gowalk-cicd 1.0.95 → 1.0.97

package/CLAUDE.md

@@ -155,7 +155,7 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Unknown code or origins refuse; SDK setup, non-cache children and later steps retain their
   proxy requirement. Never export this scope through `GITHUB_ENV` or add cache domains to
   `NO_PROXY`. The preloader snapshot under `RUNNER_TEMP` also covers official post/save after
-  consumer autoupdate changes the action directory. The installer delivers this development
+  older consumer autoupdate changes the action directory. The installer delivers this development
   tooling for native iOS repositories too; it does not require an Android app.
 - Flutter manifest/archive GET recovery is scoped to the two pinned setup invocations through `BASH_ENV`.
   It retains the account proxy and allows four attempts within 60 seconds for manifests or 20 minutes
@@ -165,6 +165,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   `flutter_download_failed` emits fixed transport codes and retained-byte counts, never curl stderr.
   Archive progress emits retained byte counts every minute and safe results after each attempt;
   the transfer deadline leaves room for a failure receipt before a 30-minute validation job ends.
+  With SDK caching enabled, failed archive transfers preserve public bytes in a job-owned,
+  digest-scoped directory. Separate optional cache restore/save steps retain them between runs;
+  they never expose partial bytes as an installed SDK. Successful or corrupt completed archives
+  are removed from that partial cache. Full SDK cache identities and provider transport stay unchanged.
 - Web Release selects bundled renderer resources with `--no-web-resources-cdn` inside
   the existing proxied build command. This is not a font or integration offline guarantee;
   preserve app-authored font declarations, bootstrap configuration and other build inputs.
@@ -309,7 +313,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   from `${{ github.action_path }}` after that step. The plugin self-update
   (`autoupdate_check.sh`) runs right after the snapshot and preserves its own source candidate,
   before the version/signing/archive steps, so a red deploy still receives the
-  release that fixes it; the snapshot is what keeps that run on one version.
+  release that fixes it. `autoupdate_stage.py` installs and preserves that update in one
+  task-owned detached worktree, then removes it. The active build's HEAD, index, dirty files
+  and action manifests stay unchanged: GitHub reparses local composites for post hooks using
+  cached step IDs, so a script snapshot alone cannot protect a changed manifest's step count.
   `test_action_step_order.py` pins both. A new script reference in
   `action/action.yml` therefore uses `"$SWIFT_APP_ACTION/scripts/..."`.
 - Delivery dependencies may remain after a green job; each is a typed

package/README.md

@@ -321,6 +321,11 @@ and `retained_bytes`; `attempt_finished` adds `attempt`, `curl_exit`, `http_stat
 and `proxy_status`. In-progress notices arrive each minute; elapsed time belongs to
 the current attempt. Archives have a 20-minute total transfer budget so a failure
 receipt precedes a 30-minute validation job's deadline. Progress is not a success receipt.
+When SDK caching is enabled, an exhausted transfer preserves its partial public archive for
+the next run under a separate release-specific cache key. Resumption still uses the selected
+official manifest digest and the configured provider proxy; only a verified complete archive
+can reach SDK extraction. Partial-cache restore uses the existing one-minute cache segment
+bound. Optional cache operations do not extend the transfer deadline or turn a failed installation green.
 
 Add a field by bumping the schema version; never change the meaning of an
 existing one.
@@ -335,8 +340,10 @@ into its current task branch and land it through the normal checked PR, includin
 when later deploy steps fail. CI never pushes to the default branch or rebases its
 dirty build checkout; a failed preservation is a job failure. The run that
 performed the update keeps executing the version it started with: the action
-snapshots itself to `$RUNNER_TEMP` before anything mutates and reads every script
-and prompt from that copy.
+snapshots its scripts to `$RUNNER_TEMP`. Updates install and publish from a separate,
+owned detached worktree that is removed afterward. The active checkout's action
+manifests remain unchanged too: GitHub reloads local composites for post hooks using
+previously cached step IDs, so changing their step count can crash cleanup.
 
 ### Google Play upload retry
 
@@ -1011,7 +1018,7 @@ The vendored action ships with a per-run autoupdate check. On every
 push to your default branch, the action queries npm for the latest
 `gowalk-cicd`, compares against the local marker at
 `.github/actions/swift-app/.daemux-version`, and if newer, re-vendors
-the package via `npx --yes` and preserves the refreshed action files
+the package via `npx --yes` in a temporary detached worktree and preserves its action files
 on a verified task branch (under both `.github/actions/swift-app/` and
 `.github/actions/android-app/`).
 `.github/workflows/deploy.yml` is NEVER auto-committed — see

package/action/.daemux-version

@@ -1 +1 @@
-1.0.95
+1.0.97

package/action/action.yml

@@ -179,7 +179,7 @@ inputs:
     description: >
       Per-run check for a newer gowalk-cicd on npm. When 'true'
       (default), the action queries npm on default-branch push runs and
-      re-vendors the package via `npx --yes` if the published version is
+      installs the package in a detached worktree via `npx --yes` if its version is
       newer than the marker at .github/actions/swift-app/.daemux-version.
       The refreshed action files (NOT deploy.yml, which GITHUB_TOKEN
       cannot push) are retained on a verified task branch for the app session's
@@ -190,14 +190,9 @@ inputs:
 runs:
   using: composite
   steps:
-    # Every later step reads this action's scripts and prompts from the
-    # snapshot, never from ${action_path}. The autoupdate below re-vendors
-    # .github/actions/swift-app/ — the same directory as ${action_path} for
-    # local-action consumers — while this run is still executing the
-    # action.yml the runner loaded at job start. Reading scripts from the
-    # refreshed tree under the old step definitions is a mid-run version
-    # mix; one copy taken before anything mutates keeps the whole run on
-    # one version of the plugin.
+    # Keep every script and prompt on the version this invocation started with.
+    # Auto-update installs and publishes from a detached worktree; it never changes
+    # action manifests that the runner may reparse using already-cached step IDs.
     - name: Snapshot this action for the whole run
       shell: bash
       run: |
@@ -233,6 +228,8 @@ runs:
         mkdir -p "$RUNNER_TEMP/swift-app-bot-scripts"
         cp "$SWIFT_APP_ACTION/scripts/autoupdate_check.sh" \
           "$RUNNER_TEMP/swift-app-bot-scripts/"
+        cp "$SWIFT_APP_ACTION/scripts/autoupdate_stage.py" \
+          "$RUNNER_TEMP/swift-app-bot-scripts/"
         cp "$SWIFT_APP_ACTION/scripts/commit_bot_changes.sh" \
           "$RUNNER_TEMP/swift-app-bot-scripts/"
         cp "$SWIFT_APP_ACTION/scripts/source_maintenance.py" \
@@ -243,8 +240,8 @@ runs:
     - name: Check for app-ci update
       # Default branch + push event only. `auto-update` is on by default;
       # consumers can pin via `false`. Runs from $BOT_SCRIPTS_DIR
-      # (RUNNER_TEMP) so its own `npx` overwriting ${action_path} cannot
-      # swap the script under us.
+      # (RUNNER_TEMP); installation and candidate preservation run in an isolated
+      # checkout so current action manifests and scripts remain unchanged.
       if: ${{ inputs.auto-update == 'true'
             && github.event_name == 'push'
             && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
@@ -521,8 +518,7 @@ runs:
       # this action; this script is a no-op when nothing is staged, so a
       # PR / feature-branch run that somehow reaches this step does no
       # harm — but we still gate on default-branch push for clarity.
-      # Runs from $BOT_SCRIPTS_DIR (RUNNER_TEMP): the autoupdate re-vendored
-      # ${action_path} earlier in this run and must not swap scripts under us.
+      # Runs from the same immutable $BOT_SCRIPTS_DIR as the update candidate.
       if: ${{ (inputs.archive == 'true' || inputs.auto-update == 'true')
             && github.event_name == 'push'
             && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}

package/action/scripts/autoupdate_check.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# Checks npm for newer gowalk-cicd, re-vendors via npx if newer.
-# Stages refreshed files for commit. Exits 0 on no-op or non-fatal failure.
+# Checks npm for newer gowalk-cicd and preserves an isolated update candidate.
+# Exits 0 on no-op or package-install failure; unconfirmed source preservation fails.
 #
 # DESIGN DECISION (intentional, not a bug):
 # This script runs `npx --yes gowalk-cicd@<latest>` on every default-
@@ -53,66 +53,9 @@ if [[ "$current" == "$latest" ]]; then
   exit 0
 fi
 
-echo "autoupdate: $PKG $current -> $latest; re-vendoring"
-
-if ! npx --yes "$PKG@$latest"; then
-  echo "::warning::autoupdate: npx $PKG@$latest failed"
-  exit 0
-fi
-
-git config user.name  >/dev/null 2>&1 || git config user.name  "github-actions[bot]"
-git config user.email >/dev/null 2>&1 || \
-  git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-
-# NOTE: We deliberately do NOT stage .github/workflows/deploy.yml here.
-# GITHUB_TOKEN cannot push workflow-file changes regardless of
-# `permissions: contents: write` (GH security policy: prevents CI from
-# modifying its own triggers). Consumer-side deploy.yml updates require
-# manual `npx --yes gowalk-cicd` by the user. Document this in
-# the action README and changelog when shipping a deploy.yml schema change.
-
-# Stage everything under the vendored action dir EXCEPT Python bytecode
-# caches. The action's own scripts run during this CI job and Python
-# generates `__pycache__/*.pyc` files inside scripts/ as a side effect of
-# importing them. Those caches are build artifacts of *this* run, not part
-# of the action distribution -- sweeping them into the autoupdate bot
-# commit is benign but noisy (every clean run emits a "refresh
-# __pycache__" diff).
-#
-# DESIGN DECISION: use `git add -A` (stages additions, modifications, AND
-# deletions) instead of the previous `git ls-files -mo` flow. `ls-files
-# -mo` enumerates modified + other (untracked) paths but NOT deletions:
-# when an autoupdate cycle removes a script (e.g. `prepare_signing.py`
-# gets renamed to `prepare_signing_v2.py` in a new release), the old
-# file would stay tracked in the consumer repo forever -- the bot
-# commit would add the new file but never remove the orphan. `git add
-# -A` handles all three change kinds in one call. We then unstage any
-# pycache paths that the broad `-A` swept in.
-#
-# Force flag (`-f`) is implicit in `git add -A` for explicitly listed
-# pathspecs that match .gitignore patterns? No -- `-A` still honors
-# .gitignore for untracked files. To preserve the prior semantics
-# (consumer's .gitignore must not silently drop autoupdate-managed
-# files like `.daemux-version`), we pass `--force` explicitly.
-#
-# BSD xargs (default on macos-15 runners) does NOT support
-# `-r`/`--no-run-if-empty`, so we capture pycache paths into a variable
-# and skip the xargs call when empty -- portable across BSD and GNU.
-git add -A --force -- \
-  .github/actions/swift-app/ \
-  .github/actions/android-app/ 2>/dev/null || true
-
-# Unstage Python bytecode that the broad `-A` swept in. `git diff
-# --cached --name-only` lists every staged path; we filter to pycache
-# entries and `git reset HEAD --` to drop them from the index. Working
-# tree is left untouched (the .pyc files remain on disk; only their
-# index entries are removed).
-pycache="$(git diff --cached --name-only -- \
-  .github/actions/swift-app/ .github/actions/android-app/ \
-  | grep -E '(/__pycache__/|\.pyc$)' || true)"
-if [[ -n "$pycache" ]]; then
-  printf '%s\n' "$pycache" \
-    | tr '\n' '\0' \
-    | xargs -0 git reset HEAD -- 2>/dev/null || true
-fi
-echo "autoupdate: staged refreshed iOS + Android actions (deploy.yml not staged; __pycache__ excluded)"
+# The runner reparses local action.yml files for post hooks and reuses the step IDs
+# it cached before execution. Updating these files in place can change their step
+# count and crash cleanup. Publish the update candidate from a detached worktree;
+# the current job keeps its exact manifests, scripts, index and uncommitted source.
+echo "autoupdate: $PKG $current -> $latest; preparing an isolated source candidate"
+exec python3 "$(dirname "$0")/autoupdate_stage.py" "$latest"

package/action/scripts/autoupdate_stage.py

@@ -0,0 +1,62 @@
+"""Prepare CI updates away from action manifests the current runner may reload."""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+
+
+def git(root: Path, *args: str) -> str:
+    result = subprocess.run(["git", *args], cwd=root, capture_output=True,
+                            text=True, check=False, timeout=60)
+    if result.returncode:
+        raise RuntimeError("autoupdate_worktree_git_failed")
+    return result.stdout.strip()
+
+
+def stage(root: Path) -> None:
+    git(root, "add", "-A", "--force", "--", ".github/actions/swift-app/", ".github/actions/android-app/")
+    names = git(root, "diff", "--cached", "--name-only", "-z").split("\0")
+    bytecode = [name for name in names if "/__pycache__/" in name or name.endswith((".pyc", ".pyo"))]
+    if bytecode:
+        git(root, "reset", "--quiet", "HEAD", "--", *bytecode)
+
+
+def update(version: str) -> None:
+    if not re.fullmatch(r"\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?(?:\+[A-Za-z0-9.-]+)?", version):
+        raise RuntimeError("autoupdate_version_invalid")
+    root = Path.cwd()
+    base = git(root, "rev-parse", "HEAD")
+    parent = Path(tempfile.mkdtemp(prefix="app-ci-update-", dir=os.environ["RUNNER_TEMP"]))
+    worktree = parent / "checkout"
+    added = False
+    try:
+        git(root, "worktree", "add", "--detach", str(worktree), base)
+        added = True
+        result = subprocess.run(["npx", "--yes", "gowalk-cicd@" + version], cwd=worktree,
+                                check=False, timeout=180)
+        if result.returncode:
+            print("::warning::autoupdate: pinned package installation failed; keeping the current build")
+            return
+        stage(worktree)
+        script = Path(__file__).with_name("commit_bot_changes.sh")
+        result = subprocess.run(["bash", str(script)], cwd=worktree, check=False, timeout=180)
+        if result.returncode:
+            raise RuntimeError("autoupdate_source_preservation_failed")
+    finally:
+        if added:
+            git(root, "worktree", "remove", "--force", str(worktree))
+        shutil.rmtree(parent)
+
+
+if __name__ == "__main__":
+    try:
+        update(sys.argv[1])
+    except (RuntimeError, OSError, subprocess.SubprocessError) as exc:
+        code = str(exc) if isinstance(exc, RuntimeError) else "autoupdate_operation_unverified"
+        print("::error::" + code, file=sys.stderr)
+        raise SystemExit(1) from None

package/action/scripts/test_autoupdate_stage.py

@@ -0,0 +1,107 @@
+"""Exercise real isolated installs and protected-remote publication without changing a live action."""
+from pathlib import Path
+import re
+import subprocess
+import textwrap
+import unittest
+
+from source_maintenance_fixture import MaintenanceFixture
+
+
+class AutoupdateTests(MaintenanceFixture):
+    def setUp(self):
+        super().setUp()
+        self.remote_base = self.base
+        self.action = self.repo / ".github/actions/android-app/flutter-setup/action.yml"
+        self.marker = self.repo / ".github/actions/swift-app/.daemux-version"
+        self.action.parent.mkdir(parents=True)
+        self.marker.parent.mkdir(parents=True)
+        self.action.write_text("runs:\n  using: composite\n  steps:\n    - run: old\n      shell: bash\n")
+        self.marker.write_text("1.2.3")
+        self.git("add", ".github")
+        self.git("commit", "-m", "Existing action")
+        self.base = self.git("rev-parse", "HEAD").strip()
+        self.env["GITHUB_SHA"] = self.base
+        config = self.root / "checkout-auth.config"
+        self.git("config", "--file", str(config), "fixture.token", "worktree-allowed")
+        self.git("config", "includeIf.gitdir:" + str((self.repo / ".git").resolve()) + "/worktrees/*.path",
+                 str(config))
+        self.scratch = self.root / "runner-temp"
+        self.scratch.mkdir()
+        self.env["RUNNER_TEMP"] = str(self.scratch)
+        binary = self.root / "bin"
+        binary.mkdir()
+        (binary / "npm").write_text("#!/bin/sh\nprintf '1.2.4\\n'\n")
+        (binary / "npm").chmod(0o755)
+        self.installer = binary / "npx"
+        self.installer.write_text("#!/bin/sh\nset -eu\n"
+            "[ \"$1\" = --yes ] && [ \"$2\" = gowalk-cicd@1.2.4 ]\n"
+            "[ \"$(git config --get fixture.token)\" = worktree-allowed ]\n"
+            "printf '1.2.4' > .github/actions/swift-app/.daemux-version\n"
+            "printf '    - run: added\\n      shell: bash\\n' >> .github/actions/android-app/flutter-setup/action.yml\n"
+            "mkdir -p .github/workflows .github/actions/swift-app/scripts/__pycache__\n"
+            "printf 'never publish workflow' > .github/workflows/deploy.yml\n"
+            "printf 'never publish bytecode' > .github/actions/swift-app/scripts/__pycache__/test.pyc\n"
+            "exit ${INSTALL_EXIT:-0}\n")
+        self.installer.chmod(0o755)
+        self.env["PATH"] = str(binary) + ":" + self.env["PATH"]
+        self.script = Path(__file__).with_name("autoupdate_check.sh")
+
+    def assert_current_build_preserved(self, original, staged):
+        self.assertEqual(self.action.read_bytes(), original)
+        self.assertEqual(self.marker.read_text(), "1.2.3")
+        self.assertEqual(self.git("diff", "--cached"), staged)
+        self.assertEqual(self.git("rev-parse", "HEAD").strip(), self.base)
+        self.assertEqual(self.git("ls-remote", "origin", "refs/heads/main").split()[0], self.remote_base)
+        self.assertEqual(len(self.git("worktree", "list", "--porcelain").split("worktree ")) - 1, 1)
+        self.assertEqual(list(self.scratch.iterdir()), [])
+
+    def test_growing_composite_and_replay_preserve_current_build_and_publish_exact_update(self):
+        self.stage()
+        original, staged = self.action.read_bytes(), self.git("diff", "--cached")
+        first = self.receipt(self.run_script())
+        self.assert_current_build_preserved(original, staged)
+        updated = self.git("show", first["head_sha"] + ":.github/actions/android-app/flutter-setup/action.yml")
+        self.assertEqual(updated.count("- run:"), 2)
+        self.assertEqual(original.decode().count("- run:"), 1)
+        paths = self.git("diff", "--name-only", self.base, first["head_sha"]).splitlines()
+        self.assertEqual(paths, [".github/actions/android-app/flutter-setup/action.yml",
+                                 ".github/actions/swift-app/.daemux-version"])
+        self.assertEqual(self.receipt(self.run_script()), first)
+        self.assert_current_build_preserved(original, staged)
+
+    def test_failed_partial_install_keeps_current_action_and_cleans_owned_worktree(self):
+        self.stage()
+        original, staged = self.action.read_bytes(), self.git("diff", "--cached")
+        self.env["INSTALL_EXIT"] = "1"
+        result = self.run_script()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("pinned package installation failed", result.stdout)
+        self.assertNotIn("source_maintenance_pending", result.stdout)
+        self.assert_current_build_preserved(original, staged)
+        self.assertEqual(len(self.git("ls-remote", "--heads", "origin").splitlines()), 1)
+
+    def test_unconfirmed_preservation_is_not_a_success(self):
+        self.stage()
+        original, staged = self.action.read_bytes(), self.git("diff", "--cached")
+        self.hook.write_text("#!/bin/sh\nexit 1\n")
+        result = self.run_script()
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("autoupdate_source_preservation_failed", result.stderr)
+        self.assert_current_build_preserved(original, staged)
+
+    def test_actual_action_snapshot_can_execute_the_update_helper(self):
+        action = Path(__file__).resolve().parents[1]
+        source = (action / "action.yml").read_text()
+        block = re.search(r"    - name: Stage bot-side scripts to runner temp\n(.*?)(?=\n    - name:)",
+                          source, re.S)[1]
+        script = textwrap.dedent(block.split("      run: |\n", 1)[1])
+        self.env.update({"SWIFT_APP_ACTION": str(action), "GITHUB_ENV": str(self.root / "environment")})
+        subprocess.run(["bash", "-e", "-c", script], env=self.env, cwd=self.repo, check=True,
+                       text=True, capture_output=True, timeout=10)
+        self.script = self.scratch / "swift-app-bot-scripts/autoupdate_check.sh"
+        self.assertEqual(self.receipt(self.run_script())["base_sha"], self.base)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.95
+1.0.97

package/android-action/flutter-setup/action.yml

@@ -138,6 +138,18 @@ runs:
     with:
       path: ${{ steps.flutter-action.outputs.PUB-CACHE-PATH }}
       key: ${{ steps.flutter-action.outputs.PUB-CACHE-KEY }}-${{ hashFiles('**/pubspec.lock') }}
+  - name: Restore interrupted Flutter archive
+    if: ${{ inputs.cache == 'true' && inputs.dry-run != 'true' && steps.cache-flutter.outputs.cache-hit != 'true' }}
+    uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25
+    continue-on-error: true
+    env:
+      NODE_OPTIONS: --require "${{ steps.scope.outputs.preloader }}"
+      SEGMENT_DOWNLOAD_TIMEOUT_MINS: '1'
+    with:
+      path: ${{ runner.temp }}/gowalk-flutter-archives
+      key: >-
+        flutter-archive-v1-${{ steps.flutter-action.outputs.CACHE-KEY }}-${{ github.run_id }}-${{ github.run_attempt }}
+      restore-keys: flutter-archive-v1-${{ steps.flutter-action.outputs.CACHE-KEY }}-
   - name: Install or reuse the resolved Flutter SDK
     id: install
     if: ${{ inputs.dry-run != 'true' }}
@@ -145,6 +157,8 @@ runs:
     env:
       BASH_ENV: ${{ steps.transport.outputs.manifest_env }}
       GOWALK_FLUTTER_MANIFEST_HELPER: ${{ steps.transport.outputs.manifest_helper }}
+      GOWALK_FLUTTER_ARCHIVE_CACHE: >-
+        ${{ inputs.cache == 'true' && format('{0}/gowalk-flutter-archives', runner.temp) || '' }}
     with:
       channel: ${{ steps.flutter-action.outputs.CHANNEL }}
       flutter-version: ${{ steps.flutter-action.outputs.VERSION }}
@@ -158,6 +172,18 @@ runs:
       pub-cache-path: ${{ steps.flutter-action.outputs.PUB-CACHE-PATH }}
       dry-run: 'false'
       git-source: ${{ inputs.git-source }}
+  - name: Preserve interrupted Flutter archive
+    if: >-
+      ${{ !cancelled() && inputs.cache == 'true' && steps.install.outcome == 'failure'
+          && steps.scope.outcome == 'success' }}
+    uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25
+    continue-on-error: true
+    env:
+      NODE_OPTIONS: --require "${{ steps.scope.outputs.preloader }}"
+    with:
+      path: ${{ runner.temp }}/gowalk-flutter-archives
+      key: >-
+        flutter-archive-v1-${{ steps.flutter-action.outputs.CACHE-KEY }}-${{ github.run_id }}-${{ github.run_attempt }}
   # A later app failure must not discard a successfully installed, expensive SDK.
   - name: Save installed Flutter SDK
     if: >-

package/android-action/scripts/flutter_archive_cache.py

@@ -0,0 +1,47 @@
+"""Keep only public SDK archive bytes in the job's optional, digest-scoped download cache."""
+from contextlib import contextmanager
+import os
+from pathlib import Path
+import tempfile
+
+import flutter_download
+
+
+def cached_directory() -> Path:
+    root = Path(os.environ["GOWALK_FLUTTER_ARCHIVE_CACHE"])
+    temporary = Path(os.environ["RUNNER_TEMP"]).resolve(strict=True)
+    if root.is_symlink() or root.parent.resolve(strict=True) != temporary:
+        raise ValueError("flutter_archive_cache_scope_invalid")
+    root.mkdir(mode=0o700, exist_ok=True)
+    directory = root / flutter_download.archive_digest()
+    if directory.is_symlink():
+        raise ValueError("flutter_archive_cache_scope_invalid")
+    directory.mkdir(mode=0o700, exist_ok=True)
+    destination = directory / "download"
+    if destination.is_symlink() or (destination.exists() and not destination.is_file()):
+        raise ValueError("flutter_archive_cache_scope_invalid")
+    if destination.exists() and destination.stat().st_size > flutter_download.MAX_ARCHIVE_BYTES:
+        raise ValueError("flutter_archive_size_exceeded")
+    return directory
+
+
+@contextmanager
+def workspace(kind: str):
+    if kind != "archive" or not os.environ.get("GOWALK_FLUTTER_ARCHIVE_CACHE"):
+        with tempfile.TemporaryDirectory(prefix="flutter-manifest-", dir=os.environ["RUNNER_TEMP"]) as scratch:
+            yield Path(scratch)
+        return
+    directory = cached_directory()
+    try:
+        yield directory
+    except ValueError as error:
+        if str(error) == "flutter_archive_checksum_mismatch":
+            (directory / "download").unlink(missing_ok=True)
+        raise
+
+
+def reuse_complete(destination: Path, kind: str) -> bool:
+    if kind != "archive" or not destination.stat().st_size or not flutter_download.archive_matches(destination):
+        return False
+    flutter_download.publish(destination, kind)
+    return True

package/android-action/scripts/flutter_download.py

@@ -63,18 +63,21 @@ def progress(destination: Path, started: float, event: str, **fields) -> None:
           file=sys.stderr, flush=True)
 
 
+def archive_matches(destination: Path) -> bool:
+    if destination.stat().st_size > MAX_ARCHIVE_BYTES:
+        raise ValueError("flutter_archive_size_exceeded")
+    digest = hashlib.sha256()
+    with destination.open("rb") as source:
+        for chunk in iter(lambda: source.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest() == archive_digest()
+
+
 def publish(destination: Path, kind: str) -> None:
     if kind == "manifest":
         json.loads(destination.read_bytes())
-    else:
-        if destination.stat().st_size > MAX_ARCHIVE_BYTES:
-            raise ValueError("flutter_archive_size_exceeded")
-        digest = hashlib.sha256()
-        with destination.open("rb") as source:
-            for chunk in iter(lambda: source.read(1024 * 1024), b""):
-                digest.update(chunk)
-        if digest.hexdigest() != archive_digest():
-            raise ValueError("flutter_archive_checksum_mismatch")
+    elif not archive_matches(destination):
+        raise ValueError("flutter_archive_checksum_mismatch")
     with destination.open("rb") as source:
         shutil.copyfileobj(source, sys.stdout.buffer, length=1024 * 1024)
 

package/android-action/scripts/flutter_manifest.py

@@ -5,11 +5,11 @@ import os
 from pathlib import Path
 import re
 import sys
-import tempfile
 import time
 from urllib.parse import urlsplit
 
 import flutter_download
+import flutter_archive_cache
 
 RETRY_CODES = {5, 6, 7, 18, 28, 35, 52, 55, 56, 92, 95}
 RETRY_HTTP = {408, 429, 500, 502, 503, 504}
@@ -24,8 +24,10 @@ def download(arguments: list[str], directory: Path) -> int:
     child_env = {**os.environ, "NO_PROXY": "", "no_proxy": ""}
     deadline, code, http, proxy_http = time.monotonic() + (60 if kind == "manifest" else 1200), 1, 0, 0
     destination = directory / "download"
-    destination.touch(mode=0o600, exist_ok=False)
+    destination.touch(mode=0o600, exist_ok=True)
     destination.chmod(0o600)
+    if flutter_archive_cache.reuse_complete(destination, kind):
+        return 0
     attempted = 0
     for attempt in range(1, 5):
         remaining = deadline - time.monotonic()
@@ -74,8 +76,11 @@ def request_kind(arguments):
 
 def main() -> int:
     try:
-        with tempfile.TemporaryDirectory(prefix="flutter-manifest-", dir=os.environ["RUNNER_TEMP"]) as scratch:
-            return download(sys.argv[1:], Path(scratch))
+        with flutter_archive_cache.workspace(request_kind(sys.argv[1:])) as scratch:
+            result = download(sys.argv[1:], scratch)
+            if result == 0:
+                (scratch / "download").unlink(missing_ok=True)
+            return result
     except (ValueError, OSError, KeyError) as error:
         safe = {"flutter_archive_digest_required", "flutter_archive_size_exceeded", "flutter_archive_checksum_mismatch"}
         reason = str(error) if str(error) in safe else "flutter_manifest_invalid_request_or_response"

package/android-action/scripts/test_flutter_archive_cache.py

@@ -0,0 +1,102 @@
+"""A later job resumes retained public SDK bytes without bypassing digest or account checks."""
+import hashlib
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+from flutter_manifest_fixture import tls_proxy
+import test_flutter_archive as archive_fixture
+
+ARCHIVE, ROOT = archive_fixture.ARCHIVE, archive_fixture.ROOT
+DIGEST = hashlib.sha256(ARCHIVE).hexdigest()
+
+
+def invoke(root, server, cert, **kwargs):
+    with patch.dict(os.environ, {"GOWALK_FLUTTER_ARCHIVE_CACHE": str(root / "gowalk-flutter-archives")}):
+        return archive_fixture.ArchiveRecoveryTests().invoke(root, server, cert, **kwargs)
+
+
+class ArchiveCacheTests(unittest.TestCase):
+    def test_later_job_resumes_after_the_previous_job_exhausted_its_retries(self):
+        with tempfile.TemporaryDirectory() as first, tempfile.TemporaryDirectory() as second:
+            root, resumed = Path(first), Path(second)
+            with tls_proxy(root, ["partial", "range_partial", "range_partial", "range_partial"],
+                           ARCHIVE) as (server, cert):
+                result = invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (18, b""))
+            partial = root / "gowalk-flutter-archives" / DIGEST / "download"
+            self.assertEqual(partial.read_bytes(), ARCHIVE[:124])
+            shutil.copytree(root / "gowalk-flutter-archives", resumed / "gowalk-flutter-archives")
+            with tls_proxy(resumed, ["range"], ARCHIVE) as (server, cert):
+                result = invoke(resumed, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE))
+                self.assertEqual(server.ranges, ["bytes=124-"])
+            self.assertFalse((resumed / "gowalk-flutter-archives" / DIGEST / "download").exists())
+
+    def test_complete_cached_archive_is_verified_without_another_archive_request(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            partial = root / "gowalk-flutter-archives" / DIGEST / "download"
+            partial.parent.mkdir(parents=True)
+            partial.write_bytes(ARCHIVE)
+            with tls_proxy(root, [], ARCHIVE) as (server, cert):
+                result = invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout, server.connects), (0, ARCHIVE, 0))
+
+    def test_complete_cached_bytes_cannot_bypass_a_missing_proxy(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            partial = root / "gowalk-flutter-archives" / DIGEST / "download"
+            partial.parent.mkdir(parents=True)
+            partial.write_bytes(ARCHIVE)
+            env = {**os.environ, "RUNNER_TEMP": str(root), "GOWALK_FLUTTER_ARCHIVE_SHA256": DIGEST,
+                   "GOWALK_FLUTTER_ARCHIVE_CACHE": str(root / "gowalk-flutter-archives"),
+                   "HTTPS_PROXY": "", "https_proxy": ""}
+            url = "https://provider.invalid/flutter_infra_release/releases/stable/sdk.tar.xz"
+            result = subprocess.run([sys.executable, str(ROOT / "flutter_manifest.py"),
+                                     "--connect-timeout", "15", "--retry", "5", url],
+                                    env=env, capture_output=True, timeout=10)
+            self.assertEqual((result.returncode, result.stdout), (1, b""))
+            self.assertEqual(partial.read_bytes(), ARCHIVE)
+
+    def test_changed_digest_cannot_reuse_another_release_partial(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            foreign = root / "gowalk-flutter-archives" / ("a" * 64) / "download"
+            foreign.parent.mkdir(parents=True)
+            foreign.write_bytes(b"unrelated release")
+            with tls_proxy(root, ["ok"], ARCHIVE) as (server, cert):
+                result = invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE))
+                self.assertEqual(server.ranges, [""])
+            self.assertEqual(foreign.read_bytes(), b"unrelated release")
+
+    def test_corrupted_restored_partial_fails_verification_and_is_not_cached_again(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            partial = root / "gowalk-flutter-archives" / DIGEST / "download"
+            partial.parent.mkdir(parents=True)
+            partial.write_bytes(b"wrong bytes")
+            with tls_proxy(root, ["range"], ARCHIVE) as (server, cert):
+                result = invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (1, b""))
+                self.assertEqual(server.ranges, ["bytes=11-"])
+            self.assertFalse(partial.exists())
+
+    def test_symlinked_cache_does_not_read_or_write_another_directory(self):
+        with tempfile.TemporaryDirectory() as directory, tempfile.TemporaryDirectory() as outside:
+            root = Path(directory)
+            (root / "gowalk-flutter-archives").symlink_to(outside, target_is_directory=True)
+            with tls_proxy(root, [], ARCHIVE) as (server, cert):
+                result = invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout, server.connects), (1, b"", 0))
+            self.assertEqual(list(Path(outside).iterdir()), [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_google_bootstrap_wiring.py

@@ -24,7 +24,11 @@ class BootstrapWiringTests(unittest.TestCase):
                     self.assertNotIn("continue-on-error", step)
         self.assertEqual(checked, 3)
         setup = yaml.safe_load((ROOT / "android-action/flutter-setup/action.yml").read_text())
-        guard, scope, resolve, sdk_cache, pub_cache, install, save = setup["runs"]["steps"]
+        steps = setup["runs"]["steps"]
+        by_id = {step.get("id"): step for step in steps}
+        guard, scope, resolve, sdk_cache, pub_cache, install = (
+            by_id[name] for name in ("transport", "scope", "flutter-action", "cache-flutter", "cache-pub", "install"))
+        save = next(step for step in steps if step["name"] == "Save installed Flutter SDK")
         self.assertIn('play_store_proxy.py" --bootstrap-env', guard["run"])
         self.assertNotIn("continue-on-error", guard)
         self.assertTrue(scope["continue-on-error"])
@@ -32,9 +36,13 @@ class BootstrapWiringTests(unittest.TestCase):
         self.assertEqual(resolve["with"]["dry-run"], "true")
         for step in (resolve, install):
             self.assertEqual(step["uses"], "subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2")
-            self.assertEqual(step["env"], {
+            expected_env = {
                 "BASH_ENV": "${{ steps.transport.outputs.manifest_env }}",
-                "GOWALK_FLUTTER_MANIFEST_HELPER": "${{ steps.transport.outputs.manifest_helper }}"})
+                "GOWALK_FLUTTER_MANIFEST_HELPER": "${{ steps.transport.outputs.manifest_helper }}"}
+            if step is install:
+                expected_env["GOWALK_FLUTTER_ARCHIVE_CACHE"] = (
+                    "${{ inputs.cache == 'true' && format('{0}/gowalk-flutter-archives', runner.temp) || '' }}")
+            self.assertEqual(step["env"], expected_env)
             self.assertEqual(step["with"]["cache"], "false")
             self.assertEqual(step["with"]["pub-cache"], "false")
             self.assertNotIn("continue-on-error", step)
@@ -66,7 +74,8 @@ class BootstrapWiringTests(unittest.TestCase):
         self.assertEqual(restore["uses"],
                          "actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25")
         install = next(step for step in steps if step.get("id") == "install")
-        save = steps[steps.index(install) + 1]
+        save = next(step for step in steps if step["name"] == "Save installed Flutter SDK")
+        self.assertGreater(steps.index(save), steps.index(install))
         self.assertEqual(save["uses"], "actions/cache/save@caa296126883cff596d87d8935842f9db880ef25")
         self.assertEqual(save["with"], restore["with"])
         self.assertTrue(save["continue-on-error"])

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.95
+1.0.97

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.95",
+  "version": "1.0.97",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {