gowalk-cicd 1.0.91 → 1.0.92

package/CLAUDE.md

@@ -282,7 +282,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   symbols and uploads them before the store bundle, using the configured proxy.
 - Play readiness and AAB/APK version inventory share one prebuild edit. Retry OAuth
   transport, inventory reads and cleanup of that known edit; never replay an ambiguous
-  `edits.insert`. Only an explicit package-404 allows first-release defaults; failed
+  `edits.insert`. Edit creation retries at most three times only for typed connection-timeout
+  or typed connection failure / CONNECT 502,503,504 evidence that no provider request was sent. Bare proxy errors,
+  TLS verification failures, provider responses and lost origin responses do not authorize a retry.
+  Only an explicit package-404 allows first-release defaults; failed
   inventory is not an empty account. The action exposes `play-api-ready` so current
   workflows skip the redundant postbuild check. Error annotations carry safe
   phase/category evidence and any cleanup edit ID without raw provider exceptions.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.91
+1.0.92

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.91
+1.0.92

package/android-action/scripts/play_preflight.py

@@ -55,9 +55,9 @@ def opened_edit(client, package: str, account: Path):
     call("oauth_refresh", lambda: credentials.refresh(request), retry=True)
     headers = {"Authorization": f"Bearer {credentials.token}"}
     url = f"{BASE_URL}/applications/{package}/edits"
-    # A timed-out insert may already have created an edit. Never blindly insert again.
+    # Retry only a proven failed connection; an ambiguous insert is never replayed.
     response = call("edit_create", lambda: client.post(url, headers=headers, json={}, timeout=30),
-                    accepted=(200, 404))
+                    accepted=(200, 404), retry_connect=True)
     if response.status_code == 404:
         print(
             "::warning::Google Play package is not API-ready. The app session must upload the "

package/android-action/scripts/play_preflight_transport.py

@@ -2,15 +2,45 @@
 from __future__ import annotations
 
 import json
+import re
 import time
 
 from google.auth.exceptions import RefreshError, TransportError
 import requests
+from urllib3 import exceptions as urllib_errors
 
 RETRY_STATUSES = {429, 500, 502, 503, 504}
 TRANSPORT_ERRORS = (requests.RequestException, TransportError)
 
 
+def connection_not_sent(error: Exception) -> bool:
+    """Retry only typed connection failure or a transient HTTP CONNECT refusal.
+
+    Requests explicitly declares ConnectTimeout safe to retry. Other failures must
+    carry urllib3's structured reason. ProxyError alone is ambiguous: it can wrap
+    a dropped origin response. A plain OSError with http.client's exact tunnel
+    status framing identifies CONNECT 502/503/504 before any origin TLS/POST.
+    """
+    if isinstance(error, requests.exceptions.ConnectTimeout):
+        return error.response is None
+    if not isinstance(error, requests.exceptions.ConnectionError) or error.response is not None:
+        return False
+    if len(error.args) != 1:
+        return False
+    reason = error.args[0]
+    if isinstance(reason, urllib_errors.MaxRetryError):
+        reason = reason.reason
+    if isinstance(reason, urllib_errors.ConnectTimeoutError):
+        return True
+    if not isinstance(reason, urllib_errors.ProxyError):
+        return False
+    original = reason.original_error
+    if isinstance(original, urllib_errors.ConnectTimeoutError):
+        return True
+    return (type(original) is OSError and original.errno is None
+            and re.fullmatch(r"Tunnel connection failed: (?:502|503|504)(?: [^\r\n]*)?", str(original)) is not None)
+
+
 def transport_code(error: Exception) -> str:
     pending, seen = [error], set()
     while pending and len(seen) < 12:
@@ -45,13 +75,13 @@ def fail(phase: str, code: str, attempt: int, *, status: int | None = None,
 
 
 def call(phase: str, operation, *, retry: bool = False, edit_id: str | None = None,
-         accepted: tuple[int, ...] | None = None):
-    limit = 3 if retry else 1
+         accepted: tuple[int, ...] | None = None, retry_connect: bool = False):
+    limit = 3 if retry or retry_connect else 1
     for attempt in range(1, limit + 1):
         try:
             result = operation()
         except TRANSPORT_ERRORS as error:
-            if attempt == limit:
+            if attempt == limit or (not retry and not connection_not_sent(error)):
                 fail(phase, transport_code(error), attempt, edit_id=edit_id)
         except RefreshError:
             fail(phase, "oauth_refresh_failed", attempt)

package/android-action/scripts/play_proxy_test_support.py

@@ -0,0 +1,82 @@
+"""An owned TLS origin inside a loopback CONNECT proxy; no external traffic."""
+from contextlib import contextmanager
+from datetime import datetime, timedelta, timezone
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+import ssl
+import tempfile
+import threading
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.x509.oid import NameOID
+
+
+def tls_material(root):
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "play.test")])
+    now = datetime.now(timezone.utc)
+    cert = (x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key())
+            .serial_number(x509.random_serial_number()).not_valid_before(now - timedelta(days=1))
+            .not_valid_after(now + timedelta(days=1))
+            .add_extension(x509.SubjectAlternativeName([x509.DNSName("play.test")]), critical=False)
+            .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+            .sign(key, hashes.SHA256()))
+    path = Path(root)
+    certificate, private = path / "certificate.pem", path / "private.pem"
+    certificate.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
+    private.write_bytes(key.private_bytes(serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8,
+                                        serialization.NoEncryption()))
+    private.chmod(0o600)
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    context.load_cert_chain(certificate, private)
+    return context, str(certificate)
+
+
+class Proxy(BaseHTTPRequestHandler):
+    def do_CONNECT(self):
+        self.server.connections.append(self.path)
+        self.server.authenticated.append(bool(self.headers.get("Proxy-Authorization")))
+        if len(self.server.connections) <= self.server.reject:
+            self.send_error(502, "private proxy rejection")
+            return
+        self.send_response(200)
+        self.end_headers()
+        try:
+            with self.server.context.wrap_socket(self.connection, server_side=True) as stream:
+                stream.settimeout(3)
+                request = b""
+                while b"\r\n\r\n" not in request:
+                    data = stream.recv(4096)
+                    if not data:
+                        return
+                    request += data
+                self.server.requests.append(request.split(b"\r\n", 1)[0])
+                if self.server.drop_response:
+                    return
+                body = b'{"id":"edit-1"}'
+                response = b"HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Length: " + str(len(body)).encode()
+                stream.sendall(response + b"\r\nContent-Type: application/json\r\n\r\n" + body)
+        except ssl.SSLError:
+            pass
+
+    def log_message(self, *args):
+        pass
+
+
+@contextmanager
+def running(*, reject=0, drop_response=False):
+    with tempfile.TemporaryDirectory(prefix="play-connect-test-") as root:
+        server = ThreadingHTTPServer(("127.0.0.1", 0), Proxy)
+        server.context, certificate = tls_material(root)
+        server.connections, server.requests, server.authenticated = [], [], []
+        server.reject, server.drop_response = reject, drop_response
+        thread = threading.Thread(target=server.serve_forever, daemon=True)
+        thread.start()
+        try:
+            yield server, certificate
+        finally:
+            server.shutdown()
+            server.server_close()
+            thread.join(timeout=2)

package/android-action/scripts/test_play_connect_retry.py

@@ -0,0 +1,115 @@
+"""Edit inserts retry only transport evidence that excludes an origin request."""
+import io
+from pathlib import Path
+import ssl
+import sys
+import unittest
+from unittest import mock
+
+import requests
+from urllib3 import exceptions as errors
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_preflight_transport as transport
+
+
+def proxy_failure(cause=None):
+    cause = cause or OSError("Tunnel connection failed: 502 private proxy refusal")
+    reason = errors.ProxyError("private proxy", cause)
+    return requests.exceptions.ProxyError(errors.MaxRetryError(None, "private URL", reason))
+
+
+class ConnectRetryTests(unittest.TestCase):
+    def setUp(self):
+        self.sleep = self.enterContext(mock.patch.object(transport.time, "sleep"))
+        self.output = self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def test_proven_connection_failures_recover_with_one_successful_insert(self):
+        connection = errors.NewConnectionError(None, "private connect failure")
+        direct = requests.exceptions.ConnectionError(errors.MaxRetryError(None, "private URL", connection))
+        for error in (requests.exceptions.ConnectTimeout("private"), proxy_failure(),
+                      proxy_failure(connection), direct):
+            with self.subTest(kind=type(error).__name__):
+                response = mock.Mock(status_code=200)
+                operation = mock.Mock(side_effect=[error, response])
+                self.assertIs(transport.call("edit_create", operation, retry_connect=True, accepted=(200,)), response)
+                self.assertEqual(operation.call_count, 2)
+                self.assertNotIn("private", self.output.getvalue())
+
+    def test_ambiguous_errors_never_authorize_an_insert_retry(self):
+        for error in (requests.exceptions.ReadTimeout("private"), requests.exceptions.ProxyError("private"),
+                      requests.exceptions.ConnectionError(errors.ProtocolError("private")),
+                      proxy_failure(OSError("unknown private refusal")),
+                      proxy_failure(OSError("Tunnel connection failed: 407 private authentication")),
+                      proxy_failure(errors.ProtocolError("Tunnel connection failed: 502 private"))):
+            with self.subTest(kind=type(error).__name__):
+                operation = mock.Mock(side_effect=error)
+                with self.assertRaises(SystemExit):
+                    transport.call("edit_create", operation, retry_connect=True)
+                operation.assert_called_once()
+        self.sleep.assert_not_called()
+
+    def test_proxy_wrapped_tls_failure_remains_terminal(self):
+        error = proxy_failure(errors.SSLError(ssl.SSLCertVerificationError("private certificate")))
+        operation = mock.Mock(side_effect=error)
+        with self.assertRaises(SystemExit):
+            transport.call("edit_create", operation, retry_connect=True)
+        operation.assert_called_once()
+        self.sleep.assert_not_called()
+        self.assertNotIn("private", self.output.getvalue())
+
+    def test_origin_response_never_uses_connection_retry_permission(self):
+        operation = mock.Mock(return_value=mock.Mock(status_code=503))
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_create", operation, retry_connect=True, accepted=(200, 404))
+        operation.assert_called_once()
+        self.sleep.assert_not_called()
+        self.assertIn('"status": 503', str(caught.exception))
+
+    def test_lost_response_after_a_connection_retry_stops_at_that_attempt(self):
+        operation = mock.Mock(side_effect=[proxy_failure(), requests.exceptions.ReadTimeout("private")])
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_create", operation, retry_connect=True)
+        self.assertEqual(operation.call_count, 2)
+        self.assertIn('"attempts": 2', str(caught.exception))
+        self.sleep.assert_called_once_with(1)
+
+    def test_failed_connections_are_bounded_and_keep_safe_evidence(self):
+        operation = mock.Mock(side_effect=proxy_failure())
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_create", operation, retry_connect=True)
+        self.assertEqual(operation.call_count, 3)
+        self.assertEqual(self.sleep.call_args_list, [mock.call(1), mock.call(2)])
+        self.assertIn('"attempts": 3', str(caught.exception))
+        self.assertIn('"code": "proxy_connection_failed"', str(caught.exception))
+        self.assertNotIn("private", str(caught.exception) + self.output.getvalue())
+
+    def test_other_writes_have_no_implicit_retry_permission(self):
+        operation = mock.Mock(side_effect=proxy_failure())
+        with self.assertRaises(SystemExit):
+            transport.call("another_write", operation)
+        operation.assert_called_once()
+        self.sleep.assert_not_called()
+
+
+class PreflightConnectWiringTests(unittest.TestCase):
+    def test_real_preflight_recovers_connection_before_one_known_edit_cleanup(self):
+        import play_preflight as preflight
+
+        client = mock.Mock()
+        client.post.side_effect = [proxy_failure(), mock.Mock(status_code=200, text='{"id":"known-edit"}')]
+        client.delete.return_value = mock.Mock(status_code=204)
+        credentials = mock.Mock(token="private token")
+        with mock.patch.object(preflight.service_account.Credentials, "from_service_account_file",
+                               return_value=credentials), mock.patch.object(preflight, "write_ready") as ready, \
+                mock.patch.object(transport.time, "sleep"), mock.patch("sys.stdout", new_callable=io.StringIO):
+            preflight.check_ready(client, "com.example.app", Path("account.json"))
+        self.assertEqual(client.post.call_count, 2)
+        self.assertEqual(client.post.call_args_list[0], client.post.call_args_list[1])
+        client.delete.assert_called_once()
+        self.assertTrue(client.delete.call_args.args[0].endswith("/known-edit"))
+        ready.assert_called_once_with(True)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_connect_runtime.py

@@ -0,0 +1,62 @@
+"""Real Requests traffic proves bounded proxy retry and no replay after an origin POST."""
+from contextlib import redirect_stdout
+import io
+import os
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_preflight_transport as transport
+import play_store_proxy
+from play_proxy_test_support import running
+
+
+class ConnectRuntimeTests(unittest.TestCase):
+    def test_two_failed_tunnels_then_one_origin_post_on_the_same_assigned_proxy(self):
+        with running(reject=2) as (server, certificate):
+            env = {"GOOGLE_STORE_PROXY_URL": f"http://user:private-password@127.0.0.1:{server.server_port}",
+                   "HTTPS_PROXY": "http://127.0.0.1:1", "NO_PROXY": "*"}
+            output = io.StringIO()
+            with mock.patch.dict(os.environ, env), play_store_proxy.session() as client, \
+                    mock.patch.object(transport.time, "sleep"), redirect_stdout(output):
+                client.verify = certificate
+                result = transport.call("edit_create", lambda: client.post("https://play.test/edits", timeout=3),
+                                        retry_connect=True, accepted=(200,))
+            self.assertEqual(result.json(), {"id": "edit-1"})
+            self.assertEqual(server.connections, ["play.test:443"] * 3)
+            self.assertEqual(server.requests, [b"POST /edits HTTP/1.1"])
+            self.assertEqual(server.authenticated, [True] * 3)
+            self.assertNotIn("private", output.getvalue())
+
+    def test_dropped_response_after_received_post_is_never_replayed(self):
+        with running(drop_response=True) as (server, certificate):
+            env = {"GOOGLE_STORE_PROXY_URL": f"http://127.0.0.1:{server.server_port}"}
+            output = io.StringIO()
+            with mock.patch.dict(os.environ, env), play_store_proxy.session() as client, \
+                    mock.patch.object(transport.time, "sleep") as sleep, redirect_stdout(output):
+                client.verify = certificate
+                with self.assertRaises(SystemExit) as caught:
+                    transport.call("edit_create", lambda: client.post("https://play.test/edits", timeout=3),
+                                   retry_connect=True, accepted=(200,))
+            self.assertEqual(server.connections, ["play.test:443"])
+            self.assertEqual(server.requests, [b"POST /edits HTTP/1.1"])
+            self.assertIn('"attempts": 1', str(caught.exception))
+            sleep.assert_not_called()
+
+    def test_untrusted_tls_certificate_stops_before_origin_post_without_retry(self):
+        with running() as (server, _certificate):
+            env = {"GOOGLE_STORE_PROXY_URL": f"http://127.0.0.1:{server.server_port}"}
+            with mock.patch.dict(os.environ, env), play_store_proxy.session() as client, \
+                    mock.patch.object(transport.time, "sleep") as sleep, redirect_stdout(io.StringIO()):
+                with self.assertRaises(SystemExit):
+                    transport.call("edit_create", lambda: client.post("https://play.test/edits", timeout=3),
+                                   retry_connect=True, accepted=(200,))
+            self.assertEqual(server.connections, ["play.test:443"])
+            self.assertEqual(server.requests, [])
+            sleep.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.91
+1.0.92

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.91",
+  "version": "1.0.92",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {