gowalk-cicd 1.0.94 → 1.0.96

package/CLAUDE.md

@@ -52,7 +52,9 @@ vendoring concept are gone.
 ## Publishing
 
 Auto-publish on every push to `main` (the entire repo IS the package). The
-workflow (`.github/workflows/publish.yml`):
+workflow (`.github/workflows/publish.yml`) serializes version selection through
+publication; PR checks use separate cancellable groups. This prevents concurrent
+main runs from choosing the same npm patch version. The workflow:
 
 1. Runs `scripts/auto-version.mjs .` which queries npm for the current
    published version of `gowalk-cicd` and bumps the patch. A first publish
@@ -153,7 +155,7 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Unknown code or origins refuse; SDK setup, non-cache children and later steps retain their
   proxy requirement. Never export this scope through `GITHUB_ENV` or add cache domains to
   `NO_PROXY`. The preloader snapshot under `RUNNER_TEMP` also covers official post/save after
-  consumer autoupdate changes the action directory. The installer delivers this development
+  older consumer autoupdate changes the action directory. The installer delivers this development
   tooling for native iOS repositories too; it does not require an Android app.
 - Flutter manifest/archive GET recovery is scoped to the two pinned setup invocations through `BASH_ENV`.
   It retains the account proxy and allows four attempts within 60 seconds for manifests or 20 minutes
@@ -196,7 +198,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   new app before GitHub registers `deploy-backend.yml` on the default branch.
   Default-branch deploys continue through the separate backend workflow.
 - Mobile pushes exclude durable `.factory/progress` records and the separately deployed
-  backend/server/Compose paths. A mixed commit with any native/shared input still builds;
+  backend/server/Compose paths, backend action, docs, marketing, account-recovery scripts,
+  tests and the standard validation/web workflows. Backend action changes trigger only backend
+  deployment; its package version marker alone does not. A mixed commit with any native/shared input still builds;
   explicit workflow dispatch remains available. Keep backend deployment's own path filters
   intact, and do not broadly exclude assets, root build settings or unknown app layouts.
 - Domain-backed backend deploys fail closed on certificate issuance and the
@@ -305,7 +309,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   from `${{ github.action_path }}` after that step. The plugin self-update
   (`autoupdate_check.sh`) runs right after the snapshot and preserves its own source candidate,
   before the version/signing/archive steps, so a red deploy still receives the
-  release that fixes it; the snapshot is what keeps that run on one version.
+  release that fixes it. `autoupdate_stage.py` installs and preserves that update in one
+  task-owned detached worktree, then removes it. The active build's HEAD, index, dirty files
+  and action manifests stay unchanged: GitHub reparses local composites for post hooks using
+  cached step IDs, so a script snapshot alone cannot protect a changed manifest's step count.
   `test_action_step_order.py` pins both. A new script reference in
   `action/action.yml` therefore uses `"$SWIFT_APP_ACTION/scripts/..."`.
 - Delivery dependencies may remain after a green job; each is a typed

package/README.md

@@ -26,6 +26,20 @@ are unaffected.
 
 Re-run the same command anytime to pull the latest version.
 
+Mobile releases run for changes to the app or its release inputs. Documentation,
+marketing, `tools/recovery/`, tests, `.factory/progress/`, backend-only changes and
+the standard validation/web workflows do not upload another mobile binary. Mixed
+commits still release when they change any app input, including embedded editors,
+assets and build scripts. Backend action changes deploy the backend; updating only
+its `.daemux-version` marker does not. Keep runtime assets outside these excluded
+directories, or customize the filters if your build deliberately includes them.
+
+These filters take effect after updating and committing the consumer workflow
+files with this installer; CI self-update refreshes action directories only.
+Follow an existing push-triggered release before dispatching another one. Manual
+dispatch remains available after an actual release-input or credential repair;
+it bypasses push path filters and can repeat a successful release.
+
 Flutter's optional SDK and pub cache restores have a one-minute timeout per
 download segment. A slow segment becomes a cache miss and normal SDK setup
 continues through the assigned Google proxy; SDK setup errors still fail the
@@ -321,8 +335,10 @@ into its current task branch and land it through the normal checked PR, includin
 when later deploy steps fail. CI never pushes to the default branch or rebases its
 dirty build checkout; a failed preservation is a job failure. The run that
 performed the update keeps executing the version it started with: the action
-snapshots itself to `$RUNNER_TEMP` before anything mutates and reads every script
-and prompt from that copy.
+snapshots its scripts to `$RUNNER_TEMP`. Updates install and publish from a separate,
+owned detached worktree that is removed afterward. The active checkout's action
+manifests remain unchanged too: GitHub reloads local composites for post hooks using
+previously cached step IDs, so changing their step count can crash cleanup.
 
 ### Google Play upload retry
 
@@ -997,7 +1013,7 @@ The vendored action ships with a per-run autoupdate check. On every
 push to your default branch, the action queries npm for the latest
 `gowalk-cicd`, compares against the local marker at
 `.github/actions/swift-app/.daemux-version`, and if newer, re-vendors
-the package via `npx --yes` and preserves the refreshed action files
+the package via `npx --yes` in a temporary detached worktree and preserves its action files
 on a verified task branch (under both `.github/actions/swift-app/` and
 `.github/actions/android-app/`).
 `.github/workflows/deploy.yml` is NEVER auto-committed — see

package/action/.daemux-version

@@ -1 +1 @@
-1.0.94
+1.0.96

package/action/action.yml

@@ -179,7 +179,7 @@ inputs:
     description: >
       Per-run check for a newer gowalk-cicd on npm. When 'true'
       (default), the action queries npm on default-branch push runs and
-      re-vendors the package via `npx --yes` if the published version is
+      installs the package in a detached worktree via `npx --yes` if its version is
       newer than the marker at .github/actions/swift-app/.daemux-version.
       The refreshed action files (NOT deploy.yml, which GITHUB_TOKEN
       cannot push) are retained on a verified task branch for the app session's
@@ -190,14 +190,9 @@ inputs:
 runs:
   using: composite
   steps:
-    # Every later step reads this action's scripts and prompts from the
-    # snapshot, never from ${action_path}. The autoupdate below re-vendors
-    # .github/actions/swift-app/ — the same directory as ${action_path} for
-    # local-action consumers — while this run is still executing the
-    # action.yml the runner loaded at job start. Reading scripts from the
-    # refreshed tree under the old step definitions is a mid-run version
-    # mix; one copy taken before anything mutates keeps the whole run on
-    # one version of the plugin.
+    # Keep every script and prompt on the version this invocation started with.
+    # Auto-update installs and publishes from a detached worktree; it never changes
+    # action manifests that the runner may reparse using already-cached step IDs.
     - name: Snapshot this action for the whole run
       shell: bash
       run: |
@@ -233,6 +228,8 @@ runs:
         mkdir -p "$RUNNER_TEMP/swift-app-bot-scripts"
         cp "$SWIFT_APP_ACTION/scripts/autoupdate_check.sh" \
           "$RUNNER_TEMP/swift-app-bot-scripts/"
+        cp "$SWIFT_APP_ACTION/scripts/autoupdate_stage.py" \
+          "$RUNNER_TEMP/swift-app-bot-scripts/"
         cp "$SWIFT_APP_ACTION/scripts/commit_bot_changes.sh" \
           "$RUNNER_TEMP/swift-app-bot-scripts/"
         cp "$SWIFT_APP_ACTION/scripts/source_maintenance.py" \
@@ -243,8 +240,8 @@ runs:
     - name: Check for app-ci update
       # Default branch + push event only. `auto-update` is on by default;
       # consumers can pin via `false`. Runs from $BOT_SCRIPTS_DIR
-      # (RUNNER_TEMP) so its own `npx` overwriting ${action_path} cannot
-      # swap the script under us.
+      # (RUNNER_TEMP); installation and candidate preservation run in an isolated
+      # checkout so current action manifests and scripts remain unchanged.
       if: ${{ inputs.auto-update == 'true'
             && github.event_name == 'push'
             && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
@@ -521,8 +518,7 @@ runs:
       # this action; this script is a no-op when nothing is staged, so a
       # PR / feature-branch run that somehow reaches this step does no
       # harm — but we still gate on default-branch push for clarity.
-      # Runs from $BOT_SCRIPTS_DIR (RUNNER_TEMP): the autoupdate re-vendored
-      # ${action_path} earlier in this run and must not swap scripts under us.
+      # Runs from the same immutable $BOT_SCRIPTS_DIR as the update candidate.
       if: ${{ (inputs.archive == 'true' || inputs.auto-update == 'true')
             && github.event_name == 'push'
             && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}

package/action/scripts/autoupdate_check.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# Checks npm for newer gowalk-cicd, re-vendors via npx if newer.
-# Stages refreshed files for commit. Exits 0 on no-op or non-fatal failure.
+# Checks npm for newer gowalk-cicd and preserves an isolated update candidate.
+# Exits 0 on no-op or package-install failure; unconfirmed source preservation fails.
 #
 # DESIGN DECISION (intentional, not a bug):
 # This script runs `npx --yes gowalk-cicd@<latest>` on every default-
@@ -53,66 +53,9 @@ if [[ "$current" == "$latest" ]]; then
   exit 0
 fi
 
-echo "autoupdate: $PKG $current -> $latest; re-vendoring"
-
-if ! npx --yes "$PKG@$latest"; then
-  echo "::warning::autoupdate: npx $PKG@$latest failed"
-  exit 0
-fi
-
-git config user.name  >/dev/null 2>&1 || git config user.name  "github-actions[bot]"
-git config user.email >/dev/null 2>&1 || \
-  git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-# NOTE: We deliberately do NOT stage .github/workflows/deploy.yml here.
-# GITHUB_TOKEN cannot push workflow-file changes regardless of
-# `permissions: contents: write` (GH security policy: prevents CI from
-# modifying its own triggers). Consumer-side deploy.yml updates require
-# manual `npx --yes gowalk-cicd` by the user. Document this in
-# the action README and changelog when shipping a deploy.yml schema change.
-
-# Stage everything under the vendored action dir EXCEPT Python bytecode
-# caches. The action's own scripts run during this CI job and Python
-# generates `__pycache__/*.pyc` files inside scripts/ as a side effect of
-# importing them. Those caches are build artifacts of *this* run, not part
-# of the action distribution -- sweeping them into the autoupdate bot
-# commit is benign but noisy (every clean run emits a "refresh
-# __pycache__" diff).
-#
-# DESIGN DECISION: use `git add -A` (stages additions, modifications, AND
-# deletions) instead of the previous `git ls-files -mo` flow. `ls-files
-# -mo` enumerates modified + other (untracked) paths but NOT deletions:
-# when an autoupdate cycle removes a script (e.g. `prepare_signing.py`
-# gets renamed to `prepare_signing_v2.py` in a new release), the old
-# file would stay tracked in the consumer repo forever -- the bot
-# commit would add the new file but never remove the orphan. `git add
-# -A` handles all three change kinds in one call. We then unstage any
-# pycache paths that the broad `-A` swept in.
-#
-# Force flag (`-f`) is implicit in `git add -A` for explicitly listed
-# pathspecs that match .gitignore patterns? No -- `-A` still honors
-# .gitignore for untracked files. To preserve the prior semantics
-# (consumer's .gitignore must not silently drop autoupdate-managed
-# files like `.daemux-version`), we pass `--force` explicitly.
-#
-# BSD xargs (default on macos-15 runners) does NOT support
-# `-r`/`--no-run-if-empty`, so we capture pycache paths into a variable
-# and skip the xargs call when empty -- portable across BSD and GNU.
-git add -A --force -- \
-  .github/actions/swift-app/ \
-  .github/actions/android-app/ 2>/dev/null || true
-
-# Unstage Python bytecode that the broad `-A` swept in. `git diff
-# --cached --name-only` lists every staged path; we filter to pycache
-# entries and `git reset HEAD --` to drop them from the index. Working
-# tree is left untouched (the .pyc files remain on disk; only their
-# index entries are removed).
-pycache="$(git diff --cached --name-only -- \
-  .github/actions/swift-app/ .github/actions/android-app/ \
-  | grep -E '(/__pycache__/|\.pyc$)' || true)"
-if [[ -n "$pycache" ]]; then
-  printf '%s\n' "$pycache" \
-    | tr '\n' '\0' \
-    | xargs -0 git reset HEAD -- 2>/dev/null || true
-fi
-echo "autoupdate: staged refreshed iOS + Android actions (deploy.yml not staged; __pycache__ excluded)"
+# The runner reparses local action.yml files for post hooks and reuses the step IDs
+# it cached before execution. Updating these files in place can change their step
+# count and crash cleanup. Publish the update candidate from a detached worktree;
+# the current job keeps its exact manifests, scripts, index and uncommitted source.
+echo "autoupdate: $PKG $current -> $latest; preparing an isolated source candidate"
+exec python3 "$(dirname "$0")/autoupdate_stage.py" "$latest"

package/action/scripts/autoupdate_stage.py

@@ -0,0 +1,62 @@
+"""Prepare CI updates away from action manifests the current runner may reload."""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+
+
+def git(root: Path, *args: str) -> str:
+    result = subprocess.run(["git", *args], cwd=root, capture_output=True,
+                            text=True, check=False, timeout=60)
+    if result.returncode:
+        raise RuntimeError("autoupdate_worktree_git_failed")
+    return result.stdout.strip()
+
+
+def stage(root: Path) -> None:
+    git(root, "add", "-A", "--force", "--", ".github/actions/swift-app/", ".github/actions/android-app/")
+    names = git(root, "diff", "--cached", "--name-only", "-z").split("\0")
+    bytecode = [name for name in names if "/__pycache__/" in name or name.endswith((".pyc", ".pyo"))]
+    if bytecode:
+        git(root, "reset", "--quiet", "HEAD", "--", *bytecode)
+
+
+def update(version: str) -> None:
+    if not re.fullmatch(r"\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?(?:\+[A-Za-z0-9.-]+)?", version):
+        raise RuntimeError("autoupdate_version_invalid")
+    root = Path.cwd()
+    base = git(root, "rev-parse", "HEAD")
+    parent = Path(tempfile.mkdtemp(prefix="app-ci-update-", dir=os.environ["RUNNER_TEMP"]))
+    worktree = parent / "checkout"
+    added = False
+    try:
+        git(root, "worktree", "add", "--detach", str(worktree), base)
+        added = True
+        result = subprocess.run(["npx", "--yes", "gowalk-cicd@" + version], cwd=worktree,
+                                check=False, timeout=180)
+        if result.returncode:
+            print("::warning::autoupdate: pinned package installation failed; keeping the current build")
+            return
+        stage(worktree)
+        script = Path(__file__).with_name("commit_bot_changes.sh")
+        result = subprocess.run(["bash", str(script)], cwd=worktree, check=False, timeout=180)
+        if result.returncode:
+            raise RuntimeError("autoupdate_source_preservation_failed")
+    finally:
+        if added:
+            git(root, "worktree", "remove", "--force", str(worktree))
+        shutil.rmtree(parent)
+
+
+if __name__ == "__main__":
+    try:
+        update(sys.argv[1])
+    except (RuntimeError, OSError, subprocess.SubprocessError) as exc:
+        code = str(exc) if isinstance(exc, RuntimeError) else "autoupdate_operation_unverified"
+        print("::error::" + code, file=sys.stderr)
+        raise SystemExit(1) from None

package/action/scripts/test_autoupdate_stage.py

@@ -0,0 +1,107 @@
+"""Exercise real isolated installs and protected-remote publication without changing a live action."""
+from pathlib import Path
+import re
+import subprocess
+import textwrap
+import unittest
+
+from source_maintenance_fixture import MaintenanceFixture
+
+
+class AutoupdateTests(MaintenanceFixture):
+    def setUp(self):
+        super().setUp()
+        self.remote_base = self.base
+        self.action = self.repo / ".github/actions/android-app/flutter-setup/action.yml"
+        self.marker = self.repo / ".github/actions/swift-app/.daemux-version"
+        self.action.parent.mkdir(parents=True)
+        self.marker.parent.mkdir(parents=True)
+        self.action.write_text("runs:\n  using: composite\n  steps:\n    - run: old\n      shell: bash\n")
+        self.marker.write_text("1.2.3")
+        self.git("add", ".github")
+        self.git("commit", "-m", "Existing action")
+        self.base = self.git("rev-parse", "HEAD").strip()
+        self.env["GITHUB_SHA"] = self.base
+        config = self.root / "checkout-auth.config"
+        self.git("config", "--file", str(config), "fixture.token", "worktree-allowed")
+        self.git("config", "includeIf.gitdir:" + str((self.repo / ".git").resolve()) + "/worktrees/*.path",
+                 str(config))
+        self.scratch = self.root / "runner-temp"
+        self.scratch.mkdir()
+        self.env["RUNNER_TEMP"] = str(self.scratch)
+        binary = self.root / "bin"
+        binary.mkdir()
+        (binary / "npm").write_text("#!/bin/sh\nprintf '1.2.4\\n'\n")
+        (binary / "npm").chmod(0o755)
+        self.installer = binary / "npx"
+        self.installer.write_text("#!/bin/sh\nset -eu\n"
+            "[ \"$1\" = --yes ] && [ \"$2\" = gowalk-cicd@1.2.4 ]\n"
+            "[ \"$(git config --get fixture.token)\" = worktree-allowed ]\n"
+            "printf '1.2.4' > .github/actions/swift-app/.daemux-version\n"
+            "printf '    - run: added\\n      shell: bash\\n' >> .github/actions/android-app/flutter-setup/action.yml\n"
+            "mkdir -p .github/workflows .github/actions/swift-app/scripts/__pycache__\n"
+            "printf 'never publish workflow' > .github/workflows/deploy.yml\n"
+            "printf 'never publish bytecode' > .github/actions/swift-app/scripts/__pycache__/test.pyc\n"
+            "exit ${INSTALL_EXIT:-0}\n")
+        self.installer.chmod(0o755)
+        self.env["PATH"] = str(binary) + ":" + self.env["PATH"]
+        self.script = Path(__file__).with_name("autoupdate_check.sh")
+
+    def assert_current_build_preserved(self, original, staged):
+        self.assertEqual(self.action.read_bytes(), original)
+        self.assertEqual(self.marker.read_text(), "1.2.3")
+        self.assertEqual(self.git("diff", "--cached"), staged)
+        self.assertEqual(self.git("rev-parse", "HEAD").strip(), self.base)
+        self.assertEqual(self.git("ls-remote", "origin", "refs/heads/main").split()[0], self.remote_base)
+        self.assertEqual(len(self.git("worktree", "list", "--porcelain").split("worktree ")) - 1, 1)
+        self.assertEqual(list(self.scratch.iterdir()), [])
+
+    def test_growing_composite_and_replay_preserve_current_build_and_publish_exact_update(self):
+        self.stage()
+        original, staged = self.action.read_bytes(), self.git("diff", "--cached")
+        first = self.receipt(self.run_script())
+        self.assert_current_build_preserved(original, staged)
+        updated = self.git("show", first["head_sha"] + ":.github/actions/android-app/flutter-setup/action.yml")
+        self.assertEqual(updated.count("- run:"), 2)
+        self.assertEqual(original.decode().count("- run:"), 1)
+        paths = self.git("diff", "--name-only", self.base, first["head_sha"]).splitlines()
+        self.assertEqual(paths, [".github/actions/android-app/flutter-setup/action.yml",
+                                 ".github/actions/swift-app/.daemux-version"])
+        self.assertEqual(self.receipt(self.run_script()), first)
+        self.assert_current_build_preserved(original, staged)
+
+    def test_failed_partial_install_keeps_current_action_and_cleans_owned_worktree(self):
+        self.stage()
+        original, staged = self.action.read_bytes(), self.git("diff", "--cached")
+        self.env["INSTALL_EXIT"] = "1"
+        result = self.run_script()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("pinned package installation failed", result.stdout)
+        self.assertNotIn("source_maintenance_pending", result.stdout)
+        self.assert_current_build_preserved(original, staged)
+        self.assertEqual(len(self.git("ls-remote", "--heads", "origin").splitlines()), 1)
+
+    def test_unconfirmed_preservation_is_not_a_success(self):
+        self.stage()
+        original, staged = self.action.read_bytes(), self.git("diff", "--cached")
+        self.hook.write_text("#!/bin/sh\nexit 1\n")
+        result = self.run_script()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("autoupdate_source_preservation_failed", result.stderr)
+        self.assert_current_build_preserved(original, staged)
+
+    def test_actual_action_snapshot_can_execute_the_update_helper(self):
+        action = Path(__file__).resolve().parents[1]
+        source = (action / "action.yml").read_text()
+        block = re.search(r"    - name: Stage bot-side scripts to runner temp\n(.*?)(?=\n    - name:)",
+                          source, re.S)[1]
+        script = textwrap.dedent(block.split("      run: |\n", 1)[1])
+        self.env.update({"SWIFT_APP_ACTION": str(action), "GITHUB_ENV": str(self.root / "environment")})
+        subprocess.run(["bash", "-e", "-c", script], env=self.env, cwd=self.repo, check=True,
+                       text=True, capture_output=True, timeout=10)
+        self.script = self.scratch / "swift-app-bot-scripts/autoupdate_check.sh"
+        self.assertEqual(self.receipt(self.run_script())["base_sha"], self.base)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.94
+1.0.96

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.94
+1.0.96

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.94",
+  "version": "1.0.96",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy-backend.yml

@@ -11,6 +11,8 @@ on:
       - "server/**"
       - "docker-compose.yml"
       - ".github/workflows/deploy-backend.yml"
+      - ".github/actions/backend-app/**"
+      - "!.github/actions/backend-app/.daemux-version"
   workflow_dispatch:
 
 permissions:

package/templates/deploy.yml

@@ -9,12 +9,22 @@ on:
       # Durable task records and independently deployed backend sources do not
       # change a native binary. Mixed commits still run when any mobile input changes.
       - '.factory/progress/**'
+      - 'docs/**'
+      - 'marketing/**'
+      - 'tools/recovery/**'
+      - 'test/**'
+      - 'tests/**'
+      - 'integration_test/**'
       - 'backend/**'
       - 'server/**'
       - 'docker-compose.yml'
       - '.github/workflows/deploy-backend.yml'
+      - '.github/workflows/deploy-web.yml'
+      - '.github/workflows/flutter-ci.yml'
+      - '.github/workflows/ios-ci.yml'
       - '.github/actions/swift-app/**'
       - '.github/actions/android-app/**'
+      - '.github/actions/backend-app/**'
   workflow_dispatch:
 
 permissions: