gowalk-cicd 1.0.91 → 1.0.93

package/CLAUDE.md

@@ -172,6 +172,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   errors still fail the job. Never use `continue-on-error` or a timeout around all SDK setup
   to hide an optional cache failure. Do not alter cache keys or disable caches as part of
   this timeout handling.
+- Flutter SDK caching restores first and saves immediately after successful setup, before
+  consumer tests/builds can fail and suppress a combined cache action's success-only post hook.
+  Save only on a cache miss with caching enabled, a real successful install and verified cache
+  scope. Preserve resolved keys/paths and the official pinned restore/save programs. Failed or
+  dry-run setup never publishes an SDK cache; pub dependency caching retains its job-end behavior.
 - Gradle caches use explicit checksum-pinned restore/save actions, each optional and bounded
   to two minutes. Preserve setup-java's key inputs and absolute cache paths to reuse existing
   caches. Java setup, builds and store uploads remain mandatory; save runs after delivery.
@@ -282,7 +287,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   symbols and uploads them before the store bundle, using the configured proxy.
 - Play readiness and AAB/APK version inventory share one prebuild edit. Retry OAuth
   transport, inventory reads and cleanup of that known edit; never replay an ambiguous
-  `edits.insert`. Only an explicit package-404 allows first-release defaults; failed
+  `edits.insert`. Edit creation retries at most three times only for typed connection-timeout
+  or typed connection failure / CONNECT 502,503,504 evidence that no provider request was sent. Bare proxy errors,
+  TLS verification failures, provider responses and lost origin responses do not authorize a retry.
+  Only an explicit package-404 allows first-release defaults; failed
   inventory is not an empty account. The action exposes `play-api-ready` so current
   workflows skip the redundant postbuild check. Error annotations carry safe
   phase/category evidence and any cleanup edit ID without raw provider exceptions.

package/README.md

@@ -30,7 +30,9 @@ Flutter's optional SDK and pub cache restores have a one-minute timeout per
 download segment. A slow segment becomes a cache miss and normal SDK setup
 continues through the assigned Google proxy; SDK setup errors still fail the
 job. This bounds individual cache segments, not the total cache or SDK download,
-and keeps existing cache keys and the successful restore/save behavior.
+and keeps existing cache keys. A successfully installed SDK is saved before app
+checks run, so a later test/build failure does not force another cold SDK download.
+Failed setup never saves an SDK cache; pub dependencies retain their job-end save.
 
 ## Flutter web release
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.91
+1.0.93

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.91
+1.0.93

package/android-action/flutter-setup/action.yml

@@ -119,7 +119,7 @@ runs:
   - name: Cache Flutter
     id: cache-flutter
     if: ${{ inputs.cache == 'true' }}
-    uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25
+    uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25
     continue-on-error: true
     env:
       NODE_OPTIONS: --require "${{ steps.scope.outputs.preloader }}"
@@ -139,6 +139,7 @@ runs:
       path: ${{ steps.flutter-action.outputs.PUB-CACHE-PATH }}
       key: ${{ steps.flutter-action.outputs.PUB-CACHE-KEY }}-${{ hashFiles('**/pubspec.lock') }}
   - name: Install or reuse the resolved Flutter SDK
+    id: install
     if: ${{ inputs.dry-run != 'true' }}
     uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
     env:
@@ -157,3 +158,16 @@ runs:
       pub-cache-path: ${{ steps.flutter-action.outputs.PUB-CACHE-PATH }}
       dry-run: 'false'
       git-source: ${{ inputs.git-source }}
+  # A later app failure must not discard a successfully installed, expensive SDK.
+  - name: Save installed Flutter SDK
+    if: >-
+      ${{ inputs.cache == 'true' && inputs.dry-run != 'true'
+          && steps.install.outcome == 'success' && steps.scope.outcome == 'success'
+          && steps.cache-flutter.outputs.cache-hit != 'true' }}
+    uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25
+    continue-on-error: true
+    env:
+      NODE_OPTIONS: --require "${{ steps.scope.outputs.preloader }}"
+    with:
+      path: ${{ steps.flutter-action.outputs.CACHE-PATH }}
+      key: ${{ steps.flutter-action.outputs.CACHE-KEY }}

package/android-action/scripts/play_preflight.py

@@ -55,9 +55,9 @@ def opened_edit(client, package: str, account: Path):
     call("oauth_refresh", lambda: credentials.refresh(request), retry=True)
     headers = {"Authorization": f"Bearer {credentials.token}"}
     url = f"{BASE_URL}/applications/{package}/edits"
-    # A timed-out insert may already have created an edit. Never blindly insert again.
+    # Retry only a proven failed connection; an ambiguous insert is never replayed.
     response = call("edit_create", lambda: client.post(url, headers=headers, json={}, timeout=30),
-                    accepted=(200, 404))
+                    accepted=(200, 404), retry_connect=True)
     if response.status_code == 404:
         print(
             "::warning::Google Play package is not API-ready. The app session must upload the "

package/android-action/scripts/play_preflight_transport.py

@@ -2,15 +2,45 @@
 from __future__ import annotations
 
 import json
+import re
 import time
 
 from google.auth.exceptions import RefreshError, TransportError
 import requests
+from urllib3 import exceptions as urllib_errors
 
 RETRY_STATUSES = {429, 500, 502, 503, 504}
 TRANSPORT_ERRORS = (requests.RequestException, TransportError)
 
 
+def connection_not_sent(error: Exception) -> bool:
+    """Retry only typed connection failure or a transient HTTP CONNECT refusal.
+
+    Requests explicitly declares ConnectTimeout safe to retry. Other failures must
+    carry urllib3's structured reason. ProxyError alone is ambiguous: it can wrap
+    a dropped origin response. A plain OSError with http.client's exact tunnel
+    status framing identifies CONNECT 502/503/504 before any origin TLS/POST.
+    """
+    if isinstance(error, requests.exceptions.ConnectTimeout):
+        return error.response is None
+    if not isinstance(error, requests.exceptions.ConnectionError) or error.response is not None:
+        return False
+    if len(error.args) != 1:
+        return False
+    reason = error.args[0]
+    if isinstance(reason, urllib_errors.MaxRetryError):
+        reason = reason.reason
+    if isinstance(reason, urllib_errors.ConnectTimeoutError):
+        return True
+    if not isinstance(reason, urllib_errors.ProxyError):
+        return False
+    original = reason.original_error
+    if isinstance(original, urllib_errors.ConnectTimeoutError):
+        return True
+    return (type(original) is OSError and original.errno is None
+            and re.fullmatch(r"Tunnel connection failed: (?:502|503|504)(?: [^\r\n]*)?", str(original)) is not None)
+
+
 def transport_code(error: Exception) -> str:
     pending, seen = [error], set()
     while pending and len(seen) < 12:
@@ -45,13 +75,13 @@ def fail(phase: str, code: str, attempt: int, *, status: int | None = None,
 
 
 def call(phase: str, operation, *, retry: bool = False, edit_id: str | None = None,
-         accepted: tuple[int, ...] | None = None):
-    limit = 3 if retry else 1
+         accepted: tuple[int, ...] | None = None, retry_connect: bool = False):
+    limit = 3 if retry or retry_connect else 1
     for attempt in range(1, limit + 1):
         try:
             result = operation()
         except TRANSPORT_ERRORS as error:
-            if attempt == limit:
+            if attempt == limit or (not retry and not connection_not_sent(error)):
                 fail(phase, transport_code(error), attempt, edit_id=edit_id)
         except RefreshError:
             fail(phase, "oauth_refresh_failed", attempt)

package/android-action/scripts/play_proxy_test_support.py

@@ -0,0 +1,82 @@
+"""An owned TLS origin inside a loopback CONNECT proxy; no external traffic."""
+from contextlib import contextmanager
+from datetime import datetime, timedelta, timezone
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+import ssl
+import tempfile
+import threading
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.x509.oid import NameOID
+
+
+def tls_material(root):
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "play.test")])
+    now = datetime.now(timezone.utc)
+    cert = (x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key())
+            .serial_number(x509.random_serial_number()).not_valid_before(now - timedelta(days=1))
+            .not_valid_after(now + timedelta(days=1))
+            .add_extension(x509.SubjectAlternativeName([x509.DNSName("play.test")]), critical=False)
+            .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+            .sign(key, hashes.SHA256()))
+    path = Path(root)
+    certificate, private = path / "certificate.pem", path / "private.pem"
+    certificate.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
+    private.write_bytes(key.private_bytes(serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8,
+                                        serialization.NoEncryption()))
+    private.chmod(0o600)
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    context.load_cert_chain(certificate, private)
+    return context, str(certificate)
+
+
+class Proxy(BaseHTTPRequestHandler):
+    def do_CONNECT(self):
+        self.server.connections.append(self.path)
+        self.server.authenticated.append(bool(self.headers.get("Proxy-Authorization")))
+        if len(self.server.connections) <= self.server.reject:
+            self.send_error(502, "private proxy rejection")
+            return
+        self.send_response(200)
+        self.end_headers()
+        try:
+            with self.server.context.wrap_socket(self.connection, server_side=True) as stream:
+                stream.settimeout(3)
+                request = b""
+                while b"\r\n\r\n" not in request:
+                    data = stream.recv(4096)
+                    if not data:
+                        return
+                    request += data
+                self.server.requests.append(request.split(b"\r\n", 1)[0])
+                if self.server.drop_response:
+                    return
+                body = b'{"id":"edit-1"}'
+                response = b"HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Length: " + str(len(body)).encode()
+                stream.sendall(response + b"\r\nContent-Type: application/json\r\n\r\n" + body)
+        except ssl.SSLError:
+            pass
+
+    def log_message(self, *args):
+        pass
+
+
+@contextmanager
+def running(*, reject=0, drop_response=False):
+    with tempfile.TemporaryDirectory(prefix="play-connect-test-") as root:
+        server = ThreadingHTTPServer(("127.0.0.1", 0), Proxy)
+        server.context, certificate = tls_material(root)
+        server.connections, server.requests, server.authenticated = [], [], []
+        server.reject, server.drop_response = reject, drop_response
+        thread = threading.Thread(target=server.serve_forever, daemon=True)
+        thread.start()
+        try:
+            yield server, certificate
+        finally:
+            server.shutdown()
+            server.server_close()
+            thread.join(timeout=2)

package/android-action/scripts/test_google_bootstrap_wiring.py

@@ -24,7 +24,7 @@ class BootstrapWiringTests(unittest.TestCase):
                     self.assertNotIn("continue-on-error", step)
         self.assertEqual(checked, 3)
         setup = yaml.safe_load((ROOT / "android-action/flutter-setup/action.yml").read_text())
-        guard, scope, resolve, sdk_cache, pub_cache, install = setup["runs"]["steps"]
+        guard, scope, resolve, sdk_cache, pub_cache, install, save = setup["runs"]["steps"]
         self.assertIn('play_store_proxy.py" --bootstrap-env', guard["run"])
         self.assertNotIn("continue-on-error", guard)
         self.assertTrue(scope["continue-on-error"])
@@ -39,7 +39,7 @@ class BootstrapWiringTests(unittest.TestCase):
             self.assertEqual(step["with"]["pub-cache"], "false")
             self.assertNotIn("continue-on-error", step)
         self.assertNotIn("BASH_ENV", setup.get("env", {}))
-        for step in (guard, scope, sdk_cache, pub_cache):
+        for step in (guard, scope, sdk_cache, pub_cache, save):
             self.assertNotIn("BASH_ENV", step.get("env", {}))
         self.assertEqual(guard["id"], "transport")
         self.assertIn('>> "$GITHUB_OUTPUT"', guard["run"])
@@ -59,6 +59,25 @@ class BootstrapWiringTests(unittest.TestCase):
         self.assertEqual(setup["outputs"]["CACHE-HIT"]["value"], "${{ steps.cache-flutter.outputs.cache-hit }}")
         self.assertEqual(setup["outputs"]["PUB-CACHE-HIT"]["value"], "${{ steps.cache-pub.outputs.cache-hit }}")
 
+    def test_successful_sdk_is_saved_before_later_consumer_failure_can_discard_it(self):
+        setup = yaml.safe_load((ROOT / "android-action/flutter-setup/action.yml").read_text())
+        steps = setup["runs"]["steps"]
+        restore = next(step for step in steps if step.get("id") == "cache-flutter")
+        self.assertEqual(restore["uses"],
+                         "actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25")
+        install = next(step for step in steps if step.get("id") == "install")
+        save = steps[steps.index(install) + 1]
+        self.assertEqual(save["uses"], "actions/cache/save@caa296126883cff596d87d8935842f9db880ef25")
+        self.assertEqual(save["with"], restore["with"])
+        self.assertTrue(save["continue-on-error"])
+        self.assertEqual(save["env"], {"NODE_OPTIONS": '--require "${{ steps.scope.outputs.preloader }}"'})
+        condition = " ".join(save["if"].split())
+        self.assertEqual(condition, "${{ inputs.cache == 'true' && inputs.dry-run != 'true' "
+                         "&& steps.install.outcome == 'success' && steps.scope.outcome == 'success' "
+                         "&& steps.cache-flutter.outputs.cache-hit != 'true' }}")
+        self.assertNotIn("continue-on-error", install)
+        self.assertNotIn("timeout-minutes", save)  # Unsupported in composite action steps.
+
     def test_pods_cache_keeps_identity_and_uses_the_same_optional_scope(self):
         workflow = yaml.safe_load((ROOT / "templates/deploy.yml").read_text())
         steps = workflow["jobs"]["ios"]["steps"]

package/android-action/scripts/test_play_connect_retry.py

@@ -0,0 +1,115 @@
+"""Edit inserts retry only transport evidence that excludes an origin request."""
+import io
+from pathlib import Path
+import ssl
+import sys
+import unittest
+from unittest import mock
+
+import requests
+from urllib3 import exceptions as errors
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_preflight_transport as transport
+
+
+def proxy_failure(cause=None):
+    cause = cause or OSError("Tunnel connection failed: 502 private proxy refusal")
+    reason = errors.ProxyError("private proxy", cause)
+    return requests.exceptions.ProxyError(errors.MaxRetryError(None, "private URL", reason))
+
+
+class ConnectRetryTests(unittest.TestCase):
+    def setUp(self):
+        self.sleep = self.enterContext(mock.patch.object(transport.time, "sleep"))
+        self.output = self.enterContext(mock.patch("sys.stdout", new_callable=io.StringIO))
+
+    def test_proven_connection_failures_recover_with_one_successful_insert(self):
+        connection = errors.NewConnectionError(None, "private connect failure")
+        direct = requests.exceptions.ConnectionError(errors.MaxRetryError(None, "private URL", connection))
+        for error in (requests.exceptions.ConnectTimeout("private"), proxy_failure(),
+                      proxy_failure(connection), direct):
+            with self.subTest(kind=type(error).__name__):
+                response = mock.Mock(status_code=200)
+                operation = mock.Mock(side_effect=[error, response])
+                self.assertIs(transport.call("edit_create", operation, retry_connect=True, accepted=(200,)), response)
+                self.assertEqual(operation.call_count, 2)
+                self.assertNotIn("private", self.output.getvalue())
+
+    def test_ambiguous_errors_never_authorize_an_insert_retry(self):
+        for error in (requests.exceptions.ReadTimeout("private"), requests.exceptions.ProxyError("private"),
+                      requests.exceptions.ConnectionError(errors.ProtocolError("private")),
+                      proxy_failure(OSError("unknown private refusal")),
+                      proxy_failure(OSError("Tunnel connection failed: 407 private authentication")),
+                      proxy_failure(errors.ProtocolError("Tunnel connection failed: 502 private"))):
+            with self.subTest(kind=type(error).__name__):
+                operation = mock.Mock(side_effect=error)
+                with self.assertRaises(SystemExit):
+                    transport.call("edit_create", operation, retry_connect=True)
+                operation.assert_called_once()
+        self.sleep.assert_not_called()
+
+    def test_proxy_wrapped_tls_failure_remains_terminal(self):
+        error = proxy_failure(errors.SSLError(ssl.SSLCertVerificationError("private certificate")))
+        operation = mock.Mock(side_effect=error)
+        with self.assertRaises(SystemExit):
+            transport.call("edit_create", operation, retry_connect=True)
+        operation.assert_called_once()
+        self.sleep.assert_not_called()
+        self.assertNotIn("private", self.output.getvalue())
+
+    def test_origin_response_never_uses_connection_retry_permission(self):
+        operation = mock.Mock(return_value=mock.Mock(status_code=503))
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_create", operation, retry_connect=True, accepted=(200, 404))
+        operation.assert_called_once()
+        self.sleep.assert_not_called()
+        self.assertIn('"status": 503', str(caught.exception))
+
+    def test_lost_response_after_a_connection_retry_stops_at_that_attempt(self):
+        operation = mock.Mock(side_effect=[proxy_failure(), requests.exceptions.ReadTimeout("private")])
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_create", operation, retry_connect=True)
+        self.assertEqual(operation.call_count, 2)
+        self.assertIn('"attempts": 2', str(caught.exception))
+        self.sleep.assert_called_once_with(1)
+
+    def test_failed_connections_are_bounded_and_keep_safe_evidence(self):
+        operation = mock.Mock(side_effect=proxy_failure())
+        with self.assertRaises(SystemExit) as caught:
+            transport.call("edit_create", operation, retry_connect=True)
+        self.assertEqual(operation.call_count, 3)
+        self.assertEqual(self.sleep.call_args_list, [mock.call(1), mock.call(2)])
+        self.assertIn('"attempts": 3', str(caught.exception))
+        self.assertIn('"code": "proxy_connection_failed"', str(caught.exception))
+        self.assertNotIn("private", str(caught.exception) + self.output.getvalue())
+
+    def test_other_writes_have_no_implicit_retry_permission(self):
+        operation = mock.Mock(side_effect=proxy_failure())
+        with self.assertRaises(SystemExit):
+            transport.call("another_write", operation)
+        operation.assert_called_once()
+        self.sleep.assert_not_called()
+
+
+class PreflightConnectWiringTests(unittest.TestCase):
+    def test_real_preflight_recovers_connection_before_one_known_edit_cleanup(self):
+        import play_preflight as preflight
+
+        client = mock.Mock()
+        client.post.side_effect = [proxy_failure(), mock.Mock(status_code=200, text='{"id":"known-edit"}')]
+        client.delete.return_value = mock.Mock(status_code=204)
+        credentials = mock.Mock(token="private token")
+        with mock.patch.object(preflight.service_account.Credentials, "from_service_account_file",
+                               return_value=credentials), mock.patch.object(preflight, "write_ready") as ready, \
+                mock.patch.object(transport.time, "sleep"), mock.patch("sys.stdout", new_callable=io.StringIO):
+            preflight.check_ready(client, "com.example.app", Path("account.json"))
+        self.assertEqual(client.post.call_count, 2)
+        self.assertEqual(client.post.call_args_list[0], client.post.call_args_list[1])
+        client.delete.assert_called_once()
+        self.assertTrue(client.delete.call_args.args[0].endswith("/known-edit"))
+        ready.assert_called_once_with(True)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_play_connect_runtime.py

@@ -0,0 +1,62 @@
+"""Real Requests traffic proves bounded proxy retry and no replay after an origin POST."""
+from contextlib import redirect_stdout
+import io
+import os
+from pathlib import Path
+import sys
+import unittest
+from unittest import mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import play_preflight_transport as transport
+import play_store_proxy
+from play_proxy_test_support import running
+
+
+class ConnectRuntimeTests(unittest.TestCase):
+    def test_two_failed_tunnels_then_one_origin_post_on_the_same_assigned_proxy(self):
+        with running(reject=2) as (server, certificate):
+            env = {"GOOGLE_STORE_PROXY_URL": f"http://user:private-password@127.0.0.1:{server.server_port}",
+                   "HTTPS_PROXY": "http://127.0.0.1:1", "NO_PROXY": "*"}
+            output = io.StringIO()
+            with mock.patch.dict(os.environ, env), play_store_proxy.session() as client, \
+                    mock.patch.object(transport.time, "sleep"), redirect_stdout(output):
+                client.verify = certificate
+                result = transport.call("edit_create", lambda: client.post("https://play.test/edits", timeout=3),
+                                        retry_connect=True, accepted=(200,))
+            self.assertEqual(result.json(), {"id": "edit-1"})
+            self.assertEqual(server.connections, ["play.test:443"] * 3)
+            self.assertEqual(server.requests, [b"POST /edits HTTP/1.1"])
+            self.assertEqual(server.authenticated, [True] * 3)
+            self.assertNotIn("private", output.getvalue())
+
+    def test_dropped_response_after_received_post_is_never_replayed(self):
+        with running(drop_response=True) as (server, certificate):
+            env = {"GOOGLE_STORE_PROXY_URL": f"http://127.0.0.1:{server.server_port}"}
+            output = io.StringIO()
+            with mock.patch.dict(os.environ, env), play_store_proxy.session() as client, \
+                    mock.patch.object(transport.time, "sleep") as sleep, redirect_stdout(output):
+                client.verify = certificate
+                with self.assertRaises(SystemExit) as caught:
+                    transport.call("edit_create", lambda: client.post("https://play.test/edits", timeout=3),
+                                   retry_connect=True, accepted=(200,))
+            self.assertEqual(server.connections, ["play.test:443"])
+            self.assertEqual(server.requests, [b"POST /edits HTTP/1.1"])
+            self.assertIn('"attempts": 1', str(caught.exception))
+            sleep.assert_not_called()
+
+    def test_untrusted_tls_certificate_stops_before_origin_post_without_retry(self):
+        with running() as (server, _certificate):
+            env = {"GOOGLE_STORE_PROXY_URL": f"http://127.0.0.1:{server.server_port}"}
+            with mock.patch.dict(os.environ, env), play_store_proxy.session() as client, \
+                    mock.patch.object(transport.time, "sleep") as sleep, redirect_stdout(io.StringIO()):
+                with self.assertRaises(SystemExit):
+                    transport.call("edit_create", lambda: client.post("https://play.test/edits", timeout=3),
+                                   retry_connect=True, accepted=(200,))
+            self.assertEqual(server.connections, ["play.test:443"])
+            self.assertEqual(server.requests, [])
+            sleep.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.91
+1.0.93

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.91",
+  "version": "1.0.93",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {