gowalk-cicd 1.0.8 → 1.0.10

package/README.md

@@ -206,15 +206,28 @@ Provisioning profile "CI-com.example.app" doesn't include the App Attest capabil
 
 Before creating a profile, the action reads the target's
 `CODE_SIGN_ENTITLEMENTS` plist and enables the matching capabilities on the App
-ID — Push Notifications, App Attest, Associated Domains, Sign in with Apple,
-HealthKit, SiriKit, NFC, HomeKit, network extensions and the other plain
-on/off toggles. If it had to turn anything on, it regenerates the profile
-rather than reusing the cached one, which predates the change.
-
-Capabilities that carry values an entitlements file cannot supply — App Groups,
-iCloud containers, Apple Pay merchant IDs, Wallet pass types, Data Protection —
-are **not** enabled automatically. The action emits a `::warning::` naming what
-it saw and leaves those for you to configure in the Apple Developer portal.
+ID — Push Notifications, Associated Domains, HealthKit, SiriKit, HomeKit,
+network extensions and the other plain on/off toggles.
+
+The cached profile under `creds/profiles/` is checked against those same
+entitlements and regenerated when it does not carry them. The cache manifest
+records only a UUID and an expiry, so without that check a profile issued
+before a capability was turned on — whether by this action or by you in the
+developer portal — would be reused indefinitely, and the archive would keep
+failing on a capability the App ID already has.
+
+Two classes of capability are **not** enabled automatically, and each gets a
+`::warning::` naming what was seen:
+
+- **Values the action cannot infer** — App Groups, iCloud containers, Apple Pay
+  merchant IDs, Wallet pass types, Data Protection. Configure these on the App
+  ID yourself.
+- **App Attest** — a real App ID capability in the developer portal, but absent
+  from the ASC API's `capabilityType` enum, so *no* API call can turn it on.
+  Any app using Firebase App Check's `AppAttestProvider` must have App Attest
+  ticked once by hand under **Certificates, Identifiers & Profiles → Identifiers
+  → <your App ID>**. Until then the archive fails with `Provisioning profile
+  "CI-<bundle>" doesn't include the App Attest capability`.
 
 ## AI metadata auto-fill
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.8
+1.0.10

package/action/scripts/capabilities.py

@@ -41,7 +41,6 @@ _API_FAILURES = (Exception, SystemExit)
 # capability at all.
 CAPABILITY_BY_ENTITLEMENT = {
     "aps-environment": "PUSH_NOTIFICATIONS",
-    "com.apple.developer.devicecheck.appattest-environment": "APP_ATTEST",
     "com.apple.developer.associated-domains": "ASSOCIATED_DOMAINS",
     "com.apple.developer.applesignin": "APPLE_ID_AUTH",
     "com.apple.developer.networking.wifi-info": "ACCESS_WIFI_INFORMATION",
@@ -65,7 +64,17 @@ CAPABILITY_BY_ENTITLEMENT = {
 # merchant ids, protection level) that an entitlements file cannot supply
 # unambiguously. Enabling these blind would create a half-configured App ID,
 # so we say what is missing and stop.
+APP_ATTEST_ENTITLEMENT = "com.apple.developer.devicecheck.appattest-environment"
+
 MANUAL_ENTITLEMENTS = {
+    # App Attest is a real App ID capability in the developer portal, but it is
+    # absent from the ASC API's capabilityType enum entirely — POSTing it
+    # returns 409 ENTITY_ERROR.ATTRIBUTE.TYPE listing the valid values, which
+    # do not include it. There is no API to turn this one on.
+    APP_ATTEST_ENTITLEMENT: (
+        "App Attest, which the App Store Connect API cannot enable — tick it "
+        "on the App ID under Certificates, Identifiers & Profiles"
+    ),
     "com.apple.security.application-groups": "App Groups",
     "com.apple.developer.icloud-container-identifiers": "iCloud",
     "com.apple.developer.icloud-services": "iCloud",
@@ -76,6 +85,30 @@ MANUAL_ENTITLEMENTS = {
 }
 
 
+# Entitlement keys Apple mirrors into an issued profile's Entitlements dict
+# when the capability is on. Checking a cached profile against these is what
+# makes the cache self-correcting: the manifest records a UUID and an expiry
+# but nothing about which capabilities the profile was issued with, so a
+# profile minted before a capability was added stays "valid" forever.
+#
+# Deliberately excludes the settings-bearing capabilities (App Groups, iCloud,
+# Apple Pay, Wallet, Data Protection): those need App ID configuration this
+# action does not perform, so treating them as missing would regenerate the
+# profile on every single run without ever fixing anything.
+PROFILE_ENTITLEMENT_KEYS = set(CAPABILITY_BY_ENTITLEMENT) | {APP_ATTEST_ENTITLEMENT}
+
+
+def missing_profile_entitlements(
+    profile_entitlements: dict, required_keys: set[str]
+) -> set[str]:
+    """Required entitlement keys an already-issued profile does not carry."""
+    return {
+        key
+        for key in required_keys & PROFILE_ENTITLEMENT_KEYS
+        if key not in profile_entitlements
+    }
+
+
 def read_entitlement_keys(path: Path) -> set[str]:
     """Top-level keys of an entitlements plist; empty when unreadable."""
     try:
@@ -145,9 +178,12 @@ def enable_capability(token: str, bundle_pk: str, capability: str) -> bool:
         # identically from the status code alone. Surface the body: without it
         # the run just reports a profile missing a capability we claimed to
         # have enabled, and there is nothing in the log to explain why.
+        # Untruncated enough to show Apple's full list of valid capabilityType
+        # values, which is the only way to learn that a name is simply not
+        # API-manageable (see App Attest in MANUAL_ENTITLEMENTS).
         print(
             f"::warning::App Store Connect returned 409 for {capability}: "
-            f"{response.text[:600]}"
+            f"{response.text[:2000]}"
         )
         return False
     print(f"Enabled {capability} on the App ID")

package/action/scripts/profile_manager.py

@@ -181,18 +181,36 @@ def _try_reuse_cached(
     cert_id: str,
     creds_dir: Path,
     manifest: dict,
+    entitlement_keys: set[str] | None = None,
 ) -> tuple[str, str, dict] | None:
     """Return ``(uuid, team, entry)`` if a cached profile reinstalls cleanly.
 
     A corrupt .mobileprovision (truncated, manually edited, ``security
     cms`` decode failure) must NEVER abort the build — log and return
     ``None`` so the caller falls through to the fresh-create path.
+
+    The profile is also checked against the app's entitlements. The manifest
+    records a UUID and an expiry but nothing about the capabilities the
+    profile carries, so one issued before a capability was enabled — by this
+    action or by a human in the developer portal — would otherwise be reused
+    forever, failing the archive on a capability the App ID now has.
     """
     cached = creds_store.find_reusable_profile(manifest, bid, cert_id, creds_dir)
     if cached is None:
         return None
     try:
         der = creds_store.profile_path(creds_dir, cached.uuid).read_bytes()
+        if entitlement_keys:
+            plist = decode_profile_plist(der, _PROFILE_DIRS[0])
+            missing = capabilities.missing_profile_entitlements(
+                plist.get("Entitlements") or {}, entitlement_keys
+            )
+            if missing:
+                print(
+                    f"cached profile {cached.uuid} predates "
+                    f"{', '.join(sorted(missing))}; regenerating"
+                )
+                return None
         uuid, team_id, _ = install_profile(der)
     except (OSError, subprocess.CalledProcessError, ValueError, KeyError) as exc:
         print(
@@ -234,7 +252,9 @@ def _provision_bundle(
         if capabilities.reconcile(token, bundle_pk, bid, entitlement_keys):
             can_reuse = False
     if can_reuse:
-        reused = _try_reuse_cached(bid, name, cert_id, creds_dir, manifest)
+        reused = _try_reuse_cached(
+            bid, name, cert_id, creds_dir, manifest, entitlement_keys
+        )
         if reused is not None:
             uuid, team_id, entry = reused
             return name, uuid, team_id, entry

package/action/scripts/test_capabilities.py

@@ -19,6 +19,7 @@ import capabilities
 
 ENTITLEMENTS = {
     "aps-environment": "production",
+    "com.apple.developer.associated-domains": ["applinks:gowalk.example"],
     "com.apple.developer.devicecheck.appattest-environment": "production",
     "keychain-access-groups": ["$(AppIdentifierPrefix)com.gowalk.form"],
 }
@@ -46,12 +47,26 @@ class ReadEntitlementsTest(unittest.TestCase):
 
 class RequiredCapabilitiesTest(unittest.TestCase):
     def test_maps_only_known_toggles(self) -> None:
-        # keychain-access-groups needs no App ID capability at all.
+        # keychain-access-groups needs no App ID capability at all, and App
+        # Attest is not in the ASC API's capabilityType enum, so neither can
+        # produce a POST.
         self.assertEqual(
             capabilities.required_capabilities(set(ENTITLEMENTS)),
-            {"PUSH_NOTIFICATIONS", "APP_ATTEST"},
+            {"PUSH_NOTIFICATIONS", "ASSOCIATED_DOMAINS"},
         )
 
+    def test_app_attest_is_reported_not_attempted(self) -> None:
+        key = "com.apple.developer.devicecheck.appattest-environment"
+
+        self.assertNotIn(key, capabilities.CAPABILITY_BY_ENTITLEMENT)
+        self.assertIn(key, capabilities.MANUAL_ENTITLEMENTS)
+
+        with mock.patch("builtins.print") as printed:
+            capabilities.warn_about_manual_entitlements({key}, "com.gowalk.form")
+
+        messages = [c.args[0] for c in printed.call_args_list if c.args]
+        self.assertTrue(any("App Attest" in m for m in messages), messages)
+
     def test_ignores_entitlements_with_no_capability(self) -> None:
         self.assertEqual(
             capabilities.required_capabilities({"get-task-allow", "com.apple.security.get-task-allow"}),
@@ -78,13 +93,13 @@ class ReconcileTest(unittest.TestCase):
             changed = capabilities.reconcile("tok", "PK", "com.gowalk.form", set(ENTITLEMENTS))
 
         self.assertTrue(changed)
-        self.assertEqual(posted, ["APP_ATTEST"])
+        self.assertEqual(posted, ["ASSOCIATED_DOMAINS"])
 
     def test_no_op_when_the_app_id_already_has_everything(self) -> None:
         listed = {
             "data": [
                 {"attributes": {"capabilityType": "PUSH_NOTIFICATIONS"}},
-                {"attributes": {"capabilityType": "APP_ATTEST"}},
+                {"attributes": {"capabilityType": "ASSOCIATED_DOMAINS"}},
             ]
         }
         with mock.patch.object(capabilities, "get_json", return_value=listed), \
@@ -107,7 +122,7 @@ class ReconcileTest(unittest.TestCase):
                 mock.patch.object(capabilities, "request", side_effect=fake_request):
             capabilities.reconcile("tok", "PK", "com.gowalk.form", set(ENTITLEMENTS))
 
-        self.assertEqual(sorted(posted), ["APP_ATTEST", "PUSH_NOTIFICATIONS"])
+        self.assertEqual(sorted(posted), ["ASSOCIATED_DOMAINS", "PUSH_NOTIFICATIONS"])
 
     def test_regenerates_even_when_the_capability_could_not_be_enabled(self) -> None:
         # A 409 (or any refusal) still means the cached profile was issued
@@ -119,7 +134,7 @@ class ReconcileTest(unittest.TestCase):
                 mock.patch.object(capabilities, "request", return_value=response):
             changed = capabilities.reconcile(
                 "tok", "PK", "com.gowalk.form",
-                {"com.apple.developer.devicecheck.appattest-environment"},
+                {"com.apple.developer.associated-domains"},
             )
 
         self.assertTrue(changed)
@@ -132,7 +147,7 @@ class ReconcileTest(unittest.TestCase):
                 mock.patch("builtins.print") as printed:
             capabilities.reconcile(
                 "tok", "PK", "com.gowalk.form",
-                {"com.apple.developer.devicecheck.appattest-environment"},
+                {"com.apple.developer.associated-domains"},
             )
 
         messages = [c.args[0] for c in printed.call_args_list if c.args]
@@ -145,7 +160,7 @@ class ReconcileTest(unittest.TestCase):
                 mock.patch.object(capabilities, "request", side_effect=RuntimeError("boom")):
             changed = capabilities.reconcile(
                 "tok", "PK", "com.gowalk.form",
-                {"com.apple.developer.devicecheck.appattest-environment"},
+                {"com.apple.developer.associated-domains"},
             )
 
         self.assertTrue(changed)
@@ -159,7 +174,7 @@ class ReconcileTest(unittest.TestCase):
                 mock.patch.object(capabilities, "request", side_effect=SystemExit("400")):
             changed = capabilities.reconcile(
                 "tok", "PK", "com.gowalk.form",
-                {"com.apple.developer.devicecheck.appattest-environment"},
+                {"com.apple.developer.associated-domains"},
             )
 
         self.assertTrue(changed)

package/action/scripts/test_profile_reuse.py

@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+"""Cached-profile reuse must account for the app's entitlements.
+
+The manifest records a profile's UUID and expiry but nothing about the
+capabilities Apple baked into it. Without checking, a profile issued before a
+capability was enabled — by this action or by hand in the developer portal —
+is reused forever and the archive keeps failing on a capability the App ID
+already has.
+"""
+
+from __future__ import annotations
+
+import tempfile
+import unittest
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from unittest import mock
+
+import capabilities
+import profile_manager
+
+
+APP_ATTEST = capabilities.APP_ATTEST_ENTITLEMENT
+
+
+class CachedProfileEntitlementsTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temp = tempfile.TemporaryDirectory()
+        self.creds = Path(self.temp.name)
+        self.uuid = "c981d698-f941-44ff-8ff2-5823b7851ac6"
+        cached = mock.MagicMock()
+        cached.uuid = self.uuid
+        cached.name = "CI-com.gowalk.form"
+        cached.filename = f"{self.uuid}.mobileprovision"
+        cached.expiration = datetime.now(timezone.utc) + timedelta(days=300)
+        self.cached = cached
+
+    def tearDown(self) -> None:
+        self.temp.cleanup()
+
+    def _reuse(self, profile_entitlements: dict, required: set[str]):
+        path = mock.MagicMock()
+        path.read_bytes.return_value = b"der"
+        with mock.patch.object(
+                profile_manager.creds_store, "find_reusable_profile",
+                return_value=self.cached), \
+                mock.patch.object(
+                    profile_manager.creds_store, "profile_path", return_value=path), \
+                mock.patch.object(
+                    profile_manager, "decode_profile_plist",
+                    return_value={"Entitlements": profile_entitlements}), \
+                mock.patch.object(
+                    profile_manager, "install_profile",
+                    return_value=(self.uuid, "TEAM123", None)):
+            return profile_manager._try_reuse_cached(
+                "com.gowalk.form", "CI-com.gowalk.form", "CERT",
+                self.creds, {}, required,
+            )
+
+    def test_rejects_a_profile_issued_before_the_capability(self) -> None:
+        result = self._reuse({"aps-environment": "production"}, {APP_ATTEST})
+
+        self.assertIsNone(result)
+
+    def test_reuses_a_profile_that_carries_the_entitlement(self) -> None:
+        result = self._reuse(
+            {"aps-environment": "production", APP_ATTEST: "production"},
+            {APP_ATTEST, "aps-environment"},
+        )
+
+        self.assertIsNotNone(result)
+        self.assertEqual(result[0], self.uuid)
+
+    def test_ignores_entitlements_a_profile_never_mirrors(self) -> None:
+        # keychain-access-groups needs no capability, and App Groups needs App
+        # ID configuration this action does not perform — treating either as
+        # missing would regenerate the profile on every run and fix nothing.
+        result = self._reuse(
+            {APP_ATTEST: "production"},
+            {APP_ATTEST, "keychain-access-groups",
+             "com.apple.security.application-groups"},
+        )
+
+        self.assertIsNotNone(result)
+
+    def test_no_entitlements_declared_keeps_the_old_fast_path(self) -> None:
+        result = self._reuse({}, set())
+
+        self.assertIsNotNone(result)
+
+
+class MissingProfileEntitlementsTest(unittest.TestCase):
+    def test_reports_only_checkable_keys(self) -> None:
+        self.assertEqual(
+            capabilities.missing_profile_entitlements(
+                {"aps-environment": "production"},
+                {APP_ATTEST, "aps-environment", "keychain-access-groups"},
+            ),
+            {APP_ATTEST},
+        )
+
+    def test_empty_when_the_profile_covers_everything(self) -> None:
+        self.assertEqual(
+            capabilities.missing_profile_entitlements(
+                {"aps-environment": "x", APP_ATTEST: "production"},
+                {APP_ATTEST, "aps-environment"},
+            ),
+            set(),
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.8
+1.0.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {