gowalk-cicd 1.0.87 → 1.0.89

package/CLAUDE.md

@@ -121,6 +121,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Tracked `creds/` files remain a backward-compatible read fallback. Refreshed signing
   files stay ephemeral and are never staged; `persist-signing-cache` is ignored.
   Version source staged before signing is preserved separately with its original index bytes.
+- App Group identifiers come from each archive target's entitlements. `app_groups.py`
+  checks exact values in cached and fresh profiles; a fresh mismatch fails before profile
+  installation with `apple_app_groups_required`. Register/assign groups through the scoped
+  Apple account console before retrying CI. Never invent an ASC group operation, infer an
+  identifier from the bundle name, or accept a wildcard/unrelated group as a matching grant.
 - Never revoke a distribution certificate automatically, including legacy caches.
   `certificate-cap-policy` accepts only `fail`; a full cap requires registry reconciliation.
   A certificate POST's HTTP 409 alone does not prove a full cap. `certificate_failure.py`
@@ -150,10 +155,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   `NO_PROXY`. The preloader snapshot under `RUNNER_TEMP` also covers official post/save after
   consumer autoupdate changes the action directory. The installer delivers this development
   tooling for native iOS repositories too; it does not require an Android app.
-- Flutter manifest GET recovery is scoped to the two pinned setup invocations through `BASH_ENV`.
-  It retains the account proxy, retries transient TLS/transport errors within 60 seconds, and emits
-  only complete JSON. Partial responses and private curl stderr never enter action outputs;
-  authentication/certificate failures remain terminal. SDK archive calls retain upstream behavior.
+- Flutter manifest/archive GET recovery is scoped to the two pinned setup invocations through `BASH_ENV`.
+  It retains the account proxy and allows four attempts within 60 seconds for manifests or 600 seconds
+  for archives. Interrupted archives resume private partial bytes with HTTP Range; an origin ignoring
+  Range permits a bounded full restart. Only complete JSON or an archive matching the selected official
+  manifest's SHA-256 enters action outputs. Authentication/certificate refusals remain terminal.
+  `flutter_download_failed` emits fixed transport codes and retained-byte counts, never curl stderr.
 - Web Release selects bundled renderer resources with `--no-web-resources-cdn` inside
   the existing proxied build command. This is not a font or integration offline guarantee;
   preserve app-authored font declarations, bootstrap configuration and other build inputs.

package/README.md

@@ -297,6 +297,7 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | `firebase_symbols_pending` | `gowalk-cicd/firebase-symbols-pending.v1` | `platform`, `app_id`, `source_sha`, `artifact`, `file`, `sha256`, `status` |
 | `source_maintenance_pending` | `gowalk-cicd/source-maintenance-pending.v1` | `repo`, `base_sha`, `head_sha`, `branch`, `run_id` |
 | `apple_build_upload_failed` (error) | `gowalk-cicd/apple-build-upload-failed.v2` | `category`, `stage`, `receipt_available`, receipt identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`, `provider_status`, `provider_code`, `provider_pointer`), `action` |
+| `flutter_download_failed` (error) | `gowalk-cicd/flutter-download-failed.v1` | `phase`, `curl_exit`, `http_status`, `proxy_status`, `attempts`, `retained_bytes` |
 
 Add a field by bumping the schema version; never change the meaning of an
 existing one.
@@ -737,10 +738,19 @@ before a capability was turned on — whether by this action or by you in the
 developer portal — would be reused indefinitely, and the archive would keep
 failing on a capability the App ID already has.
 
-Two classes of capability are **not** enabled automatically, and each gets a
+App Groups require registration and assignment to each participating App ID through
+the account's Apple Developer console. The action reads the literal identifiers from
+each archive target's entitlements and verifies their exact membership in both cached
+and fresh profiles. A stale cache regenerates; a fresh profile missing a required group
+fails before installation with `apple_app_groups_required`, schema
+`gowalk-cicd/apple-app-groups-required.v1`, containing the bundle ID and missing groups.
+Complete those assignments through the scoped console and rerun CI. This check creates
+no group or certificate and does not replace the account's capability provisioning.
+
+Two other classes of capability are **not** enabled automatically, and each gets a
 `::warning::` naming what was seen:
 
-- **Values the action cannot infer** — App Groups, iCloud containers, Apple Pay
+- **Values the action cannot infer** — iCloud containers, Apple Pay
   merchant IDs, Wallet pass types, Data Protection. Configure these on the App
   ID yourself.
 - **App Attest** — a real App ID capability in the developer portal, but absent
@@ -1060,6 +1070,9 @@ different bytes under the same number. Build numbers come from `/builds`,
 reservation is never reused; delete such a reservation only after reading it back.
 All requests and parts still use the Apple proxy.
 
-Flutter SDK setup retries interrupted manifest and archive GETs on the assigned proxy. Archive attempts remain
-bounded, expose only complete bytes to extraction, and never retry authentication or certificate refusals. Cache
-identities remain those of the pinned upstream Flutter action.
+Flutter SDK setup retries interrupted manifest and archive GETs on the assigned proxy, with four attempts
+within 60 seconds for manifests or 600 seconds for archives. Archive retries resume retained private bytes
+with HTTP Range; if the origin ignores Range, a bounded full restart is permitted. The completed archive
+must match the selected official manifest's SHA-256 before extraction. Authentication and certificate
+refusals remain terminal. Exhausted transfers emit `flutter_download_failed` with fixed status codes and
+retained-byte counts, without URLs or private curl stderr. Cache identities remain those of the pinned action.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.87
+1.0.89

