gowalk-cicd 1.0.78 → 1.0.80

package/action/scripts/test_native_pods.py

@@ -0,0 +1,106 @@
+"""Run the real native preparation CLI, Git lock fence and canonical relay offline."""
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+import native_pods
+from test_native_dependency_guard import project
+
+PROXY = Path(__file__).resolve().parents[2] / "android-action/scripts/play_store_proxy.py"
+
+
+class PodsTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="app-robot-native-pods-test-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name).resolve()
+        project(self.root)
+        self.env = {**os.environ, "GOOGLE_STORE_PROXY_URL": "http://fixture:PRIVATE_SENTINEL@127.0.0.1:9"}
+
+    def locked(self):
+        (self.root / "Podfile").write_text("fixture")
+        (self.root / "Podfile.lock").write_text("fixture-lock")
+        commands = [["git", "init", "-q"], ["git", "add", "Podfile", "Podfile.lock"],
+                    ["git", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                     "commit", "-qm", "Own fixture lock"]]
+        for command in commands:
+            subprocess.run(command, cwd=self.root, check=True, capture_output=True)
+
+    def run_cli(self):
+        result = subprocess.run([sys.executable, native_pods.__file__, str(self.root),
+                                 "--container", "App.xcodeproj", "--proxy-helper", str(PROXY)],
+                                capture_output=True, text=True, env=self.env, timeout=20)
+        self.assertNotIn("PRIVATE_SENTINEL", result.stdout + result.stderr)
+        return result.returncode, json.loads(result.stdout)
+
+    def test_without_podfile_does_not_require_a_proxy(self):
+        self.env.pop("GOOGLE_STORE_PROXY_URL")
+        code, result = self.run_cli()
+        self.assertEqual((code, result["pods"]), (0, "not_configured"))
+
+    def test_missing_or_uncommitted_or_modified_lock_refuses(self):
+        (self.root / "Podfile").write_text("fixture")
+        self.assertEqual(self.run_cli()[1]["code"], "native_podfile_lock_required")
+        (self.root / "Podfile.lock").write_text("uncommitted")
+        self.assertEqual(self.run_cli()[1]["code"], "native_podfile_lock_commit_required")
+        self.locked()
+        (self.root / "Podfile.lock").write_text("changed")
+        self.assertEqual(self.run_cli()[1]["code"], "native_podfile_lock_commit_required")
+
+    def test_missing_proxy_fails_before_the_pod_process(self):
+        self.locked()
+        self.env.pop("GOOGLE_STORE_PROXY_URL")
+        self.assertEqual(self.run_cli()[1]["code"], "native_google_proxy_required")
+
+    def test_real_child_has_relay_and_deployment_flags_and_preserves_failure(self):
+        self.locked()
+        script = self.root / "pod"
+        script.write_text('#!' + sys.executable + '\nimport os,sys,json\n'
+                          'from pathlib import Path\n'
+                          'Path("child.json").write_text(json.dumps({"argv":sys.argv[1:],'
+                          '"proxy":os.environ["HTTPS_PROXY"],"bypass":os.environ["NO_PROXY"]}))\n'
+                          'print("PRIVATE_SENTINEL", file=sys.stderr)\nraise SystemExit(7)\n')
+        script.chmod(0o700)
+        self.env["PATH"] = str(self.root) + os.pathsep + self.env["PATH"]
+        self.env["NO_PROXY"] = "*"
+        code, result = self.run_cli()
+        self.assertEqual((code, result["code"]), (1, "native_pods_install_failed"))
+        child = json.loads((self.root / "child.json").read_text())
+        self.assertEqual(child["argv"], ["install", "--deployment", "--no-repo-update"])
+        self.assertTrue(child["proxy"].startswith("http://127.0.0.1:"))
+        self.assertNotIn("PRIVATE_SENTINEL", child["proxy"])
+        self.assertEqual(child["bypass"], "")
+
+    @unittest.skipUnless(os.name == "posix", "owned POSIX process groups")
+    def test_termination_reaps_the_owned_pod_child(self):
+        import time
+        self.locked()
+        script = self.root / "pod"
+        script.write_text('#!' + sys.executable + '\nimport os,time\nfrom pathlib import Path\n'
+                          'Path("owned-child").write_text(str(os.getpid()))\ntime.sleep(30)\n')
+        script.chmod(0o700)
+        self.env["PATH"] = str(self.root) + os.pathsep + self.env["PATH"]
+        argv = [sys.executable, native_pods.__file__, str(self.root), "--container", "App.xcodeproj",
+                "--proxy-helper", str(PROXY)]
+        with subprocess.Popen(argv, env=self.env, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True) as child:
+            deadline = time.monotonic() + 5
+            while not (self.root / "owned-child").exists() and time.monotonic() < deadline:
+                time.sleep(0.02)
+            child.terminate()
+            output, errors = child.communicate(timeout=10)
+        self.assertTrue((self.root / "owned-child").exists())
+        self.assertEqual(json.loads(output)["code"], "native_pods_operation_interrupted")
+        self.assertEqual(errors, "")
+        owned_pid = int((self.root / "owned-child").read_text())
+        deadline = time.monotonic() + 5
+        while time.monotonic() < deadline:
+            try:
+                os.kill(owned_pid, 0)
+            except ProcessLookupError:
+                return
+            time.sleep(0.02)
+        self.fail("the owned pod child survived helper termination")

