@invarn/cibuild 2.5.6 → 2.5.9

package/dist/src/yaml/steps/cache.js

@@ -94,6 +94,53 @@ function resolvePresetChain(technology) {
 function daemonCurl(args) {
     return `curl -fsS \${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} ${args}`;
 }
+/**
+ * The same request, keeping the response body when the daemon refuses.
+ *
+ * `-f` throws the body away, so a rejection reached the log as an exit code
+ * and nothing else. The daemon distinguishes `invalid_cache_key` (400), a
+ * retryable `cache_busy` (503) and an auth failure (401); all three arrived
+ * as the same `curl: (22)` line under the same warning, which is how a
+ * one-line bug stayed open behind it. Push only — on the pull side the body
+ * would be piped into `zstd`.
+ *
+ * `--fail-with-body` is curl 7.76+ (2021); every runner image is well past
+ * it. An older curl rejects the option and the step still degrades to
+ * today's behaviour, with the reason in the message.
+ */
+function daemonCurlKeepingErrorBody(args) {
+    return `curl --fail-with-body -sS \${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} ${args}`;
+}
+/**
+ * The daemon half of `cache-push`, shared by both step forms.
+ *
+ * Shared because it did not used to be. The two forms carried byte-identical
+ * copies of this block, and the explicit-key one reached it without ever
+ * assigning the `CACHE_KEY` it interpolates — the preset form assigned it,
+ * the other only assigned `CACHE_FILE`. There is no `set -u`, so the PUT went
+ * to `<daemon>/cache/.tar.zst`, the daemon answered 400, and the step
+ * reported success. Every curated Invarn template uses the explicit-key form,
+ * so nothing was ever stored by any of them. One definition cannot diverge
+ * from itself.
+ */
+function emitDaemonPushCommands() {
+    return [
+        `    if __ci_push_err=$(tar -cf - "\${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 | ${daemonCurlKeepingErrorBody('-T - "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} 2>&1); then`,
+        '      echo "Cache created successfully"',
+        '    else',
+        // Never fatal: a build that produced good output should not be failed by
+        // a cache upload, and the next build simply misses. Saying *why* costs
+        // nothing and is the difference between a warning and a diagnosis.
+        "      __ci_push_msg=$(printf '%s' \"$__ci_push_err\" | tr '\\n' ' ')",
+        '      __ci_push_msg=${__ci_push_msg:0:300}',
+        '      if [ -n "$__ci_push_msg" ]; then',
+        '        echo "Warning: failed to upload cache to the daemon — $__ci_push_msg"',
+        '      else',
+        '        echo "Warning: failed to upload cache to the daemon"',
+        '      fi',
+        '    fi',
+    ];
+}
 /**
  * Restores a cache through the daemon rather than a shared directory.
  *
@@ -491,7 +538,11 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
-        commands.push(`CACHE_FILE="$CACHE_DIR/${this.escapeBash(cacheKey)}.tar.zst"`);
+        // CACHE_KEY first, CACHE_FILE derived from it — exactly as the pull side
+        // does. This step used to set only CACHE_FILE while the daemon URL below
+        // interpolated `$CACHE_KEY`; see emitDaemonPushCommands.
+        commands.push(`CACHE_KEY="${this.escapeBash(cacheKey)}"`);
+        commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
         if (isDebugMode) {
             commands.push('echo "Debug mode enabled"');
             commands.push('echo "Cache file: $CACHE_FILE"');
@@ -561,11 +612,7 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         }
         // Transport split — see the preset path.
         commands.push('  if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
-        commands.push(`    if tar -cf - "\${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 | ${daemonCurl('-T - "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} > /dev/null; then`);
-        commands.push('      echo "Cache created successfully"');
-        commands.push('    else');
-        commands.push('      echo "Warning: failed to upload cache to the daemon"');
-        commands.push('    fi');
+        commands.push(...emitDaemonPushCommands());
         commands.push('  else');
         // Atomic write into a per-process-unique temp (CBR-12). The "runs serialized
         // per runner" assumption behind a fixed "$CACHE_FILE.tmp" is false with two VM
@@ -692,13 +739,7 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         // so there is no temp file to collide or orphan, and the daemon does the
         // atomic temp+rename on the host side where the cache actually lives.
         commands.push('  if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
-        commands.push(`    if tar -cf - "\${PATHS_TO_CACHE[@]}" 2>/dev/null | zstd -3 | ${daemonCurl('-T - "$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} > /dev/null; then`);
-        commands.push('      echo "Cache created successfully"');
-        commands.push('    else');
-        // Never fatal: a build that produced good output should not be failed by a
-        // cache upload, and the next build simply misses.
-        commands.push('      echo "Warning: failed to upload cache to the daemon"');
-        commands.push('    fi');
+        commands.push(...emitDaemonPushCommands());
         commands.push('  else');
         // Per-process-unique temp (CBR-12). The old fixed "$CACHE_FILE.tmp" assumed
         // a single serialized writer — false with two VM slots, and it collides with

