gowalk-cicd 1.0.81 → 1.0.83

package/CLAUDE.md

@@ -118,7 +118,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   (`IOS_DISTRIBUTION_P12_BASE64`, `IOS_DISTRIBUTION_CERT_META_BASE64`,
   `IOS_DISTRIBUTION_CERT_REGISTRY_BASE64`), and the Android keystore, properties
   and Play service account into an ephemeral runner checkout.
-  Tracked `creds/` files remain a backward-compatible fallback.
+  Tracked `creds/` files remain a backward-compatible read fallback. Refreshed signing
+  files stay ephemeral and are never staged; `persist-signing-cache` is ignored.
+  Version source staged before signing is preserved separately with its original index bytes.
 - Never revoke a distribution certificate automatically, including legacy caches.
   `certificate-cap-policy` accepts only `fail`; a full cap requires registry reconciliation.
 - Keep preinstalled Android SDK/NDKs. Every Gradle test/build and SDK download runs
@@ -158,6 +160,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   errors still fail the job. Never use `continue-on-error` or a timeout around all SDK setup
   to hide an optional cache failure. Do not alter cache keys or disable caches as part of
   this timeout handling.
+- Gradle caches use explicit checksum-pinned restore/save actions, each optional and bounded
+  to two minutes. Preserve setup-java's key inputs and absolute cache paths to reuse existing
+  caches. Java setup, builds and store uploads remain mandatory; save runs after delivery.
+  The cache-only preloader also admits the pinned `restore-only`/`save-only` entrypoints.
 - GitHub artifact uploads have their own checksum-pinned `artifact_env.cjs` process scope.
   It reuses the cache transport's approved HTTPS request guard, then removes inherited proxy
   variables only inside the official `upload-artifact` process. Unknown programs/origins refuse;

package/README.md

@@ -62,9 +62,10 @@ the reusable Apple Distribution identity:
 All three distribution-identity values are base64 so their exact bytes—and the
 registry digests over those bytes—survive the secret round trip. The workflow
 materializes them with mode `0600` only in the ephemeral runner
-checkout. Secret-backed signing files are never staged or committed by the
-composite action. The distribution identity files come from the signing
-registry provisioner; pass their paths to the secret tooling without printing
+checkout. Refreshed signing files are never staged or committed by the
+composite action, including when a legacy workflow passes `persist-signing-cache: true`.
+That input is retained as an ignored compatibility input. The distribution identity
+files come from the signing registry provisioner; pass their paths to the secret tooling without printing
 their contents.
 
 Legacy private repositories can still provide the API key at:

package/action/.daemux-version

@@ -1 +1 @@
-1.0.81
+1.0.83

package/action/action.yml

@@ -1,6 +1,6 @@
 # Note: this file is ~800 lines, above the project's 400-line composite-
 # action guideline. The size pre-dates the cert-caching feature; the
-# signing + commit-back step, the AI-metadata phases, and the
+# signing preparation, the AI-metadata phases, and the
 # export / upload chunk are candidates for extraction into separate
 # scripts under ``scripts/`` (similar to how prepare_signing.py /
 # cert_factory.py / keychain.py / profile_io.py split the cert +
@@ -59,10 +59,10 @@ inputs:
     default: "fail"
   persist-signing-cache:
     description: >
-      Commit refreshed signing files back to the default branch. Set to
-      'false' when credentials were materialized from encrypted secrets.
+      DEPRECATED (ignored). Signing files remain in the ephemeral checkout;
+      the action never stages refreshed credentials, including legacy caches.
     required: false
-    default: "true"
+    default: "false"
   upload:
     description: "Set to 'false' to stop after producing the IPA"
     required: false
@@ -509,70 +509,11 @@ runs:
         set -e
         echo "SIGNING_PREP_EXIT=$signing_exit" >> "$GITHUB_ENV"
         if [ "$signing_exit" -ne 0 ]; then
-          echo "::error::Signing preparation failed; preserving any generated cache before failing."
+          echo "::error::Signing preparation failed; preserving staged source before failing."
         fi
 
-    # Encrypted signing material is the supported factory path and disables
-    # the legacy signing-cache staging below. Source maintenance refuses staged
-    # credential paths; it never pushes them or bypasses branch protection.
-    # A version bump is preserved separately from the earlier action update.
-
-    - name: Stage refreshed signing identity
-      # Only stage on push to the default branch — PR runs and feature
-      # branches must NOT mutate creds/ (they'd race the default branch
-      # commit and clutter PR diffs). The signing identity is a long-lived
-      # artifact owned by the canonical branch.
-      if: ${{ inputs.archive == 'true'
-            && inputs.persist-signing-cache == 'true'
-            && github.event_name == 'push'
-            && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
-      shell: bash
-      working-directory: ${{ github.workspace }}
-      run: |
-        set -euo pipefail
-        # Default checkout is shallow (fetch-depth=1). Pushing back to the
-        # default branch needs a full ref so git can rebase on top of any
-        # commits that landed since checkout — promote to a full clone.
-        # Either form may fail on already-deep checkouts; ignore non-zero.
-        git fetch --unshallow 2>/dev/null \
-          || git fetch --depth=2147483647 2>/dev/null \
-          || true
-        git config user.name 'github-actions[bot]'
-        git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-        # Stage ONLY the specific files prepare_signing.py manages — never
-        # `creds/` wholesale. The user's ASC .p8 key is already tracked
-        # (committed separately at setup) so `git add` of new files leaves
-        # it alone, but `creds/` may also hold notes, build artifacts, or
-        # other unmanaged files we MUST NOT commit. Each `git add -f`
-        # bypasses any consumer .gitignore that hides creds/. Missing
-        # files (shouldn't happen given step ordering, but defensive)
-        # produce a non-zero exit which we swallow — the commit-step is
-        # the source of truth for "is there anything to commit".
-        git add -f -- creds/cert.p12 2>/dev/null || true
-        git add -f -- creds/cert.meta.json 2>/dev/null || true
-        git add -f -- creds/cert.registry.json 2>/dev/null || true
-        git add -f -- creds/profiles.manifest.json 2>/dev/null || true
-        # The whole profiles/ directory is action-managed (one
-        # .mobileprovision per signable bundle, GC'd when bundles are
-        # removed); staging the directory picks up adds + removes in one
-        # shot. Force-flag overrides any creds/profiles/ ignore rule.
-        git add -f -- creds/profiles/ 2>/dev/null || true
-        # Marketing-version auto-bump: NOTHING TO DO HERE.
-        # version_utils.write_marketing_version() does an immediate
-        # `git add -f -- <path>` right after the write, which captures
-        # the post-bump, pre-prepare_signing state in the index.
-        # prepare_signing.py later mutates the working-tree pbxproj
-        # for manual-signing settings, but those edits land only in
-        # the working tree -- the index keeps the version bump alone.
-        # The marker at $RUNNER_TEMP/swift-app-mv-bumped is for log /
-        # diagnostics; we surface it here so CI logs show exactly
-        # which file mmv touched.
-        bump_marker="$RUNNER_TEMP/swift-app-mv-bumped"
-        if [ -f "$bump_marker" ]; then
-          echo "auto-bump: marker present; the following file(s) were"
-          echo "auto-bumped and pre-staged by version_utils:"
-          sed 's/^/  /' "$bump_marker"
-        fi
+    # Signing files remain in the ephemeral checkout for archive/export.
+    # Only version changes staged before prepare_signing enter source maintenance.
 
