@invarn/cibuild 2.5.9 → 2.6.0

package/dist/src/envman/envstore-round-trip.test.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A build whose HEAD commit has a multi-line message completes every step.
+ *
+ * This is the regression that started the whole thread. On 2026-08-30 the first
+ * real `invarn setup` proof died of it: `git-clone` publishes the commit body,
+ * and every step after it failed loading the envstore —
+ *
+ *     [step_2] Running: cache-pull
+ *     …: line 59: export: `value nothing provides.': not a valid identifier
+ *     ✗ Pipeline failed: Step "Install CocoaPods" failed with exit code 1
+ *
+ * `src/yaml/steps/envstore-loader.test.ts` drives the *reader* with hostile
+ * content written by hand, which is the right shape for the defect but stops
+ * short of the thing that actually happened: the value came out of a real
+ * repository, through a real producer. This closes that gap — a real
+ * `git commit`, the real `git-clone` step reading it with `git log -1
+ * --format=%b`, the real `envman` writer (`envmanShellFunction`, the same
+ * bytes the runner prepends to every script step), and the real reader in the
+ * next step's preamble.
+ *
+ * The fixture's commit message carries both consequences the PRD names, because
+ * they need different bytes to surface: a line that is *not* a valid assignment
+ * (which killed the step) and a line that *is* one (which let the commit's
+ * author set `PATH` for every step after it).
+ */
+export {};
+//# sourceMappingURL=envstore-round-trip.test.d.ts.map

package/dist/src/envman/envstore-round-trip.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envstore-round-trip.test.d.ts","sourceRoot":"","sources":["../../../src/envman/envstore-round-trip.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}

package/dist/src/envman/envstore-round-trip.test.js

@@ -0,0 +1,130 @@
+/**
+ * A build whose HEAD commit has a multi-line message completes every step.
+ *
+ * This is the regression that started the whole thread. On 2026-08-30 the first
+ * real `invarn setup` proof died of it: `git-clone` publishes the commit body,
+ * and every step after it failed loading the envstore —
+ *
+ *     [step_2] Running: cache-pull
+ *     …: line 59: export: `value nothing provides.': not a valid identifier
+ *     ✗ Pipeline failed: Step "Install CocoaPods" failed with exit code 1
+ *
+ * `src/yaml/steps/envstore-loader.test.ts` drives the *reader* with hostile
+ * content written by hand, which is the right shape for the defect but stops
+ * short of the thing that actually happened: the value came out of a real
+ * repository, through a real producer. This closes that gap — a real
+ * `git commit`, the real `git-clone` step reading it with `git log -1
+ * --format=%b`, the real `envman` writer (`envmanShellFunction`, the same
+ * bytes the runner prepends to every script step), and the real reader in the
+ * next step's preamble.
+ *
+ * The fixture's commit message carries both consequences the PRD names, because
+ * they need different bytes to surface: a line that is *not* a valid assignment
+ * (which killed the step) and a line that *is* one (which let the commit's
+ * author set `PATH` for every step after it).
+ */
+import { describe, test, expect, beforeAll, afterAll } from '@jest/globals';
+import { execFileSync, spawnSync } from 'child_process';
+import { mkdtempSync, readFileSync, mkdirSync, rmSync, writeFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { envmanShellFunction } from './shim.js';
+import { GitCloneStepExecutor } from '../yaml/steps/git-clone.js';
+import { ScriptStepExecutor } from '../yaml/steps/script.js';
+import { testConfigNoPeer } from '../yaml/steps/test-config.js';
+const SUBJECT = 'Add Invarn pipeline';
+/**
+ * Three lines and a blank one. Line 2 is not a valid assignment; line 4 is.
+ * `git log --format=%b` emits a trailing newline that `$( )` strips, so the
+ * expected value below carries none.
+ */
+const BODY = [
+    'cibuild sets CIBUILD_GIT_BRANCH, so pre-execution validation asked for a',
+    'value nothing provides.',
+    '',
+    'PATH=/tmp/attacker-controlled',
+].join('\n');
+describe('a multi-line commit message, from the repository to the next step', () => {
+    let repoDir;
+    let envstorePath;
+    let captureDir;
+    beforeAll(() => {
+        repoDir = mkdtempSync(join(tmpdir(), 'envstore-round-trip-'));
+        envstorePath = join(repoDir, '.ci', '.envstore.json');
+        captureDir = join(repoDir, 'captured');
+        mkdirSync(captureDir, { recursive: true });
+        writeFileSync(join(repoDir, 'README.md'), 'fixture\n', 'utf-8');
+        const git = (...args) => {
+            execFileSync('git', args, { cwd: repoDir, stdio: 'ignore' });
+        };
+        git('init', '-b', 'main');
+        git('config', 'user.name', 'CI Build Tests');
+        git('config', 'user.email', 'cibuild-tests@example.com');
+        git('config', 'commit.gpgsign', 'false');
+        git('add', '.');
+        git('commit', '-m', `${SUBJECT}\n\n${BODY}`);
+    });
+    afterAll(() => {
+        rmSync(repoDir, { recursive: true, force: true });
+    });
+    /**
+     * Runs one generated step the way the runner does: the envman shell function
+     * prepended, bash, the envstore path in the environment so it survives the
+     * `cd` the step does.
+     */
+    function runStep(script) {
+        const scriptPath = join(repoDir, '__step.sh');
+        writeFileSync(scriptPath, envmanShellFunction() + script, 'utf-8');
+        const proc = spawnSync('bash', [scriptPath], {
+            cwd: repoDir,
+            encoding: 'utf-8',
+            env: {
+                ...process.env,
+                ENVMAN_ENVSTORE_PATH: envstorePath,
+                CAPTURE_DIR: captureDir,
+            },
+        });
+        return { status: proc.status, stdout: proc.stdout ?? '', stderr: proc.stderr ?? '' };
+    }
+    function captured(name) {
+        const file = join(captureDir, name);
+        return existsSync(file) ? readFileSync(file, 'utf-8') : undefined;
+    }
+    test('git-clone publishes the commit body without dying on it', async () => {
+        const { script } = await new GitCloneStepExecutor().execute({}, {}, testConfigNoPeer);
+        const run = runStep(script);
+        expect(run.status).toBe(0);
+        expect(run.stdout).toContain(`Message: ${SUBJECT}`);
+        // The envstore is what the next step reads, so it has to exist and to hold
+        // the body as data rather than as three more records.
+        const store = JSON.parse(readFileSync(envstorePath, 'utf-8'));
+        expect(store.envs.find(e => e.key === 'GIT_CLONE_COMMIT_MESSAGE_BODY')?.value).toBe(BODY);
+        expect(store.envs.map(e => e.key)).not.toContain('PATH');
+    });
+    test('the next step loads it, completes, and is not reconfigured by it', async () => {
+        // Runs after git-clone above: the envstore on disk is the real one that
+        // step wrote.
+        const { script } = await new ScriptStepExecutor().execute({
+            content: [
+                `printf '%s' "\${GIT_CLONE_COMMIT_MESSAGE_BODY-}" > "$CAPTURE_DIR/body"`,
+                `printf '%s' "\${GIT_CLONE_COMMIT_MESSAGE_SUBJECT-}" > "$CAPTURE_DIR/subject"`,
+                `printf '%s' "$PATH" > "$CAPTURE_DIR/path"`,
+                'echo step-completed',
+            ].join('\n'),
+        }, {}, testConfigNoPeer);
+        const run = runStep(script);
+        // "Completes every step" — the whole acceptance criterion, and what the
+        // production build could not do.
+        expect(run.status).toBe(0);
+        expect(run.stdout).toContain('step-completed');
+        expect(run.stderr).not.toContain('not a valid identifier');
+        // Correctness: byte for byte, internal blank line and all.
+        expect(captured('body')).toBe(BODY);
+        expect(captured('subject')).toBe(SUBJECT);
+        // Security: the commit's author does not get to choose PATH. Compared
+        // against what the parent process held, which is what "unchanged" means.
+        expect(captured('path')).toBe(process.env.PATH ?? '');
+        expect(captured('path')).not.toContain('/tmp/attacker-controlled');
+    });
+});
+//# sourceMappingURL=envstore-round-trip.test.js.map

package/dist/src/envman/shim.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The `envman` shell function prepended to every script step.
+ *
+ * Steps call `envman add --key K --value V` to publish a value to the steps
+ * after them. This is a bash function rather than a call to the `ci` binary
+ * because pkg-built binaries mishandle subcommands — so the writer half of the
+ * envstore contract is generated bash, exactly like the reader half in
+ * `createBashScript`.
+ *
+ * Lives in its own module so a test can run the *same bytes production runs*
+ * against a real producer, rather than a copy that can drift from it. The
+ * reader is driven directly in `src/yaml/steps/envstore-loader.test.ts`; the
+ * pair is exercised end to end in `src/envman/envstore-round-trip.test.ts`.
+ */
+export declare function envmanShellFunction(): string;
+//# sourceMappingURL=shim.d.ts.map

package/dist/src/envman/shim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shim.d.ts","sourceRoot":"","sources":["../../../src/envman/shim.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAkD5C"}

package/dist/src/envman/shim.js

@@ -0,0 +1,66 @@
+/**
+ * The `envman` shell function prepended to every script step.
+ *
+ * Steps call `envman add --key K --value V` to publish a value to the steps
+ * after them. This is a bash function rather than a call to the `ci` binary
+ * because pkg-built binaries mishandle subcommands — so the writer half of the
+ * envstore contract is generated bash, exactly like the reader half in
+ * `createBashScript`.
+ *
+ * Lives in its own module so a test can run the *same bytes production runs*
+ * against a real producer, rather than a copy that can drift from it. The
+ * reader is driven directly in `src/yaml/steps/envstore-loader.test.ts`; the
+ * pair is exercised end to end in `src/envman/envstore-round-trip.test.ts`.
+ */
+export function envmanShellFunction() {
+    return `envman() {
+  local cmd="$1"; shift
+  local store="\${ENVMAN_ENVSTORE_PATH:-.ci/.envstore.json}"
+  case "$cmd" in
+    add)
+      local key="" value="" valuefile="" sensitive=false skipifempty=false append=false
+      while [ $# -gt 0 ]; do
+        case "$1" in
+          --key|-k) key="$2"; shift 2 ;;
+          --value|-v) value="$2"; shift 2 ;;
+          --valuefile|-f) valuefile="$2"; shift 2 ;;
+          --sensitive|-s) sensitive=true; shift ;;
+          --skip-if-empty) skipifempty=true; shift ;;
+          --append|-a) append=true; shift ;;
+          *) shift ;;
+        esac
+      done
+      [ -z "$key" ] && { echo "envman add: --key required" >&2; return 1; }
+      if [ -n "$valuefile" ]; then
+        value="$(cat "$valuefile")"
+      elif [ -z "$value" ] && ! [ -t 0 ]; then
+        value="$(cat)"
+      fi
+      [ "$skipifempty" = true ] && [ -z "$value" ] && return 0
+      node -e '
+        const fs=require("fs");
+        const f=process.argv[1], k=process.argv[2], v=process.argv[3];
+        const s=process.argv[4]==="true", a=process.argv[5]==="true";
+        let store={envs:[]};
+        try{store=JSON.parse(fs.readFileSync(f,"utf-8"))}catch{}
+        const idx=store.envs.findIndex(e=>e.key===k);
+        if(a && idx>=0){store.envs[idx].value+=v}
+        else if(idx>=0){store.envs[idx].value=v;store.envs[idx].sensitive=s}
+        else{store.envs.push({key:k,value:v,sensitive:s})}
+        fs.mkdirSync(require("path").dirname(f),{recursive:true});
+        fs.writeFileSync(f,JSON.stringify(store,null,2));
+      ' "$store" "$key" "$value" "$sensitive" "$append"
+      echo "envman: $key set"
+      ;;
+    init)
+      node -e 'const fs=require("fs");const f=process.argv[1];fs.mkdirSync(require("path").dirname(f),{recursive:true});fs.writeFileSync(f,JSON.stringify({envs:[]},null,2))' "$store"
+      ;;
+    *)
+      echo "envman: unknown command: $cmd" >&2; return 1
+      ;;
+  esac
+}
+export -f envman
+`;
+}
+//# sourceMappingURL=shim.js.map

package/dist/src/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/runner.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAMjE,qBAAa,kBAAmB,SAAQ,KAAK;IAElC,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,MAAM;gBAFhB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;CAK1B;AAED,qBAAa,cAAc;IACb,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,QAAQ;IAE9B,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkKhE,OAAO,CAAC,cAAc;IAYtB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,IAAI;IAwB7C,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAczD,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA2CpG"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/runner.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAOjE,qBAAa,kBAAmB,SAAQ,KAAK;IAElC,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,MAAM;gBAFhB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;CAK1B;AAED,qBAAa,cAAc;IACb,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,QAAQ;IAE9B,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiHhE,OAAO,CAAC,cAAc;IAYtB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,IAAI;IAwB7C,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAczD,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA2CpG"}

package/dist/src/runner.js

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { dirname, join, resolve } from "node:path";
 import { unlinkSync, existsSync, writeFileSync, chmodSync, mkdtempSync, rmSync, mkdirSync } from "node:fs";
 import { tmpdir } from "node:os";
+import { envmanShellFunction } from "./envman/shim.js";
 import { formatStepMarker, shouldEmitStepMarker } from "./step-marker.js";
 // Use absolute path for envstore so it works regardless of cd in scripts
 const ENVMAN_ENVSTORE_PATH = resolve(process.cwd(), ".ci", ".envstore.json");
@@ -54,56 +55,7 @@ export class PipelineRunner {
                         tmpScriptPath = join(tmpDir, `step-${step.id || 'script'}.sh`);
                         // Prepend envman shell function that writes directly to the envstore JSON file.
                         // This avoids calling the ci binary (pkg binaries have issues with subcommands).
-                        const envmanShim = `envman() {
-  local cmd="\$1"; shift
-  local store="\${ENVMAN_ENVSTORE_PATH:-.ci/.envstore.json}"
-  case "\$cmd" in
-    add)
-      local key="" value="" valuefile="" sensitive=false skipifempty=false append=false
-      while [ \$# -gt 0 ]; do
-        case "\$1" in
-          --key|-k) key="\$2"; shift 2 ;;
-          --value|-v) value="\$2"; shift 2 ;;
-          --valuefile|-f) valuefile="\$2"; shift 2 ;;
-          --sensitive|-s) sensitive=true; shift ;;
-          --skip-if-empty) skipifempty=true; shift ;;
-          --append|-a) append=true; shift ;;
-          *) shift ;;
-        esac
-      done
-      [ -z "\$key" ] && { echo "envman add: --key required" >&2; return 1; }
-      if [ -n "\$valuefile" ]; then
-        value="\$(cat "\$valuefile")"
-      elif [ -z "\$value" ] && ! [ -t 0 ]; then
-        value="\$(cat)"
-      fi
-      [ "\$skipifempty" = true ] && [ -z "\$value" ] && return 0
-      node -e '
-        const fs=require("fs");
-        const f=process.argv[1], k=process.argv[2], v=process.argv[3];
-        const s=process.argv[4]==="true", a=process.argv[5]==="true";
-        let store={envs:[]};
-        try{store=JSON.parse(fs.readFileSync(f,"utf-8"))}catch{}
-        const idx=store.envs.findIndex(e=>e.key===k);
-        if(a && idx>=0){store.envs[idx].value+=v}
-        else if(idx>=0){store.envs[idx].value=v;store.envs[idx].sensitive=s}
-        else{store.envs.push({key:k,value:v,sensitive:s})}
-        fs.mkdirSync(require("path").dirname(f),{recursive:true});
-        fs.writeFileSync(f,JSON.stringify(store,null,2));
-      ' "\$store" "\$key" "\$value" "\$sensitive" "\$append"
-      echo "envman: \$key set"
-      ;;
-    init)
-      node -e 'const fs=require("fs");const f=process.argv[1];fs.mkdirSync(require("path").dirname(f),{recursive:true});fs.writeFileSync(f,JSON.stringify({envs:[]},null,2))' "\$store"
-      ;;
-    *)
-      echo "envman: unknown command: \$cmd" >&2; return 1
-      ;;
-  esac
-}
-export -f envman
-`;
-                        writeFileSync(tmpScriptPath, envmanShim + step.script, 'utf-8');
+                        writeFileSync(tmpScriptPath, envmanShellFunction() + step.script, 'utf-8');
                         chmodSync(tmpScriptPath, 0o755);
                         args = ["-l", tmpScriptPath];
                     }

