gowalk-cicd 1.0.78 → 1.0.80

package/CLAUDE.md

@@ -177,7 +177,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   explicit workflow dispatch remains available. Keep backend deployment's own path filters
   intact, and do not broadly exclude assets, root build settings or unknown app layouts.
 - Domain-backed backend deploys fail closed on certificate issuance and the
-  public HTTPS health probe. `select_certbot_account.sh` chooses one existing
+  public HTTPS health probe. The probe requires a completed 2xx response with normal TLS
+  verification; a redirect, including one to the same URL, is not healthy. Each attempt
+  has bounded connection/total time and retains only curl exit and HTTP status diagnostics.
+  `select_certbot_account.sh` chooses one existing
   Let's Encrypt ACME v2 account deterministically so multi-account hosts stay
   non-interactive; legacy v1 account directories are not valid candidates.
   `ensure_certificate.sh` preserves failed inventory status and retries only Certbot's
@@ -197,6 +200,15 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   the validated source path. Missing/ambiguous source plists fail; positively generated
   plists retain the existing build-setting version path. Queries disable signing and package
   updates, retain inherited proxies, and never enable provisioning network operations.
+- Native Xcode validation and archives first check the selected project/workspace graph with
+  `native_dependency_guard.py ROOT --container PATH`. Xcode-managed Swift packages remain refused:
+  proxy environment variables do not protect SwiftPM downloads. The same app session preserves
+  source and uses the vendor's official CocoaPods distribution or verified local XCFrameworks.
+  `native_pods.py` installs a committed, unchanged `Podfile.lock` with `pod install --deployment`
+  through the existing Google relay, then checks the completed workspace. No Podfile means no
+  dependency download or Google proxy requirement. Initial local lock resolution may use the
+  explicit `--before-pods --initial-pods-lock` guard; CI never uses that development exception.
+  These checks cover the declared native dependency graph, not arbitrary custom build-script traffic.
 - Version stamping is per-build-system: Flutter takes `--build-number`, Gradle
   has no equivalent, so `set_gradle_version()` rewrites the literal in the
   checkout the way the iOS action patches the pbxproj. Never commit that edit.
@@ -256,12 +268,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - The iOS action reads every script and prompt from the snapshot it takes of
   itself in its first step (`$SWIFT_APP_ACTION`, under `RUNNER_TEMP`), never
   from `${{ github.action_path }}` after that step. The plugin self-update
-  (`autoupdate_check.sh`) runs right after the snapshot and commits on its own,
+  (`autoupdate_check.sh`) runs right after the snapshot and preserves its own source candidate,
   before the version/signing/archive steps, so a red deploy still receives the
   release that fixes it; the snapshot is what keeps that run on one version.
   `test_action_step_order.py` pins both. A new script reference in
   `action/action.yml` therefore uses `"$SWIFT_APP_ACTION/scripts/..."`.
-- Three situations end a green job with work for the panel, and each is a typed
+- Delivery dependencies may remain after a green job; each is a typed
   check-run annotation (`::notice title=<name>::<one-line JSON with a versioned
   schema>`), never prose in a `::warning::`: `play_review_pending`
   (`templates/deploy.yml`, Play refused auto-submit and the bundle landed
@@ -283,3 +295,21 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Gradle plugin below 1.9.20 drops to 17 (older kapt cannot run under JDK 21).
   Detection logic belongs in that script, where it is unit-tested — not inline
   in the workflow template, where nothing can test it.
+
+- CI-generated source is preserved by `source_maintenance.py` on a deterministic
+  `task/ci-maintenance-*` branch, with remote parent/tree/SHA readback. It never changes
+  the build HEAD, rebases a dirty checkout, force-pushes or pushes to the default branch.
+  Only managed action/version source is accepted; credential-shaped staging refuses.
+  `source_maintenance_pending` identifies the exact source for the same app session's
+  checked PR. Unconfirmed preservation is a job failure; a receipt is not a completed merge.
+- Play preflight, version inventory and the pinned uploader share the panel's package edit owner.
+  The binding's nonsecret `principal_sha256` must match the selected service account's
+  `client_email` fingerprint before provider work. A mismatch requires supported CI-secret
+  provisioning; never accept the account ID or a caller-supplied fingerprint alone.
+  `APP_ROBOT_PLAY_EDIT_BINDING` is panel-provisioned repository data; workflows pass it as
+  `PLAY_EDIT_BINDING` with the repo-local GitHub token and `contents:write`/`actions:read`.
+  `play-upload/owner_run.cjs` protects Python entrypoints; `run.cjs` holds the same owner across
+  its permitted upload retry. Missing/retired bindings, unknown write outcomes and active owners
+  refuse before provider work; only exact terminal run/attempt/source proof permits recovery.
+  Other packages stay parallel. The GitHub coordination request is fixed-origin and does not
+  change the Google account proxy. Update workflow wiring as well as action directories.

package/README.md

@@ -292,6 +292,7 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | `play_upload_result` | `gowalk-cicd/play-upload.v1` | `ok`, `code`, `attempts`, `review_pending`, upstream identity |
 | `store_version_locked` | `gowalk-cicd/store-version-locked.v1` | `version`, `state`, `build_number` |
 | `firebase_symbols_pending` | `gowalk-cicd/firebase-symbols-pending.v1` | `platform`, `app_id`, `source_sha`, `artifact`, `file`, `sha256`, `status` |
+| `source_maintenance_pending` | `gowalk-cicd/source-maintenance-pending.v1` | `repo`, `base_sha`, `head_sha`, `branch`, `run_id` |
 | `apple_build_upload_failed` (error) | `gowalk-cicd/apple-build-upload-failed.v2` | `category`, `stage`, `receipt_available`, receipt identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`, `provider_status`, `provider_code`, `provider_pointer`), `action` |
 
 Add a field by bumping the schema version; never change the meaning of an
@@ -300,10 +301,12 @@ existing one.
 ### The plugin self-update runs first
 
 The vendored iOS action checks npm for a newer `gowalk-cicd` at the **start** of
-every default-branch run and commits the refreshed action directories in their
-own commit, before the version, signing and archive steps. A deploy that is red
-in one of those steps therefore still picks up the plugin release that fixes it,
-on the very run that fails, and the next push runs the fixed plugin. The run that
+every default-branch run and preserves the refreshed action directories on a verified
+task branch before the version, signing and archive steps. The
+`source_maintenance_pending` receipt lets the same app session adopt that exact commit
+into its current task branch and land it through the normal checked PR, including
+when later deploy steps fail. CI never pushes to the default branch or rebases its
+dirty build checkout; a failed preservation is a job failure. The run that
 performed the update keeps executing the version it started with: the action
 snapshots itself to `$RUNNER_TEMP` before anything mutates and reads every script
 and prompt from that copy.
@@ -889,8 +892,9 @@ and configure that one in the Apple Developer portal, then re-run.
 
 When the ASC combined floor (max of pending review, `preReleaseVersions`,
 or builds-via-`preReleaseVersion`) exceeds your project's
-`MARKETING_VERSION`, the action auto-bumps and commits the new value as
-part of the same bot commit that handles cert refresh / autoupdate.
+`MARKETING_VERSION`, the action auto-bumps and preserves the staged source on a
+verified task branch. The app session resolves its `source_maintenance_pending`
+receipt through its normal checked PR before source delivery is complete.
 
 Default policy is `rollover` — patch with carry: at `.9` it rolls into
 the next minor (`1.0.9` → `1.1.0`), and at minor=9 it cascades into the
@@ -927,8 +931,8 @@ do not override the input.
 In `'none'` mode, the floor check fails the build and you must bump
 `MARKETING_VERSION` manually before retrying.
 
-**Side effect:** the bot commit subject reflects what was changed, e.g.
-`ci: refresh signing identity + bump MARKETING_VERSION [skip ci]`.
+**Side effect:** the retained source commit identifies the version change.
+Signing credentials are refused from maintenance commits; use encrypted repository secrets.
 
 **Source-of-truth resolution.** The auto-bump writes the new value
 into the file your project actually reads from, in this order:
@@ -956,8 +960,8 @@ The vendored action ships with a per-run autoupdate check. On every
 push to your default branch, the action queries npm for the latest
 `gowalk-cicd`, compares against the local marker at
 `.github/actions/swift-app/.daemux-version`, and if newer, re-vendors
-the package via `npx --yes` and commits the refreshed action files
-back (under both `.github/actions/swift-app/` and
+the package via `npx --yes` and preserves the refreshed action files
+on a verified task branch (under both `.github/actions/swift-app/` and
 `.github/actions/android-app/`).
 `.github/workflows/deploy.yml` is NEVER auto-committed — see
 "deploy.yml is not auto-updated" below.
@@ -965,15 +969,15 @@ back (under both `.github/actions/swift-app/` and
 | Aspect | Behaviour |
 |--------|-----------|
 | Trigger | Push to default branch only (PR / branch runs do nothing) |
-| Lag | One run — the *next* push after a new release picks up the update |
-| Suppression | `[skip ci]` in the commit subject + `paths-ignore` for both action directories |
-| Combined commit | Cert refresh + autoupdate share a single commit when both fire in the same run |
-| Failure mode | Non-fatal: a failed `npm view` or `npx` emits `::warning::` and the build continues |
+| Landing | The app session adopts the exact receipt on its current task branch and uses the protected PR |
+| Isolation | CI leaves HEAD and worktree bytes intact; no default-branch push or rebase |
+| Candidates | Action updates and later version changes have separate verified receipts |
+| Failure mode | npm discovery remains optional; unconfirmed source preservation fails the job |
 
 The shipped `deploy.yml` template already includes the required
 `paths-ignore` entries for both action directories. If you have an
 older `deploy.yml` checked in, add both entries to prevent the
-autoupdate commit-back from re-triggering the workflow.
+tooling-only source landing from re-triggering the mobile workflow.
 
 ### deploy.yml is not auto-updated
 
@@ -983,9 +987,9 @@ of `contents: write` — this is a built-in safeguard against CI
 self-modification. When a new version of `gowalk-cicd`
 requires `deploy.yml` schema changes (e.g., new permissions, new
 paths-ignore entries), the action's release notes will call this out
-and you must run `npx --yes gowalk-cicd` manually once to
-sync your `deploy.yml`. Existing deploy.yml stays untouched on every
-auto-update cycle until you do.
+and the app session runs the pinned `npx --yes gowalk-cicd` adoption in its task
+workspace, preserving app-specific workflow inputs and landing the full change through
+its checked PR. The CI-side update does not commit the workflow.
 
 Changes that need that manual run:
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.78
+1.0.80

package/action/action.yml

@@ -182,8 +182,8 @@ inputs:
       re-vendors the package via `npx --yes` if the published version is
       newer than the marker at .github/actions/swift-app/.daemux-version.
       The refreshed action files (NOT deploy.yml, which GITHUB_TOKEN
-      cannot push) are committed alongside any cert refresh in a single
-      combined commit. Set to 'false' to pin the vendored copy.
+      cannot push) are retained on a verified task branch for the app session's
+      checked PR. Set to 'false' to pin the vendored copy.
     required: false
     default: "true"
 
@@ -205,15 +205,23 @@ runs:
         rm -rf "$RUNNER_TEMP/swift-app-action"
         mkdir -p "$RUNNER_TEMP/swift-app-action"
         cp -R "${{ github.action_path }}/." "$RUNNER_TEMP/swift-app-action/"
+        # Native repositories receive the same canonical Google transport as Android.
+        mkdir -p "$RUNNER_TEMP/swift-app-action/google-transport"
+        for helper in play_store_proxy.py jvm_proxy_relay.py; do
+          if [ -f "$GITHUB_WORKSPACE/.github/actions/android-app/scripts/$helper" ]; then
+            cp "$GITHUB_WORKSPACE/.github/actions/android-app/scripts/$helper" \
+              "$RUNNER_TEMP/swift-app-action/google-transport/$helper"
+          fi
+        done
         echo "SWIFT_APP_ACTION=$RUNNER_TEMP/swift-app-action" >> "$GITHUB_ENV"
 
     # The plugin self-update runs BEFORE the version, signing and archive
-    # steps and lands in its own commit. It used to run after them, so a
+    # steps and preserves its own source candidate. It used to run after them, so a
     # deploy that was red in the version step (App Store Connect refusing a
     # new version while one is in review, GoVolt run 33743284641) never
     # reached the self-update, and the plugin release that fixed exactly
     # that failure could not arrive in the repository that needed it.
-    # Committing here rather than with the cert refresh below is the same
+    # Preserving here rather than after signing is the same
     # point: a red step later in this run must not take the update with it.
     - name: Stage bot-side scripts to runner temp
       if: ${{ (inputs.archive == 'true' || inputs.auto-update == 'true')
@@ -227,6 +235,8 @@ runs:
           "$RUNNER_TEMP/swift-app-bot-scripts/"
         cp "$SWIFT_APP_ACTION/scripts/commit_bot_changes.sh" \
           "$RUNNER_TEMP/swift-app-bot-scripts/"
+        cp "$SWIFT_APP_ACTION/scripts/source_maintenance.py" \
+          "$RUNNER_TEMP/swift-app-bot-scripts/"
         chmod +x "$RUNNER_TEMP/swift-app-bot-scripts/"*.sh
         echo "BOT_SCRIPTS_DIR=$RUNNER_TEMP/swift-app-bot-scripts" >> "$GITHUB_ENV"
 
@@ -243,9 +253,9 @@ runs:
       run: bash "$BOT_SCRIPTS_DIR/autoupdate_check.sh"
 
     - name: Commit + push refreshed app-ci
-      # Its own commit, immediately: the refreshed action files must reach
-      # the default branch even when the version or signing steps of this
-      # very run fail. deploy.yml is deliberately not staged (GITHUB_TOKEN
+      # Preserve a source candidate immediately, even when later version/signing
+      # fails. The app session lands it through its normal protected PR.
+      # deploy.yml is deliberately not staged (GITHUB_TOKEN
       # cannot push workflow files). No-op when the plugin was current.
       if: ${{ inputs.auto-update == 'true'
             && github.event_name == 'push'
@@ -256,11 +266,6 @@ runs:
         GITHUB_REF_NAME: ${{ github.ref_name }}
       run: |
         set -euo pipefail
-        # A shallow checkout (fetch-depth 1 for direct action callers) must
-        # be able to rebase on a moved default branch inside the push retry.
-        git fetch --unshallow 2>/dev/null \
-          || git fetch --depth=2147483647 2>/dev/null \
-          || true
         bash "$BOT_SCRIPTS_DIR/commit_bot_changes.sh"
 
     - name: Resolve credentials + auto-detect Xcode project
@@ -293,6 +298,21 @@ runs:
           echo "Installing xcodegen (project.yml present, binary missing)…"
           brew install xcodegen >/dev/null 2>&1 || HOMEBREW_NO_AUTO_UPDATE=1 brew install xcodegen
         fi
+        if ! python3 "$SWIFT_APP_ACTION/scripts/native_pods.py" "$GITHUB_WORKSPACE" \
+          --container "${INPUT_WORKSPACE:-$INPUT_PROJECT}" \
+          --proxy-helper "$SWIFT_APP_ACTION/google-transport/play_store_proxy.py" \
+          > "$RUNNER_TEMP/native-pods.json"; then
+          cat "$RUNNER_TEMP/native-pods.json"
+          exit 1
+        fi
+        # CocoaPods adds the dependency workspace even when the app supplied only its project.
+        INPUT_WORKSPACE=$(python3 - <<'PY_NATIVE_WORKSPACE'
+        import json, os
+        with open(os.environ["RUNNER_TEMP"] + "/native-pods.json") as receipt:
+            print(json.load(receipt).get("workspace", os.environ.get("INPUT_WORKSPACE", "")))
+        PY_NATIVE_WORKSPACE
+        )
+        export INPUT_WORKSPACE
         python3 "$SWIFT_APP_ACTION/scripts/read_config.py"
 
     - name: Select latest Xcode
@@ -320,6 +340,8 @@ runs:
               || 'platform=iOS Simulator,name=iPhone 15' }}
       run: |
         set -o pipefail
+        python3 "$SWIFT_APP_ACTION/scripts/native_dependency_guard.py" "$GITHUB_WORKSPACE" \
+          --container "${WORKSPACE:-$PROJECT}"
         if [ -n "$TEST_COMMAND" ]; then
           echo "Running custom test command: $TEST_COMMAND"
           bash -c "$TEST_COMMAND"
@@ -338,6 +360,7 @@ runs:
             -scheme "$SCHEME" \
             -configuration "$CONFIGURATION" \
             -destination "$TEST_DESTINATION" \
+            -disableAutomaticPackageResolution -skipPackageUpdates \
             CODE_SIGNING_ALLOWED=NO \
             CODE_SIGNING_REQUIRED=NO \
             CODE_SIGN_IDENTITY="" \
@@ -376,6 +399,8 @@ runs:
         CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
       run: |
         set -o pipefail
+        python3 "$SWIFT_APP_ACTION/scripts/native_dependency_guard.py" "$GITHUB_WORKSPACE" \
+          --container "${WORKSPACE:-$PROJECT}"
         python3 "$SWIFT_APP_ACTION/scripts/resolve_marketing_version.py" \
           | tee -a "$GITHUB_ENV"
 
@@ -487,30 +512,10 @@ runs:
           echo "::error::Signing preparation failed; preserving any generated cache before failing."
         fi
 
-    # DESIGN DECISION (intentional, not a bug):
-    # The next five steps stage + commit-back the Apple Distribution
-    # code-signing identity (.p12 + provisioning profiles) AND any
-    # autoupdate of the vendored app-ci actions into the consumer
-    # repo's default branch. This is a deliberate trade-off chosen over
-    # GitHub Secrets-based storage:
-    #   - Consumer repos already commit the ASC API key (.p8) to creds/, so
-    #     the threat model already accepts repo-stored Apple credentials.
-    #   - Each app uses a different Apple Developer account / .p8, so
-    #     org-level GitHub Secrets do not amortize setup work.
-    #   - "Drop file in creds/" remains the consistent UX for new projects.
-    # Non-negotiable mitigations (see IOS_NATIVE_CI_SETUP.md):
-    #   - Repo MUST stay private (branch protection on visibility recommended).
-    #   - permissions: contents: write is required; expands attack surface
-    #     of any compromised step in the workflow — keep workflow minimal.
-    #   - .gitignore must NOT block the new creds/ files (see setup doc).
-    #
-    # The autoupdate half runs FIRST in this action (see the top of the
-    # step list) and lands in its own commit, so a fixed plugin reaches a
-    # repository whose deploy is failing in the version or signing steps
-    # below. What remains here: (1) stage cert files, (2) commit + push
-    # whatever is staged, (3) re-raise a deferred prepare failure after
-    # preserving its cache.
-
+    # Encrypted signing material is the supported factory path and disables
+    # the legacy signing-cache staging below. Source maintenance refuses staged
+    # credential paths; it never pushes them or bypasses branch protection.
+    # A version bump is preserved separately from the earlier action update.
 
     - name: Stage refreshed signing identity
       # Only stage on push to the default branch — PR runs and feature
@@ -570,8 +575,8 @@ runs:
         fi
 
     - name: Commit + push staged bot changes
-      # The cert refresh (and any marketing-version auto-bump the version
-      # step staged). The autoupdate landed in its own commit at the top of
+      # Any marketing-version auto-bump the version step staged is preserved.
+      # The autoupdate has its own candidate at the top of
       # this action; this script is a no-op when nothing is staged, so a
       # PR / feature-branch run that somehow reaches this step does no
       # harm — but we still gate on default-branch push for clarity.
@@ -604,6 +609,8 @@ runs:
         BUNDLE_ID: ${{ inputs.bundle-id || env.CFG_BUNDLE_ID }}
       run: |
         set -o pipefail
+        python3 "$SWIFT_APP_ACTION/scripts/native_dependency_guard.py" "$GITHUB_WORKSPACE" \
+          --container "${WORKSPACE:-$PROJECT}"
         # Read every target's complete settings and preserve Xcode's actual status/error.
         # The selected application's source root can differ from its containing workspace.
         INFOPLIST_PATH=$(python3 "$SWIFT_APP_ACTION/scripts/resolve_info_plist.py")
@@ -662,6 +669,8 @@ runs:
         CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
       run: |
         set -o pipefail
+        python3 "$SWIFT_APP_ACTION/scripts/native_dependency_guard.py" "$GITHUB_WORKSPACE" \
+          --container "${WORKSPACE:-$PROJECT}"
         if [ -n "$WORKSPACE" ]; then
           PROJ_ARGS=(-workspace "$WORKSPACE")
         else
@@ -680,6 +689,7 @@ runs:
           -configuration "$CONFIGURATION" \
           -destination "generic/platform=iOS" \
           -archivePath "$RUNNER_TEMP/app.xcarchive" \
+          -disableAutomaticPackageResolution -skipPackageUpdates \
           -skipPackagePluginValidation \
           -skipMacroValidation \
           CURRENT_PROJECT_VERSION="$BUILD_NUMBER" \

package/action/scripts/auto_detect.py

@@ -47,6 +47,7 @@ from pathlib import Path
 from typing import Optional
 
 from cfg_io import log, notice
+import native_dependency_guard
 
 
 APP_PRODUCT_TYPE = "com.apple.product-type.application"
@@ -231,12 +232,8 @@ def _pick_by_basename(matches: list[Path], workspace: Path, label: str) -> Path:
 def _resolve_package_dependencies(
     workspace: Path, project: str, workspace_file: str
 ) -> bool:
-    """Resolve the SPM graph once so later xcodebuild calls are cheap.
-
-    Returns True when resolution finished (regardless of exit status — a
-    project with no packages still exits cleanly and a partial resolve may
-    be enough for ``-list``), False when it could not be run at all.
-    """
+    """Retain local Xcode recovery only after refusing an unverified package graph."""
+    native_dependency_guard.check(workspace, workspace_file or project)
     cmd = ["xcodebuild", "-resolvePackageDependencies"]
     if workspace_file:
         cmd += ["-workspace", workspace_file]
@@ -269,7 +266,8 @@ def _list_schemes(
     if key in _list_cache:
         return _list_cache[key]
 
-    cmd = ["xcodebuild", "-list", "-json"]
+    native_dependency_guard.check(workspace, workspace_file or project)
+    cmd = ["xcodebuild", "-list", "-json", "-disableAutomaticPackageResolution", "-skipPackageUpdates"]
     if workspace_file:
         cmd += ["-workspace", workspace_file]
     elif project:
@@ -343,7 +341,9 @@ def _show_build_settings(
     if key in _settings_cache:
         return _settings_cache[key]
 
-    cmd = ["xcodebuild", "-showBuildSettings", "-json", "-scheme", scheme]
+    native_dependency_guard.check(workspace, workspace_file or project)
+    cmd = ["xcodebuild", "-showBuildSettings", "-json", "-scheme", scheme,
+           "-disableAutomaticPackageResolution", "-skipPackageUpdates"]
     if configuration:
         cmd += ["-configuration", configuration]
     if workspace_file:

package/action/scripts/commit_bot_changes.sh

@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
-# Commits whatever previous steps staged (cert refresh and/or autoupdate),
-# pushes with up-to-3 attempts (rebase between). Exits 0 with ::warning::
-# on exhausted retries so the wrapping job stays green.
+# Preserve staged source on a verified task branch for the app session's normal PR.
+# The build checkout, protected default branch and unrelated dirty files stay intact.
 set -euo pipefail
 
 if git diff --cached --quiet; then
@@ -54,29 +53,4 @@ git config user.name  >/dev/null 2>&1 || git config user.name  "github-actions[b
 git config user.email >/dev/null 2>&1 || \
   git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
-git commit -m "$subject" \
-  -m "Co-Authored-By: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
-
-branch="${GITHUB_REF_NAME:-$(git rev-parse --abbrev-ref HEAD)}"
-
-attempt=1
-max=3
-while (( attempt <= max )); do
-  if git push origin "HEAD:$branch"; then
-    echo "commit_bot_changes: push succeeded on attempt $attempt"
-    exit 0
-  fi
-  echo "::warning::commit_bot_changes: push attempt $attempt failed"
-  if (( attempt < max )); then
-    git fetch origin "$branch" || true
-    git pull --rebase origin "$branch" || {
-      echo "::warning::commit_bot_changes: rebase failed, aborting"
-      git rebase --abort >/dev/null 2>&1 || true
-      exit 0
-    }
-  fi
-  attempt=$((attempt + 1))
-done
-
-echo "::warning::commit_bot_changes: exhausted $max push attempts"
-exit 0
+exec python3 "$(dirname "$0")/source_maintenance.py" "$subject"

package/action/scripts/native_dependency_guard.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Refuse unverified Xcode package networking in the selected native dependency graph."""
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import sys
+
+from native_project_graph import Refused, project, selected, workspace
+
+REMEDIATION = ("Preserve source; use the vendor's official CocoaPods distribution through the assigned Google proxy "
+               "and commit Podfile.lock, or verified local XCFrameworks; rerun the same task's build.")
+
+
+def check(root: Path, container: str = "", *, before_pods: bool = False, initial_pods_lock: bool = False) -> dict:
+    if initial_pods_lock and not before_pods:
+        raise Refused("native_initial_lock_phase_required")
+    root = root.resolve(strict=True)
+    pending, visited, count = [selected(root, container, before_pods)], set(), 0
+    while pending:
+        path = pending.pop()
+        if path in visited:
+            continue
+        visited.add(path)
+        if len(visited) > 200:
+            raise Refused("native_project_inventory_unverified")
+        if path.suffix == ".xcworkspace":
+            pending.extend(workspace(root, path, before_pods, initial_pods_lock))
+        elif path.suffix == ".xcodeproj":
+            pending.extend(project(root, path))
+            count += 1
+        else:
+            raise Refused("native_workspace_reference_unverified")
+    if not count:
+        raise Refused("native_project_inventory_missing")
+    return {"ok": True, "projects": count, "xcode_package_resolution": "unused",
+            "phase": "before_pods" if before_pods else "complete"}
+
+
+def main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("root", type=Path)
+    parser.add_argument("--container", default="")
+    parser.add_argument("--before-pods", action="store_true")
+    parser.add_argument("--initial-pods-lock", action="store_true")
+    args = parser.parse_args(argv)
+    try:
+        answer = check(args.root, args.container, before_pods=args.before_pods,
+                       initial_pods_lock=args.initial_pods_lock)
+    except (Refused, OSError) as exc:
+        code = str(exc) if isinstance(exc, Refused) else "native_project_inventory_unverified"
+        answer = {"ok": False, "code": code, "next": REMEDIATION}
+    print(json.dumps(answer, sort_keys=True))
+    return 0 if answer["ok"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

package/action/scripts/native_pods.py

@@ -0,0 +1,97 @@
+#!/usr/bin/env python3
+"""Install committed native CocoaPods dependencies through the existing account relay."""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import signal
+import subprocess
+import sys
+import tempfile
+
+import native_dependency_guard as guard
+from native_pods_diagnostics import refuse
+import native_pods_process
+
+
+def committed(root: Path, lock: Path) -> str:
+    if not lock.is_file() or lock.is_symlink():
+        raise guard.Refused("native_podfile_lock_required")
+    result = subprocess.run(["git", "show", "HEAD:" + lock.relative_to(root).as_posix()],
+                            cwd=root, capture_output=True, check=False, timeout=15)
+    if result.returncode or result.stdout != lock.read_bytes():
+        raise guard.Refused("native_podfile_lock_commit_required")
+    return hashlib.sha256(result.stdout).hexdigest()
+
+
+def command(argv: list[str], cwd: Path, log) -> int:
+    try:
+        return native_pods_process.command(argv, cwd, log)
+    except native_pods_process.Interrupted:
+        raise guard.Refused("native_pods_operation_interrupted") from None
+    except (OSError, RuntimeError, subprocess.SubprocessError):
+        raise guard.Refused("native_pods_process_unverified") from None
+
+
+def prepare(root: Path, container: str, proxy_helper: Path) -> dict:
+    root = root.resolve(strict=True)
+    folder = (root / container).parent.resolve(strict=True) if container else root
+    if not folder.is_relative_to(root):
+        raise guard.Refused("native_workspace_reference_unverified")
+    if not (folder / "Podfile").is_file():
+        return {"ok": True, "pods": "not_configured"}
+    if (folder / "Podfile").is_symlink():
+        raise guard.Refused("native_workspace_reference_unverified")
+    digest = committed(root, folder / "Podfile.lock")
+    if not proxy_helper.is_file():
+        raise guard.Refused("native_google_transport_helper_required")
+    with tempfile.TemporaryFile() as log:
+        if command([sys.executable, str(proxy_helper)], root, log):
+            raise guard.Refused("native_google_proxy_required")
+        if not list(folder.glob("*.xcodeproj")) and (folder / "project.yml").is_file():
+            if command(["xcodegen", "generate"], folder, log):
+                refuse("native_project_generation_failed", log, guard.Refused)
+        initial = container or str(guard.selected(root, "", True).relative_to(root))
+        guard.check(root, initial, before_pods=True)
+        if command([sys.executable, str(proxy_helper), "--", "pod", "install", "--deployment", "--no-repo-update"],
+                   folder, log):
+            refuse("native_pods_install_failed", log, guard.Refused)
+        if digest != hashlib.sha256((folder / "Podfile.lock").read_bytes()).hexdigest():
+            raise guard.Refused("native_podfile_lock_changed")
+        workspaces = sorted(folder.glob("*.xcworkspace"))
+        final = container if container.endswith(".xcworkspace") else ""
+        if not final:
+            if len(workspaces) != 1:
+                raise guard.Refused("native_project_selection_required")
+            final = str(workspaces[0].relative_to(root))
+        result = guard.check(root, final)
+    return {**result, "pods": "installed", "lock_sha256": digest, "workspace": final}
+
+
+def interrupted(*_args) -> None:
+    raise KeyboardInterrupt
+
+
+def main(argv: list[str]) -> int:
+    signal.signal(signal.SIGTERM, interrupted)
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("root", type=Path)
+    parser.add_argument("--container", default="")
+    parser.add_argument("--proxy-helper", type=Path, required=True)
+    args = parser.parse_args(argv)
+    try:
+        answer = prepare(args.root, args.container, args.proxy_helper)
+    except (guard.Refused, OSError, subprocess.SubprocessError) as exc:
+        code = str(exc) if isinstance(exc, guard.Refused) else "native_pods_operation_unverified"
+        answer = {"ok": False, "code": code, "next": guard.REMEDIATION}
+        if getattr(exc, "diagnostic", ""):
+            answer["diagnostic"] = exc.diagnostic
+    print(json.dumps(answer, sort_keys=True))
+    return 0 if answer["ok"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

package/action/scripts/native_pods_diagnostics.py

@@ -0,0 +1,53 @@
+"""Bounded native dependency errors; inspect only this child's private output and environment."""
+import base64
+import os
+import re
+from urllib.parse import unquote, urlsplit
+
+SENSITIVE = re.compile(r"SECRET|TOKEN|PASSWORD|PROXY|PRIVATE_KEY|SERVICE_ACCOUNT|CREDENTIAL", re.I)
+
+
+def values(environment: dict[str, str]) -> set[str]:
+    found = set()
+    for key, value in environment.items():
+        if not SENSITIVE.search(key) or len(value) < 4:
+            continue
+        found.add(value)
+        try:
+            proxy = urlsplit(value)
+            if proxy.username is not None:
+                user, password = unquote(proxy.username), unquote(proxy.password or "")
+                found.update((user, password, base64.b64encode(f"{user}:{password}".encode()).decode()))
+        except ValueError:
+            pass
+    return {value for value in found if value}
+
+
+def diagnostic(log, environment: dict[str, str] | None = None) -> str:
+    log.flush()
+    log.seek(0, os.SEEK_END)
+    start = max(0, log.tell() - 16384)
+    log.seek(start)
+    body = log.read()
+    if start:
+        body = body.partition(b"\n")[2]
+    text = body.decode("utf-8", errors="replace")
+    for value in sorted(values(environment if environment is not None else dict(os.environ)), key=len, reverse=True):
+        text = text.replace(value, "[redacted]")
+    text = re.sub(r"\x1b\[[0-?]*[ -/]*[@-~]", "", text)
+    text = re.sub(r"-----BEGIN [^-]*PRIVATE KEY-----.*?(?:-----END [^-]*PRIVATE KEY-----|$)",
+                  "[private key redacted]", text, flags=re.S)
+    text = re.sub(r"(?im)^\s*[A-Za-z0-9+/=]{48,}\s*$", "[encoded value redacted]", text)
+    text = re.sub(r"(?i)\b(?:proxy-authorization|authorization)\s*:[^\r\n]*", "authorization: [redacted]", text)
+    text = re.sub(r'(?i)("(?:private_key|client_secret|password|access_token|refresh_token)"\s*:\s*)"(?:\\.|[^"\\])*"',
+                  r'\1"[redacted]"', text)
+    text = re.sub(r"\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+", "[token redacted]", text)
+    text = re.sub(r"https?://[^\s\"'<>]+", "[URL redacted]", text)
+    text = re.sub(r"[A-Za-z0-9_+/=-]{32,}", "[long value redacted]", text)
+    return "\n".join(text.splitlines()[-30:])[-4000:]
+
+
+def refuse(code: str, log, exception):
+    error = exception(code)
+    error.diagnostic = diagnostic(log)
+    raise error