gowalk-cicd 1.0.98 → 1.0.100

package/CLAUDE.md

@@ -183,6 +183,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Save only on a cache miss with caching enabled, a real successful install and verified cache
   scope. Preserve resolved keys/paths and the official pinned restore/save programs. Failed or
   dry-run setup never publishes an SDK cache; pub dependency caching retains its job-end behavior.
+- Exact `flutter-version` inputs may reuse previously resolved public release metadata before SDK
+  cache lookup. Metadata is scoped to platform, origin, channel, architecture and full version;
+  URL/pin/schema/release fields are checked before reuse. Blank, wildcard and version-file inputs
+  resolve online. Missing or invalid metadata falls back to the required proxied GET; missing
+  account transport still refuses even with a warm cache. SDK keys and checksum checks stay unchanged.
 - Gradle caches use explicit checksum-pinned restore/save actions, each optional and bounded
   to two minutes. Preserve setup-java's key inputs and absolute cache paths to reuse existing
   caches. Java setup, builds and store uploads remain mandatory; save runs after delivery.
@@ -249,6 +254,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   dependency download or Google proxy requirement. Initial local lock resolution may use the
   explicit `--before-pods --initial-pods-lock` guard; CI never uses that development exception.
   These checks cover the declared native dependency graph, not arbitrary custom build-script traffic.
+  `native_bundle.py` honors the selected project's committed Gemfile/lock, falling back to
+  the repository root; missing gems install through the same relay with a frozen bundle.
+  Both Flutter configuration and the Pods helper use that bundle in their child process,
+  preserving Podfile.lock and the parent job environment. Deliver the workflow wrapper and
+  action helper together; action-only updates cannot repair earlier custom configuration steps.
 - Version stamping is per-build-system: Flutter takes `--build-number`, Gradle
   has no equivalent, so `set_gradle_version()` rewrites the literal in the
   checkout the way the iOS action patches the pbxproj. Never commit that edit.

package/README.md

@@ -48,6 +48,16 @@ and keeps existing cache keys. A successfully installed SDK is saved before app
 checks run, so a later test/build failure does not force another cold SDK download.
 Failed setup never saves an SDK cache; pub dependencies retain their job-end save.
 
+Native dependency preparation uses a committed `Gemfile` and `Gemfile.lock` beside
+the selected iOS project, falling back to the repository root. It installs missing
+bundle gems through the assigned Google relay and runs Pods with `bundle exec`.
+The Flutter workflow uses that same bundle before configuration can invoke Pods;
+Ruby settings remain scoped to those commands. Provide a Ruby/Bundler runtime
+compatible with the app's lockfile. Changed or uncommitted locks fail before delivery.
+When adopting this update, retain the `native_bundle.py` configuration wrapper in
+custom workflows as well as updating the action files. Apps without a Gemfile keep
+their existing CocoaPods runtime.
+
 ## Flutter web release
 
 The conditional `deploy-web.yml` workflow runs on changes to Flutter source,

package/action/.daemux-version

@@ -1 +1 @@
-1.0.98
+1.0.100

package/action/scripts/native_bundle.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""Use the app's committed Ruby bundle for native preparation without changing the job environment."""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import signal
+import subprocess
+import sys
+import tempfile
+
+import native_dependency_guard as guard
+from native_pods_diagnostics import refuse
+import native_pods_process
+
+
+def command(argv: list[str], cwd: Path, log) -> int:
+    try:
+        return native_pods_process.command(argv, cwd, log)
+    except native_pods_process.Interrupted:
+        raise guard.Refused("native_pods_operation_interrupted") from None
+    except (OSError, RuntimeError, subprocess.SubprocessError):
+        raise guard.Refused("native_pods_process_unverified") from None
+
+
+def committed(root: Path, path: Path, kind: str) -> str:
+    if not path.is_file() or path.is_symlink() or path.stat().st_size > 2 * 1024 * 1024:
+        raise guard.Refused(f"native_{kind}_required")
+    if not path.resolve().is_relative_to(root):
+        raise guard.Refused("native_bundle_path_unverified")
+    result = subprocess.run(["git", "show", "HEAD:" + path.relative_to(root).as_posix()],
+                            cwd=root, capture_output=True, check=False, timeout=15)
+    if result.returncode or result.stdout != path.read_bytes():
+        raise guard.Refused(f"native_{kind}_commit_required")
+    return hashlib.sha256(result.stdout).hexdigest()
+
+
+def unchanged(snapshot: dict[Path, str]) -> None:
+    for path, digest in snapshot.items():
+        if not path.is_file() or path.is_symlink() or hashlib.sha256(path.read_bytes()).hexdigest() != digest:
+            raise guard.Refused("native_bundle_inputs_changed")
+
+
+def prepare(root: Path, folder: Path, proxy_helper: Path, log) -> tuple[list[str], dict[Path, str]]:
+    gemfile = next((p for p in (folder / "Gemfile", root / "Gemfile") if p.exists() or p.is_symlink()), None)
+    if gemfile is None:
+        return [], {}
+    snapshot = {gemfile: committed(root, gemfile, "gemfile"),
+                gemfile.with_name("Gemfile.lock"): committed(root, gemfile.with_name("Gemfile.lock"), "gemfile_lock")}
+    prefix = ["/usr/bin/env", "BUNDLE_GEMFILE=" + str(gemfile), "BUNDLE_FROZEN=true",
+              "BUNDLE_PATH=" + (os.environ.get("BUNDLE_PATH") or str(root / ".factory/toolchain/gems"))]
+    relay = [sys.executable, str(proxy_helper), "--", *prefix, "bundle"]
+    if command([*relay, "check"], gemfile.parent, log):
+        if command([*relay, "install", "--jobs", "2", "--retry", "1"], gemfile.parent, log):
+            refuse("native_bundle_install_failed", log, guard.Refused)
+    unchanged(snapshot)
+    return [*prefix, "bundle", "exec"], snapshot
+
+
+def run(root: Path, folder: Path, proxy_helper: Path, argv: list[str]) -> dict:
+    root = root.resolve(strict=True)
+    folder = (root / folder).resolve(strict=True)
+    proxy_helper = proxy_helper.resolve(strict=True)
+    if not folder.is_relative_to(root) or not argv:
+        raise guard.Refused("native_bundle_path_unverified")
+    if (folder / "Podfile").is_symlink():
+        raise guard.Refused("native_workspace_reference_unverified")
+    pod_lock = folder / "Podfile.lock"
+    pod_snapshot = {pod_lock: committed(root, pod_lock, "podfile_lock")} if (folder / "Podfile").exists() else {}
+    with tempfile.TemporaryFile() as log:
+        if command([sys.executable, str(proxy_helper)], root, log):
+            raise guard.Refused("native_google_proxy_required")
+        prefix, snapshot = prepare(root, folder, proxy_helper, log)
+        if command([sys.executable, str(proxy_helper), "--", *prefix, *argv], root, log):
+            refuse("native_configuration_failed", log, guard.Refused)
+        unchanged(snapshot)
+        for path, digest in pod_snapshot.items():
+            if not path.is_file() or path.is_symlink() or hashlib.sha256(path.read_bytes()).hexdigest() != digest:
+                raise guard.Refused("native_podfile_lock_changed")
+    return {"ok": True, "ruby_bundle": "locked" if snapshot else "not_configured"}
+
+
+def interrupted(*_args) -> None:
+    raise KeyboardInterrupt
+
+
+def main(argv: list[str]) -> int:
+    signal.signal(signal.SIGTERM, interrupted)
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, default=Path.cwd())
+    parser.add_argument("--folder", type=Path, default=Path("ios"))
+    parser.add_argument("--proxy-helper", type=Path, required=True)
+    parser.add_argument("command", nargs=argparse.REMAINDER)
+    args = parser.parse_args(argv)
+    command_args = args.command[1:] if args.command[:1] == ["--"] else args.command
+    try:
+        answer = run(args.root, args.folder, args.proxy_helper, command_args)
+    except (guard.Refused, OSError, subprocess.SubprocessError) as exc:
+        code = str(exc) if isinstance(exc, guard.Refused) else "native_bundle_operation_unverified"
+        answer = {"ok": False, "code": code, "next": "Use the app's committed Gemfile and Gemfile.lock with a "
+                  "compatible Ruby/Bundler runtime; reconcile dependency locks locally and retain deployment guards."}
+        if getattr(exc, "diagnostic", ""):
+            answer["diagnostic"] = exc.diagnostic
+    print(json.dumps(answer, sort_keys=True))
+    return 0 if answer["ok"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

package/action/scripts/native_pods.py

@@ -13,8 +13,9 @@ import sys
 import tempfile
 
 import native_dependency_guard as guard
+import native_bundle
+from native_bundle import command
 from native_pods_diagnostics import refuse
-import native_pods_process
 
 
 def committed(root: Path, lock: Path) -> str:
@@ -27,15 +28,6 @@ def committed(root: Path, lock: Path) -> str:
     return hashlib.sha256(result.stdout).hexdigest()
 
 
-def command(argv: list[str], cwd: Path, log) -> int:
-    try:
-        return native_pods_process.command(argv, cwd, log)
-    except native_pods_process.Interrupted:
-        raise guard.Refused("native_pods_operation_interrupted") from None
-    except (OSError, RuntimeError, subprocess.SubprocessError):
-        raise guard.Refused("native_pods_process_unverified") from None
-
-
 def prepare(root: Path, container: str, proxy_helper: Path) -> dict:
     root = root.resolve(strict=True)
     folder = (root / container).parent.resolve(strict=True) if container else root
@@ -56,9 +48,12 @@ def prepare(root: Path, container: str, proxy_helper: Path) -> dict:
                 refuse("native_project_generation_failed", log, guard.Refused)
         initial = container or str(guard.selected(root, "", True).relative_to(root))
         guard.check(root, initial, before_pods=True)
-        if command([sys.executable, str(proxy_helper), "--", "pod", "install", "--deployment", "--no-repo-update"],
+        prefix, bundle_snapshot = native_bundle.prepare(root, folder, proxy_helper, log)
+        if command([sys.executable, str(proxy_helper), "--", *prefix, "pod", "install",
+                    "--deployment", "--no-repo-update"],
                    folder, log):
             refuse("native_pods_install_failed", log, guard.Refused)
+        native_bundle.unchanged(bundle_snapshot)
         if digest != hashlib.sha256((folder / "Podfile.lock").read_bytes()).hexdigest():
             raise guard.Refused("native_podfile_lock_changed")
         workspaces = sorted(folder.glob("*.xcworkspace"))

package/action/scripts/test_native_bundle.py

@@ -0,0 +1,97 @@
+"""Exercise real child scoping and committed bundle failures without contacting a provider."""
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+import native_bundle
+
+PROXY = Path(__file__).resolve().parents[2] / "android-action/scripts/play_store_proxy.py"
+
+
+class BundleTests(unittest.TestCase):
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory(prefix="native-bundle-test-")
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name).resolve()
+        (self.root / "ios").mkdir()
+        self.env = {**os.environ, "GOOGLE_STORE_PROXY_URL": "http://fixture:PRIVATE_SENTINEL@127.0.0.1:9",
+                    "PATH": str(self.root) + os.pathsep + os.environ["PATH"]}
+        self.env.pop("BUNDLE_PATH", None)
+        subprocess.run(["git", "init", "-q"], cwd=self.root, check=True, capture_output=True)
+        bundle = self.root / "bundle"
+        bundle.write_text('#!' + sys.executable + '\nimport os,sys\nfrom pathlib import Path\n'
+                          'if sys.argv[1] == "check": raise SystemExit(int(os.environ.get("COLD_BUNDLE", "0")))\n'
+                          'if sys.argv[1] == "install":\n'
+                          ' print("PRIVATE_SENTINEL")\n'
+                          ' if os.environ.get("CHANGE_LOCK"): Path("Gemfile.lock").write_text("changed")\n'
+                          ' raise SystemExit(int(os.environ.get("INSTALL_EXIT", "0")))\n'
+                          'assert sys.argv[1] == "exec"\n'
+                          'os.environ["FIXTURE_BUNDLE_ACTIVE"] = "yes"\n'
+                          'os.execvp(sys.argv[2], sys.argv[2:])\n')
+        bundle.chmod(0o700)
+
+    def commit(self, *files):
+        for name in files:
+            path = self.root / name
+            path.write_text("fixture " + name + "\n")
+        for argv in (["git", "add", *files],
+                     ["git", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                      "commit", "-qm", "Freeze fixture inputs"]):
+            subprocess.run(argv, cwd=self.root, check=True, capture_output=True)
+
+    def run_cli(self, script=None):
+        script = script or ('import json,os; from pathlib import Path; '
+                            'Path("child.json").write_text(json.dumps({k:os.environ.get(k) for k in '
+                            '["FIXTURE_BUNDLE_ACTIVE","BUNDLE_GEMFILE","BUNDLE_FROZEN","HTTPS_PROXY"]}))')
+        result = subprocess.run([sys.executable, native_bundle.__file__, "--root", str(self.root),
+                                 "--proxy-helper", str(PROXY), "--", sys.executable, "-c", script],
+                                cwd=self.root, env=self.env, capture_output=True, text=True, timeout=20)
+        self.assertNotIn("PRIVATE_SENTINEL", result.stdout + result.stderr)
+        return result.returncode, json.loads(result.stdout)
+
+    def test_unconfigured_app_keeps_the_proxied_command(self):
+        code, value = self.run_cli()
+        self.assertEqual((code, value["ruby_bundle"]), (0, "not_configured"))
+        child = json.loads((self.root / "child.json").read_text())
+        self.assertIsNone(child["FIXTURE_BUNDLE_ACTIVE"])
+        self.assertTrue(child["HTTPS_PROXY"].startswith("http://127.0.0.1:"))
+
+    def test_nearest_bundle_scopes_configuration_and_preserves_locks(self):
+        self.commit("Gemfile", "Gemfile.lock", "ios/Gemfile", "ios/Gemfile.lock", "ios/Podfile", "ios/Podfile.lock")
+        self.env["COLD_BUNDLE"] = "1"
+        code, value = self.run_cli()
+        self.assertEqual((code, value["ruby_bundle"]), (0, "locked"))
+        child = json.loads((self.root / "child.json").read_text())
+        self.assertEqual(child["FIXTURE_BUNDLE_ACTIVE"], "yes")
+        self.assertEqual(child["BUNDLE_GEMFILE"], str(self.root / "ios/Gemfile"))
+        self.assertEqual(child["BUNDLE_FROZEN"], "true")
+        self.assertTrue(child["HTTPS_PROXY"].startswith("http://127.0.0.1:"))
+
+    def test_uncommitted_or_modified_bundle_refuses_before_configuration(self):
+        (self.root / "Gemfile").write_text("uncommitted")
+        self.assertEqual(self.run_cli()[1]["code"], "native_gemfile_commit_required")
+        self.commit("Gemfile")
+        self.assertEqual(self.run_cli()[1]["code"], "native_gemfile_lock_required")
+        self.commit("Gemfile.lock")
+        (self.root / "Gemfile.lock").write_text("changed")
+        self.assertEqual(self.run_cli()[1]["code"], "native_gemfile_lock_commit_required")
+        self.assertFalse((self.root / "child.json").exists())
+
+    def test_install_failure_and_mutation_do_not_launch_configuration(self):
+        self.commit("Gemfile", "Gemfile.lock")
+        self.env.update(COLD_BUNDLE="1", INSTALL_EXIT="7")
+        self.assertEqual(self.run_cli()[1]["code"], "native_bundle_install_failed")
+        self.env.update(INSTALL_EXIT="0", CHANGE_LOCK="1")
+        self.assertEqual(self.run_cli()[1]["code"], "native_bundle_inputs_changed")
+        self.assertFalse((self.root / "child.json").exists())
+
+    def test_failed_configuration_and_generated_lock_drift_cannot_pass(self):
+        self.commit("Gemfile", "Gemfile.lock", "ios/Podfile", "ios/Podfile.lock")
+        code, value = self.run_cli('print("PRIVATE_SENTINEL"); raise SystemExit(7)')
+        self.assertEqual((code, value["code"]), (1, "native_configuration_failed"))
+        script = 'from pathlib import Path; Path("ios/Podfile.lock").write_text("new serializer")'
+        self.assertEqual(self.run_cli(script)[1]["code"], "native_podfile_lock_changed")

package/action/scripts/test_native_dependency_wiring.py

@@ -8,6 +8,15 @@ ACTION = Path(__file__).resolve().parents[1] / "action.yml"
 
 
 class WiringTests(unittest.TestCase):
+    def test_flutter_configuration_uses_the_same_bundle_before_pods(self):
+        template = ACTION.parents[1] / "templates/deploy.yml"
+        body = template.read_text().split("- name: Prepare Flutter iOS project\n", 1)[1].split("\n      - ", 1)[0]
+        shell = body.split("shell: >-\n", 1)[1].split("\n        env:", 1)[0]
+        self.assertIn(".github/actions/swift-app/scripts/native_bundle.py", shell)
+        self.assertIn("--folder ios --proxy-helper .github/actions/android-app/scripts/play_store_proxy.py", shell)
+        self.assertIn("-- bash --noprofile --norc -e -o pipefail {0}", shell)
+        self.assertIn("flutter build ios", body)
+
     def test_every_selected_xcode_step_has_its_own_preflight(self):
         source = ACTION.read_text()
         names = {name: step_block(source, name) for name in step_names(source)}

package/action/scripts/test_native_pods.py

@@ -56,6 +56,35 @@ class PodsTests(unittest.TestCase):
         self.env.pop("GOOGLE_STORE_PROXY_URL")
         self.assertEqual(self.run_cli()[1]["code"], "native_google_proxy_required")
 
+    def test_declared_bundle_controls_the_actual_pod_child(self):
+        self.locked()
+        (self.root / "Gemfile").write_text('source "https://rubygems.org"\ngem "cocoapods", "1.16.2"\n')
+        (self.root / "Gemfile.lock").write_text("fixture gem lock\n")
+        for argv in (["git", "add", "Gemfile", "Gemfile.lock"],
+                     ["git", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                      "commit", "-qm", "Declare the app bundle"]):
+            subprocess.run(argv, cwd=self.root, check=True, capture_output=True)
+        bundle = self.root / "bundle"
+        bundle.write_text('#!' + sys.executable + '\nimport os,sys\n'
+                          'if sys.argv[1] == "install": raise SystemExit(0)\n'
+                          'assert sys.argv[1] == "exec"\n'
+                          'os.environ["FIXTURE_BUNDLE_ACTIVE"] = "yes"\n'
+                          'os.execvp(sys.argv[2], sys.argv[2:])\n')
+        bundle.chmod(0o700)
+        pod = self.root / "pod"
+        pod.write_text('#!' + sys.executable + '\nimport os,json\nfrom pathlib import Path\n'
+                       'Path("bundle-child.json").write_text(json.dumps({k:os.environ.get(k) for k in '
+                       '["FIXTURE_BUNDLE_ACTIVE","BUNDLE_GEMFILE","BUNDLE_FROZEN","HTTPS_PROXY"]}))\n'
+                       'raise SystemExit(7)\n')
+        pod.chmod(0o700)
+        self.env["PATH"] = str(self.root) + os.pathsep + self.env["PATH"]
+        self.assertEqual(self.run_cli()[1]["code"], "native_pods_install_failed")
+        child = json.loads((self.root / "bundle-child.json").read_text())
+        self.assertEqual(child["FIXTURE_BUNDLE_ACTIVE"], "yes")
+        self.assertEqual(child["BUNDLE_GEMFILE"], str(self.root / "Gemfile"))
+        self.assertEqual(child["BUNDLE_FROZEN"], "true")
+        self.assertTrue(child["HTTPS_PROXY"].startswith("http://127.0.0.1:"))
+
     def test_real_child_has_relay_and_deployment_flags_and_preserves_failure(self):
         self.locked()
         script = self.root / "pod"

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.98
+1.0.100

package/android-action/flutter-setup/action.yml

@@ -97,12 +97,36 @@ runs:
     continue-on-error: true
     shell: bash
     run: node "$GITHUB_ACTION_PATH/../scripts/cache_scope.cjs" --snapshot
+  - name: Identify an exact Flutter release metadata cache
+    id: release-metadata
+    if: ${{ inputs.cache == 'true' && steps.scope.outcome == 'success' }}
+    continue-on-error: true
+    shell: bash
+    env:
+      GOWALK_FLUTTER_VERSION: ${{ inputs.flutter-version }}
+      GOWALK_FLUTTER_VERSION_FILE: ${{ inputs.flutter-version-file }}
+      GOWALK_FLUTTER_CHANNEL: ${{ inputs.channel }}
+      GOWALK_FLUTTER_ARCHITECTURE: ${{ inputs.architecture }}
+    run: python3 "$GITHUB_ACTION_PATH/../scripts/flutter_release_cache.py"
+  - name: Restore exact Flutter release metadata
+    id: cache-release
+    if: ${{ steps.release-metadata.outputs.enabled == 'true' }}
+    uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25
+    continue-on-error: true
+    env:
+      NODE_OPTIONS: --require "${{ steps.scope.outputs.preloader }}"
+      SEGMENT_DOWNLOAD_TIMEOUT_MINS: '1'
+    with:
+      path: ${{ steps.release-metadata.outputs.path }}
+      key: ${{ steps.release-metadata.outputs.key }}
   - name: Resolve Flutter release and cache identities
     id: flutter-action
     uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2
     env:
       BASH_ENV: ${{ steps.transport.outputs.manifest_env }}
       GOWALK_FLUTTER_MANIFEST_HELPER: ${{ steps.transport.outputs.manifest_helper }}
+      GOWALK_FLUTTER_RELEASE_CACHE: ${{ steps.release-metadata.outputs.path }}
+      GOWALK_FLUTTER_RELEASE_PIN: ${{ steps.release-metadata.outputs.pin }}
     with:
       channel: ${{ inputs.channel }}
       flutter-version: ${{ inputs.flutter-version }}
@@ -116,6 +140,17 @@ runs:
       pub-cache-path: ${{ inputs.pub-cache-path }}
       dry-run: 'true'
       git-source: ${{ inputs.git-source }}
+  - name: Save resolved Flutter release metadata
+    if: >-
+      ${{ steps.release-metadata.outputs.enabled == 'true' && steps.flutter-action.outcome == 'success'
+          && steps.cache-release.outputs.cache-hit != 'true' }}
+    uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25
+    continue-on-error: true
+    env:
+      NODE_OPTIONS: --require "${{ steps.scope.outputs.preloader }}"
+    with:
+      path: ${{ steps.release-metadata.outputs.path }}
+      key: ${{ steps.release-metadata.outputs.key }}
   - name: Cache Flutter
     id: cache-flutter
     if: ${{ inputs.cache == 'true' }}
@@ -159,6 +194,8 @@ runs:
       GOWALK_FLUTTER_MANIFEST_HELPER: ${{ steps.transport.outputs.manifest_helper }}
       GOWALK_FLUTTER_ARCHIVE_CACHE: >-
         ${{ inputs.cache == 'true' && format('{0}/gowalk-flutter-archives', runner.temp) || '' }}
+      GOWALK_FLUTTER_RELEASE_CACHE: ${{ steps.release-metadata.outputs.path }}
+      GOWALK_FLUTTER_RELEASE_PIN: ${{ steps.release-metadata.outputs.pin }}
     with:
       channel: ${{ steps.flutter-action.outputs.CHANNEL }}
       flutter-version: ${{ steps.flutter-action.outputs.VERSION }}

package/android-action/scripts/flutter_manifest.py

@@ -10,6 +10,7 @@ from urllib.parse import urlsplit
 
 import flutter_download
 import flutter_archive_cache
+import flutter_release_cache
 
 RETRY_CODES = {5, 6, 7, 18, 28, 35, 52, 55, 56, 92, 95}
 RETRY_HTTP = {408, 429, 500, 502, 503, 504}
@@ -26,6 +27,8 @@ def download(arguments: list[str], directory: Path) -> int:
     destination = directory / "download"
     destination.touch(mode=0o600, exist_ok=True)
     destination.chmod(0o600)
+    if flutter_release_cache.reuse(arguments[-1], destination, kind):
+        return 0
     if flutter_archive_cache.reuse_complete(destination, kind):
         return 0
     attempted = 0
@@ -41,6 +44,7 @@ def download(arguments: list[str], directory: Path) -> int:
                                       curl_exit=code, http_status=http, proxy_status=proxy_http)
         if code == 0 and http in ({200, 206} if kind == "archive" else {200}):
             flutter_download.publish(destination, kind)
+            flutter_release_cache.remember(arguments[-1], destination, kind)
             if attempt > 1:
                 print(f"flutter_{kind}_recovered attempts={attempt}", file=sys.stderr)
             return 0

package/android-action/scripts/flutter_release_cache.py

@@ -0,0 +1,120 @@
+"""Optional public release metadata for exact Flutter pins; SDK identities remain the official action's."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import sys
+import tempfile
+
+import flutter_download
+
+MAX_BYTES = 16 * 1024 * 1024
+EXACT_VERSION = re.compile(r"[0-9]+\.[0-9]+\.[0-9]+(?:[-+][0-9A-Za-z][0-9A-Za-z.-]*)?")
+
+
+def valid_pin(value) -> bool:
+    return (isinstance(value, dict) and set(value) == {"version", "channel", "architecture"}
+            and isinstance(value["version"], str)
+            and bool(EXACT_VERSION.fullmatch(value["version"]))
+            and value["channel"] in ("stable", "beta", "dev")
+            and value["architecture"] in ("x64", "arm64"))
+
+
+def context():
+    try:
+        pin = json.loads(os.environ.get("GOWALK_FLUTTER_RELEASE_PIN", "null"))
+        raw = os.environ.get("GOWALK_FLUTTER_RELEASE_CACHE")
+        if not raw or not valid_pin(pin):
+            return None
+        path = Path(raw)
+        parent = Path(os.environ["RUNNER_TEMP"]).resolve(strict=True) / "gowalk-flutter-manifests"
+        if (path.is_symlink() or path.parent.is_symlink() or path.parent.resolve() != parent
+                or not re.fullmatch(r"[a-f0-9]{64}\.json", path.name)):
+            return None
+        return path, pin
+    except (KeyError, OSError, ValueError, TypeError):
+        return None
+
+
+def matches(manifest, pin) -> bool:
+    if not isinstance(manifest, dict) or not isinstance(manifest.get("releases"), list):
+        return False
+    rows = [row for row in manifest["releases"] if isinstance(row, dict)
+            and row.get("version") == pin["version"] and row.get("channel") == pin["channel"]
+            and (row.get("dart_sdk_arch") or "x64") == pin["architecture"]]
+    if len(rows) != 1:
+        return False
+    row = rows[0]
+    return (isinstance(row.get("archive"), str) and not row["archive"].startswith("/")
+            and ".." not in row["archive"] and "\\" not in row["archive"]
+            and bool(re.fullmatch(r"[a-fA-F0-9]{40}", str(row.get("hash", ""))))
+            and bool(re.fullmatch(r"[a-fA-F0-9]{64}", str(row.get("sha256", "")))))
+
+
+def reuse(url: str, destination: Path, kind: str) -> bool:
+    selected = context() if kind == "manifest" else None
+    if not selected:
+        return False
+    path, pin = selected
+    try:
+        if not path.is_file() or path.stat().st_size > MAX_BYTES:
+            return False
+        record = json.loads(path.read_bytes())
+        if (not isinstance(record, dict) or record.get("schema") != 1 or record.get("url") != url
+                or record.get("pin") != pin or not matches(record.get("manifest"), pin)):
+            return False
+        destination.write_text(json.dumps(record["manifest"]))
+        flutter_download.publish(destination, kind)
+        print('::notice title=flutter_manifest_cache::{"schema":"gowalk-cicd/flutter-manifest-cache.v1",'
+              '"event":"hit"}', file=sys.stderr)
+        return True
+    except (OSError, ValueError, TypeError):
+        return False
+
+
+def remember(url: str, destination: Path, kind: str) -> None:
+    selected = context() if kind == "manifest" else None
+    if not selected or destination.stat().st_size > MAX_BYTES:
+        return
+    path, pin = selected
+    temporary = None
+    try:
+        manifest = json.loads(destination.read_bytes())
+        if not matches(manifest, pin):
+            return
+        content = json.dumps({"schema": 1, "url": url, "pin": pin, "manifest": manifest}).encode()
+        if len(content) > MAX_BYTES:
+            return
+        path.parent.mkdir(mode=0o700, exist_ok=True)
+        with tempfile.NamedTemporaryFile(dir=path.parent, prefix="incoming-", delete=False) as output:
+            temporary = Path(output.name)
+            output.write(content)
+        os.replace(temporary, path)
+    except (OSError, ValueError, TypeError):
+        pass  # This optional cache cannot turn a completed provider read into a failed setup.
+    finally:
+        if temporary:
+            try:
+                temporary.unlink(missing_ok=True)
+            except OSError:
+                pass
+
+
+def prepare() -> None:
+    pin = {"version": os.environ.get("GOWALK_FLUTTER_VERSION", ""),
+           "channel": os.environ.get("GOWALK_FLUTTER_CHANNEL", ""),
+           "architecture": os.environ.get("GOWALK_FLUTTER_ARCHITECTURE", "").lower()}
+    with Path(os.environ["GITHUB_OUTPUT"]).open("a") as output:
+        if os.environ.get("GOWALK_FLUTTER_VERSION_FILE") or not valid_pin(pin):
+            output.write("enabled=false\n")
+            return
+        namespace = {"pin": pin, "os": os.environ["RUNNER_OS"],
+                     "origin": os.environ.get("FLUTTER_STORAGE_BASE_URL", "https://storage.googleapis.com")}
+        digest = hashlib.sha256(json.dumps(namespace, sort_keys=True).encode()).hexdigest()
+        path = Path(os.environ["RUNNER_TEMP"]).resolve(strict=True) / "gowalk-flutter-manifests" / f"{digest}.json"
+        output.write(f"enabled=true\nkey=flutter-manifest-v1-{digest}\npath={path}\npin={json.dumps(pin)}\n")
+
+
+if __name__ == "__main__":
+    prepare()

package/android-action/scripts/test_flutter_release_cache.py

@@ -0,0 +1,103 @@
+"""Exact pinned setup survives a manifest outage after a verified resolution; misses stay proxied."""
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+from flutter_manifest_fixture import HOST, official_setup, tls_proxy
+
+ROOT = Path(__file__).parent
+
+
+class ReleaseCacheTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.source = official_setup()
+
+    def setUp(self):
+        scratch = tempfile.TemporaryDirectory()
+        self.addCleanup(scratch.cleanup)
+        self.root = Path(scratch.name)
+        self.setup = self.root / "setup.sh"
+        self.setup.write_bytes(self.source)
+        self.cache = self.root / "gowalk-flutter-manifests" / ("a" * 64 + ".json")
+
+    def invoke(self, server, cert, *, version="3.44.0", bound=True):
+        pin = {"version": version, "channel": "stable", "architecture": "x64"}
+        env = {**os.environ, "RUNNER_TEMP": str(self.root), "RUNNER_OS": "Linux", "RUNNER_ARCH": "X64",
+               "RUNNER_TOOL_CACHE": str(self.root / "tools"), "GITHUB_OUTPUT": str(self.root / "output"),
+               "PUB_CACHE": str(self.root / "pub"), "FLUTTER_STORAGE_BASE_URL": "https://" + HOST,
+               "BASH_ENV": str(ROOT / "flutter_manifest_env.sh"), "CURL_CA_BUNDLE": str(cert),
+               "GOWALK_FLUTTER_MANIFEST_HELPER": str(ROOT / "flutter_manifest.py"),
+               "GOWALK_FLUTTER_RELEASE_CACHE": str(self.cache), "GOWALK_FLUTTER_RELEASE_PIN": json.dumps(pin),
+               "HTTPS_PROXY": f"http://127.0.0.1:{server.server_address[1]}", "NO_PROXY": "", "no_proxy": ""}
+        env.pop("https_proxy", None)
+        if not bound:
+            env.pop("HTTPS_PROXY")
+        (self.root / "output").write_text("")
+        return subprocess.run(["bash", str(self.setup), "-p", "-n", version, "-a", "x64",
+                               "-k", "same-:version:-:hash:", "stable"], env=env,
+                              capture_output=True, text=True, timeout=15)
+
+    def test_warm_resolution_preserves_sdk_identity_without_another_manifest_connection(self):
+        with tls_proxy(self.root, ["ok", "origin_auth"]) as (server, cert):
+            cold = self.invoke(server, cert)
+            self.assertEqual(cold.returncode, 0, cold.stderr)
+            identity = (self.root / "output").read_text()
+            warm = self.invoke(server, cert)
+            self.assertEqual(warm.returncode, 0, warm.stderr)
+            self.assertEqual((server.connects, len(server.requests)), (1, 1))
+            self.assertEqual((self.root / "output").read_text(), identity)
+            self.assertIn("flutter_manifest_cache", warm.stderr)
+
+    def test_changed_pin_does_not_reuse_another_versions_manifest(self):
+        with tls_proxy(self.root, ["ok", "origin_auth"]) as (server, cert):
+            self.assertEqual(self.invoke(server, cert).returncode, 0)
+            changed = self.invoke(server, cert, version="3.44.1")
+            self.assertNotEqual(changed.returncode, 0)
+            self.assertEqual(server.connects, 2)
+            self.assertIn("http_status=401", changed.stderr)
+
+    def test_invalid_cache_is_recovered_through_the_assigned_proxy(self):
+        self.cache.parent.mkdir()
+        self.cache.write_text("truncated JSON")
+        with tls_proxy(self.root, ["ok"]) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertEqual(server.connects, 1)
+        self.assertEqual(json.loads(self.cache.read_text())["pin"]["version"], "3.44.0")
+
+    def test_warm_cache_never_bypasses_the_required_account_pin(self):
+        with tls_proxy(self.root, ["ok"]) as (server, cert):
+            self.assertEqual(self.invoke(server, cert).returncode, 0)
+            result = self.invoke(server, cert, bound=False)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertEqual(server.connects, 1)
+
+    def test_wrong_origin_or_invalid_release_metadata_requires_a_fresh_provider_read(self):
+        for change in ["url", "sha256"]:
+            with self.subTest(change=change), tls_proxy(self.root, ["ok", "ok"]) as (server, cert):
+                self.cache.unlink(missing_ok=True)
+                self.assertEqual(self.invoke(server, cert).returncode, 0)
+                record = json.loads(self.cache.read_text())
+                if change == "url":
+                    record["url"] = "https://another.fixture.invalid/releases_linux.json"
+                else:
+                    record["manifest"]["releases"][0]["sha256"] = "invalid"
+                self.cache.write_text(json.dumps(record))
+                self.assertEqual(self.invoke(server, cert).returncode, 0)
+                self.assertEqual(server.connects, 2)
+
+    def test_wildcard_selection_still_resolves_a_fresh_manifest(self):
+        with tls_proxy(self.root, ["ok", "origin_auth"]) as (server, cert):
+            self.assertEqual(self.invoke(server, cert, version="3.44.x").returncode, 0)
+            result = self.invoke(server, cert, version="3.44.x")
+            self.assertNotEqual(result.returncode, 0)
+            self.assertEqual(server.connects, 2)
+        self.assertFalse(self.cache.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_flutter_release_cache_scope.py

@@ -0,0 +1,49 @@
+"""Metadata cache selectors cannot freeze moving requests or cross platforms/origins."""
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+SCRIPT = Path(__file__).with_name("flutter_release_cache.py")
+
+
+class CacheSelectionTests(unittest.TestCase):
+    def prepare(self, root, **changes):
+        output = root / "outputs"
+        output.write_text("")
+        env = {**os.environ, "GITHUB_OUTPUT": str(output), "RUNNER_TEMP": str(root), "RUNNER_OS": "Linux",
+               "GOWALK_FLUTTER_VERSION": "3.44.0", "GOWALK_FLUTTER_VERSION_FILE": "",
+               "GOWALK_FLUTTER_CHANNEL": "stable", "GOWALK_FLUTTER_ARCHITECTURE": "X64",
+               "FLUTTER_STORAGE_BASE_URL": "https://storage.googleapis.com", **changes}
+        result = subprocess.run([sys.executable, str(SCRIPT)], env=env, capture_output=True, timeout=10)
+        self.assertEqual((result.returncode, result.stdout, result.stderr), (0, b"", b""))
+        return dict(line.split("=", 1) for line in output.read_text().splitlines())
+
+    def test_exact_identity_is_stable_and_other_selections_have_separate_keys(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            first = self.prepare(root)
+            self.assertEqual(first, self.prepare(root))
+            self.assertEqual(first["enabled"], "true")
+            self.assertEqual(json.loads(first["pin"])["architecture"], "x64")
+            for change in [{"RUNNER_OS": "macOS"}, {"GOWALK_FLUTTER_ARCHITECTURE": "ARM64"},
+                           {"GOWALK_FLUTTER_CHANNEL": "beta"}, {"GOWALK_FLUTTER_VERSION": "3.44.1"},
+                           {"FLUTTER_STORAGE_BASE_URL": "https://another.fixture.invalid"}]:
+                with self.subTest(change=change):
+                    self.assertNotEqual(first["key"], self.prepare(root, **change)["key"])
+
+    def test_moving_or_file_resolved_versions_do_not_enable_metadata_reuse(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            for change in [{"GOWALK_FLUTTER_VERSION": ""}, {"GOWALK_FLUTTER_VERSION": "3.x"},
+                           {"GOWALK_FLUTTER_CHANNEL": "master"},
+                           {"GOWALK_FLUTTER_VERSION_FILE": "pubspec.yaml"}]:
+                with self.subTest(change=change):
+                    self.assertEqual(self.prepare(root, **change), {"enabled": "false"})
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/scripts/test_google_bootstrap_wiring.py

@@ -9,6 +9,22 @@ ROOT = Path(__file__).resolve().parents[2]
 
 
 class BootstrapWiringTests(unittest.TestCase):
+    def assert_protected_setup(self, resolve, install):
+        for step in (resolve, install):
+            self.assertEqual(step["uses"], "subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2")
+            expected_env = {
+                "BASH_ENV": "${{ steps.transport.outputs.manifest_env }}",
+                "GOWALK_FLUTTER_MANIFEST_HELPER": "${{ steps.transport.outputs.manifest_helper }}",
+                "GOWALK_FLUTTER_RELEASE_CACHE": "${{ steps.release-metadata.outputs.path }}",
+                "GOWALK_FLUTTER_RELEASE_PIN": "${{ steps.release-metadata.outputs.pin }}"}
+            if step is install:
+                expected_env["GOWALK_FLUTTER_ARCHIVE_CACHE"] = (
+                    "${{ inputs.cache == 'true' && format('{0}/gowalk-flutter-archives', runner.temp) || '' }}")
+            self.assertEqual(step["env"], expected_env)
+            self.assertEqual(step["with"]["cache"], "false")
+            self.assertEqual(step["with"]["pub-cache"], "false")
+            self.assertNotIn("continue-on-error", step)
+
     def test_each_flutter_sdk_setup_has_a_prior_mandatory_account_guard(self):
         checked = 0
         for name in ("deploy.yml", "deploy-web.yml"):
@@ -34,18 +50,7 @@ class BootstrapWiringTests(unittest.TestCase):
         self.assertTrue(scope["continue-on-error"])
         self.assertIn("--snapshot", scope["run"])
         self.assertEqual(resolve["with"]["dry-run"], "true")
-        for step in (resolve, install):
-            self.assertEqual(step["uses"], "subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2")
-            expected_env = {
-                "BASH_ENV": "${{ steps.transport.outputs.manifest_env }}",
-                "GOWALK_FLUTTER_MANIFEST_HELPER": "${{ steps.transport.outputs.manifest_helper }}"}
-            if step is install:
-                expected_env["GOWALK_FLUTTER_ARCHIVE_CACHE"] = (
-                    "${{ inputs.cache == 'true' && format('{0}/gowalk-flutter-archives', runner.temp) || '' }}")
-            self.assertEqual(step["env"], expected_env)
-            self.assertEqual(step["with"]["cache"], "false")
-            self.assertEqual(step["with"]["pub-cache"], "false")
-            self.assertNotIn("continue-on-error", step)
+        self.assert_protected_setup(resolve, install)
         self.assertNotIn("BASH_ENV", setup.get("env", {}))
         for step in (guard, scope, sdk_cache, pub_cache, save):
             self.assertNotIn("BASH_ENV", step.get("env", {}))

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.98
+1.0.100

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.98",
+  "version": "1.0.100",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -142,7 +142,8 @@ jobs:
       - name: Prepare Flutter iOS project
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
         shell: >-
-          python3 .github/actions/android-app/scripts/play_store_proxy.py
+          python3 .github/actions/swift-app/scripts/native_bundle.py
+          --folder ios --proxy-helper .github/actions/android-app/scripts/play_store_proxy.py
           -- bash --noprofile --norc -e -o pipefail {0}
         env:
           ONBOARDING_PUBLIC_ORIGIN: ${{ vars.ONBOARDING_PUBLIC_ORIGIN }}