gowalk-cicd 1.0.80 → 1.0.82

package/CLAUDE.md

@@ -158,6 +158,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   errors still fail the job. Never use `continue-on-error` or a timeout around all SDK setup
   to hide an optional cache failure. Do not alter cache keys or disable caches as part of
   this timeout handling.
+- Gradle caches use explicit checksum-pinned restore/save actions, each optional and bounded
+  to two minutes. Preserve setup-java's key inputs and absolute cache paths to reuse existing
+  caches. Java setup, builds and store uploads remain mandatory; save runs after delivery.
+  The cache-only preloader also admits the pinned `restore-only`/`save-only` entrypoints.
 - GitHub artifact uploads have their own checksum-pinned `artifact_env.cjs` process scope.
   It reuses the cache transport's approved HTTPS request guard, then removes inherited proxy
   variables only inside the official `upload-artifact` process. Unknown programs/origins refuse;
@@ -189,6 +193,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   no-certificate sentinel. Empty/malformed output and arbitrary errors never mean absence. Raw command
   output stays in an owned private temporary directory removed on exit. Do not remove
   Certbot locks, stop other processes, force renewal or bypass the public HTTPS health gate.
+  Docker port changes update only the managed nginx upstream, preserving existing TLS directives.
+  Existing certificate inventory is followed by domain-scoped `certbot install`, so a legacy
+  HTTP-only vhost also recovers without reissuance. Installation shares the bounded lock-only retry.
 - The Android action serves two build systems. `android_config.project_kind()`
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie

package/README.md

@@ -97,6 +97,8 @@ it rsyncs the backend dir to `/opt/gowalk-backends/<app>/`, runs
 wires an nginx vhost + Let's Encrypt cert for the API domain, and health-checks.
 Hosts with several existing Let's Encrypt accounts select one deterministically,
 and a domain deploy fails unless its public HTTPS certificate and health route validate.
+Changing a container's published port preserves its existing HTTPS configuration. An existing
+certificate is installed for the requested domain on redeploy, repairing older HTTP-only vhosts too.
 
 Requirements on the consumer repo:
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.80
+1.0.82

package/action/scripts/cache_scope.cjs

@@ -5,6 +5,8 @@ const {basename, dirname, join} = require('node:path');
 const hashes = new Map([
   ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
   ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
+  ['restore-only', '6255afaa3956351b8cfefc1e82f026b4db418a10678a8eaddf3d6c55f81744de'],
+  ['save-only', '7fb63f90f06ce6a10f39d40a113f99791bffdedad5394cdad5b4dfaa644559cb'],
 ]);
 const artifactHash = '168c44946cba03564808c19b83a72601e6d1d6f57081dbd2d6e2ea1cedc522f5';
 const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.80
+1.0.82

package/android-action/scripts/cache_scope.cjs

@@ -5,6 +5,8 @@ const {basename, dirname, join} = require('node:path');
 const hashes = new Map([
   ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
   ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
+  ['restore-only', '6255afaa3956351b8cfefc1e82f026b4db418a10678a8eaddf3d6c55f81744de'],
+  ['save-only', '7fb63f90f06ce6a10f39d40a113f99791bffdedad5394cdad5b4dfaa644559cb'],
 ]);
 const artifactHash = '168c44946cba03564808c19b83a72601e6d1d6f57081dbd2d6e2ea1cedc522f5';
 const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.80
+1.0.82

package/backend-action/action.yml

@@ -128,6 +128,7 @@ runs:
           "${{ github.action_path }}/remote_deploy.sh" \
           "${{ github.action_path }}/select_certbot_account.sh" \
           "${{ github.action_path }}/ensure_certificate.sh" \
+          "${{ github.action_path }}/configure_vhost.py" \
           "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
 
     - name: Deploy on the host

package/backend-action/configure_vhost.py

@@ -0,0 +1,64 @@
+"""Update one managed nginx upstream without discarding Certbot's HTTPS configuration."""
+import os
+from pathlib import Path
+import re
+import stat
+import sys
+import tempfile
+
+
+def content(previous, domain, port):
+    if not re.fullmatch(r"[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?", domain) or not 0 < port < 65536:
+        raise ValueError("invalid domain or port")
+    if previous:
+        names = re.findall(r"(?m)^\s*server_name\s+([^;]+);", previous)
+        if not names or any(name.strip() != domain for name in names):
+            raise ValueError("vhost belongs to another domain")
+        pattern = r"(?m)^(\s*proxy_pass\s+http://127\.0\.0\.1:)\d+(;[^\n]*$)"
+        result, count = re.subn(pattern, lambda match: f"{match[1]}{port}{match[2]}", previous)
+        if count != 1:
+            raise ValueError("managed upstream is not unique")
+        return result
+    return f"""server {{
+    listen 80;
+    server_name {domain};
+    client_max_body_size 100m;
+    location / {{
+        proxy_pass http://127.0.0.1:{port};
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 120s;
+    }}
+}}
+"""
+
+
+def configure(path, domain, port):
+    if path.is_symlink():
+        raise ValueError("managed vhost must not be a symlink")
+    previous = path.read_text() if path.exists() else ""
+    updated = content(previous, domain, port)
+    if previous == updated:
+        return "unchanged"
+    mode = stat.S_IMODE(path.stat().st_mode) if path.exists() else 0o644
+    fd, temporary = tempfile.mkstemp(prefix=path.name + ".", dir=path.parent)
+    try:
+        with os.fdopen(fd, "w") as output:
+            os.fchmod(output.fileno(), mode)
+            output.write(updated)
+            output.flush()
+            os.fsync(output.fileno())
+        os.replace(temporary, path)
+    finally:
+        Path(temporary).unlink(missing_ok=True)
+    return "changed"
+
+
+if __name__ == "__main__":
+    try:
+        print(configure(Path(sys.argv[1]), sys.argv[2], int(sys.argv[3])))
+    except (OSError, ValueError):
+        sys.exit("Cannot update the managed nginx vhost; its domain and upstream must be unambiguous")

package/backend-action/ensure_certificate.sh

@@ -25,7 +25,7 @@ certbot_attempt() {
 
 certificate_present() {
   # 0=present, 1=confirmed absent, 2=unrecognized/partial inventory; preserve other awk failures.
-  awk -v domain="$1" '
+  awk -v domain="$1" -v emit_name="${2:-}" '
     function valid_san(value, labels, count, i, compressed, groups) {
       if (index(value, ":")) {
         count = split(value, labels, "::"); if (count > 2) return 0
@@ -49,12 +49,20 @@ certificate_present() {
     /^Found the following certs:$/ { if (mode) bad = 1; mode = 1; next }
     $1 == "Certificate" && $2 == "Name:" {
       if (mode != 1 || NF < 3 || (records && sans != 1)) bad = 1
+      name = $0; sub(/^[[:space:]]*Certificate Name:[[:space:]]*/, "", name)
+      if (index(name, "/") || index(name, "\\") || name == "." || name == "..") bad = 1
       records++; sans = 0; next
     }
     $1 == "Domains:" || $1 == "Identifiers:" {
       if (mode != 1 || !records || sans || NF < 2) bad = 1
       sans++
-      for (i = 2; i <= NF; i++) { if (!valid_san($i)) bad = 1; if ($i == domain) found = 1 }
+      for (i = 2; i <= NF; i++) {
+        if (!valid_san($i)) bad = 1
+        if ($i == domain) {
+          if (!found || name == domain || (selected != domain && name < selected)) selected = name
+          found = 1
+        }
+      }
       next
     }
     /^[[:space:]]+(Serial Number|Key Type|Expiry Date|Certificate Path|Private Key Path):/ {
@@ -64,6 +72,7 @@ certificate_present() {
     { bad = 1 }
     END {
       if (bad || !mode || (mode == 1 && (!records || sans != 1))) exit 2
+      if (found && emit_name) print selected
       exit !found
     }
   ' "$CERTBOT_WORK/stdout"
@@ -81,7 +90,7 @@ request_certificate() {
 }
 
 ensure_certificate() (
-  local domain="$1" email="$2" delay attempt=0 status=1 CERTBOT_WORK
+  local domain="$1" email="$2" delay name attempt=0 status=1 CERTBOT_WORK
   CERTBOT_WORK="$(mktemp -d "${TMPDIR:-/tmp}/gowalk-certbot.XXXXXXXX")" || return $?
   trap 'rm -rf -- "$CERTBOT_WORK"' EXIT
   trap 'exit 130' INT
@@ -94,9 +103,17 @@ ensure_certificate() (
       sleep "$delay" || return $?
     fi
     if certbot_attempt inventory "$attempt" certificates; then
-      if certificate_present "$domain"; then
+      if name="$(certificate_present "$domain" name)"; then
         log "cert for $domain already present"
-        return 0
+        # Inventory proves possession, not nginx installation. Repair an HTTP-only legacy vhost too.
+        if certbot_attempt installation "$attempt" install --nginx --cert-name "$name" \
+            -d "$domain" --non-interactive --redirect; then
+          return 0
+        else
+          status=$?
+          certbot_lock_busy && continue
+          return "$status"
+        fi
       else
         status=$?
         if [ "$status" -ne 1 ]; then

package/backend-action/remote_deploy.sh

@@ -73,24 +73,9 @@ fi
 
 # ── nginx vhost → proxy the domain to the published port
 VHOST="/etc/nginx/conf.d/backend-$APP.conf"
-if [ ! -f "$VHOST" ] || ! grep -q "127.0.0.1:$PORT" "$VHOST"; then
-  log "writing nginx vhost $VHOST → 127.0.0.1:$PORT"
-  cat > "$VHOST" <<NGINX
-server {
-    listen 80;
-    server_name $DOMAIN;
-    client_max_body_size 100m;
-    location / {
-        proxy_pass http://127.0.0.1:$PORT;
-        proxy_http_version 1.1;
-        proxy_set_header Host \$host;
-        proxy_set_header X-Real-IP \$remote_addr;
-        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto \$scheme;
-        proxy_read_timeout 120s;
-    }
-}
-NGINX
+VHOST_STATE="$(python3 "$DIR/configure_vhost.py" "$VHOST" "$DOMAIN" "$PORT")"
+if [ "$VHOST_STATE" = changed ]; then
+  log "updated nginx upstream for $DOMAIN → 127.0.0.1:$PORT"
   nginx -t && systemctl reload nginx
 fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.80",
+  "version": "1.0.82",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -348,7 +348,35 @@ jobs:
         with:
           distribution: temurin
           java-version: ${{ steps.jdk.outputs.version }}
-          cache: gradle
+      # Keep Java setup mandatory; optional caches have no unbounded post step.
+      - name: Retain Gradle cache scope
+        id: gradle_scope
+        if: ${{ steps.mode.outputs.mode == 'local' }}
+        continue-on-error: true
+        shell: bash
+        run: |
+          node .github/actions/android-app/scripts/cache_scope.cjs --snapshot
+          node - <<'NODE'
+          require('fs').appendFileSync(process.env.GITHUB_OUTPUT,
+            `home=${require('os').homedir()}\narch=${process.arch}\n`);
+          NODE
+      - name: Restore Gradle dependencies
+        id: gradle_cache
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.gradle_scope.outcome == 'success' }}
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25
+        continue-on-error: true
+        timeout-minutes: 2
+        env:
+          NODE_OPTIONS: --require "${{ steps.gradle_scope.outputs.preloader }}"
+          SEGMENT_DOWNLOAD_TIMEOUT_MINS: '1'
+        with:
+          path: |
+            ${{ steps.gradle_scope.outputs.home }}/.gradle/caches
+            ${{ steps.gradle_scope.outputs.home }}/.gradle/wrapper
+          key: >-
+            ${{ format('setup-java-{0}-{1}-gradle-{2}', runner.os, steps.gradle_scope.outputs.arch,
+                hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'buildSrc/**/Versions.kt',
+                'buildSrc/**/Dependencies.kt', 'gradle/*.versions.toml', '**/versions.properties')) }}
       - name: Set up Flutter
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
         uses: ./.github/actions/android-app/flutter-setup
@@ -518,6 +546,22 @@ jobs:
         run: |
           echo "::notice title=play_review_pending::{\"schema\":\"gowalk-cicd/play-review-pending.v1\",\"package\":\"${PACKAGE}\",\"track\":\"${TRACK}\",\"version_code\":\"${VERSION_CODE}\"}"
 
+      - name: Save Gradle dependencies
+        if: >-
+          ${{ success() && steps.mode.outputs.mode == 'local'
+              && steps.gradle_cache.outputs.cache-primary-key != ''
+              && steps.gradle_cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25
+        continue-on-error: true
+        timeout-minutes: 2
+        env:
+          NODE_OPTIONS: --require "${{ steps.gradle_scope.outputs.preloader }}"
+        with:
+          path: |
+            ${{ steps.gradle_scope.outputs.home }}/.gradle/caches
+            ${{ steps.gradle_scope.outputs.home }}/.gradle/wrapper
+          key: ${{ steps.gradle_cache.outputs.cache-primary-key }}
+
   # GitHub only registers a newly added workflow after it reaches the default
   # branch. A brand-new app's feature branch therefore cannot dispatch the
   # separate Backend Deploy workflow yet. Reuse this already-registered mobile