gowalk-cicd 1.0.97 → 1.0.99

package/CLAUDE.md

@@ -227,6 +227,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie
   because a Flutter app also carries `android/settings.gradle`.
+- Both Android release compilers run through `android_build_diagnostics.py` inside the
+  existing proxy wrapper. It retains at most 64 KiB of private child output and publishes
+  only fixed signal names, phase and exit status in `android_build_failed`. An empty signal
+  list is unclassified, never a guessed cause; matching signals are observations, not a retry
+  decision. Minute progress notices replace raw compiler output. Preserve the actual exit,
+  command arguments, proxy environment, signing and symbol checks.
 - iOS plist stamping reads complete JSON build settings through `resolve_info_plist.py`,
   preserving Xcode's exit status and bounded sanitized stderr. Select exactly the configured
   bundle's application target and resolve paths from that target's source root; never take
@@ -243,6 +249,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   dependency download or Google proxy requirement. Initial local lock resolution may use the
   explicit `--before-pods --initial-pods-lock` guard; CI never uses that development exception.
   These checks cover the declared native dependency graph, not arbitrary custom build-script traffic.
+  `native_bundle.py` honors the selected project's committed Gemfile/lock, falling back to
+  the repository root; missing gems install through the same relay with a frozen bundle.
+  Both Flutter configuration and the Pods helper use that bundle in their child process,
+  preserving Podfile.lock and the parent job environment. Deliver the workflow wrapper and
+  action helper together; action-only updates cannot repair earlier custom configuration steps.
 - Version stamping is per-build-system: Flutter takes `--build-number`, Gradle
   has no equivalent, so `set_gradle_version()` rewrites the literal in the
   checkout the way the iOS action patches the pbxproj. Never commit that edit.

package/README.md

@@ -48,6 +48,16 @@ and keeps existing cache keys. A successfully installed SDK is saved before app
 checks run, so a later test/build failure does not force another cold SDK download.
 Failed setup never saves an SDK cache; pub dependencies retain their job-end save.
 
+Native dependency preparation uses a committed `Gemfile` and `Gemfile.lock` beside
+the selected iOS project, falling back to the repository root. It installs missing
+bundle gems through the assigned Google relay and runs Pods with `bundle exec`.
+The Flutter workflow uses that same bundle before configuration can invoke Pods;
+Ruby settings remain scoped to those commands. Provide a Ruby/Bundler runtime
+compatible with the app's lockfile. Changed or uncommitted locks fail before delivery.
+When adopting this update, retain the `native_bundle.py` configuration wrapper in
+custom workflows as well as updating the action files. Apps without a Gemfile keep
+their existing CocoaPods runtime.
+
 ## Flutter web release
 
 The conditional `deploy-web.yml` workflow runs on changes to Flutter source,
@@ -314,6 +324,12 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | `source_maintenance_pending` | `gowalk-cicd/source-maintenance-pending.v1` | `repo`, `base_sha`, `head_sha`, `branch`, `run_id` |
 | `apple_build_upload_failed` (error) | `gowalk-cicd/apple-build-upload-failed.v2` | `category`, `stage`, `receipt_available`, receipt identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`, `provider_status`, `provider_code`, `provider_pointer`), `action` |
 | `flutter_download_failed` (error) | `gowalk-cicd/flutter-download-failed.v1` | `phase`, `curl_exit`, `http_status`, `proxy_status`, `attempts`, `retained_bytes` |
+| `android_build_failed` (error) | `gowalk-cicd/android-build-failed.v1` | `phase`, `exit_code`, `signals` (fixed observed patterns; empty means unclassified) |
+
+Android release compilers retain only a bounded private output window. Their failure signals
+describe observed error patterns, not retry permission or a unique root cause. Silent builds
+emit `android_build_progress` notices (`gowalk-cicd/android-build-progress.v1`) every minute
+with `phase` and `elapsed_seconds`; successful compiler output is not republished.
 
 SDK transfers also emit `flutter_download_progress` notices with schema
 `gowalk-cicd/flutter-download-progress.v1`. Each carries `phase`, `event`, `elapsed_ms`

package/action/.daemux-version

@@ -1 +1 @@
-1.0.97
+1.0.99

package/action/scripts/native_bundle.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""Use the app's committed Ruby bundle for native preparation without changing the job environment."""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import signal
+import subprocess
+import sys
+import tempfile
+
+import native_dependency_guard as guard
+from native_pods_diagnostics import refuse
+import native_pods_process
+
+
+def command(argv: list[str], cwd: Path, log) -> int:
+    try:
+        return native_pods_process.command(argv, cwd, log)
+    except native_pods_process.Interrupted:
+        raise guard.Refused("native_pods_operation_interrupted") from None
+    except (OSError, RuntimeError, subprocess.SubprocessError):
+        raise guard.Refused("native_pods_process_unverified") from None
+
+
+def committed(root: Path, path: Path, kind: str) -> str:
+    if not path.is_file() or path.is_symlink() or path.stat().st_size > 2 * 1024 * 1024:
+        raise guard.Refused(f"native_{kind}_required")
+    if not path.resolve().is_relative_to(root):
+        raise guard.Refused("native_bundle_path_unverified")
+    result = subprocess.run(["git", "show", "HEAD:" + path.relative_to(root).as_posix()],
+                            cwd=root, capture_output=True, check=False, timeout=15)
+    if result.returncode or result.stdout != path.read_bytes():
+        raise guard.Refused(f"native_{kind}_commit_required")
+    return hashlib.sha256(result.stdout).hexdigest()
+
+
+def unchanged(snapshot: dict[Path, str]) -> None:
+    for path, digest in snapshot.items():
+        if not path.is_file() or path.is_symlink() or hashlib.sha256(path.read_bytes()).hexdigest() != digest:
+            raise guard.Refused("native_bundle_inputs_changed")
+
+
+def prepare(root: Path, folder: Path, proxy_helper: Path, log) -> tuple[list[str], dict[Path, str]]:
+    gemfile = next((p for p in (folder / "Gemfile", root / "Gemfile") if p.exists() or p.is_symlink()), None)
+    if gemfile is None:
+        return [], {}
+    snapshot = {gemfile: committed(root, gemfile, "gemfile"),
+                gemfile.with_name("Gemfile.lock"): committed(root, gemfile.with_name("Gemfile.lock"), "gemfile_lock")}
+    prefix = ["/usr/bin/env", "BUNDLE_GEMFILE=" + str(gemfile), "BUNDLE_FROZEN=true",
+              "BUNDLE_PATH=" + (os.environ.get("BUNDLE_PATH") or str(root / ".factory/toolchain/gems"))]
+    relay = [sys.executable, str(proxy_helper), "--", *prefix, "bundle"]
+    if command([*relay, "check"], gemfile.parent, log):
+        if command([*relay, "install", "--jobs", "2", "--retry", "1"], gemfile.parent, log):
+            refuse("native_bundle_install_failed", log, guard.Refused)
+    unchanged(snapshot)
+    return [*prefix, "bundle", "exec"], snapshot
+
+
+def run(root: Path, folder: Path, proxy_helper: Path, argv: list[str]) -> dict:
+    root = root.resolve(strict=True)
+    folder = (root / folder).resolve(strict=True)
+    proxy_helper = proxy_helper.resolve(strict=True)
+    if not folder.is_relative_to(root) or not argv:
+        raise guard.Refused("native_bundle_path_unverified")
+    if (folder / "Podfile").is_symlink():
+        raise guard.Refused("native_workspace_reference_unverified")
+    pod_lock = folder / "Podfile.lock"
+    pod_snapshot = {pod_lock: committed(root, pod_lock, "podfile_lock")} if (folder / "Podfile").exists() else {}
+    with tempfile.TemporaryFile() as log:
+        if command([sys.executable, str(proxy_helper)], root, log):
+            raise guard.Refused("native_google_proxy_required")
+        prefix, snapshot = prepare(root, folder, proxy_helper, log)
+        if command([sys.executable, str(proxy_helper), "--", *prefix, *argv], root, log):
+            refuse("native_configuration_failed", log, guard.Refused)
+        unchanged(snapshot)
+        for path, digest in pod_snapshot.items():
+            if not path.is_file() or path.is_symlink() or hashlib.sha256(path.read_bytes()).hexdigest() != digest:
+                raise guard.Refused("native_podfile_lock_changed")
+    return {"ok": True, "ruby_bundle": "locked" if snapshot else "not_configured"}
+
+
+def interrupted(*_args) -> None:
+    raise KeyboardInterrupt
+
+
+def main(argv: list[str]) -> int:
+    signal.signal(signal.SIGTERM, interrupted)
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, default=Path.cwd())
+    parser.add_argument("--folder", type=Path, default=Path("ios"))
+    parser.add_argument("--proxy-helper", type=Path, required=True)
+    parser.add_argument("command", nargs=argparse.REMAINDER)
+    args = parser.parse_args(argv)
+    command_args = args.command[1:] if args.command[:1] == ["--"] else args.command
+    try:
+        answer = run(args.root, args.folder, args.proxy_helper, command_args)
+    except (guard.Refused, OSError, subprocess.SubprocessError) as exc:
+        code = str(exc) if isinstance(exc, guard.Refused) else "native_bundle_operation_unverified"
+        answer = {"ok": False, "code": code, "next": "Use the app's committed Gemfile and Gemfile.lock with a "
+                  "compatible Ruby/Bundler runtime; reconcile dependency locks locally and retain deployment guards."}
+        if getattr(exc, "diagnostic", ""):
+            answer["diagnostic"] = exc.diagnostic
+    print(json.dumps(answer, sort_keys=True))
+    return 0 if answer["ok"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

package/action/scripts/native_pods.py

@@ -13,8 +13,9 @@ import sys
 import tempfile
 
 import native_dependency_guard as guard
+import native_bundle
+from native_bundle import command
 from native_pods_diagnostics import refuse
-import native_pods_process
 
 
 def committed(root: Path, lock: Path) -> str:
@@ -27,15 +28,6 @@ def committed(root: Path, lock: Path) -> str:
     return hashlib.sha256(result.stdout).hexdigest()
 
 
-def command(argv: list[str], cwd: Path, log) -> int:
-    try:
-        return native_pods_process.command(argv, cwd, log)
-    except native_pods_process.Interrupted:
-        raise guard.Refused("native_pods_operation_interrupted") from None
-    except (OSError, RuntimeError, subprocess.SubprocessError):
-        raise guard.Refused("native_pods_process_unverified") from None
-
-
 def prepare(root: Path, container: str, proxy_helper: Path) -> dict:
     root = root.resolve(strict=True)
     folder = (root / container).parent.resolve(strict=True) if container else root
@@ -56,9 +48,12 @@ def prepare(root: Path, container: str, proxy_helper: Path) -> dict:
                 refuse("native_project_generation_failed", log, guard.Refused)
         initial = container or str(guard.selected(root, "", True).relative_to(root))
         guard.check(root, initial, before_pods=True)
-        if command([sys.executable, str(proxy_helper), "--", "pod", "install", "--deployment", "--no-repo-update"],
+        prefix, bundle_snapshot = native_bundle.prepare(root, folder, proxy_helper, log)
+        if command([sys.executable, str(proxy_helper), "--", *prefix, "pod", "install",
+                    "--deployment", "--no-repo-update"],
                    folder, log):
             refuse("native_pods_install_failed", log, guard.Refused)
+        native_bundle.unchanged(bundle_snapshot)
         if digest != hashlib.sha256((folder / "Podfile.lock").read_bytes()).hexdigest():
             raise guard.Refused("native_podfile_lock_changed")
         workspaces = sorted(folder.glob("*.xcworkspace"))

package/action/scripts/test_native_bundle.py

@@ -0,0 +1,97 @@
+"""Exercise real child scoping and committed bundle failures without contacting a provider."""
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+import native_bundle
+
+PROXY = Path(__file__).resolve().parents[2] / "android-action/scripts/play_store_proxy.py"
+
+
+class BundleTests(unittest.TestCase):
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory(prefix="native-bundle-test-")
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name).resolve()
+        (self.root / "ios").mkdir()
+        self.env = {**os.environ, "GOOGLE_STORE_PROXY_URL": "http://fixture:PRIVATE_SENTINEL@127.0.0.1:9",
+                    "PATH": str(self.root) + os.pathsep + os.environ["PATH"]}
+        self.env.pop("BUNDLE_PATH", None)
+        subprocess.run(["git", "init", "-q"], cwd=self.root, check=True, capture_output=True)
+        bundle = self.root / "bundle"
+        bundle.write_text('#!' + sys.executable + '\nimport os,sys\nfrom pathlib import Path\n'
+                          'if sys.argv[1] == "check": raise SystemExit(int(os.environ.get("COLD_BUNDLE", "0")))\n'
+                          'if sys.argv[1] == "install":\n'
+                          ' print("PRIVATE_SENTINEL")\n'
+                          ' if os.environ.get("CHANGE_LOCK"): Path("Gemfile.lock").write_text("changed")\n'
+                          ' raise SystemExit(int(os.environ.get("INSTALL_EXIT", "0")))\n'
+                          'assert sys.argv[1] == "exec"\n'
+                          'os.environ["FIXTURE_BUNDLE_ACTIVE"] = "yes"\n'
+                          'os.execvp(sys.argv[2], sys.argv[2:])\n')
+        bundle.chmod(0o700)
+
+    def commit(self, *files):
+        for name in files:
+            path = self.root / name
+            path.write_text("fixture " + name + "\n")
+        for argv in (["git", "add", *files],
+                     ["git", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                      "commit", "-qm", "Freeze fixture inputs"]):
+            subprocess.run(argv, cwd=self.root, check=True, capture_output=True)
+
+    def run_cli(self, script=None):
+        script = script or ('import json,os; from pathlib import Path; '
+                            'Path("child.json").write_text(json.dumps({k:os.environ.get(k) for k in '
+                            '["FIXTURE_BUNDLE_ACTIVE","BUNDLE_GEMFILE","BUNDLE_FROZEN","HTTPS_PROXY"]}))')
+        result = subprocess.run([sys.executable, native_bundle.__file__, "--root", str(self.root),
+                                 "--proxy-helper", str(PROXY), "--", sys.executable, "-c", script],
+                                cwd=self.root, env=self.env, capture_output=True, text=True, timeout=20)
+        self.assertNotIn("PRIVATE_SENTINEL", result.stdout + result.stderr)
+        return result.returncode, json.loads(result.stdout)
+
+    def test_unconfigured_app_keeps_the_proxied_command(self):
+        code, value = self.run_cli()
+        self.assertEqual((code, value["ruby_bundle"]), (0, "not_configured"))
+        child = json.loads((self.root / "child.json").read_text())
+        self.assertIsNone(child["FIXTURE_BUNDLE_ACTIVE"])
+        self.assertTrue(child["HTTPS_PROXY"].startswith("http://127.0.0.1:"))
+
+    def test_nearest_bundle_scopes_configuration_and_preserves_locks(self):
+        self.commit("Gemfile", "Gemfile.lock", "ios/Gemfile", "ios/Gemfile.lock", "ios/Podfile", "ios/Podfile.lock")
+        self.env["COLD_BUNDLE"] = "1"
+        code, value = self.run_cli()
+        self.assertEqual((code, value["ruby_bundle"]), (0, "locked"))
+        child = json.loads((self.root / "child.json").read_text())
+        self.assertEqual(child["FIXTURE_BUNDLE_ACTIVE"], "yes")
+        self.assertEqual(child["BUNDLE_GEMFILE"], str(self.root / "ios/Gemfile"))
+        self.assertEqual(child["BUNDLE_FROZEN"], "true")
+        self.assertTrue(child["HTTPS_PROXY"].startswith("http://127.0.0.1:"))
+
+    def test_uncommitted_or_modified_bundle_refuses_before_configuration(self):
+        (self.root / "Gemfile").write_text("uncommitted")
+        self.assertEqual(self.run_cli()[1]["code"], "native_gemfile_commit_required")
+        self.commit("Gemfile")
+        self.assertEqual(self.run_cli()[1]["code"], "native_gemfile_lock_required")
+        self.commit("Gemfile.lock")
+        (self.root / "Gemfile.lock").write_text("changed")
+        self.assertEqual(self.run_cli()[1]["code"], "native_gemfile_lock_commit_required")
+        self.assertFalse((self.root / "child.json").exists())
+
+    def test_install_failure_and_mutation_do_not_launch_configuration(self):
+        self.commit("Gemfile", "Gemfile.lock")
+        self.env.update(COLD_BUNDLE="1", INSTALL_EXIT="7")
+        self.assertEqual(self.run_cli()[1]["code"], "native_bundle_install_failed")
+        self.env.update(INSTALL_EXIT="0", CHANGE_LOCK="1")
+        self.assertEqual(self.run_cli()[1]["code"], "native_bundle_inputs_changed")
+        self.assertFalse((self.root / "child.json").exists())
+
+    def test_failed_configuration_and_generated_lock_drift_cannot_pass(self):
+        self.commit("Gemfile", "Gemfile.lock", "ios/Podfile", "ios/Podfile.lock")
+        code, value = self.run_cli('print("PRIVATE_SENTINEL"); raise SystemExit(7)')
+        self.assertEqual((code, value["code"]), (1, "native_configuration_failed"))
+        script = 'from pathlib import Path; Path("ios/Podfile.lock").write_text("new serializer")'
+        self.assertEqual(self.run_cli(script)[1]["code"], "native_podfile_lock_changed")

package/action/scripts/test_native_dependency_wiring.py

@@ -8,6 +8,15 @@ ACTION = Path(__file__).resolve().parents[1] / "action.yml"
 
 
 class WiringTests(unittest.TestCase):
+    def test_flutter_configuration_uses_the_same_bundle_before_pods(self):
+        template = ACTION.parents[1] / "templates/deploy.yml"
+        body = template.read_text().split("- name: Prepare Flutter iOS project\n", 1)[1].split("\n      - ", 1)[0]
+        shell = body.split("shell: >-\n", 1)[1].split("\n        env:", 1)[0]
+        self.assertIn(".github/actions/swift-app/scripts/native_bundle.py", shell)
+        self.assertIn("--folder ios --proxy-helper .github/actions/android-app/scripts/play_store_proxy.py", shell)
+        self.assertIn("-- bash --noprofile --norc -e -o pipefail {0}", shell)
+        self.assertIn("flutter build ios", body)
+
     def test_every_selected_xcode_step_has_its_own_preflight(self):
         source = ACTION.read_text()
         names = {name: step_block(source, name) for name in step_names(source)}

package/action/scripts/test_native_pods.py

@@ -56,6 +56,35 @@ class PodsTests(unittest.TestCase):
         self.env.pop("GOOGLE_STORE_PROXY_URL")
         self.assertEqual(self.run_cli()[1]["code"], "native_google_proxy_required")
 
+    def test_declared_bundle_controls_the_actual_pod_child(self):
+        self.locked()
+        (self.root / "Gemfile").write_text('source "https://rubygems.org"\ngem "cocoapods", "1.16.2"\n')
+        (self.root / "Gemfile.lock").write_text("fixture gem lock\n")
+        for argv in (["git", "add", "Gemfile", "Gemfile.lock"],
+                     ["git", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                      "commit", "-qm", "Declare the app bundle"]):
+            subprocess.run(argv, cwd=self.root, check=True, capture_output=True)
+        bundle = self.root / "bundle"
+        bundle.write_text('#!' + sys.executable + '\nimport os,sys\n'
+                          'if sys.argv[1] == "install": raise SystemExit(0)\n'
+                          'assert sys.argv[1] == "exec"\n'
+                          'os.environ["FIXTURE_BUNDLE_ACTIVE"] = "yes"\n'
+                          'os.execvp(sys.argv[2], sys.argv[2:])\n')
+        bundle.chmod(0o700)
+        pod = self.root / "pod"
+        pod.write_text('#!' + sys.executable + '\nimport os,json\nfrom pathlib import Path\n'
+                       'Path("bundle-child.json").write_text(json.dumps({k:os.environ.get(k) for k in '
+                       '["FIXTURE_BUNDLE_ACTIVE","BUNDLE_GEMFILE","BUNDLE_FROZEN","HTTPS_PROXY"]}))\n'
+                       'raise SystemExit(7)\n')
+        pod.chmod(0o700)
+        self.env["PATH"] = str(self.root) + os.pathsep + self.env["PATH"]
+        self.assertEqual(self.run_cli()[1]["code"], "native_pods_install_failed")
+        child = json.loads((self.root / "bundle-child.json").read_text())
+        self.assertEqual(child["FIXTURE_BUNDLE_ACTIVE"], "yes")
+        self.assertEqual(child["BUNDLE_GEMFILE"], str(self.root / "Gemfile"))
+        self.assertEqual(child["BUNDLE_FROZEN"], "true")
+        self.assertTrue(child["HTTPS_PROXY"].startswith("http://127.0.0.1:"))
+
     def test_real_child_has_relay_and_deployment_flags_and_preserves_failure(self):
         self.locked()
         script = self.root / "pod"

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.97
+1.0.99

package/android-action/action.yml

@@ -178,7 +178,9 @@ runs:
             *) echo "::error::dart-defines entry '$define' is not KEY=VALUE"; exit 1 ;;
           esac
         done
-        python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- flutter "${args[@]}"
+        python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- \
+          python3 "${{ github.action_path }}/scripts/android_build_diagnostics.py" --phase flutter_bundle -- \
+          flutter "${args[@]}"
         if ! ls "$DART_SYMBOLS_DIR"/*.symbols >/dev/null 2>&1; then
           echo "::error::flutter build wrote no Dart symbol files to $DART_SYMBOLS_DIR;" \
                "a crash from this obfuscated build could never be read. Refusing to ship it."
@@ -267,6 +269,7 @@ runs:
       run: |
         chmod +x ./gradlew
         python3 "${{ github.action_path }}/scripts/play_store_proxy.py" -- \
+          python3 "${{ github.action_path }}/scripts/android_build_diagnostics.py" --phase gradle_bundle -- \
           ./gradlew "${ANDROID_GRADLE_MODULE}:bundleRelease" \
           --init-script "${{ github.action_path }}/scripts/version_override.init.gradle" \
           --console=plain --stacktrace

package/android-action/scripts/android_build_diagnostics.py

@@ -0,0 +1,80 @@
+"""Run one Android compiler with bounded private output and fixed failure signals."""
+import argparse
+import json
+import subprocess
+import sys
+import threading
+import time
+
+LIMIT = 65536
+SIGNALS = {
+    "tls_verification": ("PKIX path building failed", "CERTIFICATE_VERIFY_FAILED", "certificate verify failed"),
+    "dependency_resolution": ("Could not resolve all files", "Could not resolve all artifacts", "Could not GET '"),
+    "connection_timeout": ("Connect timed out", "Read timed out", "Connection timed out"),
+    "kotlin_compilation": ("Compilation error. See log for more details", "Kotlin compilation failed"),
+    "dart_compilation": ("Target kernel_snapshot_program failed", "Target kernel_snapshot failed"),
+    "android_resources": ("Android resource linking failed", "Android resource compilation failed"),
+    "r8_missing_classes": ("Missing classes detected while running R8",),
+    "duplicate_classes": ("Duplicate class ",),
+    "manifest_merge": ("Manifest merger failed",),
+    "signing_configuration": ("Keystore was tampered with", "Keystore file ", "Failed to read key "),
+    "out_of_memory": ("java.lang.OutOfMemoryError", "Java heap space", "GC overhead limit exceeded"),
+    "gradle_daemon_lost": ("Gradle build daemon disappeared unexpectedly",),
+    "disk_full": ("No space left on device",),
+}
+
+
+def signals(output: bytes) -> list[str]:
+    text = output.decode("utf-8", errors="replace")
+    return sorted(name for name, patterns in SIGNALS.items() if any(pattern in text for pattern in patterns))
+
+
+def emit(title: str, level: str, **fields) -> None:
+    print(f"::{level} title={title}::" + json.dumps(fields, separators=(",", ":")), flush=True)
+
+
+def drain(stream, tail: bytearray) -> None:
+    while chunk := stream.read1(8192):
+        tail[:] = (tail + chunk)[-LIMIT:]
+
+
+def run(phase: str, command: list[str], *, interval: float = 60) -> int:
+    started, tail = time.monotonic(), bytearray()
+    try:
+        child = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
+    except OSError:
+        emit("android_build_failed", "error", schema="gowalk-cicd/android-build-failed.v1",
+             phase=phase, exit_code=127, signals=["command_start_failed"])
+        return 127
+    reader = threading.Thread(target=drain, args=(child.stdout, tail), daemon=True)
+    reader.start()
+    while True:
+        try:
+            code = child.wait(timeout=interval)
+            break
+        except subprocess.TimeoutExpired:
+            emit("android_build_progress", "notice", schema="gowalk-cicd/android-build-progress.v1",
+                 phase=phase, elapsed_seconds=int(time.monotonic() - started))
+    # A descendant retaining stdout must not hold a finished compiler's result indefinitely.
+    reader.join(timeout=1)
+    if not reader.is_alive():
+        child.stdout.close()
+    if code:
+        emit("android_build_failed", "error", schema="gowalk-cicd/android-build-failed.v1",
+             phase=phase, exit_code=code, signals=signals(bytes(tail)))
+    return code if code >= 0 else 128 - code
+
+
+def main(argv: list[str]) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--phase", required=True, choices=("flutter_bundle", "gradle_bundle"))
+    parser.add_argument("command", nargs=argparse.REMAINDER)
+    args = parser.parse_args(argv)
+    command = args.command[1:] if args.command[:1] == ["--"] else args.command
+    if not command:
+        parser.error("a build command is required")
+    return run(args.phase, command)
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/android-action/scripts/test_android_build_diagnostics.py

@@ -0,0 +1,108 @@
+"""Exercise real child failures without publishing child output or altering its environment."""
+import contextlib
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+import android_build_diagnostics as diagnostics
+import yaml
+from test_jvm_proxy_relay import upstream
+
+
+class BuildDiagnosticsTests(unittest.TestCase):
+    def invoke(self, script, **kwargs):
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            code = diagnostics.run("flutter_bundle", [sys.executable, "-c", script], **kwargs)
+        rows = [json.loads(line.split("::", 2)[2]) for line in output.getvalue().splitlines()]
+        return code, rows, output.getvalue()
+
+    def test_child_failure_keeps_exit_and_only_fixed_signals(self):
+        code, rows, output = self.invoke(
+            "import sys; print('secret=do-not-publish https://user:password@example.test');"
+            "print('Missing classes detected while running R8'); sys.exit(42)"
+        )
+        self.assertEqual(code, 42)
+        self.assertEqual(rows, [{"schema": "gowalk-cicd/android-build-failed.v1", "phase": "flutter_bundle",
+                                 "exit_code": 42, "signals": ["r8_missing_classes"]}])
+        self.assertNotIn("password", output)
+        self.assertNotIn("do-not-publish", output)
+
+    def test_unknown_failure_never_guesses_or_echoes_output(self):
+        code, rows, output = self.invoke("import sys; print('private provider exception'); sys.exit(1)")
+        self.assertEqual(code, 1)
+        self.assertEqual(rows[0]["signals"], [])
+        self.assertNotIn("private provider", output)
+
+    def test_success_preserves_environment_and_arguments_without_echoing_them(self):
+        with mock.patch.dict(os.environ, {"HTTPS_PROXY": "http://private.invalid:9", "NO_PROXY": ""}):
+            code, rows, output = self.invoke(
+                "import os; assert os.environ['HTTPS_PROXY']=='http://private.invalid:9';"
+                "assert os.environ['NO_PROXY']==''; print('secret successful compiler output')"
+            )
+        self.assertEqual((code, rows, output), (0, [], ""))
+
+    def test_large_output_stays_bounded_and_recent_failures_are_retained(self):
+        tail = bytearray()
+        content = b"secret" * diagnostics.LIMIT + b"Android resource linking failed"
+        with io.BufferedReader(io.BytesIO(content)) as stream:
+            diagnostics.drain(stream, tail)
+        self.assertEqual(len(tail), diagnostics.LIMIT)
+        self.assertEqual(diagnostics.signals(tail), ["android_resources"])
+
+    def test_long_silent_build_emits_only_safe_progress(self):
+        code, rows, _ = self.invoke("import time; time.sleep(.12)", interval=.03)
+        self.assertEqual(code, 0)
+        self.assertTrue(rows)
+        for row in rows:
+            self.assertEqual(row["schema"], "gowalk-cicd/android-build-progress.v1")
+            self.assertEqual(row["phase"], "flutter_bundle")
+
+    def test_missing_program_has_typed_failure_without_argv(self):
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            code = diagnostics.run("gradle_bundle", ["/missing/private-program"])
+        self.assertEqual(code, 127)
+        self.assertNotIn("private-program", output.getvalue())
+        self.assertIn('"signals":["command_start_failed"]', output.getvalue())
+
+    def test_cli_forwards_exact_argument_vector(self):
+        with mock.patch.object(diagnostics, "run", return_value=7) as run:
+            self.assertEqual(diagnostics.main(["--phase", "gradle_bundle", "--", "./gradlew", "a b"]), 7)
+        run.assert_called_once_with("gradle_bundle", ["./gradlew", "a b"])
+
+    def test_real_release_step_keeps_proxy_and_compiler_arguments_on_failure(self):
+        root = Path(__file__).resolve().parents[1]
+        action = yaml.safe_load((root / "action.yml").read_text())
+        step = next(row for row in action["runs"]["steps"] if row["name"] == "Build release Android App Bundle")
+        with tempfile.TemporaryDirectory() as directory, upstream() as (proxy, _seen):
+            cwd = Path(directory)
+            flutter = cwd / "flutter"
+            flutter.write_text(f"#!{sys.executable}\nimport os,sys,json\nfrom pathlib import Path\n"
+                               "assert os.environ['HTTPS_PROXY'].startswith('http://127.0.0.1:')\n"
+                               "assert os.environ['NO_PROXY']==''\n"
+                               "Path('arguments.json').write_text(json.dumps(sys.argv[1:]))\n"
+                               "print('Missing classes detected while running R8: private-class')\nsys.exit(41)\n")
+            flutter.chmod(0o700)
+            env = {**os.environ, "GOOGLE_STORE_PROXY_URL": proxy, "PATH": directory + os.pathsep + os.environ["PATH"],
+                   "ANDROID_BUILD_NUMBER": "17", "BUILD_NAME": "", "DART_DEFINES": "",
+                   "DART_SYMBOLS_DIR": str(cwd / "symbols"), "NO_PROXY": "*", "HTTPS_PROXY": "http://wrong.invalid"}
+            script = step["run"].replace("${{ github.action_path }}", str(root))
+            result = subprocess.run(["bash", "-eo", "pipefail", "-c", script], cwd=cwd, env=env,
+                                    capture_output=True, text=True, timeout=20)
+            args = json.loads((cwd / "arguments.json").read_text())
+        self.assertEqual(result.returncode, 41, result.stdout + result.stderr)
+        self.assertIn("--obfuscate", args)
+        self.assertIn("--split-debug-info", args)
+        self.assertIn('"signals":["r8_missing_classes"]', result.stdout)
+        self.assertNotIn("private-class", result.stdout + result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.97
+1.0.99

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.97",
+  "version": "1.0.99",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -142,7 +142,8 @@ jobs:
       - name: Prepare Flutter iOS project
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
         shell: >-
-          python3 .github/actions/android-app/scripts/play_store_proxy.py
+          python3 .github/actions/swift-app/scripts/native_bundle.py
+          --folder ios --proxy-helper .github/actions/android-app/scripts/play_store_proxy.py
           -- bash --noprofile --norc -e -o pipefail {0}
         env:
           ONBOARDING_PUBLIC_ORIGIN: ${{ vars.ONBOARDING_PUBLIC_ORIGIN }}