gowalk-cicd 1.0.82 → 1.0.84

package/CLAUDE.md

@@ -118,7 +118,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   (`IOS_DISTRIBUTION_P12_BASE64`, `IOS_DISTRIBUTION_CERT_META_BASE64`,
   `IOS_DISTRIBUTION_CERT_REGISTRY_BASE64`), and the Android keystore, properties
   and Play service account into an ephemeral runner checkout.
-  Tracked `creds/` files remain a backward-compatible fallback.
+  Tracked `creds/` files remain a backward-compatible read fallback. Refreshed signing
+  files stay ephemeral and are never staged; `persist-signing-cache` is ignored.
+  Version source staged before signing is preserved separately with its original index bytes.
 - Never revoke a distribution certificate automatically, including legacy caches.
   `certificate-cap-policy` accepts only `fail`; a full cap requires registry reconciliation.
 - Keep preinstalled Android SDK/NDKs. Every Gradle test/build and SDK download runs

package/README.md

@@ -62,9 +62,10 @@ the reusable Apple Distribution identity:
 All three distribution-identity values are base64 so their exact bytes—and the
 registry digests over those bytes—survive the secret round trip. The workflow
 materializes them with mode `0600` only in the ephemeral runner
-checkout. Secret-backed signing files are never staged or committed by the
-composite action. The distribution identity files come from the signing
-registry provisioner; pass their paths to the secret tooling without printing
+checkout. Refreshed signing files are never staged or committed by the
+composite action, including when a legacy workflow passes `persist-signing-cache: true`.
+That input is retained as an ignored compatibility input. The distribution identity
+files come from the signing registry provisioner; pass their paths to the secret tooling without printing
 their contents.
 
 Legacy private repositories can still provide the API key at:

package/action/.daemux-version

@@ -1 +1 @@
-1.0.82
+1.0.84

package/action/action.yml

@@ -1,6 +1,6 @@
 # Note: this file is ~800 lines, above the project's 400-line composite-
 # action guideline. The size pre-dates the cert-caching feature; the
-# signing + commit-back step, the AI-metadata phases, and the
+# signing preparation, the AI-metadata phases, and the
 # export / upload chunk are candidates for extraction into separate
 # scripts under ``scripts/`` (similar to how prepare_signing.py /
 # cert_factory.py / keychain.py / profile_io.py split the cert +
@@ -59,10 +59,10 @@ inputs:
     default: "fail"
   persist-signing-cache:
     description: >
-      Commit refreshed signing files back to the default branch. Set to
-      'false' when credentials were materialized from encrypted secrets.
+      DEPRECATED (ignored). Signing files remain in the ephemeral checkout;
+      the action never stages refreshed credentials, including legacy caches.
     required: false
-    default: "true"
+    default: "false"
   upload:
     description: "Set to 'false' to stop after producing the IPA"
     required: false
@@ -509,70 +509,11 @@ runs:
         set -e
         echo "SIGNING_PREP_EXIT=$signing_exit" >> "$GITHUB_ENV"
         if [ "$signing_exit" -ne 0 ]; then
-          echo "::error::Signing preparation failed; preserving any generated cache before failing."
+          echo "::error::Signing preparation failed; preserving staged source before failing."
         fi
 
-    # Encrypted signing material is the supported factory path and disables
-    # the legacy signing-cache staging below. Source maintenance refuses staged
-    # credential paths; it never pushes them or bypasses branch protection.
-    # A version bump is preserved separately from the earlier action update.
-
-    - name: Stage refreshed signing identity
-      # Only stage on push to the default branch — PR runs and feature
-      # branches must NOT mutate creds/ (they'd race the default branch
-      # commit and clutter PR diffs). The signing identity is a long-lived
-      # artifact owned by the canonical branch.
-      if: ${{ inputs.archive == 'true'
-            && inputs.persist-signing-cache == 'true'
-            && github.event_name == 'push'
-            && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
-      shell: bash
-      working-directory: ${{ github.workspace }}
-      run: |
-        set -euo pipefail
-        # Default checkout is shallow (fetch-depth=1). Pushing back to the
-        # default branch needs a full ref so git can rebase on top of any
-        # commits that landed since checkout — promote to a full clone.
-        # Either form may fail on already-deep checkouts; ignore non-zero.
-        git fetch --unshallow 2>/dev/null \
-          || git fetch --depth=2147483647 2>/dev/null \
-          || true
-        git config user.name 'github-actions[bot]'
-        git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-        # Stage ONLY the specific files prepare_signing.py manages — never
-        # `creds/` wholesale. The user's ASC .p8 key is already tracked
-        # (committed separately at setup) so `git add` of new files leaves
-        # it alone, but `creds/` may also hold notes, build artifacts, or
-        # other unmanaged files we MUST NOT commit. Each `git add -f`
-        # bypasses any consumer .gitignore that hides creds/. Missing
-        # files (shouldn't happen given step ordering, but defensive)
-        # produce a non-zero exit which we swallow — the commit-step is
-        # the source of truth for "is there anything to commit".
-        git add -f -- creds/cert.p12 2>/dev/null || true
-        git add -f -- creds/cert.meta.json 2>/dev/null || true
-        git add -f -- creds/cert.registry.json 2>/dev/null || true
-        git add -f -- creds/profiles.manifest.json 2>/dev/null || true
-        # The whole profiles/ directory is action-managed (one
-        # .mobileprovision per signable bundle, GC'd when bundles are
-        # removed); staging the directory picks up adds + removes in one
-        # shot. Force-flag overrides any creds/profiles/ ignore rule.
-        git add -f -- creds/profiles/ 2>/dev/null || true
-        # Marketing-version auto-bump: NOTHING TO DO HERE.
-        # version_utils.write_marketing_version() does an immediate
-        # `git add -f -- <path>` right after the write, which captures
-        # the post-bump, pre-prepare_signing state in the index.
-        # prepare_signing.py later mutates the working-tree pbxproj
-        # for manual-signing settings, but those edits land only in
-        # the working tree -- the index keeps the version bump alone.
-        # The marker at $RUNNER_TEMP/swift-app-mv-bumped is for log /
-        # diagnostics; we surface it here so CI logs show exactly
-        # which file mmv touched.
-        bump_marker="$RUNNER_TEMP/swift-app-mv-bumped"
-        if [ -f "$bump_marker" ]; then
-          echo "auto-bump: marker present; the following file(s) were"
-          echo "auto-bumped and pre-staged by version_utils:"
-          sed 's/^/  /' "$bump_marker"
-        fi
+    # Signing files remain in the ephemeral checkout for archive/export.
+    # Only version changes staged before prepare_signing enter source maintenance.
 
     - name: Commit + push staged bot changes
       # Any marketing-version auto-bump the version step staged is preserved.

package/action/scripts/commit_bot_changes.sh

@@ -9,13 +9,11 @@ if git diff --cached --quiet; then
 fi
 
 staged="$(git diff --cached --name-only)"
-has_cert=0
 has_auto=0
 has_bump=0
 # autoupdate_check.sh deliberately does NOT stage .github/workflows/deploy.yml
 # (GITHUB_TOKEN cannot push workflow-file changes), so we only need to detect
 # action/ paths to classify the commit as an autoupdate.
-if grep -qE '^creds/' <<<"$staged"; then has_cert=1; fi
 if grep -qE '^\.github/actions/(swift-app|android-app)/' <<<"$staged"; then has_auto=1; fi
 # marketing-version-auto-bump (mmv_floor_check) writes the bumped value
 # into the project's source-of-truth (resolved by version_utils):
@@ -34,7 +32,6 @@ fi
 # Build a subject that lists every concern that actually fired. Avoids a
 # 2^N case explosion by composing components in a stable order.
 parts=()
-if [[ $has_cert -eq 1 ]]; then parts+=("refresh signing identity"); fi
 if [[ $has_auto -eq 1 ]]; then parts+=("autoupdate app-ci"); fi
 if [[ $has_bump -eq 1 ]]; then parts+=("bump MARKETING_VERSION"); fi
 if [[ ${#parts[@]} -eq 0 ]]; then

package/action/scripts/test_action_step_order.py

@@ -61,9 +61,9 @@ class TestActionStepOrder(unittest.TestCase):
             self.assertIn("format('refs/heads/{0}', github.event.repository.default_branch)", block)
         self.assertIn('bash "$BOT_SCRIPTS_DIR/commit_bot_changes.sh"', commit)
         self.assertIn("GITHUB_REF_NAME: ${{ github.ref_name }}", commit)
-        # The cert refresh keeps its own, later commit step.
+        # Version source is preserved after ephemeral signing preparation.
         self.assertIn("Commit + push staged bot changes", self.names)
-        self.assertLess(self.names.index("Stage refreshed signing identity"),
+        self.assertLess(self.names.index("Prepare signing (cert + keychain + per-target profiles + pbxproj)"),
                         self.names.index("Commit + push staged bot changes"))
 
     def test_every_script_and_prompt_is_read_from_the_snapshot(self) -> None:

package/action/scripts/test_signing_source_boundary.py

@@ -0,0 +1,82 @@
+"""Run the action's signing-to-maintenance steps against a protected Git remote."""
+from pathlib import Path
+import subprocess
+import textwrap
+
+from source_maintenance_fixture import MaintenanceFixture
+from test_action_step_order import step_block, step_names
+
+
+ACTION = Path(__file__).resolve().parents[1]
+PREPARE = "Prepare signing (cert + keychain + per-target profiles + pbxproj)"
+RERAISE = "Re-raise signing preparation failure"
+FILES = ("cert.p12", "cert.meta.json", "cert.registry.json", "profiles.manifest.json",
+         "profiles/app.mobileprovision")
+
+
+class SigningSourceBoundaryTests(MaintenanceFixture):
+    def setUp(self):
+        super().setUp()
+        snapshot = self.root / "action"
+        scripts = snapshot / "scripts"
+        scripts.mkdir(parents=True)
+        (scripts / "prepare_signing.py").write_text(
+            "from pathlib import Path\nimport os\n"
+            f"for name in {FILES!r}:\n"
+            " p = Path('creds') / name\n p.parent.mkdir(parents=True, exist_ok=True)\n"
+            " p.write_text('synthetic-signing-material')\n"
+            "p = Path('project.yml')\np.write_text(p.read_text() + 'signing: ephemeral\\n')\n"
+            "raise SystemExit(int(os.environ.get('FIXTURE_SIGNING_EXIT', '0')))\n")
+        (self.repo / ".git/info/exclude").write_text("creds/\n")
+        self.env.update({"SWIFT_APP_ACTION": str(snapshot), "RUNNER_TEMP": str(self.root),
+                         "GITHUB_ENV": str(self.root / "environment"),
+                         "BOT_SCRIPTS_DIR": str(ACTION / "scripts")})
+        self.source = (ACTION / "action.yml").read_text()
+
+    def run_signing_to_maintenance(self):
+        names = step_names(self.source)
+        selected = names[names.index(PREPARE):names.index(RERAISE)]
+        result = None
+        for name in selected:
+            block = step_block(self.source, name)
+            script = textwrap.dedent(block.split("      run: ", 1)[1])
+            if script.startswith("|\n"):
+                script = textwrap.dedent(script[2:])
+            result = subprocess.run(["bash", "-e", "-o", "pipefail", "-c", script],
+                                    cwd=self.repo, env=self.env, capture_output=True, text=True, timeout=15)
+            if result.returncode:
+                return result
+        return result
+
+    def assert_ephemeral_signing(self):
+        for name in FILES:
+            self.assertEqual((self.repo / "creds" / name).read_text(), "synthetic-signing-material")
+        self.assertEqual(self.git("ls-files", "creds"), "")
+        self.assertEqual(self.git("diff", "--cached", "--name-only"), "")
+        self.assertEqual(self.git("rev-parse", "HEAD").strip(), self.base)
+
+    def test_legacy_true_input_keeps_signing_out_of_version_candidate(self):
+        # All steps for archive=true/default-branch push/persist-signing-cache=true run.
+        self.stage()
+        receipt = self.receipt(self.run_signing_to_maintenance())
+        self.assertEqual(self.git("diff", "--name-only", self.base, receipt["head_sha"]), "project.yml\n")
+        self.assertEqual(self.git("show", receipt["head_sha"] + ":project.yml"), "version: 1.1\n")
+        self.assertEqual((self.repo / "project.yml").read_text(), "version: 1.1\nsigning: ephemeral\n")
+        self.assert_ephemeral_signing()
+
+    def test_signing_without_source_changes_needs_no_maintenance_candidate(self):
+        result = self.run_signing_to_maintenance()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(len(self.git("ls-remote", "--heads", "origin").splitlines()), 1)
+        self.assert_ephemeral_signing()
+
+    def test_signing_failure_stays_visible_after_source_preservation(self):
+        self.stage()
+        self.env["FIXTURE_SIGNING_EXIT"] = "7"
+        self.receipt(self.run_signing_to_maintenance())
+        self.assertIn("SIGNING_PREP_EXIT=7\n", Path(self.env["GITHUB_ENV"]).read_text())
+        script = textwrap.dedent(step_block(self.source, RERAISE).split("      run: |\n", 1)[1])
+        result = subprocess.run(["bash", "-e", "-c", script], cwd=self.repo,
+                                env={**self.env, "SIGNING_PREP_EXIT": "7"}, capture_output=True, text=True)
+        self.assertEqual(result.returncode, 7)
+        self.assert_ephemeral_signing()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.82
+1.0.84

package/android-action/scripts/jvm_proxy_relay.py

@@ -39,11 +39,14 @@ class Relay:
             self.ready.set()
             if self.server:
                 self.server.close()
-                self.loop.run_until_complete(self.server.wait_closed())
+            # Python 3.12+ waits for active clients in Server.wait_closed().
+            # Their handlers own the connections, so cancel and drain them first.
             tasks = asyncio.all_tasks(self.loop)
             for task in tasks:
                 task.cancel()
             self.loop.run_until_complete(asyncio.gather(*tasks, return_exceptions=True))
+            if self.server:
+                self.loop.run_until_complete(self.server.wait_closed())
             self.loop.close()
 
     async def _upstream(self, request: bytes):

package/android-action/scripts/test_jvm_proxy_cleanup.py

@@ -0,0 +1,44 @@
+"""Open client sockets must not keep the command's owned relay alive on Python 3.12+."""
+import asyncio
+import socket
+import unittest
+
+import jvm_proxy_relay as relay
+from test_jvm_proxy_relay import upstream
+
+
+async def accepted():
+    while not any(task.get_coro().__name__ == "_handle" for task in asyncio.all_tasks()):
+        await asyncio.sleep(0.001)
+
+
+class RelayCleanupTests(unittest.TestCase):
+    def test_shutdown_cancels_open_clients_before_waiting_for_server_connections(self):
+        with upstream() as (proxy, _seen):
+            for connected in (False, True):
+                with self.subTest(established_tunnel=connected):
+                    owned = relay.Relay(proxy)
+                    owned.thread.start()
+                    self.assertTrue(owned.ready.wait(5))
+                    client = socket.create_connection(("127.0.0.1", owned.port), timeout=5)
+                    try:
+                        if connected:
+                            client.sendall(b"CONNECT unresolvable.invalid:443 HTTP/1.1\r\nHost: ignored\r\n\r\n")
+                            self.assertIn(b"200", client.recv(4096))
+                        else:
+                            # Synchronize on acceptance while deliberately leaving the request unfinished.
+                            asyncio.run_coroutine_threadsafe(accepted(), owned.loop).result(timeout=5)
+                        owned.loop.call_soon_threadsafe(owned.loop.stop)
+                        owned.thread.join(timeout=2)
+                        self.assertFalse(owned.thread.is_alive(), "relay cleanup waits on a client it must close")
+                        self.assertTrue(owned.loop.is_closed())
+                        self.assertEqual(client.recv(4096), b"")
+                        with self.assertRaises(OSError):
+                            socket.create_connection(("127.0.0.1", owned.port), timeout=0.2)
+                    finally:
+                        client.close()
+                        owned.thread.join(timeout=5)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.82
+1.0.84

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.82",
+  "version": "1.0.84",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -181,8 +181,6 @@ jobs:
           # is locked in review. Default-branch deploys retain metadata automation.
           manage-app-store-version: >-
             ${{ github.ref_name == github.event.repository.default_branch && 'true' || 'false' }}
-          persist-signing-cache: >-
-            ${{ steps.ios_credentials.outputs.source == 'encrypted' && 'false' || 'true' }}
           # Repository variable FIREBASE_APP_ID: the app's Firebase App ID(s),
           # comma-separated when it ships both platforms. With an iOS id the
           # action uploads the archive's dSYMs to Crashlytics before TestFlight.