@invarn/cibuild 2.5.9 → 2.6.0

package/dist/src/yaml/steps/cache.js

@@ -86,13 +86,73 @@ function resolvePresetChain(technology) {
     }
     return chain;
 }
+/** The token `%{http_code}` is reported under; see `daemonCurl`. */
+const DAEMON_STATUS_TOKEN = 'ci_http_status';
 /**
  * Emits the `curl` invocation the cache steps talk to the daemon with. The
  * bearer token is per-build and only present on the Invarn runner, so it is
  * expanded conditionally and the same script works without one.
+ *
+ * Every request also reports the HTTP status it got, on **stderr** — the
+ * response body is the tarball and goes to stdout, so a status written there
+ * would corrupt it. `%{stderr}` is curl 7.63+ (2018); an older curl prints the
+ * token literally instead of a number, which the reader below tolerates.
+ *
+ * `-f`, not `--fail-with-body`: on the pull side the error body would be piped
+ * straight into `zstd`. The status is what distinguishes the answers anyway,
+ * and it now arrives without the body.
  */
 function daemonCurl(args) {
-    return `curl -fsS \${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} ${args}`;
+    return `curl -fsS -w '%{stderr}${DAEMON_STATUS_TOKEN}=%{http_code}\\n' \${CIBUILD_CACHE_TOKEN:+-H "Authorization: Bearer $CIBUILD_CACHE_TOKEN"} ${args}`;
+}
+/**
+ * Emitted once inside a daemon pull branch, before the first fetch: a file for
+ * curl's stderr, and the reader that turns it into one line — or into nothing
+ * at all when the daemon simply had no such entry.
+ *
+ * `{ curl | zstd | tar; } 2>/dev/null` used to swallow curl's message
+ * entirely, so a 401, a 400, a 503, a 500 and a daemon that was not listening
+ * all printed the same `No cache found for key: …` as an empty cache. That is
+ * the same class as the push-side defect: the instrument reported the normal
+ * case for every abnormal one.
+ *
+ * **A miss stays quiet and a failure gets loud.** A cold cache is the normal
+ * case and must not start printing errors; the point is only that a broken
+ * daemon stops looking like one.
+ */
+function emitDaemonPullDiagnostics(indent = '') {
+    return [
+        `${indent}__ci_cache_diag="\${TMPDIR:-/tmp}/cibuild-cache-pull.$$.diag"`,
+        `${indent}__ci_cache_daemon_said() {`,
+        `${indent}  local __said=''`,
+        `${indent}  if [ -s "$__ci_cache_diag" ]; then`,
+        `${indent}    __said=$(tr '\\n' ' ' < "$__ci_cache_diag")`,
+        `${indent}  fi`,
+        `${indent}  case "$__said" in`,
+        // 404 is the daemon's answer for `cache_miss` and `no_cache_for_scope` —
+        // an empty cache, which is normal. The second pattern reads curl's own
+        // English for a curl too old to honour `%{stderr}`, so neither reader
+        // failing alone can turn a cold cache noisy.
+        `${indent}    *${DAEMON_STATUS_TOKEN}=404*|*'error: 404'*) __said='' ;;`,
+        `${indent}  esac`,
+        // Always exits 0. A non-zero return would be the assignment's status at
+        // every call site, and under errexit that ends the step on a cache miss.
+        `${indent}  printf '%s' "\${__said:0:300}"`,
+        `${indent}}`,
+    ];
+}
+/**
+ * The `else` arm of a daemon fetch: says why it did not restore, unless the
+ * daemon simply had no such entry. Never fatal — a build that cannot read a
+ * cache still builds, it just builds cold.
+ */
+function emitDaemonPullFailureDiagnosis(indent, what) {
+    return [
+        `${indent}__ci_cache_why=$(__ci_cache_daemon_said)`,
+        `${indent}if [ -n "$__ci_cache_why" ]; then`,
+        `${indent}  echo "Warning: cache-pull could not restore ${what} from the daemon — $__ci_cache_why"`,
+        `${indent}fi`,
+    ];
 }
 /**
  * The same request, keeping the response body when the daemon refuses.
@@ -156,12 +216,18 @@ function emitDaemonPushCommands() {
 function emitDaemonPullCommands() {
     return [
         'echo "Cache daemon: $CIBUILD_CACHE_DAEMON"',
-        // Exact key. stderr silenced — a miss is the normal case and curl/zstd
-        // both editorialise about it; pipefail still carries the exit status.
-        `if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`,
+        ...emitDaemonPullDiagnostics(),
+        // Exact key. zstd's and tar's stderr is silenced — a miss is the normal
+        // case and they both editorialise about it; pipefail still carries the
+        // exit status. curl's own stderr is kept, in the file the diagnostics
+        // above read: it is the only thing that knows *why*.
+        `if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst" 2>"$__ci_cache_diag"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`,
         '  echo "Cache found (daemon), extracting..."',
         '  echo "CACHE_SOURCE=daemon CACHE_KEY=$CACHE_KEY"',
         'else',
+        // Said before the fallback is attempted, so the reason names the request
+        // it belongs to rather than whichever request happened to fail last.
+        ...emitDaemonPullFailureDiagnosis('  ', '$CACHE_KEY'),
         // Scope fallback: the newest tarball for this <keyPrefix>-<projectId>.
         // Gradle/Xcode re-hash their inputs on top of the warm directory, hitting
         // the unchanged work and rebuilding only what actually moved.
@@ -177,10 +243,11 @@ function emitDaemonPullCommands() {
         // than seed from ancient state. Exact-key hits are unaffected.
         '    if [ "$__ci_fb_age_days" -le 30 ]; then',
         '      echo "Cache fallback (daemon): using prior tarball $__ci_fb_key (${__ci_fb_age_days}d old)"',
-        `      if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$__ci_fb_key.tar.zst"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`,
+        `      if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$__ci_fb_key.tar.zst" 2>"$__ci_cache_diag"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`,
         '        echo "CACHE_SOURCE=fallback_daemon CACHE_KEY=$CACHE_KEY FALLBACK_KEY=$__ci_fb_key"',
         '      else',
         '        echo "Cache fallback $__ci_fb_key could not be fetched — going cold"',
+        ...emitDaemonPullFailureDiagnosis('        ', '$__ci_fb_key'),
         '        echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"',
         '      fi',
         '    else',
@@ -192,6 +259,7 @@ function emitDaemonPullCommands() {
         '    echo "CACHE_SOURCE=cold CACHE_KEY=$CACHE_KEY"',
         '  fi',
         'fi',
+        'rm -f "$__ci_cache_diag"',
     ];
 }
 /**
@@ -264,13 +332,16 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // Transport split — see the preset path. An explicit-key step has no scope
         // to fall back to, so the daemon side is the exact key or nothing.
         commands.push('if [ -n "$CIBUILD_CACHE_DAEMON" ]; then');
-        commands.push(`  if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`);
+        commands.push(...emitDaemonPullDiagnostics('  '));
+        commands.push(`  if { ${daemonCurl('"$CIBUILD_CACHE_DAEMON/cache/$CACHE_KEY.tar.zst" 2>"$__ci_cache_diag"')} | zstd -dc | tar -xf - -C /; } 2>/dev/null; then`);
         commands.push('    echo "Cache found (daemon), extracting..."');
         commands.push('    echo "CACHE_SOURCE=daemon"');
         commands.push('  else');
+        commands.push(...emitDaemonPullFailureDiagnosis('    ', '$CACHE_KEY'));
         commands.push(`    echo "No cache found for key: ${this.escapeBash(cacheKey)}"`);
         commands.push('    echo "CACHE_SOURCE=cold"');
         commands.push('  fi');
+        commands.push('  rm -f "$__ci_cache_diag"');
         commands.push('else');
         commands.push('if [ -f "$CACHE_FILE" ]; then');
         commands.push('  echo "Cache found (local), extracting..."');

package/dist/src/yaml/steps/steps.test.js

@@ -218,17 +218,28 @@ describe('Step Implementations', () => {
                 mkdirSync(swiftpm, { recursive: true });
                 writeFileSync(join(swiftpm, 'Package.resolved'), '{"pins":[],"version":3}');
             }
-            test('a cold daemon miss does not print curl/zstd noise', async () => {
-                // Reproduce the runner setup: a configured cache daemon whose
-                // probe fails for an uncached key. (We point at a closed port so
-                // curl errors instantly with no server handle to leak — the fix
-                // silences curl's stderr regardless of the failure mode, exactly
-                // as it does for the 404 seen in production.) The probe must fall
-                // through to cold quietly: no "curl:" or "unexpected end of file".
-                const { stdout, combined } = await runIosPull(writeSpmFixture, {
+            test('a daemon that is not listening is named once, and leaks no raw noise', async () => {
+                // A closed port: curl errors instantly with no server handle to leak.
+                //
+                // This used to assert that the output contained no `curl:` at all —
+                // curl's stderr was silenced whatever the failure mode was, which is
+                // how a 401, a 500 and a dead daemon all came to print the same
+                // `No cache found` as an empty cache. The contract is now narrower: a
+                // *miss* is silent (the 404 case, covered against a real listener in
+                // cache-pull-daemon.test.ts), a *failure* is named exactly once, and
+                // neither leaks the raw pipeline chatter that made the old blanket
+                // silence attractive in the first place.
+                const { stdout, stderr, combined } = await runIosPull(writeSpmFixture, {
                     CIBUILD_CACHE_DAEMON: 'http://127.0.0.1:1',
                 });
-                expect(combined).not.toContain('curl:');
+                expect(stdout).toContain('Warning: cache-pull could not restore');
+                expect(stdout).toMatch(/Failed to connect|Couldn't connect|Connection refused/);
+                // Once, not once per request the step happens to make.
+                expect(stdout.match(/Warning: cache-pull could not restore/gu)).toHaveLength(1);
+                // Whatever curl said arrives inside that one line, on stdout. Nothing
+                // reaches the build log as loose interleaved stderr, and zstd/tar still
+                // do not editorialise about a stream that never arrived.
+                expect(stderr).not.toContain('curl:');
                 expect(combined).not.toContain('unexpected end of file');
                 // Still resolves the SPM key and reports a cold miss.
                 expect(stdout).toContain('CACHE_SOURCE=cold');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.5.9",
+  "version": "2.6.0",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",