package/dist/src/yaml/steps/envstore-loader.test.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The envstore loader carried by every generated step.
+ *
+ * These tests drive the *reader* — the preamble `createBashScript` prepends —
+ * directly, with hostile envstore content written by hand. Going through a
+ * producer such as git-clone would only prove the one value that producer
+ * happens to write; the defect lives in the reader, so the reader is what gets
+ * the hostile input.
+ *
+ * Each case actually runs bash. Assertions are made on files the script body
+ * writes with `printf '%s'`, not on stdout, so a value's own newlines and
+ * quoting cannot be confused with the test's framing.
+ */
+export {};
+//# sourceMappingURL=envstore-loader.test.d.ts.map

package/dist/src/yaml/steps/envstore-loader.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envstore-loader.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/envstore-loader.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/src/yaml/steps/envstore-loader.test.js

@@ -0,0 +1,143 @@
+/**
+ * The envstore loader carried by every generated step.
+ *
+ * These tests drive the *reader* — the preamble `createBashScript` prepends —
+ * directly, with hostile envstore content written by hand. Going through a
+ * producer such as git-clone would only prove the one value that producer
+ * happens to write; the defect lives in the reader, so the reader is what gets
+ * the hostile input.
+ *
+ * Each case actually runs bash. Assertions are made on files the script body
+ * writes with `printf '%s'`, not on stdout, so a value's own newlines and
+ * quoting cannot be confused with the test's framing.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { spawnSync } from 'child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, existsSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { BaseStepExecutor } from './base.js';
+/** Exposes the protected preamble builder so the reader can be tested on its own. */
+class PreambleProbe extends BaseStepExecutor {
+    async execute(_inputs, _env, _config) {
+        throw new Error('not used');
+    }
+    build(scriptContent) {
+        return this.createBashScript(scriptContent, 'envstore-loader-probe');
+    }
+}
+describe('envstore loader', () => {
+    let workDir;
+    beforeEach(() => {
+        workDir = mkdtempSync(join(tmpdir(), 'envstore-loader-'));
+    });
+    afterEach(() => {
+        rmSync(workDir, { recursive: true, force: true });
+    });
+    /**
+     * Writes an envstore, runs the generated preamble over it, and captures the
+     * named variables as the step body sees them.
+     */
+    function run(envs, capture, extraBody = '') {
+        const storePath = join(workDir, 'envstore.json');
+        const outDir = join(workDir, 'captured');
+        mkdirSync(outDir, { recursive: true });
+        writeFileSync(storePath, JSON.stringify({ envs: envs.map(e => ({ ...e, sensitive: false })) }), 'utf-8');
+        const body = [
+            ...capture.map(name => `printf '%s' "\${${name}-}" > "$CAPTURE_DIR/${name}"`),
+            extraBody,
+        ].join('\n');
+        const scriptPath = join(workDir, 'step.sh');
+        writeFileSync(scriptPath, new PreambleProbe().build(body), 'utf-8');
+        const proc = spawnSync('bash', [scriptPath], {
+            cwd: workDir,
+            encoding: 'utf-8',
+            env: {
+                ...process.env,
+                ENVMAN_ENVSTORE_PATH: storePath,
+                CAPTURE_DIR: outDir,
+            },
+        });
+        return {
+            status: proc.status,
+            stderr: proc.stderr ?? '',
+            captured(name) {
+                const file = join(outDir, name);
+                return existsSync(file) ? readFileSync(file, 'utf-8') : undefined;
+            },
+        };
+    }
+    test('a value containing newlines round-trips byte for byte', () => {
+        const body = 'first line\nsecond line\nthird line';
+        const result = run([{ key: 'GIT_CLONE_COMMIT_MESSAGE_BODY', value: body }], ['GIT_CLONE_COMMIT_MESSAGE_BODY']);
+        expect(result.status).toBe(0);
+        expect(result.captured('GIT_CLONE_COMMIT_MESSAGE_BODY')).toBe(body);
+    });
+    test('security: a value whose lines look like assignments sets nothing', () => {
+        const hostile = 'looks harmless\nPATH=/tmp/attacker-controlled\nNODE_OPTIONS=--require=/tmp/evil.js';
+        const result = run([{ key: 'GIT_CLONE_COMMIT_MESSAGE_BODY', value: hostile }], ['GIT_CLONE_COMMIT_MESSAGE_BODY', 'PATH', 'NODE_OPTIONS']);
+        expect(result.status).toBe(0);
+        // The value arrives intact...
+        expect(result.captured('GIT_CLONE_COMMIT_MESSAGE_BODY')).toBe(hostile);
+        // ...and none of its lines became a variable. Both are compared against
+        // what the parent environment held, which is what "unchanged" means here:
+        // the test runner itself sets NODE_OPTIONS.
+        expect(result.captured('PATH')).toBe(process.env.PATH ?? '');
+        expect(result.captured('NODE_OPTIONS')).toBe(process.env.NODE_OPTIONS ?? '');
+        expect(result.captured('NODE_OPTIONS')).not.toContain('/tmp/evil.js');
+    });
+    test('awkward bytes in a value all survive unchanged', () => {
+        const cases = [
+            { key: 'HAS_EQUALS', value: 'a=b=c' },
+            { key: 'HAS_QUOTES', value: `single ' double " both '"` },
+            { key: 'HAS_BACKTICKS', value: 'a `whoami` b' },
+            { key: 'HAS_SUBSHELL', value: 'a $(whoami) b ${HOME} c' },
+            { key: 'HAS_TRAILING_NEWLINE', value: 'ends with a newline\n' },
+            { key: 'HAS_LONE_CR', value: 'before\rafter' },
+            { key: 'HAS_BACKSLASHES', value: 'C:\\path\\to\\thing and \\n literal' },
+            { key: 'HAS_LEADING_SPACE', value: '   padded   ' },
+        ];
+        const result = run(cases, cases.map(c => c.key));
+        expect(result.status).toBe(0);
+        for (const { key, value } of cases) {
+            expect({ key, value: result.captured(key) }).toEqual({ key, value });
+        }
+    });
+    test('a non-identifier key is skipped without failing the step under set -e', () => {
+        const result = run([
+            { key: 'not a valid identifier', value: 'x' },
+            { key: '2_LEADING_DIGIT', value: 'x' },
+            { key: '', value: 'x' },
+            { key: 'GOOD_KEY', value: 'kept' },
+        ], ['GOOD_KEY'], 'echo reached-the-end');
+        expect(result.status).toBe(0);
+        expect(result.captured('GOOD_KEY')).toBe('kept');
+        expect(result.stderr).not.toContain('not a valid identifier');
+    });
+    test('regression: a multi-line commit message does not end the step', () => {
+        // The shape that killed the first real proof on 2026-08-30: git-clone
+        // publishes the commit body, and every later step died loading it.
+        const result = run([
+            { key: 'GIT_CLONE_COMMIT_MESSAGE_SUBJECT', value: 'Add Invarn pipeline' },
+            {
+                key: 'GIT_CLONE_COMMIT_MESSAGE_BODY',
+                value: 'cibuild sets CIBUILD_GIT_BRANCH, so pre-execution validation asked for a\nvalue nothing provides.\n\nSecond paragraph.',
+            },
+        ], ['GIT_CLONE_COMMIT_MESSAGE_SUBJECT'], 'echo step-completed');
+        expect(result.status).toBe(0);
+        expect(result.captured('GIT_CLONE_COMMIT_MESSAGE_SUBJECT')).toBe('Add Invarn pipeline');
+        expect(result.stderr).not.toContain('not a valid identifier');
+    });
+    test('an absent envstore leaves the step to run normally', () => {
+        const scriptPath = join(workDir, 'no-store.sh');
+        writeFileSync(scriptPath, new PreambleProbe().build('echo ran'), 'utf-8');
+        const proc = spawnSync('bash', [scriptPath], {
+            cwd: workDir,
+            encoding: 'utf-8',
+            env: { ...process.env, ENVMAN_ENVSTORE_PATH: join(workDir, 'missing.json') },
+        });
+        expect(proc.status).toBe(0);
+        expect(proc.stdout).toContain('ran');
+    });
+});
+//# sourceMappingURL=envstore-loader.test.js.map

package/dist/src/yaml/types.d.ts

@@ -42,6 +42,12 @@ export interface YAMLApp {
 export interface YAMLTrigger {
     push_branch?: string;
     pull_request_source_branch?: string;
+    /**
+     * The branch a pull request is opened *against*. Matched by Invarn's
+     * trigger resolver alongside the source branch, and what the generated
+     * scaffold uses — a `"*"` here means "any pull request".
+     */
+    pull_request_target_branch?: string;
     workflow?: string;
 }
 export interface YAMLPipeline {

package/dist/src/yaml/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/yaml/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;AACzC,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AAGrD,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB;AAGD,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,CAAC;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAGD,MAAM,WAAW,cAAc;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAGD,MAAM,WAAW,QAAQ;IACvB,CAAC,mBAAmB,EAAE,MAAM,GAAG;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;CACH;AAGD,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,EAAE,QAAQ,EAAE,CAAC;CACnB;AAGD,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;CACrB;AAGD,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,EAAE;QAAE,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAAA;KAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;CAC7B;AAGD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAGD,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/yaml/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;AACzC,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AAGrD,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB;AAGD,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,CAAC;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAGD,MAAM,WAAW,cAAc;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAGD,MAAM,WAAW,QAAQ;IACvB,CAAC,mBAAmB,EAAE,MAAM,GAAG;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;CACH;AAGD,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;IACpB,KAAK,EAAE,QAAQ,EAAE,CAAC;CACnB;AAGD,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;CACrB;AAGD,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,EAAE;QAAE,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAAA;KAAE,CAAC;IAC5C,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;CAC7B;AAGD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAGD,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.5.6",
+  "version": "2.5.9",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",