@invarn/cibuild 1.4.9 → 1.5.1

package/dist/src/yaml/steps/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAgDF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAsGzF,iBAAiB;CA+HhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAuKzF,iBAAiB;CAqHhC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AA8DF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAsGzF,iBAAiB;CAkKhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA4JzF,iBAAiB;CA+GhC"}

package/dist/src/yaml/steps/cache.js

@@ -28,9 +28,22 @@ export const CACHE_PRESETS = {
     yarn: { lockfile: 'yarn.lock', keyPrefix: 'yarn', paths: ['node_modules'] },
     dart: { lockfile: 'pubspec.lock', keyPrefix: 'dart', paths: ['.dart_tool', '.pub-cache'] },
 };
+/**
+ * Emits bash that derives a stable short project id from the git remote URL
+ * (with embedded credentials stripped, so token rotations don't churn the key).
+ * Sets $__ci_proj to an 8-char hex. Falls back to "no-remote" if no git remote.
+ */
+function emitProjectScopeCommands() {
+    return [
+        '__ci_git_remote=$(git config --get remote.origin.url 2>/dev/null | sed -E "s#(://)[^@/]+@#\\1#" || echo "no-remote")',
+        '__ci_proj=$(printf "%s" "${__ci_git_remote:-no-remote}" | shasum -a 256 | cut -c1-8)',
+    ];
+}
 /**
  * Emits bash that discovers fingerprint filenames across the repo, sorts them,
  * and hashes their concatenated names+contents into CACHE_KEY.
+ * Key format: <keyPrefix>-<projectId>-<fingerprint>, so tarballs are scoped
+ * per-repo and fallback globbing can't cross-contaminate between projects.
  * Used by presets (Gradle, KMM) where no single lockfile captures the build graph.
  */
 function emitFingerprintKeyCommands(preset) {
@@ -48,10 +61,10 @@ function emitFingerprintKeyCommands(preset) {
         `  2>/dev/null | LC_ALL=C sort)`,
         `if [ -n "$__ci_fp_files" ]; then`,
         `  CHECKSUM=$(echo "$__ci_fp_files" | xargs shasum -a 256 2>/dev/null | shasum -a 256 | cut -c1-16)`,
-        `  CACHE_KEY="${escape(preset.keyPrefix)}-\${CHECKSUM}"`,
+        `  CACHE_KEY="${escape(preset.keyPrefix)}-\${__ci_proj}-\${CHECKSUM}"`,
         `else`,
         `  echo "Warning: no fingerprint files found, using fallback cache key"`,
-        `  CACHE_KEY="${escape(preset.keyPrefix)}-no-fingerprint"`,
+        `  CACHE_KEY="${escape(preset.keyPrefix)}-\${__ci_proj}-no-fingerprint"`,
         `fi`,
     ];
 }
@@ -181,6 +194,11 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         commands.push('  find . -name "$(basename "$1")" -not -path "*/DerivedData/*" -not -path "*/.build/*" 2>/dev/null | head -1');
         commands.push('}');
         commands.push('');
+        // Project scope: include a stable short hash of the git remote in every
+        // cache key so different repos on the same runner don't share tarballs
+        // (prevents fallback cross-contamination across projects).
+        commands.push(...emitProjectScopeCommands());
+        commands.push('');
         if (chain.length === 1 && chain[0].fingerprint && chain[0].fingerprint.length > 0) {
             commands.push(...emitFingerprintKeyCommands(chain[0]));
         }
@@ -189,10 +207,10 @@ export class CachePullStepExecutor extends BaseStepExecutor {
             commands.push(`LOCKFILE=$(__ci_find_lockfile "${this.escapeBash(preset.lockfile)}")`);
             commands.push('if [ -n "$LOCKFILE" ] && [ -f "$LOCKFILE" ]; then');
             commands.push(`  CHECKSUM=$(shasum -a 256 "$LOCKFILE" | cut -d ' ' -f1 | head -c 16)`);
-            commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${CHECKSUM}"`);
+            commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-\${CHECKSUM}"`);
             commands.push('else');
             commands.push(`  echo "Warning: ${this.escapeBash(preset.lockfile)} not found, using fallback cache key"`);
-            commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-no-lockfile"`);
+            commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-no-lockfile"`);
             commands.push('fi');
         }
         else {
@@ -204,14 +222,14 @@ export class CachePullStepExecutor extends BaseStepExecutor {
                 commands.push(`${cond} [ -n "$__ci_lockfile_candidate" ] && [ -f "$__ci_lockfile_candidate" ]; then`);
                 commands.push('  LOCKFILE="$__ci_lockfile_candidate"');
                 commands.push(`  CHECKSUM=$(shasum -a 256 "$LOCKFILE" | cut -d ' ' -f1 | head -c 16)`);
-                commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${CHECKSUM}"`);
+                commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-\${CHECKSUM}"`);
                 if (isDebugMode) {
                     commands.push(`  echo "Detected: ${this.escapeBash(preset.keyPrefix)} (lockfile: $LOCKFILE)"`);
                 }
             }
             commands.push('else');
             commands.push(`  echo "Warning: no lockfile found, using fallback cache key"`);
-            commands.push(`  CACHE_KEY="${this.escapeBash(chain[0].keyPrefix)}-no-lockfile"`);
+            commands.push(`  CACHE_KEY="${this.escapeBash(chain[0].keyPrefix)}-\${__ci_proj}-no-lockfile"`);
             commands.push('fi');
         }
         commands.push('');
@@ -247,10 +265,40 @@ export class CachePullStepExecutor extends BaseStepExecutor {
             commands.push('  mv "$CACHE_FILE.tmp" "$CACHE_FILE"');
             commands.push('  echo "CACHE_SOURCE=peer CACHE_KEY=$CACHE_KEY"');
         }
-        // 3. Cold miss
+        // 3. Fallback — no exact-key tarball, try the newest prior tarball scoped
+        // to the same <keyPrefix>-<projectId> (so fallback stays within this repo
+        // and doesn't pick up a different KMM project's cache). Gradle will
+        // re-hash task inputs on top of the warm ~/.gradle/caches directory,
+        // hitting the unchanged tasks and recompiling only what actually changed.
+        // Deliberately does NOT warm $CACHE_FILE — that way cache-push still runs
+        // and creates a fresh tarball under the new key for future exact hits.
         commands.push('else');
-        commands.push('  echo "No cache found for key: $CACHE_KEY"');
-        commands.push('  echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"');
+        commands.push('  __ci_fb_scope="${CACHE_KEY%-*}"');
+        commands.push('  __ci_fb=$(ls -t "$CACHE_DIR"/"$__ci_fb_scope"-*.tar.zst 2>/dev/null | head -1)');
+        if (peerCacheDir) {
+            commands.push('  if [ -z "$__ci_fb" ] || [ ! -f "$__ci_fb" ]; then');
+            commands.push('    __ci_fb=$(ls -t "$PEER_CACHE_DIR"/"$__ci_fb_scope"-*.tar.zst 2>/dev/null | head -1)');
+            commands.push('    __ci_fb_src=peer');
+            commands.push('  else');
+            commands.push('    __ci_fb_src=local');
+            commands.push('  fi');
+        }
+        else {
+            commands.push('  __ci_fb_src=local');
+        }
+        commands.push('  if [ -n "$__ci_fb" ] && [ -f "$__ci_fb" ]; then');
+        commands.push('    __ci_fb_key=$(basename "$__ci_fb" .tar.zst)');
+        commands.push('    echo "Cache fallback ($__ci_fb_src): using prior tarball $__ci_fb_key"');
+        if (isDebugMode) {
+            commands.push('    echo "Fallback size: $(du -h "$__ci_fb" | cut -f1)"');
+        }
+        commands.push('    zstd -dc "$__ci_fb" | tar -xf - -C /');
+        commands.push('    echo "CACHE_SOURCE=fallback_$__ci_fb_src CACHE_KEY=$CACHE_KEY FALLBACK_KEY=$__ci_fb_key"');
+        commands.push('  else');
+        // 4. Cold miss — no exact key, no fallback
+        commands.push('    echo "No cache found for key: $CACHE_KEY"');
+        commands.push('    echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"');
+        commands.push('  fi');
         commands.push('fi');
         if (isDebugMode) {
             commands.push('echo "Restored paths:"');
@@ -386,20 +434,9 @@ export class CachePushStepExecutor extends BaseStepExecutor {
             commands.push('  echo "Paths to cache:"');
             commands.push('  printf "  %s\\n" "${PATHS_TO_CACHE[@]}"');
         }
-        // Acquire lock with shlock
-        commands.push('  LOCK_FILE="$CACHE_FILE.lock"');
-        commands.push('  __ci_lock_tries=0');
-        commands.push('  while ! shlock -f "$LOCK_FILE" -p $$; do');
-        commands.push('    __ci_lock_tries=$((__ci_lock_tries + 1))');
-        commands.push('    if [ "$__ci_lock_tries" -ge 30 ]; then');
-        commands.push('      echo "Warning: cache push lock timeout, skipping"');
-        commands.push('      rm -f "$LOCK_FILE"');
-        commands.push('      exit 0');
-        commands.push('    fi');
-        commands.push('    sleep 1');
-        commands.push('  done');
+        // Atomic write: .tmp + rename. No lock needed — runs are serialized per runner,
+        // and cross-writer races resolve to last-writer-wins without corruption.
         commands.push('  tar -cf - "${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 > "$CACHE_FILE.tmp" && mv "$CACHE_FILE.tmp" "$CACHE_FILE" || true');
-        commands.push('  rm -f "$LOCK_FILE"');
         commands.push('  if [ -f "$CACHE_FILE" ]; then');
         commands.push('    echo "Cache created successfully"');
         if (isDebugMode) {
@@ -435,6 +472,10 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         commands.push('  find . -name "$(basename "$1")" -not -path "*/DerivedData/*" -not -path "*/.build/*" 2>/dev/null | head -1');
         commands.push('}');
         commands.push('');
+        // Project scope: include a stable short hash of the git remote in every
+        // cache key so different repos on the same runner don't share tarballs.
+        commands.push(...emitProjectScopeCommands());
+        commands.push('');
         if (chain.length === 1 && chain[0].fingerprint && chain[0].fingerprint.length > 0) {
             commands.push(...emitFingerprintKeyCommands(chain[0]));
         }
@@ -443,10 +484,10 @@ export class CachePushStepExecutor extends BaseStepExecutor {
             commands.push(`LOCKFILE=$(__ci_find_lockfile "${this.escapeBash(preset.lockfile)}")`);
             commands.push('if [ -n "$LOCKFILE" ] && [ -f "$LOCKFILE" ]; then');
             commands.push(`  CHECKSUM=$(shasum -a 256 "$LOCKFILE" | cut -d ' ' -f1 | head -c 16)`);
-            commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${CHECKSUM}"`);
+            commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-\${CHECKSUM}"`);
             commands.push('else');
             commands.push(`  echo "Warning: ${this.escapeBash(preset.lockfile)} not found, using fallback cache key"`);
-            commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-no-lockfile"`);
+            commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-no-lockfile"`);
             commands.push('fi');
         }
         else {
@@ -457,11 +498,11 @@ export class CachePushStepExecutor extends BaseStepExecutor {
                 commands.push(`${cond} [ -n "$__ci_lockfile_candidate" ] && [ -f "$__ci_lockfile_candidate" ]; then`);
                 commands.push('  LOCKFILE="$__ci_lockfile_candidate"');
                 commands.push(`  CHECKSUM=$(shasum -a 256 "$LOCKFILE" | cut -d ' ' -f1 | head -c 16)`);
-                commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${CHECKSUM}"`);
+                commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-\${CHECKSUM}"`);
             }
             commands.push('else');
             commands.push(`  echo "Warning: no lockfile found, using fallback cache key"`);
-            commands.push(`  CACHE_KEY="${this.escapeBash(chain[0].keyPrefix)}-no-lockfile"`);
+            commands.push(`  CACHE_KEY="${this.escapeBash(chain[0].keyPrefix)}-\${__ci_proj}-no-lockfile"`);
             commands.push('fi');
         }
         commands.push('');
@@ -493,21 +534,10 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         commands.push('  echo "Cache already up to date for key: $CACHE_KEY"');
         commands.push('elif [ ${#PATHS_TO_CACHE[@]} -gt 0 ]; then');
         commands.push('  echo "Caching ${#PATHS_TO_CACHE[@]} path(s)..."');
-        // Acquire lock with shlock (macOS-native, stale-lock safe via PID check)
-        commands.push('  LOCK_FILE="$CACHE_FILE.lock"');
-        commands.push('  __ci_lock_tries=0');
-        commands.push('  while ! shlock -f "$LOCK_FILE" -p $$; do');
-        commands.push('    __ci_lock_tries=$((__ci_lock_tries + 1))');
-        commands.push('    if [ "$__ci_lock_tries" -ge 30 ]; then');
-        commands.push('      echo "Warning: cache push lock timeout, skipping"');
-        commands.push('      rm -f "$LOCK_FILE"');
-        commands.push('      exit 0');
-        commands.push('    fi');
-        commands.push('    sleep 1');
-        commands.push('  done');
-        // Atomic write: compress to .tmp, then mv (peers never see half-written files)
+        // Atomic write: compress to .tmp, then mv. No lock needed — runs are
+        // serialized per runner and cross-writer races resolve to last-writer-wins
+        // without corruption. shlock was flaky on the virtiofs cache mount.
         commands.push('  tar -cf - "${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 > "$CACHE_FILE.tmp" && mv "$CACHE_FILE.tmp" "$CACHE_FILE" || true');
-        commands.push('  rm -f "$LOCK_FILE"');
         commands.push('  if [ -f "$CACHE_FILE" ]; then');
         commands.push('    echo "Cache created successfully"');
         if (isDebugMode) {

package/dist/src/yaml/steps/steps.test.js

@@ -218,6 +218,47 @@ describe('Step Implementations', () => {
             expect(result.script).toContain('CACHE_SOURCE=peer');
             expect(result.script).toContain('tee "$CACHE_FILE.tmp" < "$PEER_CACHE_FILE"');
         });
+        test('should fall back to newest prior tarball scoped to <keyPrefix>-<projectId> on exact-key miss', async () => {
+            const executor = new CachePullStepExecutor();
+            const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
+            // Scope = everything before the last dash (prefix+projectId, not just prefix),
+            // so fallback cannot cross-contaminate between different projects
+            expect(result.script).toContain('__ci_fb_scope="${CACHE_KEY%-*}"');
+            expect(result.script).toContain('ls -t "$CACHE_DIR"/"$__ci_fb_scope"-*.tar.zst');
+            expect(result.script).toContain('CACHE_SOURCE=fallback_');
+            expect(result.script).toContain('FALLBACK_KEY=');
+            // Fallback must NOT warm $CACHE_FILE (otherwise cache-push would skip)
+            const fallbackSection = result.script.split('__ci_fb_scope=')[1] ?? '';
+            expect(fallbackSection).not.toContain('mv "$CACHE_FILE.tmp" "$CACHE_FILE"');
+        });
+        test('should try peer dir for fallback when local has no prior tarball', async () => {
+            const executor = new CachePullStepExecutor();
+            const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
+            expect(result.script).toContain('ls -t "$PEER_CACHE_DIR"/"$__ci_fb_scope"-*.tar.zst');
+            expect(result.script).toContain('__ci_fb_src=peer');
+        });
+        test('should skip peer fallback branch when peerCacheDir is not set', async () => {
+            const executor = new CachePullStepExecutor();
+            const result = await executor.execute({ technology: 'kmm' }, {}, testConfigNoPeer);
+            expect(result.script).not.toContain('ls -t "$PEER_CACHE_DIR"');
+            // Local fallback still available
+            expect(result.script).toContain('ls -t "$CACHE_DIR"/"$__ci_fb_scope"-*.tar.zst');
+        });
+        test('should include project-scope id ($__ci_proj) in cache key', async () => {
+            const executor = new CachePullStepExecutor();
+            const result = await executor.execute({ technology: 'kmm' }, {}, testConfig);
+            // Project id derived from stripped git remote URL, 8-char hash
+            expect(result.script).toContain('git config --get remote.origin.url');
+            expect(result.script).toContain('__ci_proj=$');
+            // Key format: <prefix>-<projid>-<fp>
+            expect(result.script).toContain('CACHE_KEY="kmm-${__ci_proj}-${CHECKSUM}"');
+        });
+        test('should include project-scope id in lockfile-based preset keys', async () => {
+            const executor = new CachePullStepExecutor();
+            const result = await executor.execute({ technology: 'cocoapods' }, {}, testConfig);
+            expect(result.script).toContain('__ci_proj=$');
+            expect(result.script).toContain('CACHE_KEY="pods-${__ci_proj}-${CHECKSUM}"');
+        });
     });
     describe('CachePushStepExecutor', () => {
         test('should generate cache push script', async () => {
@@ -310,21 +351,18 @@ describe('Step Implementations', () => {
             const executor = new CachePushStepExecutor();
             await expect(executor.execute({ technology: 'unknown' }, {}, testConfig)).rejects.toThrow("Unknown cache technology 'unknown'");
         });
-        test('should use shlock locking for preset push', async () => {
+        test('should not use shlock (flaky on virtiofs cache mount) for preset push', async () => {
             const executor = new CachePushStepExecutor();
             const result = await executor.execute({ technology: 'cocoapods' }, {}, testConfig);
-            expect(result.script).toContain('shlock -f "$LOCK_FILE" -p $$');
-            expect(result.script).toContain('LOCK_FILE="$CACHE_FILE.lock"');
-            expect(result.script).toContain('rm -f "$LOCK_FILE"');
-            // Lock timeout after 30 retries
-            expect(result.script).toContain('__ci_lock_tries');
-            expect(result.script).toContain('-ge 30');
-        });
-        test('should use shlock locking for manual cache_key push', async () => {
+            expect(result.script).not.toContain('shlock');
+            expect(result.script).not.toContain('LOCK_FILE');
+            expect(result.script).not.toContain('__ci_lock_tries');
+        });
+        test('should not use shlock for manual cache_key push', async () => {
             const executor = new CachePushStepExecutor();
             const result = await executor.execute({ cache_key: 'my-key', cache_paths: ['build'] }, {}, testConfig);
-            expect(result.script).toContain('shlock -f "$LOCK_FILE" -p $$');
-            expect(result.script).toContain('rm -f "$LOCK_FILE"');
+            expect(result.script).not.toContain('shlock');
+            expect(result.script).not.toContain('LOCK_FILE');
         });
         test('should use atomic write (tmp + mv) for preset push', async () => {
             const executor = new CachePushStepExecutor();
@@ -332,6 +370,12 @@ describe('Step Implementations', () => {
             expect(result.script).toContain('> "$CACHE_FILE.tmp"');
             expect(result.script).toContain('mv "$CACHE_FILE.tmp" "$CACHE_FILE"');
         });
+        test('should use atomic write (tmp + mv) for manual cache_key push', async () => {
+            const executor = new CachePushStepExecutor();
+            const result = await executor.execute({ cache_key: 'my-key', cache_paths: ['build'] }, {}, testConfig);
+            expect(result.script).toContain('> "$CACHE_FILE.tmp"');
+            expect(result.script).toContain('mv "$CACHE_FILE.tmp" "$CACHE_FILE"');
+        });
     });
     describe('XcodeBuildStepExecutor', () => {
         test('should generate xcodebuild script', async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "1.4.9",
+  "version": "1.5.1",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",