package/dist/src/yaml/steps/cache-pull-daemon.test.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `cache-pull` over the daemon: a miss and a broken daemon are different things.
+ *
+ * `{ curl | zstd | tar; } 2>/dev/null` swallowed curl's message entirely, so a
+ * 401, a 400, a 503, a 500 and a daemon that was not listening all printed the
+ * same line as an empty cache:
+ *
+ *     No cache found for key: pods-0fc6c3e8f03403bc5fb869d95e505969-HEAD
+ *
+ * Same class as the push-side defect in `27e05e5`, where `curl -f` threw the
+ * response body away so `invalid_cache_key` never reached the log. A cold cache
+ * is the normal case and must stay quiet; the point is only that a broken
+ * daemon stops looking like one.
+ *
+ * These tests RUN the generated script against a **real listener with the real
+ * curl**. Stubbing curl onto PATH cannot see this: the whole question is what
+ * the real curl reports and where it writes it, so a stub that emits the status
+ * itself would pass against a step that never asked for one.
+ *
+ * `zstd` and `tar` *are* stubbed, for two different reasons. zstd is not on
+ * every host, and without it the pipeline fails before curl is reached — which
+ * would make these pass vacuously. tar is stubbed because the generated script
+ * extracts with `-C /`: nothing under test here is worth writing to the root of
+ * the machine running the suite.
+ */
+export {};
+//# sourceMappingURL=cache-pull-daemon.test.d.ts.map

package/dist/src/yaml/steps/cache-pull-daemon.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-pull-daemon.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache-pull-daemon.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}

package/dist/src/yaml/steps/cache-pull-daemon.test.js

@@ -0,0 +1,183 @@
+/**
+ * `cache-pull` over the daemon: a miss and a broken daemon are different things.
+ *
+ * `{ curl | zstd | tar; } 2>/dev/null` swallowed curl's message entirely, so a
+ * 401, a 400, a 503, a 500 and a daemon that was not listening all printed the
+ * same line as an empty cache:
+ *
+ *     No cache found for key: pods-0fc6c3e8f03403bc5fb869d95e505969-HEAD
+ *
+ * Same class as the push-side defect in `27e05e5`, where `curl -f` threw the
+ * response body away so `invalid_cache_key` never reached the log. A cold cache
+ * is the normal case and must stay quiet; the point is only that a broken
+ * daemon stops looking like one.
+ *
+ * These tests RUN the generated script against a **real listener with the real
+ * curl**. Stubbing curl onto PATH cannot see this: the whole question is what
+ * the real curl reports and where it writes it, so a stub that emits the status
+ * itself would pass against a step that never asked for one.
+ *
+ * `zstd` and `tar` *are* stubbed, for two different reasons. zstd is not on
+ * every host, and without it the pipeline fails before curl is reached — which
+ * would make these pass vacuously. tar is stubbed because the generated script
+ * extracts with `-C /`: nothing under test here is worth writing to the root of
+ * the machine running the suite.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { execFile } from 'child_process';
+import { mkdtempSync, writeFileSync, rmSync, mkdirSync, chmodSync } from 'fs';
+import { createServer } from 'http';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { promisify } from 'util';
+import { CachePullStepExecutor } from './cache.js';
+import { testConfigNoPeer } from './test-config.js';
+/**
+ * Async on purpose. The listener below lives in this process, and
+ * `execFileSync` blocks the event loop — so it would never answer curl, every
+ * request would time out, and every case would look like a dead daemon
+ * whatever the test asked for.
+ */
+const run = promisify(execFile);
+const CACHE_KEY = 'pods-abc123def456-release-1.4';
+async function listen(handler, paths) {
+    const server = createServer((req, res) => {
+        const path = req.url ?? '/';
+        paths.push(path);
+        const { status, body } = handler(path);
+        res.writeHead(status, { 'content-type': 'application/octet-stream' });
+        res.end(body);
+    });
+    const port = await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            resolve(typeof address === 'object' && address !== null ? address.port : 0);
+        });
+    });
+    return { server, port };
+}
+async function runPull(options) {
+    const dir = mkdtempSync(join(tmpdir(), 'cibuild-pull-'));
+    const paths = [];
+    const { server, port } = await listen((path) => {
+        if (path.includes('/scope/')) {
+            return { status: options.scopeStatus ?? 404, body: '{"error":"no_cache_for_scope"}' };
+        }
+        const status = options.keyStatus === 'dead' ? 404 : options.keyStatus;
+        return {
+            status,
+            body: status === 200 ? 'a-tarball-shaped-payload' : '{"error":"cache_miss"}',
+        };
+    }, paths);
+    // A dead daemon is a port nothing answers on — the one the listener just
+    // released. Anything else and curl would be diagnosing the wrong failure.
+    if (options.keyStatus === 'dead') {
+        await new Promise((resolve) => server.close(() => resolve()));
+    }
+    try {
+        const bin = join(dir, 'bin');
+        mkdirSync(bin, { recursive: true });
+        writeFileSync(join(bin, 'zstd'), '#!/bin/bash\ncat\n', 'utf-8');
+        chmodSync(join(bin, 'zstd'), 0o755);
+        // Consumes the stream and writes nothing: see the file header on `-C /`.
+        writeFileSync(join(bin, 'tar'), '#!/bin/bash\ncat > /dev/null\n', 'utf-8');
+        chmodSync(join(bin, 'tar'), 0o755);
+        // The preset form derives its key from a lockfile, so it needs one.
+        if (options.technology) {
+            writeFileSync(join(dir, 'package-lock.json'), '{"lockfileVersion":3}\n', 'utf-8');
+        }
+        const { script } = await new CachePullStepExecutor().execute(options.technology
+            ? { technology: options.technology }
+            : { cache_key: CACHE_KEY, cache_paths: ['Pods'] }, {}, testConfigNoPeer);
+        const scriptPath = join(dir, '__cache_pull.sh');
+        writeFileSync(scriptPath, script, 'utf-8');
+        let stdout = '';
+        try {
+            const result = await run('bash', [scriptPath], {
+                cwd: dir,
+                encoding: 'utf-8',
+                env: {
+                    ...process.env,
+                    PATH: `${bin}:${process.env.PATH}`,
+                    CIBUILD_CACHE_DAEMON: `http://127.0.0.1:${port}`,
+                    CIBUILD_CACHE_TOKEN: 'tok',
+                },
+                timeout: 20000,
+            });
+            stdout = String(result.stdout) + String(result.stderr);
+        }
+        catch (e) {
+            const err = e;
+            stdout = String(err.stdout ?? '') + String(err.stderr ?? '');
+        }
+        return { stdout, paths };
+    }
+    finally {
+        if (options.keyStatus !== 'dead') {
+            await new Promise((resolve) => server.close(() => resolve()));
+        }
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+describe('cache-pull with an explicit key, over the daemon', () => {
+    test('an empty cache is reported, and nothing else', async () => {
+        // 404 is the daemon's answer for `cache_miss`. The normal case on any
+        // first build: it must not start printing warnings.
+        const { stdout, paths } = await runPull({ keyStatus: 404 });
+        expect(paths).toEqual([`/cache/${CACHE_KEY}.tar.zst`]);
+        expect(stdout).toContain(`No cache found for key: ${CACHE_KEY}`);
+        expect(stdout).toContain('CACHE_SOURCE=cold');
+        expect(stdout).not.toContain('Warning');
+    });
+    test('an auth failure no longer looks like an empty cache', async () => {
+        const { stdout } = await runPull({ keyStatus: 401 });
+        expect(stdout).toContain('Warning: cache-pull could not restore');
+        expect(stdout).toContain('401');
+        // Still not fatal, and still cold: a build that cannot read a cache builds
+        // anyway. Only the silence is gone.
+        expect(stdout).toContain('CACHE_SOURCE=cold');
+    });
+    test.each([
+        ['a rejected key', 400],
+        ['a busy cache', 503],
+        ['a daemon that broke', 500],
+    ])('%s says so, with the status', async (_label, status) => {
+        const { stdout } = await runPull({ keyStatus: status });
+        expect(stdout).toContain('Warning: cache-pull could not restore');
+        expect(stdout).toContain(String(status));
+    });
+    test('a daemon that is not listening says so, rather than reporting a miss', async () => {
+        const { stdout } = await runPull({ keyStatus: 'dead' });
+        expect(stdout).toContain('Warning: cache-pull could not restore');
+        // curl's own words for it. There is no HTTP status to report — which is
+        // itself the distinction from every case above.
+        expect(stdout).toMatch(/Failed to connect|Couldn't connect|Connection refused/u);
+    });
+    test('a hit is still a hit', async () => {
+        const { stdout } = await runPull({ keyStatus: 200 });
+        expect(stdout).toContain('Cache found (daemon), extracting...');
+        expect(stdout).toContain('CACHE_SOURCE=daemon');
+        expect(stdout).not.toContain('Warning');
+    });
+});
+describe('cache-pull from a preset, over the daemon', () => {
+    test('an empty cache is quiet through the scope fallback too', async () => {
+        const { stdout, paths } = await runPull({ keyStatus: 404, technology: 'npm' });
+        // Exact key first, then the scope's newest — the shape the fallback needs.
+        expect(paths).toHaveLength(2);
+        expect(paths[1]).toContain('/cache/scope/');
+        expect(stdout).toContain('No cache found for key: npm-');
+        expect(stdout).not.toContain('Warning');
+    });
+    test('a broken daemon is named on the preset path as well', async () => {
+        // The two forms emit the same diagnosis from one definition. They used to
+        // carry byte-identical copies of the upload block, and that is exactly how
+        // the push-side defect got in.
+        const { stdout } = await runPull({ keyStatus: 401, technology: 'npm' });
+        expect(stdout).toContain('Warning: cache-pull could not restore');
+        expect(stdout).toContain('401');
+        expect(stdout).toContain('CACHE_SOURCE=cold');
+    });
+});
+//# sourceMappingURL=cache-pull-daemon.test.js.map

package/dist/src/yaml/steps/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAgLF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA0HzF,iBAAiB;CA0MhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAkLzF,iBAAiB;CAgJhC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAuPF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA6HzF,iBAAiB;CA0MhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAkLzF,iBAAiB;CAgJhC"}