@invarn/cibuild 1.9.7 → 1.9.9

package/dist/src/yaml/steps/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAmFF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA0GzF,iBAAiB;CA8LhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAgKzF,iBAAiB;CA4HhC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAwFF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA0GzF,iBAAiB;CAqMhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAgKzF,iBAAiB;CAmIhC"}

package/dist/src/yaml/steps/cache.js

@@ -97,7 +97,12 @@ function resolvePresetChain(technology) {
  */
 function emitDaemonPullBranch() {
     return [
-        'elif [ -n "$CIBUILD_CACHE_DAEMON" ] && curl -fsS ${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst" | zstd -dc | tar -xf - -C /; then',
+        // stderr is silenced on the probe: a cache miss is the normal case and
+        // makes curl emit "(22) ... 404" (and the empty body makes zstd print
+        // "unexpected end of file"). Those are non-actionable — the branch just
+        // falls through to the cold path — so they're pure log noise. Exit
+        // status is preserved (pipefail), so the fall-through still works.
+        'elif [ -n "$CIBUILD_CACHE_DAEMON" ] && { curl -fsS ${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst" | zstd -dc | tar -xf - -C /; } 2>/dev/null; then',
         '  echo "Cache found (daemon), extracting..."',
         // LRU bump the tarball the daemon just persisted to ~/cache (same dir as
         // the --dir mount); tolerate its absence in case the daemon served it
@@ -237,13 +242,20 @@ export class CachePullStepExecutor extends BaseStepExecutor {
             commands.push('fi');
         }
         else {
-            // Fallback chain: try each lockfile in order, use the first one found
+            // Fallback chain: probe every lockfile up front, then branch on the
+            // results. The probes must precede the if/elif — emitting a probe
+            // inside a prior preset's `then` body (the old shape) meant the
+            // second lockfile was only checked when the FIRST one was found, so
+            // an SPM project with no Podfile.lock never reached the Package.resolved
+            // branch and fell through to `<first>-no-lockfile`.
+            for (let i = 0; i < chain.length; i++) {
+                commands.push(`__ci_lockfile_${i}=$(__ci_find_lockfile "${this.escapeBash(chain[i].lockfile)}")`);
+            }
             for (let i = 0; i < chain.length; i++) {
                 const preset = chain[i];
                 const cond = i === 0 ? 'if' : 'elif';
-                commands.push(`__ci_lockfile_candidate=$(__ci_find_lockfile "${this.escapeBash(preset.lockfile)}")`);
-                commands.push(`${cond} [ -n "$__ci_lockfile_candidate" ] && [ -f "$__ci_lockfile_candidate" ]; then`);
-                commands.push('  LOCKFILE="$__ci_lockfile_candidate"');
+                commands.push(`${cond} [ -n "$__ci_lockfile_${i}" ] && [ -f "$__ci_lockfile_${i}" ]; then`);
+                commands.push(`  LOCKFILE="$__ci_lockfile_${i}"`);
                 commands.push(`  CHECKSUM=$(shasum -a 256 "$LOCKFILE" | cut -d ' ' -f1 | head -c 16)`);
                 commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-\${CHECKSUM}"`);
                 if (isDebugMode) {
@@ -545,12 +557,19 @@ export class CachePushStepExecutor extends BaseStepExecutor {
             commands.push('fi');
         }
         else {
+            // Fallback chain: probe every lockfile up front, then branch — same
+            // fix as cache-pull. A probe nested in a prior preset's `then` body
+            // only ran when the first lockfile was found, so push wrote the
+            // `<first>-no-lockfile` key for SPM projects, mismatching what a
+            // correct pull would look for.
+            for (let i = 0; i < chain.length; i++) {
+                commands.push(`__ci_lockfile_${i}=$(__ci_find_lockfile "${this.escapeBash(chain[i].lockfile)}")`);
+            }
             for (let i = 0; i < chain.length; i++) {
                 const preset = chain[i];
                 const cond = i === 0 ? 'if' : 'elif';
-                commands.push(`__ci_lockfile_candidate=$(__ci_find_lockfile "${this.escapeBash(preset.lockfile)}")`);
-                commands.push(`${cond} [ -n "$__ci_lockfile_candidate" ] && [ -f "$__ci_lockfile_candidate" ]; then`);
-                commands.push('  LOCKFILE="$__ci_lockfile_candidate"');
+                commands.push(`${cond} [ -n "$__ci_lockfile_${i}" ] && [ -f "$__ci_lockfile_${i}" ]; then`);
+                commands.push(`  LOCKFILE="$__ci_lockfile_${i}"`);
                 commands.push(`  CHECKSUM=$(shasum -a 256 "$LOCKFILE" | cut -d ' ' -f1 | head -c 16)`);
                 commands.push(`  CACHE_KEY="${this.escapeBash(preset.keyPrefix)}-\${__ci_proj}-\${CHECKSUM}"`);
             }

package/dist/src/yaml/steps/steps.test.js

@@ -3,6 +3,10 @@
  * Tests each step executor with sample inputs
  */
 import { describe, test, expect } from '@jest/globals';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { GitCloneStepExecutor } from './git-clone.js';
 import { ScriptStepExecutor } from './script.js';
 import { CachePullStepExecutor, CachePushStepExecutor } from './cache.js';
@@ -166,6 +170,101 @@ describe('Step Implementations', () => {
             expect(result.script).toContain('Package.resolved');
             expect(result.script).toContain('spm-');
         });
+        // A static `toContain` check can't catch a control-flow bug in the
+        // fallback chain (the script "contains" both Podfile.lock and
+        // Package.resolved either way). So actually execute the generated
+        // key-derivation in a fixture repo and read the resolved key back.
+        describe('ios fallback chain (executed in a fixture repo)', () => {
+            // Run the generated ios cache-pull in a fixture repo and capture
+            // BOTH streams (the daemon probe writes its noise to stderr).
+            async function runIosPull(build, env = {}) {
+                const script = (await new CachePullStepExecutor().execute({ technology: 'ios' }, {}, testConfigNoPeer)).script;
+                const dir = mkdtempSync(join(tmpdir(), 'cibuild-cache-'));
+                try {
+                    build(dir);
+                    const scriptPath = join(dir, '__cache_pull.sh');
+                    writeFileSync(scriptPath, script);
+                    let stdout = '';
+                    let stderr = '';
+                    try {
+                        stdout = execFileSync('bash', [scriptPath], {
+                            cwd: dir,
+                            encoding: 'utf-8',
+                            stdio: ['ignore', 'pipe', 'pipe'],
+                            env: { ...process.env, ...env },
+                            timeout: 20000,
+                        });
+                    }
+                    catch (e) {
+                        const err = e;
+                        stdout = String(err.stdout ?? '');
+                        stderr = String(err.stderr ?? '');
+                    }
+                    return { stdout, stderr, combined: stdout + stderr };
+                }
+                finally {
+                    rmSync(dir, { recursive: true, force: true });
+                }
+            }
+            async function resolveIosCacheKey(build) {
+                const { combined } = await runIosPull(build);
+                const m = combined.match(/CACHE_KEY=(\S+)/);
+                if (!m)
+                    throw new Error(`No CACHE_KEY in output:\n${combined}`);
+                return m[1];
+            }
+            function writeSpmFixture(dir) {
+                const swiftpm = join(dir, 'App.xcodeproj/project.xcworkspace/xcshareddata/swiftpm');
+                mkdirSync(swiftpm, { recursive: true });
+                writeFileSync(join(swiftpm, 'Package.resolved'), '{"pins":[],"version":3}');
+            }
+            test('a cold daemon miss does not print curl/zstd noise', async () => {
+                // Reproduce the runner setup: a configured cache daemon whose
+                // probe fails for an uncached key. (We point at a closed port so
+                // curl errors instantly with no server handle to leak — the fix
+                // silences curl's stderr regardless of the failure mode, exactly
+                // as it does for the 404 seen in production.) The probe must fall
+                // through to cold quietly: no "curl:" or "unexpected end of file".
+                const { stdout, combined } = await runIosPull(writeSpmFixture, {
+                    CIBUILD_CACHE_DAEMON: 'http://127.0.0.1:1',
+                });
+                expect(combined).not.toContain('curl:');
+                expect(combined).not.toContain('unexpected end of file');
+                // Still resolves the SPM key and reports a cold miss.
+                expect(stdout).toContain('CACHE_SOURCE=cold');
+                expect(stdout).toMatch(/CACHE_KEY=spm-/);
+            });
+            test('SPM project (Package.resolved, no Podfile.lock) resolves an spm- key', async () => {
+                const key = await resolveIosCacheKey((dir) => {
+                    // Real Xcode SPM location — Package.resolved committed under
+                    // the shared xcworkspace data, no Podfile.lock anywhere.
+                    const swiftpm = join(dir, 'App.xcodeproj/project.xcworkspace/xcshareddata/swiftpm');
+                    mkdirSync(swiftpm, { recursive: true });
+                    writeFileSync(join(swiftpm, 'Package.resolved'), '{"pins":[],"version":3}');
+                });
+                expect(key).toMatch(/^spm-/);
+                expect(key).not.toContain('no-lockfile');
+            });
+            test('CocoaPods project (Podfile.lock) resolves a pods- key', async () => {
+                const key = await resolveIosCacheKey((dir) => {
+                    writeFileSync(join(dir, 'Podfile.lock'), 'PODS:\n  - Alamofire\n');
+                });
+                expect(key).toMatch(/^pods-/);
+                expect(key).not.toContain('no-lockfile');
+            });
+            test('Podfile.lock wins over Package.resolved when both exist', async () => {
+                const key = await resolveIosCacheKey((dir) => {
+                    writeFileSync(join(dir, 'Podfile.lock'), 'PODS:\n');
+                    writeFileSync(join(dir, 'Package.resolved'), '{"pins":[]}');
+                });
+                expect(key).toMatch(/^pods-/);
+                expect(key).not.toContain('no-lockfile');
+            });
+            test('neither lockfile present falls back to a no-lockfile key', async () => {
+                const key = await resolveIosCacheKey(() => { });
+                expect(key).toContain('no-lockfile');
+            });
+        });
         test('should auto-configure for yarn technology', async () => {
             const executor = new CachePullStepExecutor();
             const result = await executor.execute({ technology: 'yarn' }, {}, testConfig);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "1.9.7",
+  "version": "1.9.9",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",