gowalk-cicd 1.0.87 → 1.0.88

package/CLAUDE.md

@@ -121,6 +121,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Tracked `creds/` files remain a backward-compatible read fallback. Refreshed signing
   files stay ephemeral and are never staged; `persist-signing-cache` is ignored.
   Version source staged before signing is preserved separately with its original index bytes.
+- App Group identifiers come from each archive target's entitlements. `app_groups.py`
+  checks exact values in cached and fresh profiles; a fresh mismatch fails before profile
+  installation with `apple_app_groups_required`. Register/assign groups through the scoped
+  Apple account console before retrying CI. Never invent an ASC group operation, infer an
+  identifier from the bundle name, or accept a wildcard/unrelated group as a matching grant.
 - Never revoke a distribution certificate automatically, including legacy caches.
   `certificate-cap-policy` accepts only `fail`; a full cap requires registry reconciliation.
   A certificate POST's HTTP 409 alone does not prove a full cap. `certificate_failure.py`

package/README.md

@@ -737,10 +737,19 @@ before a capability was turned on — whether by this action or by you in the
 developer portal — would be reused indefinitely, and the archive would keep
 failing on a capability the App ID already has.
 
-Two classes of capability are **not** enabled automatically, and each gets a
+App Groups require registration and assignment to each participating App ID through
+the account's Apple Developer console. The action reads the literal identifiers from
+each archive target's entitlements and verifies their exact membership in both cached
+and fresh profiles. A stale cache regenerates; a fresh profile missing a required group
+fails before installation with `apple_app_groups_required`, schema
+`gowalk-cicd/apple-app-groups-required.v1`, containing the bundle ID and missing groups.
+Complete those assignments through the scoped console and rerun CI. This check creates
+no group or certificate and does not replace the account's capability provisioning.
+
+Two other classes of capability are **not** enabled automatically, and each gets a
 `::warning::` naming what was seen:
 
-- **Values the action cannot infer** — App Groups, iCloud containers, Apple Pay
+- **Values the action cannot infer** — iCloud containers, Apple Pay
   merchant IDs, Wallet pass types, Data Protection. Configure these on the App
   ID yourself.
 - **App Attest** — a real App ID capability in the developer portal, but absent

package/action/.daemux-version

@@ -1 +1 @@
-1.0.87
+1.0.88

package/action/scripts/app_groups.py

@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+"""Verify declared App Group identifiers against Apple's issued profiles.
+
+Registration and assignment belong to the account's Developer console. This
+module never guesses groups, posts an unsupported ASC operation or changes a
+certificate. It rejects profiles that would break an app/extension shared container.
+"""
+from __future__ import annotations
+
+import json
+import plistlib
+import re
+from pathlib import Path
+
+from profile_io import decode_profile_plist
+
+ENTITLEMENT = "com.apple.security.application-groups"
+_IDENTIFIER = re.compile(r"group\.[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*")
+
+
+def declared_by_bundle(project: str, targets: list[dict]) -> dict[str, set[str]]:
+    """Read literal group values from the selected archive target entitlements."""
+    result: dict[str, set[str]] = {}
+    for target in targets:
+        relative = target.get("entitlements")
+        if not relative:
+            continue
+        path = Path(project).parent / relative
+        try:
+            data = plistlib.loads(path.read_bytes())
+        except (OSError, ValueError, plistlib.InvalidFileException):
+            raise SystemExit("::error::Cannot verify App Groups: target entitlements are unreadable") from None
+        if not isinstance(data, dict):
+            raise SystemExit("::error::Cannot verify App Groups: target entitlements must be a dictionary")
+        if ENTITLEMENT not in data:
+            continue
+        values = data[ENTITLEMENT]
+        if not isinstance(values, list) or any(
+            not isinstance(value, str) or not _IDENTIFIER.fullmatch(value) for value in values
+        ):
+            raise SystemExit("::error::App Groups must contain literal group identifiers, without build variables")
+        result.setdefault(target["bundle_id"], set()).update(values)
+    return result
+
+
+def missing(profile_entitlements: dict, required: set[str]) -> set[str]:
+    """An unrelated group, malformed value or wildcard never grants a required group."""
+    if not isinstance(profile_entitlements, dict):
+        return set(required)
+    granted = profile_entitlements.get(ENTITLEMENT)
+    if not isinstance(granted, list) or any(not isinstance(value, str) for value in granted):
+        return set(required)
+    return required - set(granted)
+
+
+def validate_requirements(keys_by_bundle: dict, groups_by_bundle: dict) -> None:
+    """Refuse legacy key-only inputs rather than silently ignoring group values."""
+    for bundle, keys in keys_by_bundle.items():
+        if ENTITLEMENT in keys and bundle not in groups_by_bundle:
+            raise SystemExit("::error::App Group profile verification requires declared identifier values")
+
+
+def assert_profile(profile_der: bytes, required: set[str], bundle: str, scratch: Path) -> None:
+    """A fresh profile must contain every declared group before installation."""
+    if not required:
+        return
+    try:
+        profile = decode_profile_plist(profile_der, scratch)
+    except Exception:
+        raise SystemExit("::error::Cannot verify App Groups in the issued profile") from None
+    if not isinstance(profile, dict):
+        raise SystemExit("::error::Cannot verify App Groups in the issued profile")
+    absent = missing(profile.get("Entitlements") or {}, required)
+    if not absent:
+        return
+    receipt = {
+        "schema": "gowalk-cicd/apple-app-groups-required.v1",
+        "bundle_id": bundle,
+        "missing_group_identifiers": sorted(absent),
+        "recovery": "Assign the declared groups to this App ID through the account console, then rerun CI",
+    }
+    raise SystemExit("::error title=apple_app_groups_required::" + json.dumps(receipt, separators=(",", ":")))

package/action/scripts/capabilities.py

@@ -114,7 +114,8 @@ MANUAL_ENTITLEMENTS = {
 # but nothing about which capabilities the profile was issued with, so a
 # profile minted before a capability was added stays "valid" forever.
 #
-# Deliberately excludes the settings-bearing capabilities (App Groups, iCloud,
+# App Groups are checked by exact identifier values in app_groups.py.
+# Deliberately excludes the other settings-bearing capabilities (iCloud,
 # Apple Pay, Wallet, Data Protection): those need App ID configuration this
 # action does not perform, so treating them as missing would regenerate the
 # profile on every single run without ever fixing anything.
@@ -178,6 +179,9 @@ def required_capabilities(entitlement_keys: set[str]) -> set[str]:
 
 def warn_about_manual_entitlements(entitlement_keys: set[str], bundle_id: str) -> None:
     for key in sorted(entitlement_keys & set(MANUAL_ENTITLEMENTS)):
+        if key == "com.apple.security.application-groups":
+            print(f"App Groups for {bundle_id}: issued profiles must cover every declared group identifier")
+            continue
         print(
             f"::warning::{bundle_id} declares {key}, which needs "
             f"{MANUAL_ENTITLEMENTS[key]} configured on the App ID with values "

package/action/scripts/prepare_signing.py

@@ -39,6 +39,7 @@ import os
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
+import app_groups
 import capabilities
 import cert_factory
 import creds_store
@@ -230,12 +231,14 @@ def main() -> None:
             f"({len(t['config_ids'])} configs)"
         )
 
+    groups_by_bundle = app_groups.declared_by_bundle(project, targets)
     cert_id, p12_bytes, p12_pass, cache_hit = _load_or_create_cert(
         token, creds_dir
     )
     mappings, effective_team = provision_all_bundles(
         token, bundle_ids, cert_id, creds_dir=creds_dir, cache_hit=cache_hit,
         entitlements_by_bundle=_entitlement_keys_by_bundle(project, targets),
+        app_groups_by_bundle=groups_by_bundle,
     )
     print("Profile map:")
     for bid, pname, uuid in mappings:

package/action/scripts/profile_manager.py

@@ -43,6 +43,7 @@ import subprocess
 from datetime import datetime
 from pathlib import Path
 
+import app_groups
 import capabilities
 import creds_store
 from asc_common import get_json, request
@@ -97,10 +98,6 @@ def _register_bundle_id(token: str, identifier: str) -> str:
 # Profile lifecycle                                                           #
 # --------------------------------------------------------------------------- #
 
-def profile_name_for(bundle_id: str) -> str:
-    return f"{PROFILE_PREFIX}{bundle_id}"
-
-
 def delete_profile_by_name(token: str, name: str) -> None:
     """Delete every existing profile with the given name (paginated scan)."""
     deleted_any = False
@@ -182,29 +179,26 @@ def _try_reuse_cached(
     creds_dir: Path,
     manifest: dict,
     entitlement_keys: set[str] | None = None,
+    required_groups: set[str] | None = None,
 ) -> tuple[str, str, dict] | None:
     """Return ``(uuid, team, entry)`` if a cached profile reinstalls cleanly.
 
-    A corrupt .mobileprovision (truncated, manually edited, ``security
-    cms`` decode failure) must NEVER abort the build — log and return
-    ``None`` so the caller falls through to the fresh-create path.
-
-    The profile is also checked against the app's entitlements. The manifest
-    records a UUID and an expiry but nothing about the capabilities the
-    profile carries, so one issued before a capability was enabled — by this
-    action or by a human in the developer portal — would otherwise be reused
-    forever, failing the archive on a capability the App ID now has.
+    Decode failure or missing entitlement keys/group values falls through to
+    fresh creation. The cache manifest's UUID and expiry alone cannot prove
+    that a profile reflects the App ID's current capability assignments.
     """
     cached = creds_store.find_reusable_profile(manifest, bid, cert_id, creds_dir)
     if cached is None:
         return None
     try:
         der = creds_store.profile_path(creds_dir, cached.uuid).read_bytes()
-        if entitlement_keys:
+        if entitlement_keys or required_groups:
             plist = decode_profile_plist(der, _PROFILE_DIRS[0])
             missing = capabilities.missing_profile_entitlements(
-                plist.get("Entitlements") or {}, entitlement_keys
+                plist.get("Entitlements") or {}, entitlement_keys or set()
             )
+            if app_groups.missing(plist.get("Entitlements") or {}, required_groups or set()):
+                missing.add(app_groups.ENTITLEMENT)
             if missing:
                 print(
                     f"cached profile {cached.uuid} predates "
@@ -218,8 +212,7 @@ def _try_reuse_cached(
             f"({exc!r}); regenerating"
         )
         return None
-    # cached.expiration is already UTC-aware (load_profile_manifest routes
-    # it through _parse_iso); no astimezone needed.
+    # load_profile_manifest already normalizes cached.expiration to UTC.
     entry = {
         "bundle_id": bid,
         "name": cached.name or name,
@@ -239,9 +232,10 @@ def _provision_bundle(
     manifest: dict,
     can_reuse: bool,
     entitlement_keys: set[str] | None = None,
+    required_groups: set[str] | None = None,
 ) -> tuple[str, str, str, dict]:
     """Provision one bundle; return ``(name, uuid, team, manifest_entry)``."""
-    name = profile_name_for(bid)
+    name = f"{PROFILE_PREFIX}{bid}"
     # Reconcile capabilities BEFORE deciding to reuse. A profile carries only
     # the capabilities its App ID had when it was issued, so a cached profile
     # that predates an entitlement being added stays broken forever otherwise
@@ -253,7 +247,7 @@ def _provision_bundle(
             can_reuse = False
     if can_reuse:
         reused = _try_reuse_cached(
-            bid, name, cert_id, creds_dir, manifest, entitlement_keys
+            bid, name, cert_id, creds_dir, manifest, entitlement_keys, required_groups
         )
         if reused is not None:
             uuid, team_id, entry = reused
@@ -262,6 +256,7 @@ def _provision_bundle(
     bundle_pk = bundle_pk or ensure_bundle_id(token, bid)
     delete_profile_by_name(token, name)
     profile_der = create_profile(token, name, bundle_pk, cert_id)
+    app_groups.assert_profile(profile_der, required_groups or set(), bid, _PROFILE_DIRS[0])
     if entitlement_keys:
         _assert_carplay_entitlements(profile_der, entitlement_keys, bid, name)
     uuid, team_id, expiration = install_profile(profile_der)
@@ -332,20 +327,21 @@ def provision_all_bundles(
     creds_dir: Path,
     cache_hit: bool,
     entitlements_by_bundle: dict[str, set[str]] | None = None,
+    app_groups_by_bundle: dict[str, set[str]] | None = None,
 ) -> tuple[list[tuple[str, str, str]], str]:
     """Create + install a CI profile for each bundle id, with caching.
 
-    Returns ``(mappings, team_id)`` where mappings is a list of
-    ``(bundle_id, profile_name, uuid)`` tuples and ``team_id`` is the
-    team Apple assigned to the profiles (shared — the ASC API key binds
-    every profile it issues to a single team).
-
+    Returns ``(mappings, team_id)`` with ``(bundle_id, profile_name, uuid)``
+    tuples and the team Apple assigned to the profiles.
     ``cache_hit`` says whether the cert came from cache. ``creds_dir``
     is the workspace ``creds/`` root. When the manifest's cert_id
     differs from ``cert_id`` we force a full regen — Apple invalidates
     every profile bound to the prior cert the moment that cert is
     revoked, so reusing on-disk profiles would archive unsigned bits.
     """
+    entitlements_by_bundle = entitlements_by_bundle or {}
+    app_groups_by_bundle = app_groups_by_bundle or {}
+    app_groups.validate_requirements(entitlements_by_bundle, app_groups_by_bundle)
     manifest = creds_store.load_profile_manifest(creds_dir)
     can_reuse = cache_hit and manifest.get("cert_id") == cert_id
     if cache_hit and not can_reuse:
@@ -357,11 +353,11 @@ def provision_all_bundles(
     results: list[tuple[str, str, str]] = []
     new_entries: list[dict] = []
     effective_team = ""
-    entitlements_by_bundle = entitlements_by_bundle or {}
     for bid in bundle_ids:
         name, uuid, team_id, entry = _provision_bundle(
             token, bid, cert_id, creds_dir, manifest, can_reuse,
             entitlements_by_bundle.get(bid),
+            app_groups_by_bundle.get(bid),
         )
         if team_id:
             effective_team = team_id

package/action/scripts/test_app_group_requirements.py

@@ -0,0 +1,83 @@
+"""Archive target declarations retain actual App Group values without guessing."""
+import plistlib
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import app_groups
+import prepare_signing
+
+
+class GroupRequirementsTest(unittest.TestCase):
+    def test_parent_and_extension_receive_their_declared_groups(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            targets = []
+            for name, groups in [("App", ["group.example.shared", "group.example.app"]),
+                                 ("Broadcast", ["group.example.shared"])]:
+                filename = name + ".entitlements"
+                (root / filename).write_bytes(plistlib.dumps({app_groups.ENTITLEMENT: groups}))
+                targets.append({"name": name, "bundle_id": name, "entitlements": filename})
+            self.assertEqual(app_groups.declared_by_bundle(str(root / "App.xcodeproj"), targets), {
+                "App": {"group.example.shared", "group.example.app"}, "Broadcast": {"group.example.shared"},
+            })
+
+    def test_unresolved_or_malformed_values_fail_before_signing(self):
+        values = ["group.example", ["$(GROUP_ID)"], ["group.example.*"], [1], ["group..example"]]
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            targets = [{"bundle_id": "App", "entitlements": "App.entitlements"}]
+            for value in values:
+                with self.subTest(value=value):
+                    (root / "App.entitlements").write_bytes(plistlib.dumps({app_groups.ENTITLEMENT: value}))
+                    with self.assertRaisesRegex(SystemExit, "literal group identifiers"):
+                        app_groups.declared_by_bundle(str(root / "App.xcodeproj"), targets)
+
+    def test_unreadable_declaration_is_not_an_empty_requirement(self):
+        with tempfile.TemporaryDirectory() as directory:
+            with self.assertRaisesRegex(SystemExit, "unreadable"):
+                app_groups.declared_by_bundle(str(Path(directory) / "App.xcodeproj"), [
+                    {"bundle_id": "App", "entitlements": "missing.entitlements"},
+                ])
+
+    def test_unrelated_targets_and_empty_groups_need_no_assignment(self):
+        self.assertEqual(app_groups.declared_by_bundle("App.xcodeproj", [{"bundle_id": "App"}]), {})
+        app_groups.validate_requirements({"App": {app_groups.ENTITLEMENT}}, {"App": set()})
+
+    def test_key_only_legacy_requirement_is_refused(self):
+        with self.assertRaisesRegex(SystemExit, "declared identifier values"):
+            app_groups.validate_requirements({"App": {app_groups.ENTITLEMENT}}, {})
+
+    def test_malformed_or_wildcard_profile_does_not_grant_group(self):
+        required = {"group.example.shared"}
+        for value in [None, "group.example.shared", ["group.*"], [1], ["group.example.other"]]:
+            with self.subTest(value=value):
+                self.assertEqual(app_groups.missing({app_groups.ENTITLEMENT: value}, required), required)
+
+    def test_prepare_signing_forwards_values_to_profile_provisioning(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / "App.entitlements").write_bytes(plistlib.dumps({
+                app_groups.ENTITLEMENT: ["group.example.shared"],
+            }))
+            targets = [{"name": "App", "bundle_id": "App", "config_ids": ["R"],
+                        "entitlements": "App.entitlements"}]
+            env = {"RUNNER_TEMP": directory, "PROJECT": str(root / "App.xcodeproj"),
+                   "ASC_KEY_ID": "K", "ASC_ISSUER_ID": "I", "ASC_KEY_PATH": "unused"}
+            with mock.patch.dict(prepare_signing.os.environ, env, clear=True), \
+                    mock.patch.object(prepare_signing, "make_jwt", return_value="test"), \
+                    mock.patch.object(prepare_signing, "discover_signable_targets", return_value=targets), \
+                    mock.patch.object(prepare_signing, "_load_or_create_cert", return_value=("C", b"p12", "", True)), \
+                    mock.patch.object(
+                        prepare_signing, "provision_all_bundles", return_value=([], "TEAM")) as provision, \
+                    mock.patch.object(prepare_signing, "patch_project_signing"), \
+                    mock.patch.object(prepare_signing, "setup_keychain"):
+                prepare_signing.main()
+            self.assertEqual(provision.call_args.kwargs["app_groups_by_bundle"], {
+                "App": {"group.example.shared"},
+            })
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/test_profile_app_groups.py

@@ -0,0 +1,103 @@
+"""A stale/misconfigured group profile cannot be installed or cached as usable."""
+import json
+import tempfile
+import unittest
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from unittest import mock
+
+import app_groups
+import profile_manager
+
+
+class GroupProfileTest(unittest.TestCase):
+    def test_cached_profile_requires_exact_group_values(self):
+        required = {"group.example.shared"}
+        cached = mock.MagicMock(uuid="UUID", name="CI-App", filename="UUID.mobileprovision")
+        cached.expiration = datetime.now(timezone.utc) + timedelta(days=100)
+        for granted, reusable in [([], False), (["group.example.other"], False),
+                                  (["group.example.shared", "group.example.extra"], True)]:
+            with self.subTest(granted=granted), tempfile.TemporaryDirectory() as directory:
+                with mock.patch.object(profile_manager.creds_store, "find_reusable_profile", return_value=cached), \
+                        mock.patch.object(profile_manager.creds_store, "profile_path") as path, \
+                        mock.patch.object(profile_manager, "decode_profile_plist", return_value={
+                            "Entitlements": {app_groups.ENTITLEMENT: granted},
+                        }), \
+                        mock.patch.object(
+                            profile_manager, "install_profile", return_value=("UUID", "T", None)) as install:
+                    path.return_value.read_bytes.return_value = b"profile"
+                    result = profile_manager._try_reuse_cached(
+                        "App", "CI-App", "C", Path(directory), {}, {app_groups.ENTITLEMENT}, required,
+                    )
+                self.assertEqual(result is not None, reusable)
+                self.assertEqual(install.called, reusable)
+
+    def test_fresh_profile_missing_group_is_rejected_before_install_or_cache(self):
+        with tempfile.TemporaryDirectory() as directory:
+            with mock.patch.object(profile_manager, "ensure_bundle_id", return_value="B"), \
+                    mock.patch.object(profile_manager.capabilities, "reconcile", return_value=False), \
+                    mock.patch.object(profile_manager, "delete_profile_by_name"), \
+                    mock.patch.object(profile_manager, "create_profile", return_value=b"profile"), \
+                    mock.patch.object(app_groups, "decode_profile_plist", return_value={"Entitlements": {}}), \
+                    mock.patch.object(profile_manager, "install_profile") as install, \
+                    mock.patch.object(profile_manager.creds_store, "write_cached_profile") as write:
+                with self.assertRaises(SystemExit) as caught:
+                    profile_manager._provision_bundle(
+                        "test", "App", "C", Path(directory), {}, False,
+                        {app_groups.ENTITLEMENT}, {"group.example.shared"},
+                    )
+            install.assert_not_called()
+            write.assert_not_called()
+            receipt = json.loads(str(caught.exception).split("::", 2)[2])
+            self.assertEqual(receipt["bundle_id"], "App")
+            self.assertEqual(receipt["missing_group_identifiers"], ["group.example.shared"])
+
+    def test_fresh_matching_profile_is_accepted(self):
+        with mock.patch.object(app_groups, "decode_profile_plist", return_value={
+            "Entitlements": {app_groups.ENTITLEMENT: ["group.example.shared"]},
+        }):
+            app_groups.assert_profile(b"profile", {"group.example.shared"}, "App", Path("unused"))
+
+    def test_each_bundle_is_checked_against_its_own_group_requirements(self):
+        expires = datetime.now(timezone.utc) + timedelta(days=100)
+        with tempfile.TemporaryDirectory() as directory:
+            with mock.patch.object(profile_manager, "ensure_bundle_id", side_effect=["A", "B"]), \
+                    mock.patch.object(profile_manager.capabilities, "reconcile", return_value=False), \
+                    mock.patch.object(profile_manager, "delete_profile_by_name"), \
+                    mock.patch.object(profile_manager, "create_profile", return_value=b"profile"), \
+                    mock.patch.object(app_groups, "decode_profile_plist", return_value={
+                        "Entitlements": {app_groups.ENTITLEMENT: ["group.example.parent"]},
+                    }), \
+                    mock.patch.object(profile_manager, "_assert_carplay_entitlements"), \
+                    mock.patch.object(
+                        profile_manager, "install_profile", return_value=("U", "T", expires)) as install, \
+                    mock.patch.object(profile_manager.creds_store, "write_cached_profile"), \
+                    mock.patch.object(profile_manager.creds_store, "write_profile_manifest") as manifest:
+                with self.assertRaises(SystemExit) as caught:
+                    profile_manager.provision_all_bundles(
+                        "test", ["App", "Broadcast"], "C", creds_dir=Path(directory), cache_hit=False,
+                        entitlements_by_bundle={bid: {app_groups.ENTITLEMENT} for bid in ["App", "Broadcast"]},
+                        app_groups_by_bundle={
+                            "App": {"group.example.parent"}, "Broadcast": {"group.example.broadcast"},
+                        },
+                    )
+            receipt = json.loads(str(caught.exception).split("::", 2)[2])
+            self.assertEqual(receipt["bundle_id"], "Broadcast")
+            self.assertEqual(receipt["missing_group_identifiers"], ["group.example.broadcast"])
+            self.assertEqual(install.call_count, 1)
+            manifest.assert_not_called()
+
+    def test_profile_decode_failure_is_private_and_fails_closed(self):
+        with mock.patch.object(app_groups, "decode_profile_plist", side_effect=ValueError("private raw bytes")):
+            with self.assertRaises(SystemExit) as caught:
+                app_groups.assert_profile(b"profile", {"group.example.shared"}, "App", Path("unused"))
+        self.assertNotIn("private raw bytes", str(caught.exception))
+
+    def test_no_group_declaration_keeps_existing_profile_path(self):
+        with mock.patch.object(app_groups, "decode_profile_plist") as decode:
+            app_groups.assert_profile(b"profile", set(), "App", Path("unused"))
+        decode.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.87
+1.0.88

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.87
+1.0.88

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.87",
+  "version": "1.0.88",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {