if "native_dependency_guard.py" in body or "native_pods.py" in body:
+                script = textwrap.dedent(body.split("      run: |\n", 1)[1])
+                result = subprocess.run(["bash", "-n"], input=script, text=True, capture_output=True)
+                self.assertEqual(result.returncode, 0, name)
+
+    def test_real_archive_shell_refuses_remote_graph_before_xcode(self):
+        import os
+        import subprocess
+        import tempfile
+        import textwrap
+        from test_native_dependency_guard import project
+        with tempfile.TemporaryDirectory(prefix="app-robot-native-archive-") as temporary:
+            root = Path(temporary).resolve()
+            project(root, extra={"remote": {"isa": "XCRemoteSwiftPackageReference"}})
+            xcode = root / "xcodebuild"
+            xcode.write_text('#!/bin/sh\ntouch "$GITHUB_WORKSPACE/xcode-called"\n')
+            xcode.chmod(0o700)
+            script = textwrap.dedent(step_block(ACTION.read_text(), "Archive").split("      run: |\n", 1)[1])
+            env = {**os.environ, "GITHUB_WORKSPACE": str(root), "SWIFT_APP_ACTION": str(ACTION.parent),
+                   "PROJECT": "App.xcodeproj", "WORKSPACE": "", "PATH": str(root) + os.pathsep + os.environ["PATH"]}
+            result = subprocess.run(["bash", "-e", "-o", "pipefail", "-c", script],
+                                    cwd=root, env=env, capture_output=True, text=True, timeout=10)
+            self.assertEqual(result.returncode, 1)
+            self.assertIn("native_package_proxy_transport_required", result.stdout)
+            self.assertFalse((root / "xcode-called").exists())