@invarn/cibuild 1.3.16 → 1.3.18

package/dist/src/yaml/secrets-manager.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Universal secrets management for CI Build
+ * Stores sensitive values by exact variable name — no UUIDs, no YAML modification
+ * Supports per-workflow scoping with global fallback
+ *
+ * File format:
+ * {
+ *   "global": { "VAR_NAME": "value" },
+ *   "workflows": {
+ *     "staging-java-17": { "VAR_NAME": "value" }
+ *   }
+ * }
+ */
+export interface SecretsFile {
+    global: Record<string, string>;
+    workflows: Record<string, Record<string, string>>;
+}
+export declare class SecretsManager {
+    private secretsFilePath;
+    private data;
+    private fileLoaded;
+    constructor(secretsFilePath?: string);
+    private loadSecrets;
+    /**
+     * Reads structured env vars (CIBUILD_S__* and CIBUILD_SW__*) and decodes them
+     * back into a SecretsFile structure. Used when running in CI where secrets
+     * were uploaded via `ci secrets upload`.
+     */
+    private getStructuredEnvSecrets;
+    private saveSecrets;
+    /**
+     * Store a secret by variable name, optionally scoped to a workflow.
+     * @returns The variable name (used as the key)
+     */
+    storeSecret(name: string, value: string, workflow?: string): string;
+    private static readonly ENV_PREFIX;
+    /**
+     * Reads all CIBUILD_-prefixed env vars, stripping the prefix from the keys.
+     * e.g. CIBUILD_SSH_RSA_PRIVATE_KEY → SSH_RSA_PRIVATE_KEY
+     */
+    private getEnvSecrets;
+    /**
+     * Get a secret value by variable name.
+     * Workflow-specific value takes precedence over global.
+     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     */
+    getSecret(name: string, workflow?: string): string | undefined;
+    /**
+     * Get all secrets merged: global + workflow-specific (workflow overrides global).
+     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     */
+    getAll(workflow?: string): Record<string, string>;
+    /**
+     * Returns the variable name if a secret exists for it, undefined otherwise.
+     * Checks workflow scope first, then global.
+     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     */
+    getSecretIdByName(name: string, workflow?: string): string | undefined;
+    /**
+     * Returns the name itself (API compatibility).
+     */
+    getSecretName(id: string): string | undefined;
+    /**
+     * Check if a secret exists by variable name (global or any workflow).
+     */
+    hasSecret(name: string, workflow?: string): boolean;
+    /**
+     * Get all stored variable names (global + all workflows, deduplicated).
+     */
+    getAllSecretNames(): string[];
+    /**
+     * Delete a secret by variable name (from workflow scope or global).
+     */
+    deleteSecret(name: string, workflow?: string): boolean;
+    getSecretsFilePath(): string;
+}
+//# sourceMappingURL=secrets-manager.d.ts.map

package/dist/src/yaml/secrets-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-manager.d.ts","sourceRoot":"","sources":["../../../src/yaml/secrets-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACnD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,UAAU,CAAkB;gBAExB,eAAe,CAAC,EAAE,MAAM;IAMpC,OAAO,CAAC,WAAW;IAqCnB;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAkB/B,OAAO,CAAC,WAAW;IAUnB;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAanE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAc;IAEhD;;;OAGG;IACH,OAAO,CAAC,aAAa;IAUrB;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAU9D;;;OAGG;IACH,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAWjD;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAatE;;OAEG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAInD;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAQ7B;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAetD,kBAAkB,IAAI,MAAM;CAG7B"}

package/dist/src/yaml/secrets-manager.js

@@ -0,0 +1,219 @@
+/**
+ * Universal secrets management for CI Build
+ * Stores sensitive values by exact variable name — no UUIDs, no YAML modification
+ * Supports per-workflow scoping with global fallback
+ *
+ * File format:
+ * {
+ *   "global": { "VAR_NAME": "value" },
+ *   "workflows": {
+ *     "staging-java-17": { "VAR_NAME": "value" }
+ *   }
+ * }
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { decodeSecretName } from '../commands/secrets-upload.js';
+export class SecretsManager {
+    secretsFilePath;
+    data;
+    fileLoaded = false;
+    constructor(secretsFilePath) {
+        this.secretsFilePath = secretsFilePath || path.join(process.cwd(), '.cibuild-secrets.json');
+        this.data = { global: {}, workflows: {} };
+        this.loadSecrets();
+    }
+    loadSecrets() {
+        try {
+            if (fs.existsSync(this.secretsFilePath)) {
+                const content = fs.readFileSync(this.secretsFilePath, 'utf-8');
+                const parsed = JSON.parse(content);
+                this.fileLoaded = true;
+                // Support both new format and legacy flat format
+                if (parsed.global !== undefined || parsed.workflows !== undefined) {
+                    this.data = {
+                        global: parsed.global || {},
+                        workflows: parsed.workflows || {},
+                    };
+                }
+                else {
+                    // Legacy flat format: treat all keys as global
+                    this.data.global = {};
+                    for (const [key, value] of Object.entries(parsed)) {
+                        if (typeof value === 'string') {
+                            this.data.global[key] = value;
+                        }
+                    }
+                }
+            }
+            else {
+                // No file — try loading from structured env vars (GitHub environment secrets)
+                const envData = this.getStructuredEnvSecrets();
+                if (Object.keys(envData.global).length > 0 ||
+                    Object.keys(envData.workflows).length > 0) {
+                    this.data = envData;
+                    this.fileLoaded = true;
+                }
+            }
+        }
+        catch (error) {
+            console.warn(`Warning: Could not load secrets file: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Reads structured env vars (CIBUILD_S__* and CIBUILD_SW__*) and decodes them
+     * back into a SecretsFile structure. Used when running in CI where secrets
+     * were uploaded via `ci secrets upload`.
+     */
+    getStructuredEnvSecrets() {
+        const result = { global: {}, workflows: {} };
+        for (const [key, value] of Object.entries(process.env)) {
+            if (value === undefined)
+                continue;
+            const decoded = decodeSecretName(key);
+            if (!decoded)
+                continue;
+            if (decoded.workflow) {
+                if (!result.workflows[decoded.workflow]) {
+                    result.workflows[decoded.workflow] = {};
+                }
+                result.workflows[decoded.workflow][decoded.varName] = value;
+            }
+            else {
+                result.global[decoded.varName] = value;
+            }
+        }
+        return result;
+    }
+    saveSecrets() {
+        const dir = path.dirname(this.secretsFilePath);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        fs.writeFileSync(this.secretsFilePath, JSON.stringify(this.data, null, 2), {
+            mode: 0o600,
+        });
+    }
+    /**
+     * Store a secret by variable name, optionally scoped to a workflow.
+     * @returns The variable name (used as the key)
+     */
+    storeSecret(name, value, workflow) {
+        if (workflow) {
+            if (!this.data.workflows[workflow]) {
+                this.data.workflows[workflow] = {};
+            }
+            this.data.workflows[workflow][name] = value;
+        }
+        else {
+            this.data.global[name] = value;
+        }
+        this.saveSecrets();
+        return name;
+    }
+    static ENV_PREFIX = 'CIBUILD_';
+    /**
+     * Reads all CIBUILD_-prefixed env vars, stripping the prefix from the keys.
+     * e.g. CIBUILD_SSH_RSA_PRIVATE_KEY → SSH_RSA_PRIVATE_KEY
+     */
+    getEnvSecrets() {
+        const secrets = {};
+        for (const [key, value] of Object.entries(process.env)) {
+            if (key.startsWith(SecretsManager.ENV_PREFIX) && value !== undefined) {
+                secrets[key.slice(SecretsManager.ENV_PREFIX.length)] = value;
+            }
+        }
+        return secrets;
+    }
+    /**
+     * Get a secret value by variable name.
+     * Workflow-specific value takes precedence over global.
+     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     */
+    getSecret(name, workflow) {
+        if (!this.fileLoaded) {
+            return process.env[SecretsManager.ENV_PREFIX + name];
+        }
+        if (workflow && this.data.workflows[workflow]?.[name] !== undefined) {
+            return this.data.workflows[workflow][name];
+        }
+        return this.data.global[name];
+    }
+    /**
+     * Get all secrets merged: global + workflow-specific (workflow overrides global).
+     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     */
+    getAll(workflow) {
+        if (!this.fileLoaded) {
+            return this.getEnvSecrets();
+        }
+        const merged = { ...this.data.global };
+        if (workflow && this.data.workflows[workflow]) {
+            Object.assign(merged, this.data.workflows[workflow]);
+        }
+        return merged;
+    }
+    /**
+     * Returns the variable name if a secret exists for it, undefined otherwise.
+     * Checks workflow scope first, then global.
+     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     */
+    getSecretIdByName(name, workflow) {
+        if (!this.fileLoaded) {
+            return process.env[SecretsManager.ENV_PREFIX + name] !== undefined ? name : undefined;
+        }
+        if (workflow && this.data.workflows[workflow]?.[name] !== undefined) {
+            return name;
+        }
+        if (this.data.global[name] !== undefined) {
+            return name;
+        }
+        return undefined;
+    }
+    /**
+     * Returns the name itself (API compatibility).
+     */
+    getSecretName(id) {
+        return this.getSecretIdByName(id) ? id : undefined;
+    }
+    /**
+     * Check if a secret exists by variable name (global or any workflow).
+     */
+    hasSecret(name, workflow) {
+        return this.getSecretIdByName(name, workflow) !== undefined;
+    }
+    /**
+     * Get all stored variable names (global + all workflows, deduplicated).
+     */
+    getAllSecretNames() {
+        const names = new Set(Object.keys(this.data.global));
+        for (const vars of Object.values(this.data.workflows)) {
+            for (const key of Object.keys(vars))
+                names.add(key);
+        }
+        return Array.from(names);
+    }
+    /**
+     * Delete a secret by variable name (from workflow scope or global).
+     */
+    deleteSecret(name, workflow) {
+        let deleted = false;
+        if (workflow && this.data.workflows[workflow]) {
+            if (name in this.data.workflows[workflow]) {
+                delete this.data.workflows[workflow][name];
+                deleted = true;
+            }
+        }
+        else if (name in this.data.global) {
+            delete this.data.global[name];
+            deleted = true;
+        }
+        if (deleted)
+            this.saveSecrets();
+        return deleted;
+    }
+    getSecretsFilePath() {
+        return this.secretsFilePath;
+    }
+}
+//# sourceMappingURL=secrets-manager.js.map

package/dist/src/yaml/step-validator.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Pre-execution validation orchestrator
+ *
+ * Validates all steps in a workflow BEFORE execution begins.
+ * All validation checks are READ-ONLY and safe to run on the user's machine.
+ * This enables catching all issues at once instead of failing on the first error.
+ */
+import type { YAMLPipeline } from './types.js';
+import type { CIConfig } from '../types.js';
+import type { WorkflowValidationResult } from './validation-types.js';
+/**
+ * StepValidator orchestrates pre-execution validation for a workflow.
+ * It iterates through all steps, collects validation requirements,
+ * runs pre-execution checks, and aggregates all issues.
+ */
+export declare class StepValidator {
+    private pipeline;
+    private workflow;
+    private workflowName;
+    private config;
+    private envResolver;
+    private yamlFilePath?;
+    private availableOutputs;
+    private establishedPlatform;
+    constructor(pipeline: YAMLPipeline, workflowName: string, config: CIConfig, yamlFilePath?: string);
+    /**
+     * Validates all steps in the workflow.
+     * Returns a complete validation result with all issues grouped by step and category.
+     */
+    validateWorkflow(): Promise<WorkflowValidationResult>;
+    /**
+     * Validates a single requirement and returns an issue if it fails
+     */
+    private validateRequirement;
+    /**
+     * Extracts all $VAR and ${VAR} variable names referenced in an object recursively.
+     */
+    private extractVariableReferences;
+    /**
+     * Replaces all unresolved $VAR and ${VAR} references with empty string.
+     * Used as a lenient fallback when full interpolation fails, so that
+     * getValidationRequirements can detect truly-missing variables correctly.
+     */
+    private stripUnresolvedVars;
+    /**
+     * Parses a YAML step into a ParsedStep (simplified version of converter logic)
+     */
+    private parseStep;
+}
+/**
+ * Format validation result for console output
+ */
+export declare function formatValidationResult(result: WorkflowValidationResult): string;
+//# sourceMappingURL=step-validator.d.ts.map

package/dist/src/yaml/step-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAoB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;gBAGtD,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IAwBvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAuM3D;;OAEG;YACW,mBAAmB;IAsDjC;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAoBjC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}