package/action/scripts/app_groups.py

@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+"""Verify declared App Group identifiers against Apple's issued profiles.
+
+Registration and assignment belong to the account's Developer console. This
+module never guesses groups, posts an unsupported ASC operation or changes a
+certificate. It rejects profiles that would break an app/extension shared container.
+"""
+from __future__ import annotations
+
+import json
+import plistlib
+import re
+from pathlib import Path
+
+from profile_io import decode_profile_plist
+
+ENTITLEMENT = "com.apple.security.application-groups"
+_IDENTIFIER = re.compile(r"group\.[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*")
+
+
+def declared_by_bundle(project: str, targets: list[dict]) -> dict[str, set[str]]:
+    """Read literal group values from the selected archive target entitlements."""
+    result: dict[str, set[str]] = {}
+    for target in targets:
+        relative = target.get("entitlements")
+        if not relative:
+            continue
+        path = Path(project).parent / relative
+        try:
+            data = plistlib.loads(path.read_bytes())
+        except (OSError, ValueError, plistlib.InvalidFileException):
+            raise SystemExit("::error::Cannot verify App Groups: target entitlements are unreadable") from None
+        if not isinstance(data, dict):
+            raise SystemExit("::error::Cannot verify App Groups: target entitlements must be a dictionary")
+        if ENTITLEMENT not in data:
+            continue
+        values = data[ENTITLEMENT]
+        if not isinstance(values, list) or any(
+            not isinstance(value, str) or not _IDENTIFIER.fullmatch(value) for value in values
+        ):
+            raise SystemExit("::error::App Groups must contain literal group identifiers, without build variables")
+        result.setdefault(target["bundle_id"], set()).update(values)
+    return result
+
+
+def missing(profile_entitlements: dict, required: set[str]) -> set[str]:
+    """An unrelated group, malformed value or wildcard never grants a required group."""
+    if not isinstance(profile_entitlements, dict):
+        return set(required)
+    granted = profile_entitlements.get(ENTITLEMENT)
+    if not isinstance(granted, list) or any(not isinstance(value, str) for value in granted):
+        return set(required)
+    return required - set(granted)
+
+
+def validate_requirements(keys_by_bundle: dict, groups_by_bundle: dict) -> None:
+    """Refuse legacy key-only inputs rather than silently ignoring group values."""
+    for bundle, keys in keys_by_bundle.items():
+        if ENTITLEMENT in keys and bundle not in groups_by_bundle:
+            raise SystemExit("::error::App Group profile verification requires declared identifier values")
+
+
+def assert_profile(profile_der: bytes, required: set[str], bundle: str, scratch: Path) -> None:
+    """A fresh profile must contain every declared group before installation."""
+    if not required:
+        return
+    try:
+        profile = decode_profile_plist(profile_der, scratch)
+    except Exception:
+        raise SystemExit("::error::Cannot verify App Groups in the issued profile") from None
+    if not isinstance(profile, dict):
+        raise SystemExit("::error::Cannot verify App Groups in the issued profile")
+    absent = missing(profile.get("Entitlements") or {}, required)
+    if not absent:
+        return
+    receipt = {
+        "schema": "gowalk-cicd/apple-app-groups-required.v1",
+        "bundle_id": bundle,
+        "missing_group_identifiers": sorted(absent),
+        "recovery": "Assign the declared groups to this App ID through the account console, then rerun CI",
+    }
+    raise SystemExit("::error title=apple_app_groups_required::" + json.dumps(receipt, separators=(",", ":")))

package/action/scripts/capabilities.py

@@ -114,7 +114,8 @@ MANUAL_ENTITLEMENTS = {
 # but nothing about which capabilities the profile was issued with, so a
 # profile minted before a capability was added stays "valid" forever.
 #
-# Deliberately excludes the settings-bearing capabilities (App Groups, iCloud,
+# App Groups are checked by exact identifier values in app_groups.py.
+# Deliberately excludes the other settings-bearing capabilities (iCloud,
 # Apple Pay, Wallet, Data Protection): those need App ID configuration this
 # action does not perform, so treating them as missing would regenerate the
 # profile on every single run without ever fixing anything.
@@ -178,6 +179,9 @@ def required_capabilities(entitlement_keys: set[str]) -> set[str]:
 
 def warn_about_manual_entitlements(entitlement_keys: set[str], bundle_id: str) -> None:
     for key in sorted(entitlement_keys & set(MANUAL_ENTITLEMENTS)):
+        if key == "com.apple.security.application-groups":
+            print(f"App Groups for {bundle_id}: issued profiles must cover every declared group identifier")
+            continue
         print(
             f"::warning::{bundle_id} declares {key}, which needs "
             f"{MANUAL_ENTITLEMENTS[key]} configured on the App ID with values "

package/action/scripts/prepare_signing.py

@@ -39,6 +39,7 @@ import os
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
+import app_groups
 import capabilities
 import cert_factory
 import creds_store
@@ -230,12 +231,14 @@ def main() -> None:
             f"({len(t['config_ids'])} configs)"
         )
 
+    groups_by_bundle = app_groups.declared_by_bundle(project, targets)
     cert_id, p12_bytes, p12_pass, cache_hit = _load_or_create_cert(
         token, creds_dir
     )
     mappings, effective_team = provision_all_bundles(
         token, bundle_ids, cert_id, creds_dir=creds_dir, cache_hit=cache_hit,
         entitlements_by_bundle=_entitlement_keys_by_bundle(project, targets),
+        app_groups_by_bundle=groups_by_bundle,
     )
     print("Profile map:")
     for bid, pname, uuid in mappings:

package/action/scripts/profile_manager.py

@@ -43,6 +43,7 @@ import subprocess
 from datetime import datetime
 from pathlib import Path
 
+import app_groups
 import capabilities
 import creds_store
 from asc_common import get_json, request
@@ -97,10 +98,6 @@ def _register_bundle_id(token: str, identifier: str) -> str:
 # Profile lifecycle                                                           #
 # --------------------------------------------------------------------------- #
 
-def profile_name_for(bundle_id: str) -> str:
-    return f"{PROFILE_PREFIX}{bundle_id}"
-
-
 def delete_profile_by_name(token: str, name: str) -> None:
     """Delete every existing profile with the given name (paginated scan)."""
     deleted_any = False
@@ -182,29 +179,26 @@ def _try_reuse_cached(
     creds_dir: Path,
     manifest: dict,
     entitlement_keys: set[str] | None = None,
+    required_groups: set[str] | None = None,
 ) -> tuple[str, str, dict] | None:
     """Return ``(uuid, team, entry)`` if a cached profile reinstalls cleanly.
 
-    A corrupt .mobileprovision (truncated, manually edited, ``security
-    cms`` decode failure) must NEVER abort the build — log and return
-    ``None`` so the caller falls through to the fresh-create path.
-
-    The profile is also checked against the app's entitlements. The manifest
-    records a UUID and an expiry but nothing about the capabilities the
-    profile carries, so one issued before a capability was enabled — by this
-    action or by a human in the developer portal — would otherwise be reused
-    forever, failing the archive on a capability the App ID now has.
+    Decode failure or missing entitlement keys/group values falls through to
+    fresh creation. The cache manifest's UUID and expiry alone cannot prove
+    that a profile reflects the App ID's current capability assignments.
     """
     cached = creds_store.find_reusable_profile(manifest, bid, cert_id, creds_dir)
     if cached is None:
         return None
     try:
         der = creds_store.profile_path(creds_dir, cached.uuid).read_bytes()
-        if entitlement_keys:
+        if entitlement_keys or required_groups:
             plist = decode_profile_plist(der, _PROFILE_DIRS[0])
             missing = capabilities.missing_profile_entitlements(
-                plist.get("Entitlements") or {}, entitlement_keys
+                plist.get("Entitlements") or {}, entitlement_keys or set()
             )
+            if app_groups.missing(plist.get("Entitlements") or {}, required_groups or set()):
+                missing.add(app_groups.ENTITLEMENT)
             if missing:
                 print(
                     f"cached profile {cached.uuid} predates "
@@ -218,8 +212,7 @@ def _try_reuse_cached(
             f"({exc!r}); regenerating"
         )
         return None
-    # cached.expiration is already UTC-aware (load_profile_manifest routes
-    # it through _parse_iso); no astimezone needed.
+    # load_profile_manifest already normalizes cached.expiration to UTC.
     entry = {
         "bundle_id": bid,
         "name": cached.name or name,
@@ -239,9 +232,10 @@ def _provision_bundle(
     manifest: dict,
     can_reuse: bool,
     entitlement_keys: set[str] | None = None,
+    required_groups: set[str] | None = None,
 ) -> tuple[str, str, str, dict]:
     """Provision one bundle; return ``(name, uuid, team, manifest_entry)``."""
-    name = profile_name_for(bid)
+    name = f"{PROFILE_PREFIX}{bid}"
     # Reconcile capabilities BEFORE deciding to reuse. A profile carries only
     # the capabilities its App ID had when it was issued, so a cached profile
     # that predates an entitlement being added stays broken forever otherwise
@@ -253,7 +247,7 @@ def _provision_bundle(
             can_reuse = False
     if can_reuse:
         reused = _try_reuse_cached(
-            bid, name, cert_id, creds_dir, manifest, entitlement_keys
+            bid, name, cert_id, creds_dir, manifest, entitlement_keys, required_groups
         )
         if reused is not None:
             uuid, team_id, entry = reused
@@ -262,6 +256,7 @@ def _provision_bundle(
     bundle_pk = bundle_pk or ensure_bundle_id(token, bid)
     delete_profile_by_name(token, name)
     profile_der = create_profile(token, name, bundle_pk, cert_id)
+    app_groups.assert_profile(profile_der, required_groups or set(), bid, _PROFILE_DIRS[0])
     if entitlement_keys:
         _assert_carplay_entitlements(profile_der, entitlement_keys, bid, name)
     uuid, team_id, expiration = install_profile(profile_der)
@@ -332,20 +327,21 @@ def provision_all_bundles(
     creds_dir: Path,
     cache_hit: bool,
     entitlements_by_bundle: dict[str, set[str]] | None = None,
+    app_groups_by_bundle: dict[str, set[str]] | None = None,
 ) -> tuple[list[tuple[str, str, str]], str]:
     """Create + install a CI profile for each bundle id, with caching.
 
-    Returns ``(mappings, team_id)`` where mappings is a list of
-    ``(bundle_id, profile_name, uuid)`` tuples and ``team_id`` is the
-    team Apple assigned to the profiles (shared — the ASC API key binds
-    every profile it issues to a single team).
-
+    Returns ``(mappings, team_id)`` with ``(bundle_id, profile_name, uuid)``
+    tuples and the team Apple assigned to the profiles.
     ``cache_hit`` says whether the cert came from cache. ``creds_dir``
     is the workspace ``creds/`` root. When the manifest's cert_id
     differs from ``cert_id`` we force a full regen — Apple invalidates
     every profile bound to the prior cert the moment that cert is
     revoked, so reusing on-disk profiles would archive unsigned bits.
     """
+    entitlements_by_bundle = entitlements_by_bundle or {}
+    app_groups_by_bundle = app_groups_by_bundle or {}
+    app_groups.validate_requirements(entitlements_by_bundle, app_groups_by_bundle)
     manifest = creds_store.load_profile_manifest(creds_dir)
     can_reuse = cache_hit and manifest.get("cert_id") == cert_id
     if cache_hit and not can_reuse:
@@ -357,11 +353,11 @@ def provision_all_bundles(
     results: list[tuple[str, str, str]] = []
     new_entries: list[dict] = []
     effective_team = ""
-    entitlements_by_bundle = entitlements_by_bundle or {}
     for bid in bundle_ids:
         name, uuid, team_id, entry = _provision_bundle(
             token, bid, cert_id, creds_dir, manifest, can_reuse,
             entitlements_by_bundle.get(bid),
+            app_groups_by_bundle.get(bid),
         )
         if team_id:
             effective_team = team_id

package/action/scripts/test_app_group_requirements.py

@@ -0,0 +1,83 @@
+"""Archive target declarations retain actual App Group values without guessing."""
+import plistlib
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+import app_groups
+import prepare_signing
+
+
+class GroupRequirementsTest(unittest.TestCase):
+    def test_parent_and_extension_receive_their_declared_groups(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            targets = []
+            for name, groups in [("App", ["group.example.shared", "group.example.app"]),
+                                 ("Broadcast", ["group.example.shared"])]:
+                filename = name + ".entitlements"
+                (root / filename).write_bytes(plistlib.dumps({app_groups.ENTITLEMENT: groups}))
+                targets.append({"name": name, "bundle_id": name, "entitlements": filename})
+            self.assertEqual(app_groups.declared_by_bundle(str(root / "App.xcodeproj"), targets), {
+                "App": {"group.example.shared", "group.example.app"}, "Broadcast": {"group.example.shared"},
+            })
+
+    def test_unresolved_or_malformed_values_fail_before_signing(self):
+        values = ["group.example", ["$(GROUP_ID)"], ["group.example.*"], [1], ["group..example"]]
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            targets = [{"bundle_id": "App", "entitlements": "App.entitlements"}]
+            for value in values:
+                with self.subTest(value=value):
+                    (root / "App.entitlements").write_bytes(plistlib.dumps({app_groups.ENTITLEMENT: value}))
+                    with self.assertRaisesRegex(SystemExit, "literal group identifiers"):
+                        app_groups.declared_by_bundle(str(root / "App.xcodeproj"), targets)
+
+    def test_unreadable_declaration_is_not_an_empty_requirement(self):
+        with tempfile.TemporaryDirectory() as directory:
+            with self.assertRaisesRegex(SystemExit, "unreadable"):
+                app_groups.declared_by_bundle(str(Path(directory) / "App.xcodeproj"), [
+                    {"bundle_id": "App", "entitlements": "missing.entitlements"},
+                ])
+
+    def test_unrelated_targets_and_empty_groups_need_no_assignment(self):
+        self.assertEqual(app_groups.declared_by_bundle("App.xcodeproj", [{"bundle_id": "App"}]), {})
+        app_groups.validate_requirements({"App": {app_groups.ENTITLEMENT}}, {"App": set()})
+
+    def test_key_only_legacy_requirement_is_refused(self):
+        with self.assertRaisesRegex(SystemExit, "declared identifier values"):
+            app_groups.validate_requirements({"App": {app_groups.ENTITLEMENT}}, {})
+
+    def test_malformed_or_wildcard_profile_does_not_grant_group(self):
+        required = {"group.example.shared"}
+        for value in [None, "group.example.shared", ["group.*"], [1], ["group.example.other"]]:
+            with self.subTest(value=value):
+                self.assertEqual(app_groups.missing({app_groups.ENTITLEMENT: value}, required), required)
+
+    def test_prepare_signing_forwards_values_to_profile_provisioning(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / "App.entitlements").write_bytes(plistlib.dumps({
+                app_groups.ENTITLEMENT: ["group.example.shared"],
+            }))
+            targets = [{"name": "App", "bundle_id": "App", "config_ids": ["R"],
+                        "entitlements": "App.entitlements"}]
+            env = {"RUNNER_TEMP": directory, "PROJECT": str(root / "App.xcodeproj"),
+                   "ASC_KEY_ID": "K", "ASC_ISSUER_ID": "I", "ASC_KEY_PATH": "unused"}
+            with mock.patch.dict(prepare_signing.os.environ, env, clear=True), \
+                    mock.patch.object(prepare_signing, "make_jwt", return_value="test"), \
+                    mock.patch.object(prepare_signing, "discover_signable_targets", return_value=targets), \
+                    mock.patch.object(prepare_signing, "_load_or_create_cert", return_value=("C", b"p12", "", True)), \
+                    mock.patch.object(
+                        prepare_signing, "provision_all_bundles", return_value=([], "TEAM")) as provision, \
+                    mock.patch.object(prepare_signing, "patch_project_signing"), \
+                    mock.patch.object(prepare_signing, "setup_keychain"):
+                prepare_signing.main()
+            self.assertEqual(provision.call_args.kwargs["app_groups_by_bundle"], {
+                "App": {"group.example.shared"},
+            })
+
+
+if __name__ == "__main__":
+    unittest.main()

package/action/scripts/test_profile_app_groups.py

@@ -0,0 +1,103 @@
+"""A stale/misconfigured group profile cannot be installed or cached as usable."""
+import json
+import tempfile
+import unittest
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from unittest import mock
+
+import app_groups
+import profile_manager
+
+
+class GroupProfileTest(unittest.TestCase):
+    def test_cached_profile_requires_exact_group_values(self):
+        required = {"group.example.shared"}
+        cached = mock.MagicMock(uuid="UUID", name="CI-App", filename="UUID.mobileprovision")
+        cached.expiration = datetime.now(timezone.utc) + timedelta(days=100)
+        for granted, reusable in [([], False), (["group.example.other"], False),
+                                  (["group.example.shared", "group.example.extra"], True)]:
+            with self.subTest(granted=granted), tempfile.TemporaryDirectory() as directory:
+                with mock.patch.object(profile_manager.creds_store, "find_reusable_profile", return_value=cached), \
+                        mock.patch.object(profile_manager.creds_store, "profile_path") as path, \
+                        mock.patch.object(profile_manager, "decode_profile_plist", return_value={
+                            "Entitlements": {app_groups.ENTITLEMENT: granted},
+                        }), \
+                        mock.patch.object(
+                            profile_manager, "install_profile", return_value=("UUID", "T", None)) as install:
+                    path.return_value.read_bytes.return_value = b"profile"
+                    result = profile_manager._try_reuse_cached(
+                        "App", "CI-App", "C", Path(directory), {}, {app_groups.ENTITLEMENT}, required,
+                    )
+                self.assertEqual(result is not None, reusable)
+                self.assertEqual(install.called, reusable)
+
+    def test_fresh_profile_missing_group_is_rejected_before_install_or_cache(self):
+        with tempfile.TemporaryDirectory() as directory:
+            with mock.patch.object(profile_manager, "ensure_bundle_id", return_value="B"), \
+                    mock.patch.object(profile_manager.capabilities, "reconcile", return_value=False), \
+                    mock.patch.object(profile_manager, "delete_profile_by_name"), \
+                    mock.patch.object(profile_manager, "create_profile", return_value=b"profile"), \
+                    mock.patch.object(app_groups, "decode_profile_plist", return_value={"Entitlements": {}}), \
+                    mock.patch.object(profile_manager, "install_profile") as install, \
+                    mock.patch.object(profile_manager.creds_store, "write_cached_profile") as write:
+                with self.assertRaises(SystemExit) as caught:
+                    profile_manager._provision_bundle(
+                        "test", "App", "C", Path(directory), {}, False,
+                        {app_groups.ENTITLEMENT}, {"group.example.shared"},
+                    )
+            install.assert_not_called()
+            write.assert_not_called()
+            receipt = json.loads(str(caught.exception).split("::", 2)[2])
+            self.assertEqual(receipt["bundle_id"], "App")
+            self.assertEqual(receipt["missing_group_identifiers"], ["group.example.shared"])
+
+    def test_fresh_matching_profile_is_accepted(self):
+        with mock.patch.object(app_groups, "decode_profile_plist", return_value={
+            "Entitlements": {app_groups.ENTITLEMENT: ["group.example.shared"]},
+        }):
+            app_groups.assert_profile(b"profile", {"group.example.shared"}, "App", Path("unused"))
+
+    def test_each_bundle_is_checked_against_its_own_group_requirements(self):
+        expires = datetime.now(timezone.utc) + timedelta(days=100)
+        with tempfile.TemporaryDirectory() as directory:
+            with mock.patch.object(profile_manager, "ensure_bundle_id", side_effect=["A", "B"]), \
+                    mock.patch.object(profile_manager.capabilities, "reconcile", return_value=False), \
+                    mock.patch.object(profile_manager, "delete_profile_by_name"), \
+                    mock.patch.object(profile_manager, "create_profile", return_value=b"profile"), \
+                    mock.patch.object(app_groups, "decode_profile_plist", return_value={
+                        "Entitlements": {app_groups.ENTITLEMENT: ["group.example.parent"]},
+                    }), \
+                    mock.patch.object(profile_manager, "_assert_carplay_entitlements"), \
+                    mock.patch.object(
+                        profile_manager, "install_profile", return_value=("U", "T", expires)) as install, \
+                    mock.patch.object(profile_manager.creds_store, "write_cached_profile"), \
+                    mock.patch.object(profile_manager.creds_store, "write_profile_manifest") as manifest:
+                with self.assertRaises(SystemExit) as caught:
+                    profile_manager.provision_all_bundles(
+                        "test", ["App", "Broadcast"], "C", creds_dir=Path(directory), cache_hit=False,
+                        entitlements_by_bundle={bid: {app_groups.ENTITLEMENT} for bid in ["App", "Broadcast"]},
+                        app_groups_by_bundle={
+                            "App": {"group.example.parent"}, "Broadcast": {"group.example.broadcast"},
+                        },
+                    )
+            receipt = json.loads(str(caught.exception).split("::", 2)[2])
+            self.assertEqual(receipt["bundle_id"], "Broadcast")
+            self.assertEqual(receipt["missing_group_identifiers"], ["group.example.broadcast"])
+            self.assertEqual(install.call_count, 1)
+            manifest.assert_not_called()
+
+    def test_profile_decode_failure_is_private_and_fails_closed(self):
+        with mock.patch.object(app_groups, "decode_profile_plist", side_effect=ValueError("private raw bytes")):
+            with self.assertRaises(SystemExit) as caught:
+                app_groups.assert_profile(b"profile", {"group.example.shared"}, "App", Path("unused"))
+        self.assertNotIn("private raw bytes", str(caught.exception))
+
+    def test_no_group_declaration_keeps_existing_profile_path(self):
+        with mock.patch.object(app_groups, "decode_profile_plist") as decode:
+            app_groups.assert_profile(b"profile", set(), "App", Path("unused"))
+        decode.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.87
+1.0.89

package/android-action/scripts/flutter_download.py

@@ -0,0 +1,60 @@
+"""Private Flutter transfers publish only complete JSON or an archive matching the manifest digest."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+
+MAX_ARCHIVE_BYTES = 2147483648
+
+
+def archive_digest() -> str:
+    value = os.environ.get("GOWALK_FLUTTER_ARCHIVE_SHA256", "")
+    if not re.fullmatch(r"[a-fA-F0-9]{64}", value):
+        raise ValueError("flutter_archive_digest_required")
+    return value.lower()
+
+
+def transfer(url: str, destination: Path, kind: str, remaining: float, env: dict) -> tuple[int, int, int]:
+    resume = kind == "archive" and destination.stat().st_size > 0
+    command = ["curl", "--disable", "--silent", "--show-error", "--fail", "--retry", "0",
+               "--connect-timeout", "15", "--max-time", str(min(20 if kind == "manifest" else 300, remaining)),
+               "--max-filesize", str(16777216 if kind == "manifest" else MAX_ARCHIVE_BYTES),
+               "--output", str(destination), "--write-out", "%{http_code} %{http_connect}"]
+    if resume:
+        command += ["--continue-at", "-"]
+    try:
+        result = subprocess.run([*command, url], capture_output=True, timeout=remaining, env=env)
+        status = result.stdout.split()
+        http, proxy = (map(int, status) if len(status) == 2 and all(part.isdigit() for part in status) else (0, 0))
+        return result.returncode, http, proxy
+    except subprocess.TimeoutExpired:
+        return 28, 0, 0
+
+
+def publish(destination: Path, kind: str) -> None:
+    if kind == "manifest":
+        json.loads(destination.read_bytes())
+    else:
+        if destination.stat().st_size > MAX_ARCHIVE_BYTES:
+            raise ValueError("flutter_archive_size_exceeded")
+        digest = hashlib.sha256()
+        with destination.open("rb") as source:
+            for chunk in iter(lambda: source.read(1024 * 1024), b""):
+                digest.update(chunk)
+        if digest.hexdigest() != archive_digest():
+            raise ValueError("flutter_archive_checksum_mismatch")
+    with destination.open("rb") as source:
+        shutil.copyfileobj(source, sys.stdout.buffer, length=1024 * 1024)
+
+
+def failure(kind: str, code: int, http: int, proxy: int, attempts: int, retained: int) -> None:
+    print(f"flutter_{kind}_transport_failed curl_exit={code} http_status={http} "
+          f"proxy_status={proxy} attempts={attempts} retained_bytes={retained}", file=sys.stderr)
+    note = {"schema": "gowalk-cicd/flutter-download-failed.v1", "phase": kind,
+            "curl_exit": code, "http_status": http, "proxy_status": proxy,
+            "attempts": attempts, "retained_bytes": retained}
+    print("::error title=flutter_download_failed::" + json.dumps(note, separators=(",", ":")), file=sys.stderr)

package/android-action/scripts/flutter_manifest.py

@@ -1,17 +1,16 @@
 """Retry the official Flutter manifest and SDK archive GETs without exposing partial JSON or proxy secrets."""
 from __future__ import annotations
 
-import json
 import os
 from pathlib import Path
 import re
-import shutil
-import subprocess
 import sys
 import tempfile
 import time
 from urllib.parse import urlsplit
 
+import flutter_download
+
 RETRY_CODES = {5, 6, 7, 18, 28, 35, 52, 55, 56, 92, 95}
 RETRY_HTTP = {408, 429, 500, 502, 503, 504}
 
@@ -20,42 +19,36 @@ def download(arguments: list[str], directory: Path) -> int:
     kind = request_kind(arguments)
     if not (os.environ.get("HTTPS_PROXY") or os.environ.get("https_proxy")):
         raise ValueError("flutter_download_proxy_required")
+    if kind == "archive":
+        flutter_download.archive_digest()
     child_env = {**os.environ, "NO_PROXY": "", "no_proxy": ""}
     deadline, code, http, proxy_http = time.monotonic() + (60 if kind == "manifest" else 600), 1, 0, 0
+    destination = directory / "download"
+    destination.touch(mode=0o600, exist_ok=False)
+    destination.chmod(0o600)
+    attempted = 0
     for attempt in range(1, 5):
         remaining = deadline - time.monotonic()
         if remaining <= 0:
             break
-        destination = directory / f"download-{attempt}"
-        destination.touch(mode=0o600, exist_ok=False)
-        destination.chmod(0o600)
-        try:
-            result = subprocess.run([
-                "curl", "--disable", "--silent", "--show-error", "--fail", "--retry", "0",
-                "--connect-timeout", "15", "--max-time", str(min(20 if kind == "manifest" else 300, remaining)),
-                "--max-filesize", str(16777216 if kind == "manifest" else 2147483648), "--output", str(destination),
-                "--write-out", "%{http_code} %{http_connect}", arguments[-1],
-            ], capture_output=True, timeout=remaining, env=child_env)
-            code = result.returncode
-            status = result.stdout.split()
-            http, proxy_http = (map(int, status) if len(status) == 2 and all(part.isdigit() for part in status)
-                                else (0, 0))
-        except subprocess.TimeoutExpired:
-            code, http, proxy_http = 28, 0, 0
-        if code == 0 and http == 200:
-            if kind == "manifest":
-                json.loads(destination.read_bytes())
-            with destination.open("rb") as source:
-                shutil.copyfileobj(source, sys.stdout.buffer, length=1024 * 1024)
+        attempted = attempt
+        code, http, proxy_http = flutter_download.transfer(arguments[-1], destination, kind, remaining, child_env)
+        if code == 0 and http in ({200, 206} if kind == "archive" else {200}):
+            flutter_download.publish(destination, kind)
             if attempt > 1:
                 print(f"flutter_{kind}_recovered attempts={attempt}", file=sys.stderr)
             return 0
-        destination.unlink(missing_ok=True)
-        if attempt == 4 or proxy_http in {401, 403, 407} or (code not in RETRY_CODES and http not in RETRY_HTTP):
+        if attempt == 4 or proxy_http in {401, 403, 407} or http in {401, 403}:
+            break
+        restart = kind == "archive" and code == 33 and http == 200
+        if not restart and code not in RETRY_CODES and http not in RETRY_HTTP:
             break
+        if kind == "manifest" or restart:
+            destination.write_bytes(b"")
+        if destination.stat().st_size > flutter_download.MAX_ARCHIVE_BYTES:
+            raise ValueError("flutter_archive_size_exceeded")
         time.sleep(min(2 ** (attempt - 1), max(0, deadline - time.monotonic())))
-    print(f"flutter_{kind}_transport_failed curl_exit={code} http_status={http} "
-          f"proxy_status={proxy_http} attempts={attempt}", file=sys.stderr)
+    flutter_download.failure(kind, code, http, proxy_http, attempted, destination.stat().st_size)
     return code or 1
 
 
@@ -79,8 +72,10 @@ def main() -> int:
     try:
         with tempfile.TemporaryDirectory(prefix="flutter-manifest-", dir=os.environ["RUNNER_TEMP"]) as scratch:
             return download(sys.argv[1:], Path(scratch))
-    except (ValueError, OSError, KeyError):
-        print("flutter_manifest_invalid_request_or_response", file=sys.stderr)
+    except (ValueError, OSError, KeyError) as error:
+        safe = {"flutter_archive_digest_required", "flutter_archive_size_exceeded", "flutter_archive_checksum_mismatch"}
+        reason = str(error) if str(error) in safe else "flutter_manifest_invalid_request_or_response"
+        print("::error::" + reason, file=sys.stderr)
         return 1
 
 

package/android-action/scripts/flutter_manifest_env.sh

@@ -1,10 +1,14 @@
 # Loaded only by the two pinned Flutter setup invocations, never the whole job.
 curl() {
   case "${!#}" in
-    */flutter_infra_release/releases/releases_*.json|*/flutter_infra_release/releases/*.tar.xz|\
-    */flutter_infra_release/releases/*.tar.gz|*/flutter_infra_release/releases/*.zip)
+    */flutter_infra_release/releases/releases_*.json)
       python3 "${GOWALK_FLUTTER_MANIFEST_HELPER:?}" "$@"
       ;;
+    */flutter_infra_release/releases/*.tar.xz|*/flutter_infra_release/releases/*.tar.gz|\
+    */flutter_infra_release/releases/*.zip)
+      GOWALK_FLUTTER_ARCHIVE_SHA256="$(printf '%s' "${VERSION_MANIFEST:-}" | jq -er '.sha256')" \
+        python3 "${GOWALK_FLUTTER_MANIFEST_HELPER:?}" "$@"
+      ;;
     *) command curl "$@" ;;
   esac
 }

package/android-action/scripts/flutter_manifest_fixture.py

@@ -30,6 +30,25 @@ def official_setup() -> bytes:
     return source
 
 
+def response(server, mode, headers, path):
+    requested = headers.get(b"range", b"").decode()
+    server.ranges.append(requested)
+    complete = server.body[path] if isinstance(server.body, dict) else server.body
+    extra = b""
+    status = b"401 Unauthorized" if mode == "origin_auth" else b"200 OK"
+    if mode.startswith("range"):
+        if not requested.startswith("bytes=") or not requested.endswith("-"):
+            return b"HTTP/1.1 416 Range Not Satisfiable\r\nContent-Length: 0\r\n\r\n"
+        start = int(requested[6:-1])
+        extra = f"Content-Range: bytes {start}-{len(complete) - 1}/{len(complete)}\r\n".encode()
+        complete, status = complete[start:], b"206 Partial Content"
+    body = complete[:31] if mode in {"partial", "range_partial"} else complete
+    if mode == "range_corrupt":
+        body = bytes([body[0] ^ 1]) + body[1:]
+    return (b"HTTP/1.1 " + status + b"\r\n" + extra + b"Content-Length: "
+            + str(len(complete)).encode() + b"\r\nConnection: close\r\n\r\n" + body)
+
+
 class Proxy(socketserver.StreamRequestHandler):
     def handle(self):
         first = self.rfile.readline(4096).split()
@@ -53,20 +72,18 @@ class Proxy(socketserver.StreamRequestHandler):
                 stream.settimeout(3)
                 with stream.makefile("rb") as reader:
                     request = reader.readline(4096).split()
-                    while reader.readline(4096) not in (b"\r\n", b"\n", b""):
-                        pass
+                    headers = {}
+                    while (line := reader.readline(4096)) not in (b"\r\n", b"\n", b""):
+                        name, _, value = line.partition(b":")
+                        headers[name.lower()] = value.strip()
                     self.server.requests.append(request[1].decode())
-                    status = b"401 Unauthorized" if mode == "origin_auth" else b"200 OK"
-                    complete = self.server.body
-                    body = complete[:31] if mode == "partial" else complete
-                    stream.sendall(b"HTTP/1.1 " + status + b"\r\nContent-Length: "
-                                   + str(len(complete)).encode() + b"\r\nConnection: close\r\n\r\n" + body)
+                    stream.sendall(response(self.server, mode, headers, request[1].decode()))
         except (OSError, ssl.SSLError):
             pass  # An untrusted fixture certificate must be rejected by the real client.
 
 
 @contextmanager
-def tls_proxy(root: Path, modes: list[str], body: bytes = MANIFEST):
+def tls_proxy(root: Path, modes: list[str], body: bytes | dict[str, bytes] = MANIFEST):
     cert, key = root / "cert.pem", root / "key.pem"
     command = ["openssl", "req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "1",
                "-keyout", str(key), "-out", str(cert), "-subj", "/CN=" + HOST,
@@ -78,6 +95,7 @@ def tls_proxy(root: Path, modes: list[str], body: bytes = MANIFEST):
     server.daemon_threads = True
     server.context, server.modes, server.body = context, list(modes), body
     server.connects, server.requests, server.lock = 0, [], threading.Lock()
+    server.ranges = []
     thread = threading.Thread(target=server.serve_forever, daemon=True)
     thread.start()
     try:

package/android-action/scripts/test_flutter_archive.py

@@ -1,4 +1,6 @@
-"""Real proxy/TLS transfers discard interrupted SDK bytes and preserve terminal refusals."""
+"""Real proxy/TLS transfers resume private SDK bytes and verify the official manifest digest."""
+import hashlib
+import json
 import os
 from pathlib import Path
 import subprocess
@@ -12,10 +14,12 @@ ARCHIVE = bytes(range(256)) * 512
 
 
 class ArchiveRecoveryTests(unittest.TestCase):
-    def invoke(self, root, server, cert, hooked=True, trusted=True):
+    def invoke(self, root, server, cert, hooked=True, trusted=True, digest=None):
         proxy = f"http://fixture-user:fixture-secret@127.0.0.1:{server.server_address[1]}"
         env = {**os.environ, "HOME": str(root), "RUNNER_TEMP": str(root),
-               "HTTPS_PROXY": proxy, "https_proxy": proxy, "NO_PROXY": "", "no_proxy": ""}
+               "HTTPS_PROXY": proxy, "https_proxy": proxy, "NO_PROXY": "", "no_proxy": "",
+               "VERSION_MANIFEST": json.dumps({"sha256": hashlib.sha256(ARCHIVE).hexdigest()
+                                                if digest is None else digest})}
         for key in ("BASH_ENV", "CURL_CA_BUNDLE", "SSL_CERT_FILE", "SSL_CERT_DIR"):
             env.pop(key, None)
         if trusted:
@@ -37,10 +41,11 @@ class ArchiveRecoveryTests(unittest.TestCase):
             with tls_proxy(root, ["partial"], ARCHIVE) as (server, cert):
                 original = self.invoke(root, server, cert, hooked=False)
                 self.assertEqual(original.returncode, 18)
-            with tls_proxy(root, ["partial", "ok"], ARCHIVE) as (server, cert):
+            with tls_proxy(root, ["partial", "range"], ARCHIVE) as (server, cert):
                 result = self.invoke(root, server, cert)
                 self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE))
                 self.assertEqual(server.connects, 2)
+                self.assertEqual(server.ranges, ["", "bytes=31-"])
                 self.assertIn(b"flutter_archive_recovered attempts=2", result.stderr)
 
     def test_archive_transport_never_retries_auth_or_untrusted_certificate(self):
@@ -52,12 +57,54 @@ class ArchiveRecoveryTests(unittest.TestCase):
                     self.assertNotEqual(result.returncode, 0)
                     self.assertEqual((result.stdout, server.connects), (b"", 1))
 
+    def test_authentication_refusal_after_partial_transfer_stops_without_publishing(self):
+        for mode in ("proxy_auth", "origin_auth"):
+            with self.subTest(mode=mode), tempfile.TemporaryDirectory() as directory:
+                root = Path(directory)
+                with tls_proxy(root, ["partial", mode], ARCHIVE) as (server, cert):
+                    result = self.invoke(root, server, cert)
+                    self.assertNotEqual(result.returncode, 0)
+                    self.assertEqual((result.stdout, server.connects), (b"", 2))
+
     def test_exhausted_archive_retry_never_emits_partial_bytes(self):
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
-            with tls_proxy(root, ["partial"] * 4, ARCHIVE) as (server, cert):
+            modes = ["partial", "range_partial", "range_partial", "range_partial"]
+            with tls_proxy(root, modes, ARCHIVE) as (server, cert):
                 result = self.invoke(root, server, cert)
                 self.assertEqual((result.returncode, result.stdout, server.connects), (18, b"", 4))
+                self.assertEqual(server.ranges, ["", "bytes=31-", "bytes=62-", "bytes=93-"])
+                self.assertIn(b'"retained_bytes":124', result.stderr)
+
+    def test_repeated_disconnects_resume_until_the_verified_archive_is_complete(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with tls_proxy(root, ["partial", "range_partial", "range"], ARCHIVE) as (server, cert):
+                result = self.invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE))
+                self.assertEqual(server.ranges, ["", "bytes=31-", "bytes=62-"])
+
+    def test_origin_ignoring_range_restarts_without_appending_another_full_copy(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with tls_proxy(root, ["partial", "ok", "ok"], ARCHIVE) as (server, cert):
+                result = self.invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE))
+                self.assertEqual(server.ranges, ["", "bytes=31-", ""])
+
+    def test_changed_resumed_bytes_fail_checksum_before_any_output(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with tls_proxy(root, ["partial", "range_corrupt"], ARCHIVE) as (server, cert):
+                result = self.invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout, server.connects), (1, b"", 2))
+
+    def test_missing_manifest_digest_refuses_before_download(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with tls_proxy(root, [], ARCHIVE) as (server, cert):
+                result = self.invoke(root, server, cert, digest="")
+                self.assertEqual((result.returncode, result.stdout, server.connects), (1, b"", 0))
 
 
 if __name__ == "__main__":

package/android-action/scripts/test_flutter_archive_setup.py

@@ -0,0 +1,68 @@
+"""The unchanged official setup supplies its selected digest and extracts only verified resumed bytes."""
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import tarfile
+import tempfile
+import unittest
+
+from flutter_manifest_fixture import HOST, official_setup, tls_proxy
+
+ROOT = Path(__file__).parent
+PREFIX = "/flutter_infra_release/releases/"
+
+
+def fixture_archive():
+    buffer = io.BytesIO()
+    with tarfile.open(fileobj=buffer, mode="w:gz") as archive:
+        entry = tarfile.TarInfo("flutter/bin/flutter")
+        content = b"#!/bin/sh\nexit 0\n"
+        entry.size, entry.mode = len(content), 0o755
+        archive.addfile(entry, io.BytesIO(content))
+    return buffer.getvalue()
+
+
+class OfficialArchiveSetupTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.source = official_setup()
+
+    def test_cold_setup_resumes_and_extracts_using_its_actual_manifest_scope(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            setup, sdk = root / "setup.sh", root / "sdk"
+            setup.write_bytes(self.source)
+            archive = fixture_archive()
+            manifest = json.dumps({"releases": [{"channel": "stable", "version": "3.44.0",
+                "dart_sdk_arch": "x64", "hash": "a" * 40, "sha256": hashlib.sha256(archive).hexdigest(),
+                "archive": "fixture-sdk.tar.gz"}]}).encode()
+            bodies = {PREFIX + "releases_linux.json": manifest, PREFIX + "fixture-sdk.tar.gz": archive}
+            with tls_proxy(root, ["ok", "partial", "range"], bodies) as (server, cert):
+                proxy = f"http://fixture-user:fixture-secret@127.0.0.1:{server.server_address[1]}"
+                env = {**os.environ, "HOME": str(root), "RUNNER_TEMP": str(root), "RUNNER_OS": "Linux",
+                       "RUNNER_ARCH": "X64", "RUNNER_TOOL_CACHE": str(root / "tools"),
+                       "PUB_CACHE": str(root / "pub"), "FLUTTER_STORAGE_BASE_URL": "https://" + HOST,
+                       "HTTPS_PROXY": proxy, "https_proxy": proxy, "NO_PROXY": "*", "no_proxy": "*",
+                       "CURL_CA_BUNDLE": str(cert), "BASH_ENV": str(ROOT / "flutter_manifest_env.sh"),
+                       "GOWALK_FLUTTER_MANIFEST_HELPER": str(ROOT / "flutter_manifest.py")}
+                for name in ("VERSION_MANIFEST", "GOWALK_FLUTTER_ARCHIVE_SHA256"):
+                    env.pop(name, None)
+                for name in ("GITHUB_ENV", "GITHUB_OUTPUT", "GITHUB_PATH"):
+                    env[name] = str(root / name.lower())
+                result = subprocess.run(["bash", str(setup), "-n", "3.44.0", "-a", "x64",
+                                         "-c", str(sdk), "stable"], env=env, cwd=root,
+                                        capture_output=True, timeout=20)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertEqual((sdk / "flutter/bin/flutter").read_bytes(), b"#!/bin/sh\nexit 0\n")
+                self.assertEqual(server.ranges, ["", "", "bytes=31-"])
+                self.assertEqual(server.requests, [PREFIX + "releases_linux.json"]
+                                 + [PREFIX + "fixture-sdk.tar.gz"] * 2)
+                self.assertNotIn(b"fixture-secret", result.stdout + result.stderr)
+                self.assertFalse(list(root.glob("flutter-manifest-*")))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_flutter_manifest_scope.py

@@ -20,7 +20,8 @@ class ManifestPathScopeTests(unittest.TestCase):
             parent = root / "parent/flutter-setup"
             scripts = parent.parent / "scripts"
             parent.mkdir(parents=True); scripts.mkdir()
-            for name in ("play_store_proxy.py", "flutter_manifest.py", "flutter_manifest_env.sh"):
+            names = ("play_store_proxy.py", "flutter_manifest.py", "flutter_download.py", "flutter_manifest_env.sh")
+            for name in names:
                 shutil.copyfile(ROOT / "android-action/scripts" / name, scripts / name)
             env_file, output = root / "env", root / "output"
             env = {**os.environ, "GITHUB_ACTION_PATH": str(parent), "GITHUB_ENV": str(env_file),

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.87
+1.0.89

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.87",
+  "version": "1.0.89",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {