@invarn/cibuild 2.5.6 → 2.5.9

package/dist/src/commands/build.d.ts

@@ -38,8 +38,19 @@ export interface IosSetupOptions {
     appStoreDeploy: boolean;
     bundleId: string;
 }
-export declare function generateAndroidPipeline(javaVersion?: number, setup?: SetupOptions, variants?: WorkflowVariants, cacheTechnology?: "gradle" | "kmm", metaNamespace?: 'invarn' | 'cibuild.io'): string;
-export declare function generateIosPipeline(projectPath: string, setup: IosSetupOptions, variants: IosWorkflowVariants, metaNamespace?: 'invarn' | 'cibuild.io'): string;
+/**
+ * The `trigger_map` block appended to every generated pipeline.
+ *
+ * Without it the pipeline is inert on the Invarn side: `dispatchRepoEvent`
+ * skips any pipeline whose YAML declares no trigger_map, so a scaffolded repo
+ * receives pushes and builds nothing, with no error to explain it.
+ *
+ * `release` is deliberately absent — it deploys to Google Play / App Store,
+ * and a webhook must never reach it.
+ */
+export declare function triggerMapBlock(defaultBranch?: string): string;
+export declare function generateAndroidPipeline(javaVersion?: number, setup?: SetupOptions, variants?: WorkflowVariants, cacheTechnology?: "gradle" | "kmm", metaNamespace?: 'invarn' | 'cibuild.io', defaultBranch?: string): string;
+export declare function generateIosPipeline(projectPath: string, setup: IosSetupOptions, variants: IosWorkflowVariants, metaNamespace?: 'invarn' | 'cibuild.io', defaultBranch?: string): string;
 export declare function handleBuildCommand(detectMobileProjectRoot: (dir: string) => "android" | "ios" | "kmm" | null, options?: {
     createPipelinesDir?: boolean;
     nonInteractive?: boolean;

package/dist/src/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoJD,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAgL,EACvL,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,GACpD,MAAM,CA2NR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,GACpD,MAAM,CA4LR;AAgVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoJD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAgL,EACvL,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA2NR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}

package/dist/src/commands/build.js

@@ -6,6 +6,7 @@ import { scanIosProject, formatIosScanResult } from "./ios-scanner.js";
 import { SecretsManager } from "../yaml/secrets-manager.js";
 import { collectFileSecret } from "./file-secret-collector.js";
 import { generateGitHubActionsWorkflow } from "./github-workflow.js";
+import { detectDefaultBranch, FALLBACK_DEFAULT_BRANCH } from "../shared/git.js";
 function variantFromName(name) {
     const buildType = name.charAt(0).toUpperCase() + name.slice(1);
     return { variant: name, buildType, gradleTask: `assemble${buildType}` };
@@ -122,7 +123,32 @@ function detectSetupNeeds(warnings) {
         artifactType: 'apk',
     };
 }
-export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {} }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io') {
+/**
+ * The `trigger_map` block appended to every generated pipeline.
+ *
+ * Without it the pipeline is inert on the Invarn side: `dispatchRepoEvent`
+ * skips any pipeline whose YAML declares no trigger_map, so a scaffolded repo
+ * receives pushes and builds nothing, with no error to explain it.
+ *
+ * `release` is deliberately absent — it deploys to Google Play / App Store,
+ * and a webhook must never reach it.
+ */
+export function triggerMapBlock(defaultBranch = FALLBACK_DEFAULT_BRANCH) {
+    const branch = defaultBranch.trim() || FALLBACK_DEFAULT_BRANCH;
+    // JSON.stringify gives a valid double-quoted YAML scalar for any branch
+    // name git will accept. Quoting is not cosmetic: a branch called `no` or
+    // `y` parses as a boolean unquoted, and one called `1.0` as a number.
+    return `
+# Which GitHub events build which workflow. Without this block the pipeline
+# is never triggered by a push or a pull request.
+trigger_map:
+  - push_branch: ${JSON.stringify(branch)}
+    workflow: primary
+  - pull_request_target_branch: "*"
+    workflow: pull-request
+`;
+}
+export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {} }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
     const keystoreStepFor = (wf) => {
         if (!setup.keystore)
             return "";
@@ -331,9 +357,9 @@ ${googlePlayStep}
                   echo "${releaseArtifactLabel}: \$artifact"
                 done
               fi
-`;
+${triggerMapBlock(defaultBranch)}`;
 }
-export function generateIosPipeline(projectPath, setup, variants, metaNamespace = 'cibuild.io') {
+export function generateIosPipeline(projectPath, setup, variants, metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
     const { primary: pv, pullRequest: prv, release: rv } = variants;
     // Global scheme is the primary scheme (used as default across workflows)
     const globalScheme = pv.scheme;
@@ -508,7 +534,7 @@ ${appStoreDeployStep}
               if [ -n "\$CIBUILD_XCARCHIVE_PATH" ]; then
                 echo "Archive: \$CIBUILD_XCARCHIVE_PATH"
               fi
-`;
+${triggerMapBlock(defaultBranch)}`;
 }
 /**
  * Prints a hint listing env vars / Gradle properties detected during scanning
@@ -771,7 +797,7 @@ async function handleIosBuildCommand(cwd, options = {}) {
         }
     }
     // 7. Generate and write the pipeline
-    const yaml = generateIosPipeline(iosScanResult.projectPath, iosSetupOptions, iosVariants, options.metaNamespace);
+    const yaml = generateIosPipeline(iosScanResult.projectPath, iosSetupOptions, iosVariants, options.metaNamespace, detectDefaultBranch());
     writeFileSync(outputPath, yaml, "utf-8");
     console.log("\n✅ Generated .ci/pipelines/cibuild.yml");
     console.log("   Platform: iOS");
@@ -1042,7 +1068,7 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
     // that exact JDK — a newer JDK can cross-compile. Enforce a minimum of 17
     // since ubuntu-latest runners ship with JDK 17+ and JDK <17 is unavailable.
     const javaVersion = Math.max(scanResult.detectedJavaVersion ?? 17, 17);
-    const yaml = generateAndroidPipeline(javaVersion, setupOptions, variants, cacheTechnology, options.metaNamespace);
+    const yaml = generateAndroidPipeline(javaVersion, setupOptions, variants, cacheTechnology, options.metaNamespace, detectDefaultBranch());
     writeFileSync(outputPath, yaml, "utf-8");
     console.log("\n✅ Generated .ci/pipelines/cibuild.yml");
     console.log(`   Platform: ${platformLabel}`);

package/dist/src/commands/build.test.js

@@ -10,7 +10,9 @@
  * `metaNamespace: 'invarn'` and get `meta.invarn:`.
  */
 import { describe, test, expect } from '@jest/globals';
+import { load } from 'js-yaml';
 import { generateIosPipeline, generateAndroidPipeline, } from './build.js';
+const parse = (yaml) => load(yaml);
 const iosSetup = {
     cocoaPods: false,
     codeSigning: false,
@@ -56,4 +58,64 @@ describe('generateAndroidPipeline — meta namespace', () => {
         expect(yaml).not.toContain('meta:\n  cibuild.io:\n');
     });
 });
+/**
+ * A generated pipeline with no `trigger_map` is inert on the Invarn side:
+ * the webhook handler skips any pipeline whose YAML has none, so a repo
+ * scaffolded by `ci build` receives pushes and builds nothing, with no
+ * error anywhere to explain it.
+ *
+ * Both generators emit `primary`, `pull-request` and `release`. Pushes go to
+ * `primary`, pull requests to `pull-request`, and `release` stays manual —
+ * it deploys to Google Play / App Store and must never fire off a push.
+ */
+describe.each([
+    ['generateIosPipeline', (branch) => generateIosPipeline('./MyApp', iosSetup, iosVariants, 'cibuild.io', branch)],
+    ['generateAndroidPipeline', (branch) => generateAndroidPipeline(17, undefined, undefined, 'gradle', 'cibuild.io', branch)],
+])('%s — trigger_map', (_name, generate) => {
+    test('emits a trigger_map', () => {
+        const doc = parse(generate());
+        expect(Array.isArray(doc.trigger_map)).toBe(true);
+        expect(doc.trigger_map.length).toBeGreaterThan(0);
+    });
+    test('every rule names a workflow the pipeline actually declares', () => {
+        const doc = parse(generate());
+        const declared = Object.keys(doc.workflows ?? {});
+        for (const rule of doc.trigger_map) {
+            expect(declared).toContain(rule.workflow);
+        }
+    });
+    test('routes a push to primary and a pull request to pull-request', () => {
+        const doc = parse(generate());
+        const push = doc.trigger_map.find((r) => r.push_branch !== undefined);
+        const pr = doc.trigger_map.find((r) => r.pull_request_target_branch !== undefined);
+        expect(push?.workflow).toBe('primary');
+        expect(pr?.workflow).toBe('pull-request');
+    });
+    test('never fires release off a webhook', () => {
+        const doc = parse(generate());
+        expect(doc.trigger_map.map((r) => r.workflow)).not.toContain('release');
+    });
+    test('defaults the push branch to main', () => {
+        const doc = parse(generate());
+        const push = doc.trigger_map.find((r) => r.push_branch !== undefined);
+        expect(push?.push_branch).toBe('main');
+    });
+    test('keys the push branch to the branch it is given', () => {
+        const doc = parse(generate('develop'));
+        const push = doc.trigger_map.find((r) => r.push_branch !== undefined);
+        expect(push?.push_branch).toBe('develop');
+    });
+    test('survives a branch name containing a slash', () => {
+        const doc = parse(generate('release/1.0'));
+        const push = doc.trigger_map.find((r) => r.push_branch !== undefined);
+        expect(push?.push_branch).toBe('release/1.0');
+    });
+    test('still parses when the branch name would otherwise read as a YAML bool', () => {
+        // `push_branch: no` parses as `false` unquoted. Git allows a branch
+        // called `no`, so the value has to be quoted on the way out.
+        const doc = parse(generate('no'));
+        const push = doc.trigger_map.find((r) => r.push_branch !== undefined);
+        expect(push?.push_branch).toBe('no');
+    });
+});
 //# sourceMappingURL=build.test.js.map

package/dist/src/shared/git.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Git probes used while scaffolding a pipeline.
+ *
+ * Scaffolding runs inside the user's checkout, so the repository itself is
+ * the best available source of truth for values the generated YAML has to
+ * hardcode. Everything here is best-effort: a scaffold must still succeed in
+ * a directory that is not a git repository at all.
+ */
+/** What we key a `trigger_map` to when git can't tell us anything better. */
+export declare const FALLBACK_DEFAULT_BRANCH = "main";
+/**
+ * The branch a generated `trigger_map` should build on push.
+ *
+ * Order matters. The remote's HEAD is what GitHub calls the repository's
+ * default branch, and it is what the webhook will report on a merge — so it
+ * wins over whatever happens to be checked out. Only when there is no remote
+ * (a repo that has not been pushed anywhere yet) do we fall back to the
+ * current branch, and only when that is unavailable too — no repo, or a
+ * detached HEAD — do we guess.
+ *
+ * Guessing wrong is not silent: the pipeline is written to disk where the
+ * user can read and correct the branch before committing it.
+ */
+export declare function detectDefaultBranch(cwd?: string): string;
+//# sourceMappingURL=git.d.ts.map

package/dist/src/shared/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../src/shared/git.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAc9C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,CAevE"}

package/dist/src/shared/git.js

@@ -0,0 +1,53 @@
+/**
+ * Git probes used while scaffolding a pipeline.
+ *
+ * Scaffolding runs inside the user's checkout, so the repository itself is
+ * the best available source of truth for values the generated YAML has to
+ * hardcode. Everything here is best-effort: a scaffold must still succeed in
+ * a directory that is not a git repository at all.
+ */
+import { execFileSync } from 'node:child_process';
+/** What we key a `trigger_map` to when git can't tell us anything better. */
+export const FALLBACK_DEFAULT_BRANCH = 'main';
+function git(cwd, args) {
+    try {
+        return execFileSync('git', args, {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The branch a generated `trigger_map` should build on push.
+ *
+ * Order matters. The remote's HEAD is what GitHub calls the repository's
+ * default branch, and it is what the webhook will report on a merge — so it
+ * wins over whatever happens to be checked out. Only when there is no remote
+ * (a repo that has not been pushed anywhere yet) do we fall back to the
+ * current branch, and only when that is unavailable too — no repo, or a
+ * detached HEAD — do we guess.
+ *
+ * Guessing wrong is not silent: the pipeline is written to disk where the
+ * user can read and correct the branch before committing it.
+ */
+export function detectDefaultBranch(cwd = process.cwd()) {
+    // `origin/main` → `main`. Absent unless the remote HEAD ref is set locally,
+    // which `git clone` does and `git init` does not.
+    const remoteHead = git(cwd, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']);
+    if (remoteHead) {
+        const branch = remoteHead.replace(/^origin\//, '').trim();
+        if (branch)
+            return branch;
+    }
+    // `--abbrev-ref HEAD` answers the literal string "HEAD" on a detached
+    // checkout, which is not a branch name and must not become one.
+    const current = git(cwd, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    if (current && current !== 'HEAD')
+        return current;
+    return FALLBACK_DEFAULT_BRANCH;
+}
+//# sourceMappingURL=git.js.map

package/dist/src/shared/git.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Unit tests for the default-branch probe.
+ *
+ * The probe shells out to git, so these drive it against real throwaway
+ * repositories in a temp dir rather than mocking child_process — the whole
+ * point of the helper is that it agrees with what git actually reports.
+ */
+export {};
+//# sourceMappingURL=git.test.d.ts.map

package/dist/src/shared/git.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.test.d.ts","sourceRoot":"","sources":["../../../src/shared/git.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/src/shared/git.test.js

@@ -0,0 +1,66 @@
+/**
+ * Unit tests for the default-branch probe.
+ *
+ * The probe shells out to git, so these drive it against real throwaway
+ * repositories in a temp dir rather than mocking child_process — the whole
+ * point of the helper is that it agrees with what git actually reports.
+ */
+import { describe, test, expect, beforeAll, afterAll } from '@jest/globals';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { detectDefaultBranch } from './git.js';
+function git(cwd, ...args) {
+    execFileSync('git', args, { cwd, stdio: 'ignore' });
+}
+/** A repo with one commit on `branch`, and no remote. */
+function makeRepo(root, name, branch) {
+    const dir = join(root, name);
+    execFileSync('mkdir', ['-p', dir]);
+    git(dir, 'init', '--quiet', `--initial-branch=${branch}`);
+    git(dir, 'config', 'user.email', 'test@example.com');
+    git(dir, 'config', 'user.name', 'Test');
+    writeFileSync(join(dir, 'README.md'), '# test\n');
+    git(dir, 'add', 'README.md');
+    git(dir, 'commit', '--quiet', '-m', 'init');
+    return dir;
+}
+describe('detectDefaultBranch', () => {
+    let root;
+    beforeAll(() => {
+        root = mkdtempSync(join(tmpdir(), 'cibuild-git-'));
+    });
+    afterAll(() => {
+        rmSync(root, { recursive: true, force: true });
+    });
+    test('reads the current branch when there is no remote', () => {
+        expect(detectDefaultBranch(makeRepo(root, 'plain', 'main'))).toBe('main');
+    });
+    test('reads a non-main current branch', () => {
+        expect(detectDefaultBranch(makeRepo(root, 'legacy', 'master'))).toBe('master');
+    });
+    test('prefers the remote HEAD over the checked-out branch', () => {
+        // A clone sitting on a topic branch must still key its trigger to the
+        // branch the remote considers default — otherwise the generated pipeline
+        // would only ever build whatever branch happened to be checked out at
+        // scaffold time.
+        const origin = makeRepo(root, 'origin-repo', 'develop');
+        const clone = join(root, 'cloned');
+        execFileSync('git', ['clone', '--quiet', origin, clone], { stdio: 'ignore' });
+        git(clone, 'checkout', '--quiet', '-b', 'feature/whatever');
+        expect(detectDefaultBranch(clone)).toBe('develop');
+    });
+    test('falls back to main outside a git repository', () => {
+        const notARepo = join(root, 'bare-dir');
+        execFileSync('mkdir', ['-p', notARepo]);
+        expect(detectDefaultBranch(notARepo)).toBe('main');
+    });
+    test('falls back to main on a detached HEAD with no remote', () => {
+        const dir = makeRepo(root, 'detached', 'main');
+        const sha = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: dir, encoding: 'utf8' }).trim();
+        git(dir, 'checkout', '--quiet', sha);
+        expect(detectDefaultBranch(dir)).toBe('main');
+    });
+});
+//# sourceMappingURL=git.test.js.map

package/dist/src/yaml/steps/base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/base.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtF;;;;;;;OAOG;IACH,yBAAyB,CAAC,CACxB,MAAM,EAAE,GAAG,EACX,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,MAAM,EAAE,QAAQ,GACf,qBAAqB,EAAE,CAAC;IAE3B;;;;OAIG;IACH,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC;IAE5B;;;OAGG;IACH,oBAAoB,CAAC,IAAI,OAAO,CAAC;CAClC;AAED;;GAEG;AACH,8BAAsB,gBAAiB,YAAW,YAAY;IAC5D;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAE9F;;;;;OAKG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAUjE;;;;;OAKG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IASjE;;;;;OAKG;IACH,SAAS,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAS/D;;;;;OAKG;IACH,SAAS,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAS/D;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC;IAOnE;;;;;;;OAOG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG;IAS3E;;;;OAIG;IACH,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAKzC;;;;;;OAMG;IACH,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM;IAgB7E;;;;;;OAMG;IACH,SAAS,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAmB3E;;;;;OAKG;IACH,SAAS,CAAC,4BAA4B,CACpC,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,MAAM,GACf,MAAM;IAQT;;;OAGG;IACH,yBAAyB,CACvB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAI1B;;;OAGG;IACH,UAAU,IAAI,UAAU,EAAE;IAI1B;;;;OAIG;IACH,oBAAoB,IAAI,OAAO;IAI/B;;;OAGG;IACH,SAAS,CAAC,cAAc,CACtB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,qBAAqB;IAYxB;;;OAGG;IACH,SAAS,CAAC,aAAa,CACrB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,IAAI,CAAC,EAAE,MAAM,GACZ,qBAAqB;IAiBxB;;;OAGG;IACH,SAAS,CAAC,WAAW,CACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,qBAAqB;IAiBxB;;;OAGG;IACH,SAAS,CAAC,gBAAgB,CACxB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,qBAAqB;IAiBxB;;;OAGG;IACH,SAAS,CAAC,YAAY,CACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,GAAG,EACX,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,qBAAqB;IAiBxB;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,GAAE,kBAA2B,EACrC,UAAU,CAAC,EAAE,MAAM,GAClB,qBAAqB;IAWxB;;;OAGG;cACa,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAiBnF;;;OAGG;cACa,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA2BlF;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,GAAG,CAAC;IACd,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;IACvD;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,CAAC;AAErD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,MAAM,CAAC,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAC;KAClC,CAAC;CACH"}
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/base.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtF;;;;;;;OAOG;IACH,yBAAyB,CAAC,CACxB,MAAM,EAAE,GAAG,EACX,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,MAAM,EAAE,QAAQ,GACf,qBAAqB,EAAE,CAAC;IAE3B;;;;OAIG;IACH,UAAU,CAAC,IAAI,UAAU,EAAE,CAAC;IAE5B;;;OAGG;IACH,oBAAoB,CAAC,IAAI,OAAO,CAAC;CAClC;AAED;;GAEG;AACH,8BAAsB,gBAAiB,YAAW,YAAY;IAC5D;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAE9F;;;;;OAKG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAUjE;;;;;OAKG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IASjE;;;;;OAKG;IACH,SAAS,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAS/D;;;;;OAKG;IACH,SAAS,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAS/D;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC;IAOnE;;;;;;;OAOG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG;IAS3E;;;;OAIG;IACH,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAKzC;;;;;;OAMG;IACH,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM;IAgB7E;;;;;;OAMG;IACH,SAAS,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IA0B3E;;;;;OAKG;IACH,SAAS,CAAC,4BAA4B,CACpC,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,MAAM,GACf,MAAM;IAQT;;;OAGG;IACH,yBAAyB,CACvB,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAI1B;;;OAGG;IACH,UAAU,IAAI,UAAU,EAAE;IAI1B;;;;OAIG;IACH,oBAAoB,IAAI,OAAO;IAI/B;;;OAGG;IACH,SAAS,CAAC,cAAc,CACtB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,qBAAqB;IAYxB;;;OAGG;IACH,SAAS,CAAC,aAAa,CACrB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,IAAI,CAAC,EAAE,MAAM,GACZ,qBAAqB;IAiBxB;;;OAGG;IACH,SAAS,CAAC,WAAW,CACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,qBAAqB;IAiBxB;;;OAGG;IACH,SAAS,CAAC,gBAAgB,CACxB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,qBAAqB;IAiBxB;;;OAGG;IACH,SAAS,CAAC,YAAY,CACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,GAAG,EACX,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,qBAAqB;IAiBxB;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,QAAQ,GAAE,kBAA2B,EACrC,UAAU,CAAC,EAAE,MAAM,GAClB,qBAAqB;IAWxB;;;OAGG;cACa,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAiBnF;;;OAGG;cACa,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA2BlF;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,GAAG,CAAC;IACd,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;IACvD;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,CAAC;AAErD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,MAAM,CAAC,EAAE;QACP,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAC;KAClC,CAAC;CACH"}

package/dist/src/yaml/steps/base.js

@@ -133,12 +133,19 @@ set -o pipefail  # Catch errors in pipes
 
 # Step: ${stepName}
 
-# Load environment variables from envman store (set by previous steps)
+# Load environment variables from envman store (set by previous steps).
+# Records are terminated by NUL, not by newline. An environment variable may
+# hold a newline -- a commit message body, a PEM key, a JSON blob -- but never
+# a NUL, so no value can be read back as a further record. The key is then
+# checked against the shell's identifier grammar as a second, independent
+# defence: even a malformed entry can neither be exported nor fail the step.
 ENVSTORE_FILE="\${ENVMAN_ENVSTORE_PATH:-.ci/.envstore.json}"
 if [ -f "$ENVSTORE_FILE" ]; then
-  while IFS='=' read -r key value; do
-    [ -n "$key" ] && export "$key=$value"
-  done < <(node -e "const fs=require('fs');try{const s=JSON.parse(fs.readFileSync('$ENVSTORE_FILE','utf-8'));(s.envs||[]).forEach(e=>console.log(e.key+'='+e.value))}catch(err){}" 2>/dev/null || true)
+  while IFS='=' read -r -d '' key value; do
+    if [[ "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
+      export "$key=$value"
+    fi
+  done < <(node -e "const fs=require('fs');const NUL=String.fromCharCode(0);try{const s=JSON.parse(fs.readFileSync('$ENVSTORE_FILE','utf-8'));(s.envs||[]).forEach(e=>process.stdout.write(e.key+'='+e.value+NUL))}catch(err){}" 2>/dev/null || true)
 fi
 
 ${scriptContent}

package/dist/src/yaml/steps/cache-push-daemon.test.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `cache-push` with an explicit `cache_key`, over the daemon.
+ *
+ * Every curated Invarn template uses the explicit-key form — `cache_key:
+ * pods-{{checksum "Podfile.lock"}}-$CIBUILD_GIT_BRANCH` and its Gradle/KMM
+ * siblings — for both halves of the pair. The pull side assigns the shell
+ * variable the daemon URL interpolates; the push side did not, and there is
+ * no `set -u`, so `$CACHE_KEY` expanded to nothing and the upload went to
+ * `<daemon>/cache/.tar.zst`. The daemon requires at least one character
+ * before `.tar.zst` and answers 400, which is exactly what the first real
+ * `invarn setup` proof logged on 2026-08-30:
+ *
+ *     curl: (22) The requested URL returned error: 400
+ *     Warning: failed to upload cache to the daemon
+ *     [step_6] ✓ Success (109ms)
+ *
+ * Nothing was ever stored, so the pull could never hit, and every iOS build
+ * paid a cold `pod install`.
+ *
+ * These tests RUN the generated script. A containment check on the script
+ * text cannot see this defect: the text contains the literal `$CACHE_KEY`
+ * either way, which is why the existing assertion passed throughout. `curl`
+ * and `zstd` are stubbed onto PATH so the pipeline completes on any host and
+ * the URL actually requested can be read back.
+ */
+export {};
+//# sourceMappingURL=cache-push-daemon.test.d.ts.map

package/dist/src/yaml/steps/cache-push-daemon.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-push-daemon.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache-push-daemon.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}

package/dist/src/yaml/steps/cache-push-daemon.test.js

@@ -0,0 +1,132 @@
+/**
+ * `cache-push` with an explicit `cache_key`, over the daemon.
+ *
+ * Every curated Invarn template uses the explicit-key form — `cache_key:
+ * pods-{{checksum "Podfile.lock"}}-$CIBUILD_GIT_BRANCH` and its Gradle/KMM
+ * siblings — for both halves of the pair. The pull side assigns the shell
+ * variable the daemon URL interpolates; the push side did not, and there is
+ * no `set -u`, so `$CACHE_KEY` expanded to nothing and the upload went to
+ * `<daemon>/cache/.tar.zst`. The daemon requires at least one character
+ * before `.tar.zst` and answers 400, which is exactly what the first real
+ * `invarn setup` proof logged on 2026-08-30:
+ *
+ *     curl: (22) The requested URL returned error: 400
+ *     Warning: failed to upload cache to the daemon
+ *     [step_6] ✓ Success (109ms)
+ *
+ * Nothing was ever stored, so the pull could never hit, and every iOS build
+ * paid a cold `pod install`.
+ *
+ * These tests RUN the generated script. A containment check on the script
+ * text cannot see this defect: the text contains the literal `$CACHE_KEY`
+ * either way, which is why the existing assertion passed throughout. `curl`
+ * and `zstd` are stubbed onto PATH so the pipeline completes on any host and
+ * the URL actually requested can be read back.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { execFileSync } from 'child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, existsSync, chmodSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { CachePushStepExecutor } from './cache.js';
+import { testConfigNoPeer } from './test-config.js';
+const CACHE_KEY = 'pods-abc123def456-main';
+/**
+ * Generates the explicit-key push step, runs it, and reports what `curl` was
+ * actually asked to do.
+ *
+ * @param curlExit  exit status the stub returns, and `curlBody` is what it
+ *                  prints — so a rejection can be exercised without a daemon.
+ */
+async function runPush({ curlExit = 0, curlBody = '' } = {}) {
+    const dir = mkdtempSync(join(tmpdir(), 'cibuild-push-'));
+    try {
+        // Something real to cache, so the step does not take its empty branch.
+        const payload = join(dir, 'Pods');
+        mkdirSync(payload, { recursive: true });
+        writeFileSync(join(payload, 'thing.txt'), 'contents\n', 'utf-8');
+        const bin = join(dir, 'bin');
+        mkdirSync(bin, { recursive: true });
+        const urlLog = join(dir, 'curl-urls.txt');
+        // Records the URL, drains stdin so the upstream pipe does not break.
+        writeFileSync(join(bin, 'curl'), [
+            '#!/bin/bash',
+            'for arg in "$@"; do',
+            '  case "$arg" in',
+            `    http*) printf '%s\\n' "$arg" >> "${urlLog}" ;;`,
+            '  esac',
+            'done',
+            'cat > /dev/null',
+            curlBody ? `printf '%s' ${JSON.stringify(curlBody)}` : ':',
+            `exit ${curlExit}`,
+        ].join('\n'), 'utf-8');
+        chmodSync(join(bin, 'curl'), 0o755);
+        // zstd is not on every host, and without it the pipeline fails before
+        // curl is ever reached — which would make these tests pass vacuously.
+        writeFileSync(join(bin, 'zstd'), '#!/bin/bash\ncat\n', 'utf-8');
+        chmodSync(join(bin, 'zstd'), 0o755);
+        const { script } = await new CachePushStepExecutor().execute({ cache_key: CACHE_KEY, cache_paths: ['Pods'] }, {}, testConfigNoPeer);
+        const scriptPath = join(dir, '__cache_push.sh');
+        writeFileSync(scriptPath, script, 'utf-8');
+        let stdout = '';
+        try {
+            stdout = execFileSync('bash', [scriptPath], {
+                cwd: dir,
+                encoding: 'utf-8',
+                stdio: ['ignore', 'pipe', 'pipe'],
+                env: {
+                    ...process.env,
+                    PATH: `${bin}:${process.env.PATH}`,
+                    CIBUILD_CACHE_DAEMON: 'http://daemon.invalid',
+                    CIBUILD_CACHE_TOKEN: 'tok',
+                },
+                timeout: 20000,
+            });
+        }
+        catch (e) {
+            const err = e;
+            stdout = String(err.stdout ?? '') + String(err.stderr ?? '');
+        }
+        const urls = existsSync(urlLog)
+            ? readFileSync(urlLog, 'utf-8').split('\n').filter(Boolean)
+            : [];
+        return { stdout, urls };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+describe('cache-push with an explicit key, over the daemon', () => {
+    test('uploads under the key it was given', async () => {
+        const { urls } = await runPush();
+        expect(urls).toHaveLength(1);
+        expect(urls[0]).toBe(`http://daemon.invalid/cache/${CACHE_KEY}.tar.zst`);
+    });
+    test('never uploads to an empty key', async () => {
+        // The defect, named. `<daemon>/cache/.tar.zst` is what an unassigned
+        // `$CACHE_KEY` produces, and what the daemon answers 400 to.
+        const { urls } = await runPush();
+        for (const url of urls) {
+            expect(url).not.toMatch(/\/cache\/\.tar\.zst$/);
+        }
+    });
+    test('the step survives a rejection rather than failing the build', async () => {
+        // Deliberate: a build that produced good output should not be failed by a
+        // cache upload. Whether the STEP should still report success having
+        // stored nothing is a separate, open question.
+        const { stdout } = await runPush({ curlExit: 22 });
+        expect(stdout).toContain('Warning: failed to upload cache to the daemon');
+    });
+    test('a rejection says why, not just that it happened', async () => {
+        // `curl -f` throws the response body away, so the daemon's own reason —
+        // `invalid_cache_key`, `cache_busy`, an auth failure — never reached the
+        // log. All the reader got was an exit code, which is how a one-line bug
+        // stayed open behind a warning that named nothing.
+        const { stdout } = await runPush({
+            curlExit: 22,
+            curlBody: '{"error":"invalid_cache_key"}',
+        });
+        expect(stdout).toContain('invalid_cache_key');
+    });
+});
+//# sourceMappingURL=cache-push-daemon.test.js.map

package/dist/src/yaml/steps/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AA6HF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA0HzF,iBAAiB;CA0MhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAsLzF,iBAAiB;CA0JhC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAgLF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA0HzF,iBAAiB;CA0MhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAkLzF,iBAAiB;CAgJhC"}