gowalk-cicd 1.0.96 → 1.0.98

package/CLAUDE.md

@@ -165,6 +165,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   `flutter_download_failed` emits fixed transport codes and retained-byte counts, never curl stderr.
   Archive progress emits retained byte counts every minute and safe results after each attempt;
   the transfer deadline leaves room for a failure receipt before a 30-minute validation job ends.
+  With SDK caching enabled, failed archive transfers preserve public bytes in a job-owned,
+  digest-scoped directory. Separate optional cache restore/save steps retain them between runs;
+  they never expose partial bytes as an installed SDK. Successful or corrupt completed archives
+  are removed from that partial cache. Full SDK cache identities and provider transport stay unchanged.
 - Web Release selects bundled renderer resources with `--no-web-resources-cdn` inside
   the existing proxied build command. This is not a font or integration offline guarantee;
   preserve app-authored font declarations, bootstrap configuration and other build inputs.
@@ -223,6 +227,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie
   because a Flutter app also carries `android/settings.gradle`.
+- Both Android release compilers run through `android_build_diagnostics.py` inside the
+  existing proxy wrapper. It retains at most 64 KiB of private child output and publishes
+  only fixed signal names, phase and exit status in `android_build_failed`. An empty signal
+  list is unclassified, never a guessed cause; matching signals are observations, not a retry
+  decision. Minute progress notices replace raw compiler output. Preserve the actual exit,
+  command arguments, proxy environment, signing and symbol checks.
 - iOS plist stamping reads complete JSON build settings through `resolve_info_plist.py`,
   preserving Xcode's exit status and bounded sanitized stderr. Select exactly the configured
   bundle's application target and resolve paths from that target's source root; never take

package/README.md

@@ -314,6 +314,12 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | `source_maintenance_pending` | `gowalk-cicd/source-maintenance-pending.v1` | `repo`, `base_sha`, `head_sha`, `branch`, `run_id` |
 | `apple_build_upload_failed` (error) | `gowalk-cicd/apple-build-upload-failed.v2` | `category`, `stage`, `receipt_available`, receipt identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`, `provider_status`, `provider_code`, `provider_pointer`), `action` |
 | `flutter_download_failed` (error) | `gowalk-cicd/flutter-download-failed.v1` | `phase`, `curl_exit`, `http_status`, `proxy_status`, `attempts`, `retained_bytes` |
+| `android_build_failed` (error) | `gowalk-cicd/android-build-failed.v1` | `phase`, `exit_code`, `signals` (fixed observed patterns; empty means unclassified) |
+
+Android release compilers retain only a bounded private output window. Their failure signals
+describe observed error patterns, not retry permission or a unique root cause. Silent builds
+emit `android_build_progress` notices (`gowalk-cicd/android-build-progress.v1`) every minute
+with `phase` and `elapsed_seconds`; successful compiler output is not republished.
 
 SDK transfers also emit `flutter_download_progress` notices with schema
 `gowalk-cicd/flutter-download-progress.v1`. Each carries `phase`, `event`, `elapsed_ms`
@@ -321,6 +327,11 @@ and `retained_bytes`; `attempt_finished` adds `attempt`, `curl_exit`, `http_stat
 and `proxy_status`. In-progress notices arrive each minute; elapsed time belongs to
 the current attempt. Archives have a 20-minute total transfer budget so a failure
 receipt precedes a 30-minute validation job's deadline. Progress is not a success receipt.
+When SDK caching is enabled, an exhausted transfer preserves its partial public archive for
+the next run under a separate release-specific cache key. Resumption still uses the selected
+official manifest digest and the configured provider proxy; only a verified complete archive
+can reach SDK extraction. Partial-cache restore uses the existing one-minute cache segment
+bound. Optional cache operations do not extend the transfer deadline or turn a failed installation green.
 
 Add a field by bumping the schema version; never change the meaning of an
 existing one.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.96
+1.0.98

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.96
+1.0.98

package/android-action/action.yml

@@ -178,7 +178,9 @@ runs:
             *) echo "::error::dart-defines entry '$define' is not KEY=VALUE"; exit 1 ;;
           esac
         done
-        python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- flutter "${args[@]}"
+        python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- \
+          python3 "${{ github.action_path }}/scripts/android_build_diagnostics.py" --phase flutter_bundle -- \
+          flutter "${args[@]}"
         if ! ls "$DART_SYMBOLS_DIR"/*.symbols >/dev/null 2>&1; then
           echo "::error::flutter build wrote no Dart symbol files to $DART_SYMBOLS_DIR;" \
                "a crash from this obfuscated build could never be read. Refusing to ship it."
@@ -267,6 +269,7 @@ runs:
       run: |
         chmod +x ./gradlew
         python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- \
+          python3 "${{ github.action_path }}/scripts/android_build_diagnostics.py" --phase gradle_bundle -- \
           ./gradlew "${ANDROID_GRADLE_MODULE}:bundleRelease" \
           --init-script "${{ github.action_path }}/scripts/version_override.init.gradle" \
           --console=plain --stacktrace

package/android-action/flutter-setup/action.yml

@@ -138,6 +138,18 @@ runs:
     with:
       path: ${{ steps.flutter-action.outputs.PUB-CACHE-PATH }}
       key: ${{ steps.flutter-action.outputs.PUB-CACHE-KEY }}-${{ hashFiles('**/pubspec.lock') }}
+  - name: Restore interrupted Flutter archive
+    if: ${{ inputs.cache == 'true' && inputs.dry-run != 'true' && steps.cache-flutter.outputs.cache-hit != 'true' }}
+    uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25
+    continue-on-error: true
+    env:
+      NODE_OPTIONS: --require "${{ steps.scope.outputs.preloader }}"
+      SEGMENT_DOWNLOAD_TIMEOUT_MINS: '1'
+    with:
+      path: ${{ runner.temp }}/gowalk-flutter-archives
+      key: >-
+        flutter-archive-v1-${{ steps.flutter-action.outputs.CACHE-KEY }}-${{ github.run_id }}-${{ github.run_attempt }}
+      restore-keys: flutter-archive-v1-${{ steps.flutter-action.outputs.CACHE-KEY }}-
   - name: Install or reuse the resolved Flutter SDK
     id: install
     if: ${{ inputs.dry-run != 'true' }}
@@ -145,6 +157,8 @@ runs:
     env:
       BASH_ENV: ${{ steps.transport.outputs.manifest_env }}
       GOWALK_FLUTTER_MANIFEST_HELPER: ${{ steps.transport.outputs.manifest_helper }}
+      GOWALK_FLUTTER_ARCHIVE_CACHE: >-
+        ${{ inputs.cache == 'true' && format('{0}/gowalk-flutter-archives', runner.temp) || '' }}
     with:
       channel: ${{ steps.flutter-action.outputs.CHANNEL }}
       flutter-version: ${{ steps.flutter-action.outputs.VERSION }}
@@ -158,6 +172,18 @@ runs:
       pub-cache-path: ${{ steps.flutter-action.outputs.PUB-CACHE-PATH }}
       dry-run: 'false'
       git-source: ${{ inputs.git-source }}
+  - name: Preserve interrupted Flutter archive
+    if: >-
+      ${{ !cancelled() && inputs.cache == 'true' && steps.install.outcome == 'failure'
+          && steps.scope.outcome == 'success' }}
+    uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25
+    continue-on-error: true
+    env:
+      NODE_OPTIONS: --require "${{ steps.scope.outputs.preloader }}"
+    with:
+      path: ${{ runner.temp }}/gowalk-flutter-archives
+      key: >-
+        flutter-archive-v1-${{ steps.flutter-action.outputs.CACHE-KEY }}-${{ github.run_id }}-${{ github.run_attempt }}
   # A later app failure must not discard a successfully installed, expensive SDK.
   - name: Save installed Flutter SDK
     if: >-