package/action/scripts/test_native_pods_diagnostics.py

@@ -0,0 +1,39 @@
+"""Retain useful dependency conflicts without leaking child credentials or a truncated tail."""
+import io
+import unittest
+from native_pods_diagnostics import diagnostic
+
+
+class DiagnosticsTests(unittest.TestCase):
+    def test_versions_survive_while_current_env_and_generic_credentials_are_removed(self):
+        environment = {"GOOGLE_STORE_PROXY_URL": "http://owned-user:private-password@proxy.invalid:8000",
+                       "GITHUB_TOKEN": "private-github-token", "PUBLIC_SETTING": "allowed"}
+        body = ('[!] CocoaPods could not find compatible versions for pod "Firebase/CoreOnly":\n'
+                'In snapshot (Podfile.lock): Firebase/CoreOnly (= 11.9.0)\n'
+                'In Podfile: Firebase/CoreOnly (= 11.8.0)\n'
+                'owned-user private-password private-github-token\n'
+                'https://owned-user:private-password@proxy.invalid:8000\n'
+                'Proxy-Authorization: Basic cHJpdmF0ZTpwYXNzd29yZA==\n'
+                '{"private_key":"PRIVATE_JSON_MARKER", "access_token":"PRIVATE_ACCESS_MARKER"}\n'
+                'abcDef0123456789_abcDef0123456789_SECRET\n')
+        result = diagnostic(io.BytesIO(body.encode()), environment)
+        self.assertIn('Firebase/CoreOnly (= 11.9.0)', result)
+        self.assertIn('Firebase/CoreOnly (= 11.8.0)', result)
+        for private in ('owned-user', 'private-password', 'private-github-token', 'https://',
+                        'cHJpdmF0ZTpwYXNzd29yZA==', 'PRIVATE_JSON_MARKER', 'PRIVATE_ACCESS_MARKER', 'SECRET'):
+            self.assertNotIn(private, result)
+
+    def test_truncated_first_line_and_small_proxy_credentials_cannot_escape(self):
+        body = b"x" * 17000 + b"TAIL_SECRET\n[!] Unable to satisfy dependency version 12.3.\n"
+        self.assertNotIn("TAIL_SECRET", diagnostic(io.BytesIO(body), {}))
+        result = diagnostic(io.BytesIO(b"username=Q password=Z\n"), {"HTTPS_PROXY": "http://Q:Z@fixture.invalid:8000"})
+        self.assertNotIn("Q", result)
+        self.assertNotIn("Z", result)
+
+    def test_bounds_and_pem_text_are_private(self):
+        body = b"[!] conflict 1.0 versus 2.0\n" * 1000
+        result = diagnostic(io.BytesIO(body), {})
+        self.assertLessEqual(len(result), 4000)
+        self.assertLessEqual(len(result.splitlines()), 30)
+        pem = b"-----BEGIN PRIVATE KEY-----\nPRIVATE_PEM_VALUE\n-----END PRIVATE KEY-----\n"
+        self.assertNotIn("PRIVATE_PEM_VALUE", diagnostic(io.BytesIO(pem), {}))

package/action/scripts/test_native_pods_process.py

@@ -0,0 +1,41 @@
+"""Actual retained-leader cleanup, including a stubborn surviving descendant and unrelated sibling."""
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+import native_pods_process as process
+
+
+class ProcessTests(unittest.TestCase):
+    def test_exited_leader_does_not_leave_its_term_resistant_child(self):
+        with tempfile.TemporaryDirectory(prefix="app-robot-native-process-") as temporary:
+            root = Path(temporary)
+            worker = root / "worker.py"
+            worker.write_text('import os,signal,time\nfrom pathlib import Path\n'
+                              'signal.signal(signal.SIGTERM, signal.SIG_IGN)\n'
+                              'Path("pid").write_text(str(os.getpid()))\ntime.sleep(30)\n')
+            leader = ('import subprocess,sys,time\nfrom pathlib import Path\n'
+                      'subprocess.Popen([sys.executable,"worker.py"])\n'
+                      'while not Path("pid").exists(): time.sleep(.01)\nraise SystemExit(7)\n')
+            sibling = subprocess.Popen([sys.executable, "-c", "import time;time.sleep(30)"], start_new_session=True)
+            try:
+                with tempfile.TemporaryFile() as log:
+                    code = process.command([sys.executable, "-c", leader], root, log, timeout=5)
+                self.assertEqual(code, 7)
+                self.assertIsNone(sibling.poll())
+                child_pid = int((root / "pid").read_text())
+                found = subprocess.run(["ps", "-p", str(child_pid), "-o", "stat="], capture_output=True, text=True)
+                self.assertTrue(found.returncode or found.stdout.strip().startswith("Z"))
+            finally:
+                sibling.terminate()
+                sibling.wait(timeout=5)
+
+    def test_timeout_has_no_success_verdict(self):
+        with tempfile.TemporaryDirectory(prefix="app-robot-native-timeout-") as temporary:
+            with tempfile.TemporaryFile() as log:
+                with self.assertRaises(process.Interrupted):
+                    process.command([sys.executable, "-c", "import time;time.sleep(30)"],
+                                    Path(temporary), log, timeout=0.05)

package/action/scripts/test_source_maintenance.py

@@ -0,0 +1,122 @@
+"""Exercise maintenance delivery against an actual protected bare Git remote."""
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import textwrap
+import unittest
+
+from source_maintenance_fixture import MaintenanceFixture
+
+
+class MaintenanceTests(MaintenanceFixture):
+    def test_protected_main_dirty_checkout_and_replay(self):
+        self.stage()
+        first = self.receipt(self.run_script())
+        self.assertEqual(self.git("rev-parse", "HEAD").strip(), self.base)
+        self.assertEqual(self.git("ls-remote", "origin", "refs/heads/main").split()[0], self.base)
+        self.assertEqual((self.repo / "unrelated.txt").read_text(), "unfinished build change\n")
+        self.assertEqual((self.repo / "project.yml").read_text(), "version: 1.1\n")
+        self.assertEqual(self.git("diff", "--cached", "--name-only"), "")
+        self.assertEqual(self.git("show", first["head_sha"] + ":project.yml"), "version: 1.1\n")
+        self.git("add", "project.yml")
+        self.assertEqual(self.receipt(self.run_script()), first)
+
+    def test_remote_refusal_is_failure_and_preserves_index(self):
+        self.stage()
+        self.hook.write_text("#!/bin/sh\nexit 1\n")
+        result = self.run_script()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("source_maintenance_push_unconfirmed", result.stderr)
+        self.assertEqual(self.git("diff", "--cached", "--name-only"), "project.yml\n")
+        self.assertEqual(self.git("rev-parse", "HEAD").strip(), self.base)
+
+    def test_changed_remote_candidate_is_not_overwritten(self):
+        self.stage()
+        receipt = self.receipt(self.run_script())
+        head = self.git("commit-tree", self.base + "^{tree}", "-p", receipt["head_sha"], "-m", "Other").strip()
+        self.git("push", "origin", head + ":refs/heads/" + receipt["branch"])
+        self.git("add", "project.yml")
+        result = self.run_script()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("source_maintenance_candidate_mismatch", result.stderr)
+        self.assertEqual(self.git("ls-remote", "origin", "refs/heads/" + receipt["branch"]).split()[0], head)
+
+    def test_secret_and_unexpected_staging_refuse_before_push(self):
+        for name in ("creds/private.p8", "arbitrary.txt"):
+            with self.subTest(name=name):
+                path = self.repo / name
+                path.parent.mkdir(exist_ok=True)
+                path.write_text("synthetic-secret-not-for-output")
+                self.git("add", name)
+                result = self.run_script()
+                self.assertNotEqual(result.returncode, 0)
+                self.assertNotIn(path.read_text(), result.stdout + result.stderr)
+                self.assertEqual(len(self.git("ls-remote", "--heads", "origin").splitlines()), 1)
+                self.git("reset", "--quiet", "HEAD", "--", name)
+
+    def test_no_staging_needs_no_ci_identity(self):
+        self.env.pop("GITHUB_REPOSITORY")
+        self.assertEqual(self.run_script().returncode, 0)
+
+    def test_lost_push_acknowledgment_uses_remote_readback(self):
+        self.stage()
+        real_git = shutil.which("git")
+        binary = self.root / "bin"
+        binary.mkdir()
+        shim = binary / "git"
+        shim.write_text(f"#!/bin/bash\n{real_git} \"$@\"\nstatus=$?\n"
+                        "if [ \"$1\" = push ] && [ \"$status\" = 0 ]; then exit 128; fi\nexit $status\n")
+        shim.chmod(0o755)
+        self.env["PATH"] = str(binary) + os.pathsep + self.env["PATH"]
+        receipt = self.receipt(self.run_script())
+        self.assertEqual(self.git("ls-remote", "origin", "refs/heads/" + receipt["branch"]).split()[0],
+                         receipt["head_sha"])
+
+    def test_wrong_repository_or_build_head_refuses_without_push(self):
+        self.stage()
+        for key, wrong in (("GITHUB_REPOSITORY", "other/app"), ("GITHUB_SHA", "f" * 40)):
+            original = self.env[key]
+            self.env[key] = wrong
+            self.assertNotEqual(self.run_script().returncode, 0)
+            self.assertEqual(len(self.git("ls-remote", "--heads", "origin").splitlines()), 1)
+            self.env[key] = original
+
+    def test_preserved_index_excludes_later_signing_edits_in_same_file(self):
+        self.stage()
+        (self.repo / "project.yml").write_text("version: 1.1\nsigning: ephemeral\n")
+        receipt = self.receipt(self.run_script())
+        self.assertEqual(self.git("show", receipt["head_sha"] + ":project.yml"), "version: 1.1\n")
+        self.assertEqual((self.repo / "project.yml").read_text(), "version: 1.1\nsigning: ephemeral\n")
+
+    def test_custom_plist_and_separate_update_candidates(self):
+        path = self.repo / ".github/actions/swift-app/.daemux-version"
+        path.parent.mkdir(parents=True)
+        path.write_text("1.0.79\n")
+        self.git("add", str(path.relative_to(self.repo)))
+        first = self.receipt(self.run_script())
+        (self.repo / "Custom-App-Info.plist").write_text("<plist>version</plist>\n")
+        self.git("add", "Custom-App-Info.plist")
+        second = self.receipt(self.run_script())
+        self.assertNotEqual(first["branch"], second["branch"])
+        self.assertEqual(self.git("diff", "--name-only", self.base, second["head_sha"]), "Custom-App-Info.plist\n")
+        self.assertEqual(path.read_text(), "1.0.79\n")
+
+    def test_actual_staging_step_delivers_the_helper_to_immutable_bot_snapshot(self):
+        action = Path(__file__).resolve().parents[1]
+        source = (action / "action.yml").read_text()
+        block = re.search(r"    - name: Stage bot-side scripts to runner temp\n(.*?)(?=\n    - name:)",
+                          source, re.S)[1]
+        script = textwrap.dedent(block.split("      run: |\n", 1)[1])
+        self.env.update({"SWIFT_APP_ACTION": str(action), "RUNNER_TEMP": str(self.root),
+                         "GITHUB_ENV": str(self.root / "environment")})
+        subprocess.run(["bash", "-e", "-c", script], env=self.env, cwd=self.repo, check=True,
+                       text=True, capture_output=True, timeout=10)
+        self.script = self.root / "swift-app-bot-scripts/commit_bot_changes.sh"
+        self.stage()
+        self.assertEqual(self.receipt(self.run_script())["base_sha"], self.base)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.78
+1.0.80

package/android-action/action.yml

@@ -95,7 +95,9 @@ runs:
         INPUT_PACKAGE_NAME: ${{ inputs.package-name }}
         INPUT_BUILD_NUMBER: ${{ inputs.build-number }}
         INPUT_BUILD_NAME: ${{ inputs.build-name }}
-      run: python3 "${{ github.action_path }}/scripts/resolve_android.py"
+        PLAY_EDIT_BINDING: ${{ env.PLAY_EDIT_BINDING }}
+        GITHUB_TOKEN: ${{ github.token }}
+      run: node "${{ github.action_path }}/play-upload/owner_run.cjs" resolve
 
     # --- Flutter --------------------------------------------------------
     - name: Get Flutter dependencies

package/android-action/play-upload/action.yml

@@ -1,5 +1,5 @@
 name: Publish the signed Play bundle with classified recovery
-description: Run the unchanged pinned official uploader; retry only definitive supported refusals.
+description: Hold the package edit owner around the unchanged pinned official uploader and classified retries.
 inputs:
   serviceAccountJson:
     description: Path to the provisioned service account file.

package/android-action/play-upload/owner.cjs

@@ -0,0 +1,61 @@
+const http = require('./owner_http.cjs');
+const record = require('./owner_record.cjs');
+
+async function seal(client, selected) {
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const row = record.validate(await client.read(selected.path), selected);
+    if (row.value.owner !== null && !record.same(row.value.owner, selected.owner)) return;
+    const idle = record.replacement(row, null);
+    try { await client.write(selected.path, row, idle); } catch { /* Reconcile a possibly applied write. */ }
+    const after = record.validate(await client.read(selected.path), selected);
+    if (after.value.revision === idle.revision && after.value.owner === null) return;
+    if (after.value.owner !== null && !record.same(after.value.owner, selected.owner)) return;
+  }
+  throw new Error('play_owner_release_unverified');
+}
+
+async function acquire(client, selected, attempted = () => {}) {
+  const protocol = (await client.read('protocol.json')).value;
+  if (protocol?.schema !== record.schema || protocol.repository !== selected.value.repo
+      || Object.keys(protocol).length !== 2) throw new Error('play_owner_unverified');
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const row = record.validate(await client.read(selected.path), selected);
+    if (row.value.owner !== null) {
+      const owner = row.value.owner;
+      if (owner.kind !== 'ci' || !record.terminal(await client.run(owner), owner)) throw new Error('play_owner_busy');
+    }
+    const desired = record.replacement(row, selected.owner);
+    attempted();
+    try { await client.write(selected.path, row, desired); } catch { /* Only exact readback may adopt it. */ }
+    const after = record.validate(await client.read(selected.path), selected);
+    if (after.value.revision === desired.revision && record.same(after.value.owner, selected.owner)) return;
+  }
+  throw new Error('play_owner_busy');
+}
+
+async function withOwner(env, packageName, operation, transport) {
+  const selected = record.binding(env, packageName);
+  const client = http.client(selected.value.repo, env.GITHUB_TOKEN, transport);
+  let cancelled = false, dirty = false, result, failure;
+  const stop = () => { cancelled = true; };
+  process.on('SIGTERM', stop); process.on('SIGINT', stop);
+  try {
+    await acquire(client, selected, () => { dirty = true; });
+    if (cancelled) throw new Error('play_owner_cancelled');
+    result = await operation(() => cancelled);
+  } catch (error) { failure = error; }
+  finally {
+    try { if (dirty) await seal(client, selected); } catch { failure = new Error('play_owner_release_unverified'); }
+    process.off('SIGTERM', stop); process.off('SIGINT', stop);
+  }
+  if (cancelled && !failure) failure = new Error('play_owner_cancelled');
+  if (failure) {
+    if (result !== undefined) failure.operationResult = result;
+    throw failure;
+  }
+  return result;
+}
+
+const codes = ['play_owner_binding_required', 'play_owner_unverified', 'play_owner_busy',
+  'play_owner_release_unverified', 'play_owner_cancelled', 'play_owner_principal_unverified'];
+module.exports = {acquire, seal, withOwner, codes};

package/android-action/play-upload/owner_http.cjs

@@ -0,0 +1,63 @@
+// GitHub coordination only; never send repository credentials to a configurable origin.
+const https = require('node:https');
+const {createHash} = require('node:crypto');
+const branch = 'app-robot-play-coordination';
+
+function request(token, method, path, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const call = https.request({hostname: 'api.github.com', port: 443, path, method,
+      agent: new https.Agent({keepAlive: false, proxyEnv: {}}),
+      headers: {Authorization: `Bearer ${token}`, Accept: 'application/vnd.github+json',
+        'X-GitHub-Api-Version': '2022-11-28', 'User-Agent': 'gowalk-cicd-play-owner',
+        ...(data ? {'Content-Type': 'application/json', 'Content-Length': data.length} : {})}}, response => {
+      const chunks = []; let size = 0;
+      response.on('data', chunk => {
+        size += chunk.length;
+        if (size > 131072) call.destroy(new Error('play_owner_unverified'));
+        else chunks.push(chunk);
+      });
+      response.on('end', () => {
+        try { resolve({status: response.statusCode, body: JSON.parse(Buffer.concat(chunks))}); }
+        catch { reject(new Error('play_owner_unverified')); }
+      });
+      response.on('error', () => reject(new Error('play_owner_unverified')));
+    });
+    call.setTimeout(10000, () => call.destroy(new Error('play_owner_unverified')));
+    call.on('error', () => reject(new Error('play_owner_unverified')));
+    call.end(data);
+  });
+}
+
+function decode(response) {
+  const item = response.body;
+  if (response.status !== 200 || !item || item.type !== 'file' || item.encoding !== 'base64'
+      || !Number.isSafeInteger(item.size) || item.size < 1 || item.size > 8192
+      || typeof item.content !== 'string' || item.content.length > 16384) throw new Error('play_owner_unverified');
+  const text = item.content.replace(/\n/g, '');
+  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(text)) {
+    throw new Error('play_owner_unverified');
+  }
+  const bytes = Buffer.from(text, 'base64');
+  const digest = createHash('sha1').update(`blob ${bytes.length}\0`).update(bytes).digest('hex');
+  if (bytes.length !== item.size || digest !== item.sha) throw new Error('play_owner_unverified');
+  try { return {sha: item.sha, value: JSON.parse(bytes)}; }
+  catch { throw new Error('play_owner_unverified'); }
+}
+
+function client(repo, token, transport = request) {
+  if (typeof token !== 'string' || !token || /[\r\n]/.test(token)) throw new Error('play_owner_binding_required');
+  const prefix = `/repos/${repo}`;
+  const send = (method, path, body) => transport(token, method, prefix + path, body);
+  return {
+    read: async path => decode(await send('GET', `/contents/${path}?ref=${branch}`)),
+    write: async (path, old, value) => {
+      const response = await send('PUT', `/contents/${path}`, {branch, sha: old.sha,
+        message: 'Update scoped Play edit ownership', content: Buffer.from(JSON.stringify(value)).toString('base64')});
+      if (![200, 201, 409, 422].includes(response.status)) throw new Error('play_owner_unverified');
+    },
+    run: owner => send('GET', `/actions/runs/${owner.run_id}/attempts/${owner.run_attempt}`),
+  };
+}
+
+module.exports = {branch, client, decode, request};

package/android-action/play-upload/owner_principal.cjs

@@ -0,0 +1,15 @@
+// Compare a nonsecret API-principal fingerprint; never emit credential fields or file contents.
+const {readFileSync, statSync} = require('node:fs');
+const {createHash} = require('node:crypto');
+
+function read(path) {
+  try {
+    const stat = statSync(path);
+    if (!stat.isFile() || stat.size < 1 || stat.size > 262144) throw new Error();
+    const value = JSON.parse(readFileSync(path, 'utf8'));
+    if (typeof value.client_email !== 'string' || !/^[^\s@]+@[^\s@]+$/.test(value.client_email)) throw new Error();
+    return createHash('sha256').update(value.client_email.toLowerCase()).digest('hex');
+  } catch { throw new Error('play_owner_principal_unverified'); }
+}
+
+module.exports = {read};

package/android-action/play-upload/owner_record.cjs

@@ -0,0 +1,63 @@
+const {createHash, randomUUID} = require('node:crypto');
+const {isDeepStrictEqual: same} = require('node:util');
+const schema = 'app-robot.play-edit-owner.v1';
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const sha = /^[0-9a-f]{40}$/;
+const repository = /^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9][A-Za-z0-9_.-]*$/;
+const positive = value => Number.isSafeInteger(value) && value > 0;
+
+function binding(env, packageName) {
+  let value;
+  try { value = JSON.parse(env.PLAY_EDIT_BINDING); } catch { throw new Error('play_owner_binding_required'); }
+  const prefix = `${env.GITHUB_REPOSITORY}/`;
+  const workflow = String(env.GITHUB_WORKFLOW_REF || '');
+  const path = workflow.startsWith(prefix) ? workflow.slice(prefix.length).split('@')[0] : '';
+  if (!value || !repository.test(value.repo) || value.repo !== env.GITHUB_REPOSITORY
+      || value.package !== packageName || !/^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/.test(packageName)
+      || !positive(value.account_id) || !uuid.test(value.generation)
+      || !/^[0-9a-f]{64}$/.test(value.principal_sha256)
+      || value.principal_sha256 !== env.PLAY_EDIT_PRINCIPAL_SHA256
+      || !sha.test(env.GITHUB_SHA) || !positive(Number(env.GITHUB_RUN_ID))
+      || !positive(Number(env.GITHUB_RUN_ATTEMPT)) || !workflow.includes('@')
+      || !/^[1-9][0-9]*$/.test(env.GITHUB_RUN_ID) || !/^[1-9][0-9]*$/.test(env.GITHUB_RUN_ATTEMPT)
+      || !/^\.github\/workflows\/[A-Za-z0-9_.-]+\.ya?ml$/.test(path)) {
+    throw new Error('play_owner_binding_required');
+  }
+  return {value, path: `owners/${createHash('sha256').update(packageName).digest('hex')}.json`,
+    owner: {kind: 'ci', id: randomUUID(), repo: value.repo, run_id: Number(env.GITHUB_RUN_ID),
+      run_attempt: Number(env.GITHUB_RUN_ATTEMPT), sha: env.GITHUB_SHA, workflow: path}};
+}
+
+function holder(value) {
+  if (value === null) return true;
+  if (!value || !uuid.test(value.id)) return false;
+  if (value.kind === 'panel') return value.process && /^[0-9a-f]{64}$/.test(value.process.host)
+    && /^[0-9a-f]{64}$/.test(value.process.boot) && positive(value.process.pid)
+    && Number.isFinite(value.process.birth) && value.process.birth > 0;
+  return value.kind === 'ci' && repository.test(value.repo) && positive(value.run_id)
+    && positive(value.run_attempt) && sha.test(value.sha)
+    && /^\.github\/workflows\/[A-Za-z0-9_.-]+\.ya?ml$/.test(value.workflow);
+}
+
+function validate(row, selected) {
+  const value = row.value, key = selected.value;
+  if (!value || value.schema !== schema || value.active !== true || value.repo !== key.repo
+      || value.package !== key.package
+      || value.account_id !== key.account_id || value.generation !== key.generation
+      || value.principal_sha256 !== key.principal_sha256
+      || !uuid.test(value.revision) || !holder(value.owner)
+      || (value.owner?.kind === 'ci' && value.owner.repo !== key.repo)) throw new Error('play_owner_unverified');
+  return row;
+}
+
+function replacement(row, owner) { return {...row.value, revision: randomUUID(), owner}; }
+
+function terminal(response, owner) {
+  const run = response.body;
+  return response.status === 200 && run?.id === owner.run_id && run.run_attempt === owner.run_attempt
+    && run.repository?.full_name === owner.repo && run.head_sha === owner.sha && run.path === owner.workflow
+    && run.status === 'completed' && ['success', 'failure', 'cancelled', 'timed_out', 'action_required',
+      'neutral', 'skipped', 'startup_failure', 'stale'].includes(run.conclusion);
+}
+
+module.exports = {schema, binding, validate, replacement, same, terminal};

package/android-action/play-upload/owner_run.cjs

@@ -0,0 +1,62 @@
+// Hold exactly one package while its existing Python preflight/inventory child runs.
+const {spawn} = require('node:child_process');
+const {join} = require('node:path');
+const owner = require('./owner.cjs');
+
+function child(argv, env, capture = false, cancelled = () => false) {
+  return new Promise((resolve, reject) => {
+    if (cancelled()) { reject(new Error('play_owner_cancelled')); return; }
+    const processChild = spawn('python3', argv, {env, stdio: ['ignore', 'pipe', 'pipe']});
+    let text = '', overflow = false, force;
+    const stop = () => {
+      processChild.kill('SIGTERM');
+      if (!force) force = setTimeout(() => processChild.kill('SIGKILL'), 2000);
+    };
+    process.on('SIGTERM', stop); process.on('SIGINT', stop);
+    const timer = setTimeout(stop, 3600000);
+    processChild.stdout.on('data', chunk => {
+      if (!capture) process.stdout.write(chunk);
+      else if (text.length + chunk.length <= 1024) text += chunk;
+      else { overflow = true; stop(); }
+    });
+    processChild.stderr.resume();
+    processChild.on('error', () => { overflow = true; });
+    processChild.on('close', (code, signal) => {
+      clearTimeout(timer); clearTimeout(force); process.off('SIGTERM', stop); process.off('SIGINT', stop);
+      if (signal || overflow) reject(new Error('play_owner_child_failed'));
+      else resolve({code, text: text.trim()});
+    });
+  });
+}
+
+async function main(argv = process.argv.slice(2), env = process.env) {
+  try {
+    let packageName, args, principal;
+    const directory = join(__dirname, '../scripts');
+    if (argv[0] === 'resolve' && argv.length === 1) {
+      const script = join(directory, 'resolve_android.py');
+      const local = await child([script, '--owner-package'], env, true);
+      if (local.code !== 0) throw new Error('play_owner_package_unverified');
+      const identity = JSON.parse(local.text);
+      packageName = identity.package; principal = identity.principal_sha256; args = [script];
+    } else if (argv[0] === 'preflight' && argv.length === 3) {
+      packageName = argv[1];
+      principal = require('./owner_principal.cjs').read(argv[2]);
+      args = [join(directory, 'play_preflight.py'), '--package', packageName, '--service-account', argv[2]];
+    } else throw new Error('play_owner_package_unverified');
+    const bound = {...env, PLAY_EDIT_PRINCIPAL_SHA256: principal};
+    const result = await owner.withOwner(bound, packageName, cancelled =>
+      child(args, {...bound, INPUT_PACKAGE_NAME: packageName}, false, cancelled));
+    process.exitCode = result.code;
+  } catch (error) {
+    const code = [...owner.codes, 'play_owner_child_failed', 'play_owner_package_unverified'].includes(error.message)
+      ? error.message : 'play_owner_unverified';
+    const receipt = {schema: 'gowalk-cicd/play-owner.v1', code};
+    if (Number.isInteger(error.operationResult?.code)) receipt.child_exit_code = error.operationResult.code;
+    console.log(`::error title=play_edit_owner::${JSON.stringify(receipt)}`);
+    process.exitCode = 1;
+  }
+}
+
+module.exports = {child, main};
+if (require.main === module) void main();

package/android-action/play-upload/run.cjs

@@ -3,11 +3,14 @@ const {appendFileSync, mkdtempSync, mkdirSync, rmSync} = require('node:fs');
 const {join} = require('node:path');
 const source = require('./source.cjs');
 const processRunner = require('./process.cjs');
+const owner = require('./owner.cjs');
 
-async function upload(program, env, directory, execute = processRunner.execute, timeout = 3600000) {
+async function upload(program, env, directory, execute = processRunner.execute, timeout = 3600000,
+  cancelled = () => false) {
   const deadline = Date.now() + timeout;
   let mode = 'false';
   for (let attempt = 1; attempt <= 2; attempt++) {
+    if (cancelled()) return {ok: false, code: 'upload_cancelled', attempts: attempt - 1, review_pending: false};
     const target = join(directory, String(attempt)); mkdirSync(target, {mode: 0o700});
     const result = await execute(program, {...env, INPUT_CHANGESNOTSENTFORREVIEW: mode}, target,
       Math.max(1, deadline - Date.now()));
@@ -30,14 +33,22 @@ async function main() {
   let directory, receipt;
   try {
     const env = processRunner.environment(process.env);
+    if (!env.PLAY_EDIT_BINDING) throw new Error('play_owner_binding_required');
+    env.PLAY_EDIT_PRINCIPAL_SHA256 = require('./owner_principal.cjs').read(env.INPUT_SERVICEACCOUNTJSON);
     if (!env.RUNNER_TEMP || !env.GITHUB_OUTPUT) throw new Error('runner_context_required');
     directory = mkdtempSync(join(env.RUNNER_TEMP, 'gowalk-play-upload-'));
-    receipt = await upload(await source.prepare(directory), env, directory);
+    const program = await source.prepare(directory);
+    receipt = await owner.withOwner(env, env.INPUT_PACKAGENAME, cancelled =>
+      upload(program, env, directory, processRunner.execute, 3600000, cancelled));
   } catch (error) {
     const allowed = ['assigned_proxy_required', 'runner_context_required', 'uploader_integrity_refused',
-      'uploader_source_unavailable'];
+      'uploader_source_unavailable', ...owner.codes];
     receipt = {ok: false, code: allowed.includes(error.message) ? error.message : 'uploader_failed',
       attempts: 0, review_pending: false};
+    if (owner.codes.includes(error.message) && error.operationResult) {
+      receipt = {...error.operationResult, ok: false, code: error.message,
+        owner_error: error.message, provider_result: error.operationResult};
+    }
   } finally { if (directory) rmSync(directory, {recursive: true, force: true}); }
   receipt = {schema: 'gowalk-cicd/play-upload.v1', ...receipt, upstream_revision: source.revision,
     upstream_sha256: source.digest};