gowalk-cicd 1.0.93 → 1.0.94

package/CLAUDE.md

@@ -285,6 +285,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   delivery request. This requires no human handoff. A green CI run alone is not
   evidence that the deferred symbols reached Firebase. Android retains its Dart
   symbols and uploads them before the store bundle, using the configured proxy.
+- Crashlytics buildtools bootstrap runs before Flutter compilation. `crashlytics_bootstrap.py`
+  pins the official JAR version, byte size and SHA-256, admits only verified dependency-cache
+  bytes, and bounds proxied GET recovery to three attempts within three minutes. Java receives
+  that verified file through `CRASHLYTICS_LOCAL_JAR`; changing the Firebase CLI pin must check
+  its JAR version/override contract. TLS, authorization and checksum errors never retry.
+  `firebase_symbols_bootstrap_failed` carries fixed typed evidence, never private curl output.
 - Play readiness and AAB/APK version inventory share one prebuild edit. Retry OAuth
   transport, inventory reads and cleanup of that known edit; never replay an ambiguous
   `edits.insert`. Edit creation retries at most three times only for typed connection-timeout

package/README.md

@@ -651,6 +651,14 @@ Crashlytics mapping/native-symbol uploads. Crashlytics Gradle 2.9.2+ supports pr
 environment variables; older versions must be updated before use. Dart symbols are
 retained as artifacts and uploaded through that transport before the bundle ships.
 
+Before Flutter compilation, the action downloads Crashlytics buildtools 3.0.3 through
+the assigned account proxy and verifies its exact size and SHA-256. Verified bytes are
+reused from the runner dependency cache and supplied through the Firebase CLI's
+`CRASHLYTICS_LOCAL_JAR` override. GET recovery allows three attempts within three minutes;
+TLS, authorization and checksum refusals stop immediately. A bootstrap failure emits
+`firebase_symbols_bootstrap_failed` with schema `gowalk-cicd/firebase-symbols-bootstrap.v1`,
+`phase`, `reason`, `attempts`, `exit_code` and `http_status`. Raw curl output is never published.
+
 Native iOS `upload-symbols` is refused because it does not use this environment
 transport. CI defers dedicated native upload phases in its ephemeral projects and
 retains `ios-crashlytics-symbols-<run>-<attempt>` with `ios-dsyms.zip` and a manifest

package/action/.daemux-version

@@ -1 +1 @@
-1.0.93
+1.0.94

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.93
+1.0.94

package/android-action/action.yml

@@ -100,6 +100,13 @@ runs:
       run: node "${{ github.action_path }}/play-upload/owner_run.cjs" resolve
 
     # --- Flutter --------------------------------------------------------
+    - name: Prepare Crashlytics symbol tools
+      if: ${{ steps.config.outputs.project_kind == 'flutter' }}
+      shell: bash
+      env:
+        FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}
+      run: python3 "${{ github.action_path }}/scripts/crashlytics_symbols.py" --prepare-only
+
     - name: Get Flutter dependencies
       if: ${{ steps.config.outputs.project_kind == 'flutter' }}
       shell: >-

package/android-action/scripts/crashlytics_bootstrap.py

@@ -0,0 +1,97 @@
+"""Prepare the pinned Crashlytics JAR before compiling, with bounded proxied GETs.
+
+Firebase CLI 15.28.2 accepts CRASHLYTICS_LOCAL_JAR. Its own streaming download
+has no total deadline; an idle relay can consume fifteen minutes after a build.
+Only size/checksum-verified bytes enter this dependency cache or reach Java.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import tempfile
+import time
+
+from play_store_proxy import environment
+
+VERSION = "3.0.3"
+URL = ("https://dl.google.com/android/maven2/com/google/firebase/"
+       f"firebase-crashlytics-buildtools/{VERSION}/firebase-crashlytics-buildtools-{VERSION}.jar")
+SIZE = 8437846
+SHA256 = "953b6f3942283f8332cc17a59bca2649ea49d14e0072f2c1f01762ebaebdf357"
+TOTAL_SECONDS = 180
+ATTEMPT_SECONDS = 60
+ATTEMPTS = 3
+RETRY_EXITS = {5, 6, 7, 18, 28, 52, 55, 56}
+RETRY_STATUS = {408, 429, 500, 502, 503, 504}
+
+
+class BootstrapError(RuntimeError):
+    def __init__(self, reason: str, attempt: int = 0, exit_code: int = 0, http_status: int = 0):
+        super().__init__(reason)
+        self.receipt = {"schema": "gowalk-cicd/firebase-symbols-bootstrap.v1",
+                        "phase": "buildtools_download", "reason": reason,
+                        "attempts": attempt, "exit_code": exit_code, "http_status": http_status}
+
+    def annotate(self) -> None:
+        print("::error title=firebase_symbols_bootstrap_failed::" + json.dumps(self.receipt, separators=(",", ":")))
+
+
+def verified(path: Path) -> bool:
+    return (path.is_file() and path.stat().st_size == SIZE
+            and hashlib.sha256(path.read_bytes()).hexdigest() == SHA256)
+
+
+def transfer(path: Path, env: dict, seconds: float, attempt: int) -> None:
+    command = ["curl", "--disable", "--silent", "--show-error", "--fail", "--proto", "=https",
+               "--max-redirs", "0", "--connect-timeout", "15", "--max-time", str(seconds),
+               "--max-filesize", str(SIZE), "--output", str(path), "--write-out", "%{http_code} %{http_connect}", URL]
+    try:
+        result = subprocess.run(command, env=env, capture_output=True, timeout=seconds + 5, check=False)
+    except FileNotFoundError:
+        raise BootstrapError("curl_missing", attempt) from None
+    except subprocess.TimeoutExpired:
+        raise BootstrapError("download_timeout", attempt, 28) from None
+    codes = result.stdout.split()
+    http, connect = (map(int, codes) if len(codes) == 2 and all(code.isdigit() for code in codes) else (0, 0))
+    status = http or (connect if connect >= 400 else 0)
+    if result.returncode == 0 and status == 200:
+        if not verified(path):
+            raise BootstrapError("checksum_or_size_mismatch", attempt, 0, status)
+        return
+    reason = ("download_timeout" if result.returncode == 28 else
+              "tls_refused" if result.returncode in {35, 51, 60, 77, 83, 90, 91} else
+              "size_limit" if result.returncode == 63 else
+              "http_refused" if status >= 300 else "transport_failed")
+    raise BootstrapError(reason, attempt, result.returncode, status)
+
+
+def prepare() -> Path:
+    env = environment()  # Validate the assigned account exit even when the cache is warm.
+    root = Path(env.get("RUNNER_TOOL_CACHE") or Path.home() / ".cache") / "gowalk-cicd" / "crashlytics"
+    root.mkdir(parents=True, exist_ok=True)
+    target = root / f"{VERSION}-{SHA256}.jar"
+    if verified(target):
+        return target
+    deadline = time.monotonic() + TOTAL_SECONDS
+    for attempt in range(1, ATTEMPTS + 1):
+        with tempfile.TemporaryDirectory(prefix="download-", dir=root) as scratch:
+            partial = Path(scratch) / "buildtools.jar"
+            seconds = min(ATTEMPT_SECONDS, deadline - time.monotonic())
+            if seconds <= 0:
+                raise BootstrapError("download_timeout", attempt - 1, 28)
+            try:
+                transfer(partial, env, seconds, attempt)
+            except BootstrapError as error:
+                status = error.receipt["http_status"]
+                retryable = (status in RETRY_STATUS if status >= 300
+                             else error.receipt["exit_code"] in RETRY_EXITS)
+                if not retryable or attempt == ATTEMPTS:
+                    raise
+                print(f"Crashlytics buildtools GET attempt {attempt} failed ({error.receipt['reason']}); retrying.")
+                time.sleep(min(attempt, max(0, deadline - time.monotonic())))
+                continue
+            partial.replace(target)
+            return target
+    raise AssertionError("download attempts exhausted without a result")

package/android-action/scripts/crashlytics_bootstrap_test_support.py

@@ -0,0 +1,33 @@
+"""Serve an owned dependency fixture through authenticated HTTPS CONNECT only."""
+import ssl
+import time
+
+from play_proxy_test_support import Proxy
+
+
+class DownloadProxy(Proxy):
+    def do_CONNECT(self):
+        self.server.connections.append(self.path)
+        self.server.authenticated.append(bool(self.headers.get("Proxy-Authorization")))
+        if getattr(self.server, "connect_status", 200) != 200:
+            self.send_error(self.server.connect_status, "private fixture proxy refusal")
+            return
+        self.send_response(200)
+        self.end_headers()
+        try:
+            with self.server.context.wrap_socket(self.connection, server_side=True) as stream:
+                stream.settimeout(2)
+                request = b""
+                while b"\r\n\r\n" not in request:
+                    data = stream.recv(4096)
+                    if not data:
+                        return
+                    request += data
+                self.server.requests.append(request.split(b"\r\n", 1)[0])
+                status, body, delay = self.server.responses.pop(0)
+                time.sleep(delay)
+                headers = (f"HTTP/1.1 {status} Fixture\r\nConnection: close\r\n"
+                           f"Content-Length: {self.server.expected_size}\r\n\r\n").encode()
+                stream.sendall(headers + body)
+        except (OSError, ssl.SSLError):
+            pass

package/android-action/scripts/crashlytics_symbols.py

@@ -27,11 +27,13 @@ from __future__ import annotations
 import argparse
 import os
 import re
+import shutil
 import sys
 import tempfile
 from pathlib import Path
 
 from play_store_proxy import run as run_proxied
+from crashlytics_bootstrap import BootstrapError, prepare as prepare_buildtools
 
 # Exact pin, not a range: this job holds the upload keystore and the Play
 # service account, so no floating third-party code runs in it. Bump on purpose.
@@ -99,8 +101,17 @@ def _default_run(cmd: list[str]) -> int:
     # (dump_syms.bin, ~4 MB) into the working directory, which must not be the
     # consumer's checkout.
     try:
+        if cmd and shutil.which(cmd[0]) is None:
+            raise FileNotFoundError(cmd[0])
+        jar = prepare_buildtools()
+        if not cmd:
+            print("Verified Crashlytics buildtools are ready before compilation.")
+            return 0
         with tempfile.TemporaryDirectory(prefix="crashlytics-upload-") as workdir:
-            return run_proxied(cmd, cwd=workdir)
+            return run_proxied(["env", f"CRASHLYTICS_LOCAL_JAR={jar}", *cmd], cwd=workdir)
+    except BootstrapError as error:
+        error.annotate()
+        return 1
     except FileNotFoundError:
         print(
             "::error::npx is not on PATH, so the Firebase CLI cannot run. "
@@ -110,13 +121,27 @@ def _default_run(cmd: list[str]) -> int:
         return 127
 
 
+def _missing_app(ids: list[tuple[str, str]], pubspec: Path) -> None:
+    if ids:
+        print("::warning::FIREBASE_APP_ID names no Android app "
+              "(1:<project number>:android:<hash>); the Dart symbols were not uploaded to Crashlytics.")
+    elif uses_crashlytics(pubspec):
+        print("::warning::This app depends on firebase_crashlytics but no Firebase App ID reached this build, "
+              "so every Dart frame in Crashlytics will read as ***. Either the FIREBASE_APP_ID repository "
+              "variable is unset, or this repo's deploy.yml predates the firebase-app-id input — a one-off "
+              "`npx --yes gowalk-cicd` refreshes it.")
+    else:
+        print("FIREBASE_APP_ID unset; not uploading Dart symbols to Crashlytics.")
+
+
 def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, run=None) -> int:
     environ = os.environ if environ is None else environ
     run = _default_run if run is None else run
 
     parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
-    parser.add_argument("--symbols-dir", required=True, type=Path,
+    parser.add_argument("--symbols-dir", type=Path,
                         help="the directory passed to flutter build --split-debug-info")
+    parser.add_argument("--prepare-only", action="store_true", help="verify the buildtools before compilation")
     parser.add_argument("--pubspec", type=Path, default=Path("pubspec.yaml"),
                         help="pubspec.yaml, used only to decide whether to warn when unset")
     parser.add_argument("--firebase-tools", default=FIREBASE_TOOLS,
@@ -132,28 +157,13 @@ def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, r
 
     app_id = _pick(ids, "android")
     if app_id is None:
-        if ids:
-            print(
-                "::warning::FIREBASE_APP_ID names no Android app "
-                "(1:<project number>:android:<hash>); the Dart symbols were not "
-                "uploaded to Crashlytics."
-            )
-        elif uses_crashlytics(args.pubspec):
-            # Two causes look identical from here: the variable is unset, or a
-            # deploy.yml that predates the firebase-app-id input never passed
-            # it. Name both — the action can only ever see the input.
-            print(
-                "::warning::This app depends on firebase_crashlytics but no "
-                "Firebase App ID reached this build, so every Dart frame in "
-                "Crashlytics will read as ***. Either the FIREBASE_APP_ID "
-                "repository variable is unset, or this repo's deploy.yml predates "
-                "the firebase-app-id input — a one-off `npx --yes gowalk-cicd` "
-                "refreshes it."
-            )
-        else:
-            print("FIREBASE_APP_ID unset; not uploading Dart symbols to Crashlytics.")
+        _missing_app(ids, args.pubspec)
         return 0
 
+    if args.prepare_only:
+        return 0 if run([]) == 0 else 1
+    if args.symbols_dir is None:
+        parser.error("--symbols-dir is required unless --prepare-only is used")
     symbols = sorted(args.symbols_dir.glob("*.symbols")) if args.symbols_dir.is_dir() else []
     if not symbols:
         print(f"::error::no Dart symbol files in {args.symbols_dir}; nothing to upload to Crashlytics")
@@ -167,7 +177,7 @@ def main(argv: list[str] | None = None, environ: dict[str, str] | None = None, r
         print(
             f"::error::Crashlytics symbol upload failed (exit {rc}). The symbols are "
             "retained as the android-symbols artifact; after fixing the cause, upload "
-            f"them through the configured proxy after restoring its transport."
+            "them through the configured proxy after diagnosing the failed phase."
         )
         return 1
     print(f"Uploaded Dart symbols to Crashlytics app {app_id}.")

package/android-action/scripts/test_crashlytics_bootstrap.py

@@ -0,0 +1,119 @@
+"""Real curl/TLS reads: recover partial GETs, enforce deadlines and preserve the pin."""
+from contextlib import ExitStack, redirect_stdout
+import hashlib
+import io
+import json
+import os
+from pathlib import Path
+import tempfile
+import time
+import unittest
+from unittest import mock
+
+import crashlytics_bootstrap as bootstrap
+from crashlytics_bootstrap_test_support import DownloadProxy
+from play_proxy_test_support import running
+
+BODY = b"verified fixture dependency"
+
+
+class BootstrapTests(unittest.TestCase):
+    def setUp(self):
+        self.stack = ExitStack()
+        self.addCleanup(self.stack.close)
+        self.root = Path(self.stack.enter_context(tempfile.TemporaryDirectory()))
+        self.server, self.certificate = self.stack.enter_context(running())
+        self.server.RequestHandlerClass = DownloadProxy
+        self.server.expected_size = len(BODY)
+        self.server.responses = [(200, BODY, 0)]
+        proxy = f"http://fixture-user:fixture-pass@127.0.0.1:{self.server.server_port}"
+        self.stack.enter_context(mock.patch.dict(os.environ, {
+            "GOOGLE_STORE_PROXY_URL": proxy, "RUNNER_TOOL_CACHE": str(self.root),
+            "CURL_CA_BUNDLE": self.certificate, "NO_PROXY": "*", "no_proxy": "*"}))
+        for name, value in {"URL": "https://play.test/buildtools.jar", "SIZE": len(BODY),
+                            "SHA256": hashlib.sha256(BODY).hexdigest(),
+                            "ATTEMPT_SECONDS": 1, "TOTAL_SECONDS": 5}.items():
+            self.stack.enter_context(mock.patch.object(bootstrap, name, value))
+
+    def test_verified_cache_reuses_bytes_without_another_request(self):
+        first = bootstrap.prepare()
+        self.assertEqual(first.read_bytes(), BODY)
+        self.assertEqual(bootstrap.prepare(), first)
+        self.assertEqual(self.server.requests, [b"GET /buildtools.jar HTTP/1.1"])
+        self.assertEqual(self.server.authenticated, [True])
+        self.assertEqual(self.server.connections, ["play.test:443"])
+
+    def test_partial_transfer_recovers_only_the_get_and_cleans_partial_files(self):
+        self.server.responses = [(200, BODY[:3], 0), (200, BODY, 0)]
+        target = bootstrap.prepare()
+        self.assertEqual(target.read_bytes(), BODY)
+        self.assertEqual(self.server.requests, [b"GET /buildtools.jar HTTP/1.1"] * 2)
+        self.assertEqual(list(target.parent.iterdir()), [target])
+
+    def test_corrupt_cache_is_replaced_only_after_verification(self):
+        target = bootstrap.prepare()
+        target.write_bytes(b"corrupted")
+        self.server.responses = [(200, BODY, 0)]
+        self.assertEqual(bootstrap.prepare().read_bytes(), BODY)
+        self.assertEqual(len(self.server.requests), 2)
+
+    def test_wrong_checksum_refuses_without_retry_or_cache_admission(self):
+        self.server.responses = [(200, b"x" * len(BODY), 0)]
+        with self.assertRaises(bootstrap.BootstrapError) as caught:
+            bootstrap.prepare()
+        self.assertEqual(caught.exception.receipt["reason"], "checksum_or_size_mismatch")
+        self.assertEqual(len(self.server.requests), 1)
+        self.assertFalse(list(self.root.rglob("*.jar")))
+
+    def test_stalled_download_has_a_total_deadline_and_no_partial_cache(self):
+        self.server.responses = [(200, BODY, 0.5)] * 3
+        started = time.monotonic()
+        with mock.patch.object(bootstrap, "ATTEMPT_SECONDS", 0.1), \
+                mock.patch.object(bootstrap, "TOTAL_SECONDS", 0.3):
+            with self.assertRaises(bootstrap.BootstrapError) as caught:
+                bootstrap.prepare()
+        self.assertEqual(caught.exception.receipt["reason"], "download_timeout")
+        self.assertLess(time.monotonic() - started, 1.5)
+        self.assertFalse(list(self.root.rglob("*.jar")))
+
+    def test_http_refusal_is_terminal_and_receipt_never_contains_provider_body(self):
+        self.server.responses = [(403, b"fixture-pass private body", 0)]
+        with self.assertRaises(bootstrap.BootstrapError) as caught:
+            bootstrap.prepare()
+        output = io.StringIO()
+        with redirect_stdout(output):
+            caught.exception.annotate()
+        text = output.getvalue()
+        receipt = json.loads(text.split("::", 2)[2])
+        self.assertEqual(receipt["http_status"], 403)
+        self.assertEqual(receipt["attempts"], 1)
+        self.assertNotIn("fixture-pass", text)
+        self.assertNotIn("private body", text)
+
+    def test_tls_refusal_does_not_retry_or_fall_back_to_direct(self):
+        with mock.patch.dict(os.environ, {"CURL_CA_BUNDLE": ""}):
+            with self.assertRaises(bootstrap.BootstrapError) as caught:
+                bootstrap.prepare()
+        self.assertEqual(caught.exception.receipt["reason"], "tls_refused")
+        self.assertEqual(self.server.connections, ["play.test:443"])
+        self.assertEqual(self.server.requests, [])
+
+    def test_missing_account_pin_refuses_even_with_a_verified_cache(self):
+        bootstrap.prepare()
+        with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": ""}):
+            with self.assertRaises(SystemExit):
+                bootstrap.prepare()
+        self.assertEqual(len(self.server.requests), 1)
+
+    def test_proxy_auth_refusal_is_not_retried_as_a_connection_failure(self):
+        self.server.connect_status = 407
+        with self.assertRaises(bootstrap.BootstrapError) as caught:
+            bootstrap.prepare()
+        self.assertEqual(caught.exception.receipt["http_status"], 407)
+        self.assertEqual(caught.exception.receipt["attempts"], 1)
+        self.assertEqual(self.server.connections, ["play.test:443"])
+        self.assertEqual(self.server.requests, [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_crashlytics_prebuild.py

@@ -0,0 +1,40 @@
+"""The prebuild check shares upload gating and preserves the release dependency."""
+import io
+from contextlib import redirect_stdout
+from pathlib import Path
+import unittest
+from unittest import mock
+
+import crashlytics_symbols as symbols
+
+
+class PrebuildTests(unittest.TestCase):
+    def test_prepare_requires_no_symbols_but_propagates_bootstrap_failure(self):
+        for result in (0, 1):
+            with self.subTest(result=result), redirect_stdout(io.StringIO()):
+                run = mock.Mock(return_value=result)
+                status = symbols.main(["--prepare-only"], {"FIREBASE_APP_ID": "1:123:android:abc"}, run)
+                self.assertEqual(status, result)
+                run.assert_called_once_with([])
+
+    def test_no_android_app_skips_bootstrap_without_touching_dependencies(self):
+        for value in ("", "1:123:ios:abc"):
+            with self.subTest(value=value), redirect_stdout(io.StringIO()):
+                run = mock.Mock()
+                self.assertEqual(symbols.main(["--prepare-only"], {"FIREBASE_APP_ID": value}, run), 0)
+                run.assert_not_called()
+
+    def test_bootstrap_precedes_flutter_compilation_and_keeps_upload_after_retention(self):
+        action = (Path(__file__).resolve().parents[1] / "action.yml").read_text()
+        self.assertLess(action.index("- name: Prepare Crashlytics symbol tools"),
+                        action.index("- name: Get Flutter dependencies"))
+        self.assertLess(action.index("- name: Retain Dart symbol files"),
+                        action.index("- name: Upload Dart symbols to Crashlytics"))
+        prepare = action.split("- name: Prepare Crashlytics symbol tools", 1)[1].split("- name:", 1)[0]
+        self.assertIn("project_kind == 'flutter'", prepare)
+        self.assertIn("FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}", prepare)
+        self.assertIn("--prepare-only", prepare)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_crashlytics_symbols_proxy.py

@@ -22,6 +22,7 @@ from urllib.parse import urlsplit
 proxy = urlsplit(os.environ['HTTPS_PROXY'])
 assert proxy.hostname == '127.0.0.1' and proxy.username is None
 assert os.environ['NO_PROXY'] == os.environ['no_proxy'] == ''
+assert os.environ['CRASHLYTICS_LOCAL_JAR'] == '/verified-fixture.jar'
 reply = urllib.request.urlopen('http://unresolvable.invalid/symbols', timeout=5).read()
 assert reply == b'through pinned proxy'
 Path(sys.argv[1]).write_text(json.dumps({'cwd': os.getcwd(), 'port': proxy.port}))
@@ -29,7 +30,8 @@ sys.exit(7)
 """
         with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, seen):
             result_path = Path(directory) / "result.json"
-            with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": proxy, "NO_PROXY": "*"}):
+            with mock.patch.dict(os.environ, {"GOOGLE_STORE_PROXY_URL": proxy, "NO_PROXY": "*"}), \
+                    mock.patch.object(symbols, "prepare_buildtools", return_value=Path("/verified-fixture.jar")):
                 rc = symbols._default_run([sys.executable, "-c", probe, str(result_path)])
             result = json.loads(result_path.read_text())
             self.assertEqual(rc, 7)

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.93
+1.0.94

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.93",
+  "version": "1.0.94",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {