gowalk-cicd 1.0.78 → 1.0.80

package/android-action/scripts/resolve_android.py

@@ -4,6 +4,9 @@
 from __future__ import annotations
 
 import os
+import hashlib
+import json
+import re
 import shutil
 import sys
 from pathlib import Path
@@ -143,6 +146,21 @@ def main() -> None:
     print(f"Resolved {kind} Android package {package_name}, build {build_number}")
 
 
+def owner_package() -> None:
+    """Resolve only local identity before the Node owner starts any provider operation."""
+    workspace = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
+    kind = project_kind(workspace)
+    project = None if kind == "flutter" else find_gradle_project(workspace)
+    package = os.environ.get("INPUT_PACKAGE_NAME") or detect_package_name(
+        workspace, project.build_file if project else None)
+    account = find_play_service_account(workspace)
+    value = json.loads(account.read_text())
+    email = value.get("client_email")
+    if not isinstance(email, str) or not re.fullmatch(r"[^\s@]+@[^\s@]+", email):
+        raise ConfigError("Play principal identity is unavailable")
+    print(json.dumps({"package": package, "principal_sha256": hashlib.sha256(email.lower().encode()).hexdigest()}))
+
+
 def write_config(values: dict[str, str], signing) -> None:
     env_path = Path(os.environ["GITHUB_ENV"])
     output_path = Path(os.environ["GITHUB_OUTPUT"])
@@ -163,4 +181,4 @@ def write_config(values: dict[str, str], signing) -> None:
 
 
 if __name__ == "__main__":
-    main()
+    owner_package() if sys.argv[1:] == ["--owner-package"] else main()

package/android-action/scripts/test_early_play_workflow.py

@@ -27,7 +27,7 @@ class EarlyPlayWorkflowTests(unittest.TestCase):
         script = "\n".join(line[10:] for line in step.splitlines())
         with tempfile.TemporaryDirectory() as tmp:
             root = Path(tmp)
-            fake = root / "python3"
+            fake = root / "node"
             fake.write_text('#!/bin/sh\necho called >> "$TRACE"\necho ready=true >> "$GITHUB_OUTPUT"\n')
             fake.chmod(0o700)
             env = {**os.environ, "PATH": f"{root}:{os.environ['PATH']}", "EARLY_READINESS": readiness,
@@ -69,7 +69,7 @@ class EarlyPlayWorkflowTests(unittest.TestCase):
         self.assertEqual(result.returncode, 0, result.stderr)
         self.assertEqual(output, "ready=true\n")
         self.assertTrue(called)
-        self.assertRegex(readiness_step(), r'--package "\$PACKAGE_NAME"\s*\\\s*--service-account "\$SERVICE_ACCOUNT"')
+        self.assertIn('preflight "$PACKAGE_NAME" "$SERVICE_ACCOUNT"', readiness_step())
 
     def test_invalid_output_cannot_silently_skip_preflight(self):
         result, output, called = self.run_step("unknown")

package/android-action/scripts/test_resolve_play_readiness.py

@@ -1,9 +1,11 @@
 """Store evidence must exist before configuration enables compilation or version writes."""
 import io
+import hashlib
 import json
 import os
 from pathlib import Path
 import sys
+import subprocess
 import tempfile
 import unittest
 from unittest import mock
@@ -43,6 +45,30 @@ class ResolvePlayReadinessTests(unittest.TestCase):
         self.assertIn("ANDROID_PLAY_API_READY=true\n", self.env_file.read_text())
         self.prepare.assert_called_once_with(self.root)
 
+    def test_owner_package_is_local_and_preserves_an_explicit_identity(self):
+        for path in (self.root / "creds").iterdir():
+            if path.suffix != ".json":
+                path.unlink()
+        resolve.owner_package()
+        expected = hashlib.sha256(b"fixture@example.invalid").hexdigest()
+        self.assertEqual(json.loads(sys.stdout.getvalue()), {"package": "com.example.app", "principal_sha256": expected})
+        self.read.assert_not_called()
+        self.prepare.assert_not_called()
+        self.assertFalse(self.env_file.exists())
+        self.assertFalse(self.outputs.exists())
+        with mock.patch.dict(os.environ, {"INPUT_PACKAGE_NAME": "org.owned.override"}):
+            resolve.owner_package()
+        self.assertEqual(json.loads(sys.stdout.getvalue().splitlines()[-1])["package"], "org.owned.override")
+        self.assertNotIn("fixture@example.invalid", sys.stdout.getvalue())
+
+    def test_actual_local_identity_child_emits_only_package_and_principal_hash(self):
+        result = subprocess.run([sys.executable, str(Path(resolve.__file__)), "--owner-package"],
+                                capture_output=True, text=True, timeout=10, check=False)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(json.loads(result.stdout), {"package": "com.example.app",
+            "principal_sha256": hashlib.sha256(b"fixture@example.invalid").hexdigest()})
+        self.assertNotIn("fixture@example.invalid", result.stdout + result.stderr)
+
     def test_absent_package_keeps_configuration_for_a_first_release_artifact(self):
         self.read.return_value = PlayInventory(False, None)
         resolve.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.78
+1.0.80

package/backend-action/remote_deploy.sh

@@ -107,11 +107,15 @@ fi
 # and the application together; a green deploy must mean the public API works.
 PUBLIC_HEALTHY=""
 for i in $(seq 1 15); do
-  if curl -fsS "https://$DOMAIN$HEALTH" >/dev/null 2>&1; then
+  CURL_EXIT=0
+  HTTP_CODE="$(curl --disable --silent --output /dev/null --write-out '%{http_code}' \
+    --proto '=https' --connect-timeout 5 --max-time 10 "https://$DOMAIN$HEALTH")" || CURL_EXIT=$?
+  if [ "$CURL_EXIT" -eq 0 ] && [[ "$HTTP_CODE" =~ ^2[0-9]{2}$ ]]; then
     log "public https://$DOMAIN$HEALTH healthy (after ${i}x2s)"
     PUBLIC_HEALTHY=1
     break
   fi
+  log "public health not ready (curl=$CURL_EXIT, http=$HTTP_CODE, attempt=$i/15)"
   sleep 2
 done
 if [ -z "$PUBLIC_HEALTHY" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.78",
+  "version": "1.0.80",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -19,6 +19,7 @@ on:
 
 permissions:
   contents: write
+  actions: read
   models: read
 
 concurrency:
@@ -233,6 +234,7 @@ jobs:
     name: Android Google Play
     env:
       GOOGLE_STORE_PROXY_URL: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
+      PLAY_EDIT_BINDING: ${{ vars.APP_ROBOT_PLAY_EDIT_BINDING }}
     if: ${{ vars.DEPLOY_PLATFORMS != 'ios' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 45
@@ -426,6 +428,8 @@ jobs:
         id: android
         if: ${{ steps.mode.outputs.mode == 'local' }}
         uses: ./.github/actions/android-app
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         with:
           # Tests belong to the CI gate, not the deploy path — same policy as
           # the iOS job above. Running the analyzer here breaks every deploy
@@ -467,6 +471,7 @@ jobs:
           PACKAGE_NAME: ${{ steps.android.outputs.package-name }}
           SERVICE_ACCOUNT: ${{ steps.android.outputs.play-service-account }}
           EARLY_READINESS: ${{ steps.android.outputs.play-api-ready }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           # Current actions verify readiness before compiling. Older action copies
           # have no output, so retain their standalone preflight compatibility.
@@ -475,9 +480,8 @@ jobs:
             '') ;;
             *) echo "::error::Invalid Android readiness output"; exit 1 ;;
           esac
-          python3 .github/actions/android-app/scripts/play_preflight.py \
-            --package "$PACKAGE_NAME" \
-            --service-account "$SERVICE_ACCOUNT"
+          node .github/actions/android-app/play-upload/owner_run.cjs \
+            preflight "$PACKAGE_NAME" "$SERVICE_ACCOUNT"
       # The wrapper verifies the unchanged pinned official uploader and classifies
       # its immediate result. Only explicit expired/deleted edits retry normally;
       # only Play's explicit review-hold refusal changes the review flag.
@@ -487,6 +491,7 @@ jobs:
         uses: ./.github/actions/android-app/play-upload
         env:
           GOOGLE_STORE_PROXY_URL: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
+          GITHUB_TOKEN: ${{ github.token }}
         with:
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
           packageName: ${{ steps.android.outputs.package-name }}