     - name: Commit + push staged bot changes
       # Any marketing-version auto-bump the version step staged is preserved.

package/action/scripts/cache_scope.cjs

@@ -5,6 +5,8 @@ const {basename, dirname, join} = require('node:path');
 const hashes = new Map([
   ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
   ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
+  ['restore-only', '6255afaa3956351b8cfefc1e82f026b4db418a10678a8eaddf3d6c55f81744de'],
+  ['save-only', '7fb63f90f06ce6a10f39d40a113f99791bffdedad5394cdad5b4dfaa644559cb'],
 ]);
 const artifactHash = '168c44946cba03564808c19b83a72601e6d1d6f57081dbd2d6e2ea1cedc522f5';
 const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];

package/action/scripts/commit_bot_changes.sh

@@ -9,13 +9,11 @@ if git diff --cached --quiet; then
 fi
 
 staged="$(git diff --cached --name-only)"
-has_cert=0
 has_auto=0
 has_bump=0
 # autoupdate_check.sh deliberately does NOT stage .github/workflows/deploy.yml
 # (GITHUB_TOKEN cannot push workflow-file changes), so we only need to detect
 # action/ paths to classify the commit as an autoupdate.
-if grep -qE '^creds/' <<<"$staged"; then has_cert=1; fi
 if grep -qE '^\.github/actions/(swift-app|android-app)/' <<<"$staged"; then has_auto=1; fi
 # marketing-version-auto-bump (mmv_floor_check) writes the bumped value
 # into the project's source-of-truth (resolved by version_utils):
@@ -34,7 +32,6 @@ fi
 # Build a subject that lists every concern that actually fired. Avoids a
 # 2^N case explosion by composing components in a stable order.
 parts=()
-if [[ $has_cert -eq 1 ]]; then parts+=("refresh signing identity"); fi
 if [[ $has_auto -eq 1 ]]; then parts+=("autoupdate app-ci"); fi
 if [[ $has_bump -eq 1 ]]; then parts+=("bump MARKETING_VERSION"); fi
 if [[ ${#parts[@]} -eq 0 ]]; then

package/action/scripts/test_action_step_order.py

@@ -61,9 +61,9 @@ class TestActionStepOrder(unittest.TestCase):
             self.assertIn("format('refs/heads/{0}', github.event.repository.default_branch)", block)
         self.assertIn('bash "$BOT_SCRIPTS_DIR/commit_bot_changes.sh"', commit)
         self.assertIn("GITHUB_REF_NAME: ${{ github.ref_name }}", commit)
-        # The cert refresh keeps its own, later commit step.
+        # Version source is preserved after ephemeral signing preparation.
         self.assertIn("Commit + push staged bot changes", self.names)
-        self.assertLess(self.names.index("Stage refreshed signing identity"),
+        self.assertLess(self.names.index("Prepare signing (cert + keychain + per-target profiles + pbxproj)"),
                         self.names.index("Commit + push staged bot changes"))
 
     def test_every_script_and_prompt_is_read_from_the_snapshot(self) -> None:

package/action/scripts/test_signing_source_boundary.py

@@ -0,0 +1,82 @@
+"""Run the action's signing-to-maintenance steps against a protected Git remote."""
+from pathlib import Path
+import subprocess
+import textwrap
+
+from source_maintenance_fixture import MaintenanceFixture
+from test_action_step_order import step_block, step_names
+
+
+ACTION = Path(__file__).resolve().parents[1]
+PREPARE = "Prepare signing (cert + keychain + per-target profiles + pbxproj)"
+RERAISE = "Re-raise signing preparation failure"
+FILES = ("cert.p12", "cert.meta.json", "cert.registry.json", "profiles.manifest.json",
+         "profiles/app.mobileprovision")
+
+
+class SigningSourceBoundaryTests(MaintenanceFixture):
+    def setUp(self):
+        super().setUp()
+        snapshot = self.root / "action"
+        scripts = snapshot / "scripts"
+        scripts.mkdir(parents=True)
+        (scripts / "prepare_signing.py").write_text(
+            "from pathlib import Path\nimport os\n"
+            f"for name in {FILES!r}:\n"
+            " p = Path('creds') / name\n p.parent.mkdir(parents=True, exist_ok=True)\n"
+            " p.write_text('synthetic-signing-material')\n"
+            "p = Path('project.yml')\np.write_text(p.read_text() + 'signing: ephemeral\\n')\n"
+            "raise SystemExit(int(os.environ.get('FIXTURE_SIGNING_EXIT', '0')))\n")
+        (self.repo / ".git/info/exclude").write_text("creds/\n")
+        self.env.update({"SWIFT_APP_ACTION": str(snapshot), "RUNNER_TEMP": str(self.root),
+                         "GITHUB_ENV": str(self.root / "environment"),
+                         "BOT_SCRIPTS_DIR": str(ACTION / "scripts")})
+        self.source = (ACTION / "action.yml").read_text()
+
+    def run_signing_to_maintenance(self):
+        names = step_names(self.source)
+        selected = names[names.index(PREPARE):names.index(RERAISE)]
+        result = None
+        for name in selected:
+            block = step_block(self.source, name)
+            script = textwrap.dedent(block.split("      run: ", 1)[1])
+            if script.startswith("|\n"):
+                script = textwrap.dedent(script[2:])
+            result = subprocess.run(["bash", "-e", "-o", "pipefail", "-c", script],
+                                    cwd=self.repo, env=self.env, capture_output=True, text=True, timeout=15)
+            if result.returncode:
+                return result
+        return result
+
+    def assert_ephemeral_signing(self):
+        for name in FILES:
+            self.assertEqual((self.repo / "creds" / name).read_text(), "synthetic-signing-material")
+        self.assertEqual(self.git("ls-files", "creds"), "")
+        self.assertEqual(self.git("diff", "--cached", "--name-only"), "")
+        self.assertEqual(self.git("rev-parse", "HEAD").strip(), self.base)
+
+    def test_legacy_true_input_keeps_signing_out_of_version_candidate(self):
+        # All steps for archive=true/default-branch push/persist-signing-cache=true run.
+        self.stage()
+        receipt = self.receipt(self.run_signing_to_maintenance())
+        self.assertEqual(self.git("diff", "--name-only", self.base, receipt["head_sha"]), "project.yml\n")
+        self.assertEqual(self.git("show", receipt["head_sha"] + ":project.yml"), "version: 1.1\n")
+        self.assertEqual((self.repo / "project.yml").read_text(), "version: 1.1\nsigning: ephemeral\n")
+        self.assert_ephemeral_signing()
+
+    def test_signing_without_source_changes_needs_no_maintenance_candidate(self):
+        result = self.run_signing_to_maintenance()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(len(self.git("ls-remote", "--heads", "origin").splitlines()), 1)
+        self.assert_ephemeral_signing()
+
+    def test_signing_failure_stays_visible_after_source_preservation(self):
+        self.stage()
+        self.env["FIXTURE_SIGNING_EXIT"] = "7"
+        self.receipt(self.run_signing_to_maintenance())
+        self.assertIn("SIGNING_PREP_EXIT=7\n", Path(self.env["GITHUB_ENV"]).read_text())
+        script = textwrap.dedent(step_block(self.source, RERAISE).split("      run: |\n", 1)[1])
+        result = subprocess.run(["bash", "-e", "-c", script], cwd=self.repo,
+                                env={**self.env, "SIGNING_PREP_EXIT": "7"}, capture_output=True, text=True)
+        self.assertEqual(result.returncode, 7)
+        self.assert_ephemeral_signing()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.81
+1.0.83

package/android-action/scripts/cache_scope.cjs

@@ -5,6 +5,8 @@ const {basename, dirname, join} = require('node:path');
 const hashes = new Map([
   ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
   ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
+  ['restore-only', '6255afaa3956351b8cfefc1e82f026b4db418a10678a8eaddf3d6c55f81744de'],
+  ['save-only', '7fb63f90f06ce6a10f39d40a113f99791bffdedad5394cdad5b4dfaa644559cb'],
 ]);
 const artifactHash = '168c44946cba03564808c19b83a72601e6d1d6f57081dbd2d6e2ea1cedc522f5';
 const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.81
+1.0.83

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.81",
+  "version": "1.0.83",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -181,8 +181,6 @@ jobs:
           # is locked in review. Default-branch deploys retain metadata automation.
           manage-app-store-version: >-
             ${{ github.ref_name == github.event.repository.default_branch && 'true' || 'false' }}
-          persist-signing-cache: >-
-            ${{ steps.ios_credentials.outputs.source == 'encrypted' && 'false' || 'true' }}
           # Repository variable FIREBASE_APP_ID: the app's Firebase App ID(s),
           # comma-separated when it ships both platforms. With an iOS id the
           # action uploads the archive's dSYMs to Crashlytics before TestFlight.
@@ -348,7 +346,35 @@ jobs:
         with:
           distribution: temurin
           java-version: ${{ steps.jdk.outputs.version }}
-          cache: gradle
+      # Keep Java setup mandatory; optional caches have no unbounded post step.
+      - name: Retain Gradle cache scope
+        id: gradle_scope
+        if: ${{ steps.mode.outputs.mode == 'local' }}
+        continue-on-error: true
+        shell: bash
+        run: |
+          node .github/actions/android-app/scripts/cache_scope.cjs --snapshot
+          node - <<'NODE'
+          require('fs').appendFileSync(process.env.GITHUB_OUTPUT,
+            `home=${require('os').homedir()}\narch=${process.arch}\n`);
+          NODE
+      - name: Restore Gradle dependencies
+        id: gradle_cache
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.gradle_scope.outcome == 'success' }}
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25
+        continue-on-error: true
+        timeout-minutes: 2
+        env:
+          NODE_OPTIONS: --require "${{ steps.gradle_scope.outputs.preloader }}"
+          SEGMENT_DOWNLOAD_TIMEOUT_MINS: '1'
+        with:
+          path: |
+            ${{ steps.gradle_scope.outputs.home }}/.gradle/caches
+            ${{ steps.gradle_scope.outputs.home }}/.gradle/wrapper
+          key: >-
+            ${{ format('setup-java-{0}-{1}-gradle-{2}', runner.os, steps.gradle_scope.outputs.arch,
+                hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'buildSrc/**/Versions.kt',
+                'buildSrc/**/Dependencies.kt', 'gradle/*.versions.toml', '**/versions.properties')) }}
       - name: Set up Flutter
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
         uses: ./.github/actions/android-app/flutter-setup
@@ -518,6 +544,22 @@ jobs:
         run: |
           echo "::notice title=play_review_pending::{\"schema\":\"gowalk-cicd/play-review-pending.v1\",\"package\":\"${PACKAGE}\",\"track\":\"${TRACK}\",\"version_code\":\"${VERSION_CODE}\"}"
 
+      - name: Save Gradle dependencies
+        if: >-
+          ${{ success() && steps.mode.outputs.mode == 'local'
+              && steps.gradle_cache.outputs.cache-primary-key != ''
+              && steps.gradle_cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25
+        continue-on-error: true
+        timeout-minutes: 2
+        env:
+          NODE_OPTIONS: --require "${{ steps.gradle_scope.outputs.preloader }}"
+        with:
+          path: |
+            ${{ steps.gradle_scope.outputs.home }}/.gradle/caches
+            ${{ steps.gradle_scope.outputs.home }}/.gradle/wrapper
+          key: ${{ steps.gradle_cache.outputs.cache-primary-key }}
+
   # GitHub only registers a newly added workflow after it reaches the default
   # branch. A brand-new app's feature branch therefore cannot dispatch the
   # separate Backend Deploy workflow yet. Reuse this already-registered mobile