package/android-action/scripts/android_build_diagnostics.py

@@ -0,0 +1,80 @@
+"""Run one Android compiler with bounded private output and fixed failure signals."""
+import argparse
+import json
+import subprocess
+import sys
+import threading
+import time
+
+LIMIT = 65536
+SIGNALS = {
+    "tls_verification": ("PKIX path building failed", "CERTIFICATE_VERIFY_FAILED", "certificate verify failed"),
+    "dependency_resolution": ("Could not resolve all files", "Could not resolve all artifacts", "Could not GET '"),
+    "connection_timeout": ("Connect timed out", "Read timed out", "Connection timed out"),
+    "kotlin_compilation": ("Compilation error. See log for more details", "Kotlin compilation failed"),
+    "dart_compilation": ("Target kernel_snapshot_program failed", "Target kernel_snapshot failed"),
+    "android_resources": ("Android resource linking failed", "Android resource compilation failed"),
+    "r8_missing_classes": ("Missing classes detected while running R8",),
+    "duplicate_classes": ("Duplicate class ",),
+    "manifest_merge": ("Manifest merger failed",),
+    "signing_configuration": ("Keystore was tampered with", "Keystore file ", "Failed to read key "),
+    "out_of_memory": ("java.lang.OutOfMemoryError", "Java heap space", "GC overhead limit exceeded"),
+    "gradle_daemon_lost": ("Gradle build daemon disappeared unexpectedly",),
+    "disk_full": ("No space left on device",),
+}
+
+
+def signals(output: bytes) -> list[str]:
+    text = output.decode("utf-8", errors="replace")
+    return sorted(name for name, patterns in SIGNALS.items() if any(pattern in text for pattern in patterns))
+
+
+def emit(title: str, level: str, **fields) -> None:
+    print(f"::{level} title={title}::" + json.dumps(fields, separators=(",", ":")), flush=True)
+
+
+def drain(stream, tail: bytearray) -> None:
+    while chunk := stream.read1(8192):
+        tail[:] = (tail + chunk)[-LIMIT:]
+
+
+def run(phase: str, command: list[str], *, interval: float = 60) -> int:
+    started, tail = time.monotonic(), bytearray()
+    try:
+        child = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    except OSError:
+        emit("android_build_failed", "error", schema="gowalk-cicd/android-build-failed.v1",
+             phase=phase, exit_code=127, signals=["command_start_failed"])
+        return 127
+    reader = threading.Thread(target=drain, args=(child.stdout, tail), daemon=True)
+    reader.start()
+    while True:
+        try:
+            code = child.wait(timeout=interval)
+            break
+        except subprocess.TimeoutExpired:
+            emit("android_build_progress", "notice", schema="gowalk-cicd/android-build-progress.v1",
+                 phase=phase, elapsed_seconds=int(time.monotonic() - started))
+    # A descendant retaining stdout must not hold a finished compiler's result indefinitely.
+    reader.join(timeout=1)
+    if not reader.is_alive():
+        child.stdout.close()
+    if code:
+        emit("android_build_failed", "error", schema="gowalk-cicd/android-build-failed.v1",
+             phase=phase, exit_code=code, signals=signals(bytes(tail)))
+    return code if code >= 0 else 128 - code
+
+
+def main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--phase", required=True, choices=("flutter_bundle", "gradle_bundle"))
+    parser.add_argument("command", nargs=argparse.REMAINDER)
+    args = parser.parse_args(argv)
+    command = args.command[1:] if args.command[:1] == ["--"] else args.command
+    if not command:
+        parser.error("a build command is required")
+    return run(args.phase, command)
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/android-action/scripts/flutter_archive_cache.py

@@ -0,0 +1,47 @@
+"""Keep only public SDK archive bytes in the job's optional, digest-scoped download cache."""
+from contextlib import contextmanager
+import os
+from pathlib import Path
+import tempfile
+
+import flutter_download
+
+
+def cached_directory() -> Path:
+    root = Path(os.environ["GOWALK_FLUTTER_ARCHIVE_CACHE"])
+    temporary = Path(os.environ["RUNNER_TEMP"]).resolve(strict=True)
+    if root.is_symlink() or root.parent.resolve(strict=True) != temporary:
+        raise ValueError("flutter_archive_cache_scope_invalid")
+    root.mkdir(mode=0o700, exist_ok=True)
+    directory = root / flutter_download.archive_digest()
+    if directory.is_symlink():
+        raise ValueError("flutter_archive_cache_scope_invalid")
+    directory.mkdir(mode=0o700, exist_ok=True)
+    destination = directory / "download"
+    if destination.is_symlink() or (destination.exists() and not destination.is_file()):
+        raise ValueError("flutter_archive_cache_scope_invalid")
+    if destination.exists() and destination.stat().st_size > flutter_download.MAX_ARCHIVE_BYTES:
+        raise ValueError("flutter_archive_size_exceeded")
+    return directory
+
+
+@contextmanager
+def workspace(kind: str):
+    if kind != "archive" or not os.environ.get("GOWALK_FLUTTER_ARCHIVE_CACHE"):
+        with tempfile.TemporaryDirectory(prefix="flutter-manifest-", dir=os.environ["RUNNER_TEMP"]) as scratch:
+            yield Path(scratch)
+        return
+    directory = cached_directory()
+    try:
+        yield directory
+    except ValueError as error:
+        if str(error) == "flutter_archive_checksum_mismatch":
+            (directory / "download").unlink(missing_ok=True)
+        raise
+
+
+def reuse_complete(destination: Path, kind: str) -> bool:
+    if kind != "archive" or not destination.stat().st_size or not flutter_download.archive_matches(destination):
+        return False
+    flutter_download.publish(destination, kind)
+    return True

package/android-action/scripts/flutter_download.py

@@ -63,18 +63,21 @@ def progress(destination: Path, started: float, event: str, **fields) -> None:
           file=sys.stderr, flush=True)
 
 
+def archive_matches(destination: Path) -> bool:
+    if destination.stat().st_size > MAX_ARCHIVE_BYTES:
+        raise ValueError("flutter_archive_size_exceeded")
+    digest = hashlib.sha256()
+    with destination.open("rb") as source:
+        for chunk in iter(lambda: source.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest() == archive_digest()
+
+
 def publish(destination: Path, kind: str) -> None:
     if kind == "manifest":
         json.loads(destination.read_bytes())
-    else:
-        if destination.stat().st_size > MAX_ARCHIVE_BYTES:
-            raise ValueError("flutter_archive_size_exceeded")
-        digest = hashlib.sha256()
-        with destination.open("rb") as source:
-            for chunk in iter(lambda: source.read(1024 * 1024), b""):
-                digest.update(chunk)
-        if digest.hexdigest() != archive_digest():
-            raise ValueError("flutter_archive_checksum_mismatch")
+    elif not archive_matches(destination):
+        raise ValueError("flutter_archive_checksum_mismatch")
     with destination.open("rb") as source:
         shutil.copyfileobj(source, sys.stdout.buffer, length=1024 * 1024)
 

package/android-action/scripts/flutter_manifest.py

@@ -5,11 +5,11 @@ import os
 from pathlib import Path
 import re
 import sys
-import tempfile
 import time
 from urllib.parse import urlsplit
 
 import flutter_download
+import flutter_archive_cache
 
 RETRY_CODES = {5, 6, 7, 18, 28, 35, 52, 55, 56, 92, 95}
 RETRY_HTTP = {408, 429, 500, 502, 503, 504}
@@ -24,8 +24,10 @@ def download(arguments: list[str], directory: Path) -> int:
     child_env = {**os.environ, "NO_PROXY": "", "no_proxy": ""}
     deadline, code, http, proxy_http = time.monotonic() + (60 if kind == "manifest" else 1200), 1, 0, 0
     destination = directory / "download"
-    destination.touch(mode=0o600, exist_ok=False)
+    destination.touch(mode=0o600, exist_ok=True)
     destination.chmod(0o600)
+    if flutter_archive_cache.reuse_complete(destination, kind):
+        return 0
     attempted = 0
     for attempt in range(1, 5):
         remaining = deadline - time.monotonic()
@@ -74,8 +76,11 @@ def request_kind(arguments):
 
 def main() -> int:
     try:
-        with tempfile.TemporaryDirectory(prefix="flutter-manifest-", dir=os.environ["RUNNER_TEMP"]) as scratch:
-            return download(sys.argv[1:], Path(scratch))
+        with flutter_archive_cache.workspace(request_kind(sys.argv[1:])) as scratch:
+            result = download(sys.argv[1:], scratch)
+            if result == 0:
+                (scratch / "download").unlink(missing_ok=True)
+            return result
     except (ValueError, OSError, KeyError) as error:
         safe = {"flutter_archive_digest_required", "flutter_archive_size_exceeded", "flutter_archive_checksum_mismatch"}
         reason = str(error) if str(error) in safe else "flutter_manifest_invalid_request_or_response"

package/android-action/scripts/test_android_build_diagnostics.py

@@ -0,0 +1,108 @@
+"""Exercise real child failures without publishing child output or altering its environment."""
+import contextlib
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+import android_build_diagnostics as diagnostics
+import yaml
+from test_jvm_proxy_relay import upstream
+
+
+class BuildDiagnosticsTests(unittest.TestCase):
+    def invoke(self, script, **kwargs):
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            code = diagnostics.run("flutter_bundle", [sys.executable, "-c", script], **kwargs)
+        rows = [json.loads(line.split("::", 2)[2]) for line in output.getvalue().splitlines()]
+        return code, rows, output.getvalue()
+
+    def test_child_failure_keeps_exit_and_only_fixed_signals(self):
+        code, rows, output = self.invoke(
+            "import sys; print('secret=do-not-publish https://user:password@example.test');"
+            "print('Missing classes detected while running R8'); sys.exit(42)"
+        )
+        self.assertEqual(code, 42)
+        self.assertEqual(rows, [{"schema": "gowalk-cicd/android-build-failed.v1", "phase": "flutter_bundle",
+                                 "exit_code": 42, "signals": ["r8_missing_classes"]}])
+        self.assertNotIn("password", output)
+        self.assertNotIn("do-not-publish", output)
+
+    def test_unknown_failure_never_guesses_or_echoes_output(self):
+        code, rows, output = self.invoke("import sys; print('private provider exception'); sys.exit(1)")
+        self.assertEqual(code, 1)
+        self.assertEqual(rows[0]["signals"], [])
+        self.assertNotIn("private provider", output)
+
+    def test_success_preserves_environment_and_arguments_without_echoing_them(self):
+        with mock.patch.dict(os.environ, {"HTTPS_PROXY": "http://private.invalid:9", "NO_PROXY": ""}):
+            code, rows, output = self.invoke(
+                "import os; assert os.environ['HTTPS_PROXY']=='http://private.invalid:9';"
+                "assert os.environ['NO_PROXY']==''; print('secret successful compiler output')"
+            )
+        self.assertEqual((code, rows, output), (0, [], ""))
+
+    def test_large_output_stays_bounded_and_recent_failures_are_retained(self):
+        tail = bytearray()
+        content = b"secret" * diagnostics.LIMIT + b"Android resource linking failed"
+        with io.BufferedReader(io.BytesIO(content)) as stream:
+            diagnostics.drain(stream, tail)
+        self.assertEqual(len(tail), diagnostics.LIMIT)
+        self.assertEqual(diagnostics.signals(tail), ["android_resources"])
+
+    def test_long_silent_build_emits_only_safe_progress(self):
+        code, rows, _ = self.invoke("import time; time.sleep(.12)", interval=.03)
+        self.assertEqual(code, 0)
+        self.assertTrue(rows)
+        for row in rows:
+            self.assertEqual(row["schema"], "gowalk-cicd/android-build-progress.v1")
+            self.assertEqual(row["phase"], "flutter_bundle")
+
+    def test_missing_program_has_typed_failure_without_argv(self):
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            code = diagnostics.run("gradle_bundle", ["/missing/private-program"])
+        self.assertEqual(code, 127)
+        self.assertNotIn("private-program", output.getvalue())
+        self.assertIn('"signals":["command_start_failed"]', output.getvalue())
+
+    def test_cli_forwards_exact_argument_vector(self):
+        with mock.patch.object(diagnostics, "run", return_value=7) as run:
+            self.assertEqual(diagnostics.main(["--phase", "gradle_bundle", "--", "./gradlew", "a b"]), 7)
+        run.assert_called_once_with("gradle_bundle", ["./gradlew", "a b"])
+
+    def test_real_release_step_keeps_proxy_and_compiler_arguments_on_failure(self):
+        root = Path(__file__).resolve().parents[1]
+        action = yaml.safe_load((root / "action.yml").read_text())
+        step = next(row for row in action["runs"]["steps"] if row["name"] == "Build release Android App Bundle")
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, _seen):
+            cwd = Path(directory)
+            flutter = cwd / "flutter"
+            flutter.write_text(f"#!{sys.executable}\nimport os,sys,json\nfrom pathlib import Path\n"
+                               "assert os.environ['HTTPS_PROXY'].startswith('http://127.0.0.1:')\n"
+                               "assert os.environ['NO_PROXY']==''\n"
+                               "Path('arguments.json').write_text(json.dumps(sys.argv[1:]))\n"
+                               "print('Missing classes detected while running R8: private-class')\nsys.exit(41)\n")
+            flutter.chmod(0o700)
+            env = {**os.environ, "GOOGLE_STORE_PROXY_URL": proxy, "PATH": directory + os.pathsep + os.environ["PATH"],
+                   "ANDROID_BUILD_NUMBER": "17", "BUILD_NAME": "", "DART_DEFINES": "",
+                   "DART_SYMBOLS_DIR": str(cwd / "symbols"), "NO_PROXY": "*", "HTTPS_PROXY": "http://wrong.invalid"}
+            script = step["run"].replace("${{ github.action_path }}", str(root))
+            result = subprocess.run(["bash", "-eo", "pipefail", "-c", script], cwd=cwd, env=env,
+                                    capture_output=True, text=True, timeout=20)
+            args = json.loads((cwd / "arguments.json").read_text())
+        self.assertEqual(result.returncode, 41, result.stdout + result.stderr)
+        self.assertIn("--obfuscate", args)
+        self.assertIn("--split-debug-info", args)
+        self.assertIn('"signals":["r8_missing_classes"]', result.stdout)
+        self.assertNotIn("private-class", result.stdout + result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_flutter_archive_cache.py

@@ -0,0 +1,102 @@
+"""A later job resumes retained public SDK bytes without bypassing digest or account checks."""
+import hashlib
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+from flutter_manifest_fixture import tls_proxy
+import test_flutter_archive as archive_fixture
+
+ARCHIVE, ROOT = archive_fixture.ARCHIVE, archive_fixture.ROOT
+DIGEST = hashlib.sha256(ARCHIVE).hexdigest()
+
+
+def invoke(root, server, cert, **kwargs):
+    with patch.dict(os.environ, {"GOWALK_FLUTTER_ARCHIVE_CACHE": str(root / "gowalk-flutter-archives")}):
+        return archive_fixture.ArchiveRecoveryTests().invoke(root, server, cert, **kwargs)
+
+
+class ArchiveCacheTests(unittest.TestCase):
+    def test_later_job_resumes_after_the_previous_job_exhausted_its_retries(self):
+        with tempfile.TemporaryDirectory() as first, tempfile.TemporaryDirectory() as second:
+            root, resumed = Path(first), Path(second)
+            with tls_proxy(root, ["partial", "range_partial", "range_partial", "range_partial"],
+                           ARCHIVE) as (server, cert):
+                result = invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (18, b""))
+            partial = root / "gowalk-flutter-archives" / DIGEST / "download"
+            self.assertEqual(partial.read_bytes(), ARCHIVE[:124])
+            shutil.copytree(root / "gowalk-flutter-archives", resumed / "gowalk-flutter-archives")
+            with tls_proxy(resumed, ["range"], ARCHIVE) as (server, cert):
+                result = invoke(resumed, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE))
+                self.assertEqual(server.ranges, ["bytes=124-"])
+            self.assertFalse((resumed / "gowalk-flutter-archives" / DIGEST / "download").exists())
+
+    def test_complete_cached_archive_is_verified_without_another_archive_request(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            partial = root / "gowalk-flutter-archives" / DIGEST / "download"
+            partial.parent.mkdir(parents=True)
+            partial.write_bytes(ARCHIVE)
+            with tls_proxy(root, [], ARCHIVE) as (server, cert):
+                result = invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout, server.connects), (0, ARCHIVE, 0))
+
+    def test_complete_cached_bytes_cannot_bypass_a_missing_proxy(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            partial = root / "gowalk-flutter-archives" / DIGEST / "download"
+            partial.parent.mkdir(parents=True)
+            partial.write_bytes(ARCHIVE)
+            env = {**os.environ, "RUNNER_TEMP": str(root), "GOWALK_FLUTTER_ARCHIVE_SHA256": DIGEST,
+                   "GOWALK_FLUTTER_ARCHIVE_CACHE": str(root / "gowalk-flutter-archives"),
+                   "HTTPS_PROXY": "", "https_proxy": ""}
+            url = "https://provider.invalid/flutter_infra_release/releases/stable/sdk.tar.xz"
+            result = subprocess.run([sys.executable, str(ROOT / "flutter_manifest.py"),
+                                     "--connect-timeout", "15", "--retry", "5", url],
+                                    env=env, capture_output=True, timeout=10)
+            self.assertEqual((result.returncode, result.stdout), (1, b""))
+            self.assertEqual(partial.read_bytes(), ARCHIVE)
+
+    def test_changed_digest_cannot_reuse_another_release_partial(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            foreign = root / "gowalk-flutter-archives" / ("a" * 64) / "download"
+            foreign.parent.mkdir(parents=True)
+            foreign.write_bytes(b"unrelated release")
+            with tls_proxy(root, ["ok"], ARCHIVE) as (server, cert):
+                result = invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE))
+                self.assertEqual(server.ranges, [""])
+            self.assertEqual(foreign.read_bytes(), b"unrelated release")
+
+    def test_corrupted_restored_partial_fails_verification_and_is_not_cached_again(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            partial = root / "gowalk-flutter-archives" / DIGEST / "download"
+            partial.parent.mkdir(parents=True)
+            partial.write_bytes(b"wrong bytes")
+            with tls_proxy(root, ["range"], ARCHIVE) as (server, cert):
+                result = invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout), (1, b""))
+                self.assertEqual(server.ranges, ["bytes=11-"])
+            self.assertFalse(partial.exists())
+
+    def test_symlinked_cache_does_not_read_or_write_another_directory(self):
+        with tempfile.TemporaryDirectory() as directory, tempfile.TemporaryDirectory() as outside:
+            root = Path(directory)
+            (root / "gowalk-flutter-archives").symlink_to(outside, target_is_directory=True)
+            with tls_proxy(root, [], ARCHIVE) as (server, cert):
+                result = invoke(root, server, cert)
+                self.assertEqual((result.returncode, result.stdout, server.connects), (1, b"", 0))
+            self.assertEqual(list(Path(outside).iterdir()), [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_google_bootstrap_wiring.py

@@ -24,7 +24,11 @@ class BootstrapWiringTests(unittest.TestCase):
                     self.assertNotIn("continue-on-error", step)
         self.assertEqual(checked, 3)
         setup = yaml.safe_load((ROOT / "android-action/flutter-setup/action.yml").read_text())
-        guard, scope, resolve, sdk_cache, pub_cache, install, save = setup["runs"]["steps"]
+        steps = setup["runs"]["steps"]
+        by_id = {step.get("id"): step for step in steps}
+        guard, scope, resolve, sdk_cache, pub_cache, install = (
+            by_id[name] for name in ("transport", "scope", "flutter-action", "cache-flutter", "cache-pub", "install"))
+        save = next(step for step in steps if step["name"] == "Save installed Flutter SDK")
         self.assertIn('play_store_proxy.py" --bootstrap-env', guard["run"])
         self.assertNotIn("continue-on-error", guard)
         self.assertTrue(scope["continue-on-error"])
@@ -32,9 +36,13 @@ class BootstrapWiringTests(unittest.TestCase):
         self.assertEqual(resolve["with"]["dry-run"], "true")
         for step in (resolve, install):
             self.assertEqual(step["uses"], "subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2")
-            self.assertEqual(step["env"], {
+            expected_env = {
                 "BASH_ENV": "${{ steps.transport.outputs.manifest_env }}",
-                "GOWALK_FLUTTER_MANIFEST_HELPER": "${{ steps.transport.outputs.manifest_helper }}"})
+                "GOWALK_FLUTTER_MANIFEST_HELPER": "${{ steps.transport.outputs.manifest_helper }}"}
+            if step is install:
+                expected_env["GOWALK_FLUTTER_ARCHIVE_CACHE"] = (
+                    "${{ inputs.cache == 'true' && format('{0}/gowalk-flutter-archives', runner.temp) || '' }}")
+            self.assertEqual(step["env"], expected_env)
             self.assertEqual(step["with"]["cache"], "false")
             self.assertEqual(step["with"]["pub-cache"], "false")
             self.assertNotIn("continue-on-error", step)
@@ -66,7 +74,8 @@ class BootstrapWiringTests(unittest.TestCase):
         self.assertEqual(restore["uses"],
                          "actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25")
         install = next(step for step in steps if step.get("id") == "install")
-        save = steps[steps.index(install) + 1]
+        save = next(step for step in steps if step["name"] == "Save installed Flutter SDK")
+        self.assertGreater(steps.index(save), steps.index(install))
         self.assertEqual(save["uses"], "actions/cache/save@caa296126883cff596d87d8935842f9db880ef25")
         self.assertEqual(save["with"], restore["with"])
         self.assertTrue(save["continue-on-error"])

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.96
+1.0.98

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.96",
+  "version": "1.0.98",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {