@invarn/cibuild 2.6.1 → 2.6.2

package/dist/src/yaml/meta-helpers.d.ts

@@ -16,4 +16,13 @@
  */
 import type { YAMLCIBuildMeta, YAMLPipeline } from './types.js';
 export declare function getInvarnMeta(pipeline: YAMLPipeline): YAMLCIBuildMeta | undefined;
+/**
+ * Whether the pipeline *declares* an app that spans both mobile platforms.
+ *
+ * Read only from the explicit declaration, never inferred from the steps.
+ * Inference would defeat the point: a workflow that mixes platforms by mistake
+ * is exactly what the gate exists to catch, and it looks identical to one that
+ * does so on purpose.
+ */
+export declare function declaresMultiplatformApp(pipeline: YAMLPipeline): boolean;
 //# sourceMappingURL=meta-helpers.d.ts.map

package/dist/src/yaml/meta-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meta-helpers.d.ts","sourceRoot":"","sources":["../../../src/yaml/meta-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEhE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,YAAY,GAAG,eAAe,GAAG,SAAS,CAEjF"}
+{"version":3,"file":"meta-helpers.d.ts","sourceRoot":"","sources":["../../../src/yaml/meta-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEhE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,YAAY,GAAG,eAAe,GAAG,SAAS,CAEjF;AAiBD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAGxE"}

package/dist/src/yaml/meta-helpers.js

@@ -17,4 +17,30 @@
 export function getInvarnMeta(pipeline) {
     return pipeline.meta?.invarn ?? pipeline.meta?.['cibuild.io'];
 }
+/**
+ * App types whose build is inherently both platforms in a single pass, and so
+ * whose one workflow legitimately holds both android and ios steps.
+ *
+ * A Kotlin Multiplatform build is the case that forced this: gradle assembles
+ * the XCFramework that `xcodebuild` then consumes, in that order, on one
+ * machine. It cannot be split — a workflow is one dispatch and two workflows
+ * share no filesystem, so the artifact would never reach the second half.
+ *
+ * `ios` and `android` are single-platform by definition. `other` means the app
+ * type was never classified, and an unclassified app has not declared anything
+ * — silence is not permission.
+ */
+const MULTIPLATFORM_APP_TYPES = new Set(['kmm']);
+/**
+ * Whether the pipeline *declares* an app that spans both mobile platforms.
+ *
+ * Read only from the explicit declaration, never inferred from the steps.
+ * Inference would defeat the point: a workflow that mixes platforms by mistake
+ * is exactly what the gate exists to catch, and it looks identical to one that
+ * does so on purpose.
+ */
+export function declaresMultiplatformApp(pipeline) {
+    const platform = getInvarnMeta(pipeline)?.platform;
+    return platform !== undefined && MULTIPLATFORM_APP_TYPES.has(platform);
+}
 //# sourceMappingURL=meta-helpers.js.map

package/dist/src/yaml/step-validator.d.ts

@@ -22,6 +22,7 @@ export declare class StepValidator {
     private yamlFilePath?;
     private availableOutputs;
     private establishedPlatform;
+    private readonly spansPlatforms;
     constructor(pipeline: YAMLPipeline, workflowName: string, config: CIConfig, yamlFilePath?: string);
     /**
      * Validates all steps in the workflow.

package/dist/src/yaml/step-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;gBAGtD,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IAwBvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IA8M3D;;OAEG;YACW,mBAAmB;IAsDjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}
+{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;IAKxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAGvC,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAkN3D;;OAEG;YACW,mBAAmB;IAsDjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}

package/dist/src/yaml/step-validator.js

@@ -8,6 +8,7 @@
 import { getStepExecutor, hasStep, getStepMetadata } from './steps/registry.js';
 import { EnvResolver } from './env-resolver.js';
 import { detectPlatformInfo } from './platform-detector.js';
+import { declaresMultiplatformApp } from './meta-helpers.js';
 // POSIX env vars the shell always provides — don't flag these as undeclared.
 // The runner's guest shell seeds HOME, TMPDIR, PATH, etc.; requiring
 // pipelines to redeclare them forces literal-path-only scripts.
@@ -45,6 +46,10 @@ export class StepValidator {
     availableOutputs = new Map();
     // Platform established by the first platform-specific step ('ios' or 'android')
     establishedPlatform = null;
+    // True when the pipeline declares an app that is inherently both platforms
+    // (KMM today), so one workflow may legitimately hold android and ios steps.
+    // Read from the declaration only — see `declaresMultiplatformApp`.
+    spansPlatforms;
     constructor(pipeline, workflowName, config, yamlFilePath) {
         this.pipeline = pipeline;
         this.workflowName = workflowName;
@@ -54,6 +59,7 @@ export class StepValidator {
         if (!this.workflow) {
             throw new Error(`Workflow '${workflowName}' not found in pipeline`);
         }
+        this.spansPlatforms = declaresMultiplatformApp(pipeline);
         // Create env resolver for variable interpolation
         const platformInfo = detectPlatformInfo(pipeline, workflowName);
         this.envResolver = new EnvResolver(pipeline, this.workflow, workflowName, platformInfo.platform, platformInfo.stack, yamlFilePath);
@@ -78,7 +84,11 @@ export class StepValidator {
             // Platform compatibility check
             const stepMetadata = getStepMetadata(parsedStep.name);
             const stepPlatform = stepMetadata?.platform ?? 'all';
-            if (stepPlatform !== 'all') {
+            // A declared multiplatform app is exempt: its build spans both platforms
+            // by construction, so there is no single platform for a step to conflict
+            // with. Everything else — including an app that declares nothing, or
+            // declares one platform and then mixes — is still refused below.
+            if (stepPlatform !== 'all' && !this.spansPlatforms) {
                 if (this.establishedPlatform === null) {
                     // First platform-specific step establishes the workflow platform
                     this.establishedPlatform = stepPlatform;

package/dist/src/yaml/step-validator.test.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Unit tests for the pre-execution platform gate.
+ *
+ * A workflow's platform is established by its first platform-specific step,
+ * and any later step of a different platform is refused. That rule is right
+ * for an app that targets one platform and wrong for one that targets both:
+ * a Kotlin Multiplatform build is *inherently* android-then-ios — gradle
+ * assembles the XCFramework that `xcodebuild` then consumes — and there is no
+ * way to split it, because a workflow is one dispatch on one machine and two
+ * workflows share no filesystem.
+ *
+ * On 2026-09-01 that cost a real build: a generated KMM pipeline was refused
+ * before a single step ran. These tests pin the narrow relaxation that fixes
+ * it — permitted only where the pipeline *declares* a multiplatform app,
+ * never inferred from the steps themselves.
+ */
+import '../yaml/steps/index.js';
+//# sourceMappingURL=step-validator.test.d.ts.map

package/dist/src/yaml/step-validator.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-validator.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,wBAAwB,CAAC"}

package/dist/src/yaml/step-validator.test.js

@@ -0,0 +1,140 @@
+/**
+ * Unit tests for the pre-execution platform gate.
+ *
+ * A workflow's platform is established by its first platform-specific step,
+ * and any later step of a different platform is refused. That rule is right
+ * for an app that targets one platform and wrong for one that targets both:
+ * a Kotlin Multiplatform build is *inherently* android-then-ios — gradle
+ * assembles the XCFramework that `xcodebuild` then consumes — and there is no
+ * way to split it, because a workflow is one dispatch on one machine and two
+ * workflows share no filesystem.
+ *
+ * On 2026-09-01 that cost a real build: a generated KMM pipeline was refused
+ * before a single step ran. These tests pin the narrow relaxation that fixes
+ * it — permitted only where the pipeline *declares* a multiplatform app,
+ * never inferred from the steps themselves.
+ */
+import { describe, test, expect } from '@jest/globals';
+import '../yaml/steps/index.js';
+import { StepValidator } from './step-validator.js';
+import { PlatformDetectionError } from './platform-detector.js';
+import { loadConfig } from '../config.js';
+const config = loadConfig();
+/** What every curated template declares, and what the detector reads first. */
+const STACK = 'macos-xcode-26.4';
+/**
+ * A KMM build in one workflow: gradle establishes android, xcodebuild follows.
+ *
+ * The stack is not decoration. `PlatformDetector` resolves the host OS from it
+ * first and only falls back to reading the steps — where a mixed workflow
+ * throws before this validator ever runs. Every curated template declares a
+ * stack, so this is the gate a real pipeline actually meets.
+ *
+ * `getInvarnMeta` takes `meta.invarn` as a whole when it is present, so a test
+ * about the legacy block has to omit `meta.invarn` entirely.
+ */
+function kmmShapedPipeline({ invarn, legacy } = {}, { stack = true } = {}) {
+    const base = stack ? { stack: STACK } : {};
+    const meta = legacy && !invarn
+        ? { 'cibuild.io': { ...base, ...legacy } }
+        : {
+            invarn: { ...base, ...invarn },
+            ...(legacy ? { 'cibuild.io': { ...base, ...legacy } } : {}),
+        };
+    return {
+        format_version: '1',
+        meta,
+        workflows: {
+            primary: {
+                steps: [
+                    { 'gradle-build@1.0.0': { inputs: { project_location: '.', gradle_task: 'assembleDebug' } } },
+                    {
+                        'xcodebuild@1.0.0': {
+                            inputs: {
+                                project_path: 'iosApp/iosApp.xcodeproj',
+                                scheme: 'iosApp',
+                                destination: 'generic/platform=iOS Simulator',
+                            },
+                        },
+                    },
+                ],
+            },
+        },
+    };
+}
+async function platformIssues(pipeline) {
+    const validator = new StepValidator(pipeline, 'primary', config);
+    const result = await validator.validateWorkflow();
+    return (result.issuesByCategory.get('platform') ?? []).map((i) => i.requirement.name);
+}
+describe('StepValidator platform gate', () => {
+    test('refuses a mixed workflow that declares no app platform', async () => {
+        expect(await platformIssues(kmmShapedPipeline())).toEqual(['xcodebuild']);
+    });
+    test('permits a mixed workflow that declares a KMM app', async () => {
+        expect(await platformIssues(kmmShapedPipeline({ invarn: { platform: 'kmm' } }))).toEqual([]);
+    });
+    test('permits it through the legacy meta.cibuild.io block too', async () => {
+        expect(await platformIssues(kmmShapedPipeline({ legacy: { platform: 'kmm' } }))).toEqual([]);
+    });
+    // meta.invarn wins as a whole when both blocks are present, so a stale
+    // `kmm` under the legacy key must not grant permission the current block
+    // withholds.
+    test('lets meta.invarn withhold what a stale meta.cibuild.io granted', async () => {
+        expect(await platformIssues(kmmShapedPipeline({ invarn: { platform: 'android' }, legacy: { platform: 'kmm' } }))).toEqual(['xcodebuild']);
+    });
+    // The regression this relaxation could introduce. A declared platform, never
+    // inference: an ios step in a workflow that says it is android stays refused.
+    test('still refuses an ios step in a declared-android workflow', async () => {
+        expect(await platformIssues(kmmShapedPipeline({ invarn: { platform: 'android' } }))).toEqual([
+            'xcodebuild',
+        ]);
+    });
+    test('still refuses an android step in a declared-ios workflow', async () => {
+        const iosFirst = {
+            format_version: '1',
+            meta: { invarn: { stack: STACK, platform: 'ios' } },
+            workflows: {
+                primary: {
+                    steps: [
+                        { 'xcodebuild@1.0.0': { inputs: { project_path: 'App.xcodeproj', scheme: 'App' } } },
+                        { 'gradle-build@1.0.0': { inputs: { project_location: '.', gradle_task: 'assembleDebug' } } },
+                    ],
+                },
+            },
+        };
+        expect(await platformIssues(iosFirst)).toEqual(['gradle-build']);
+    });
+    // 'other' means the app type was not classified. An unclassified app has not
+    // declared that it spans platforms; silence is not permission.
+    test('still refuses when the declared platform is other', async () => {
+        expect(await platformIssues(kmmShapedPipeline({ invarn: { platform: 'other' } }))).toEqual([
+            'xcodebuild',
+        ]);
+    });
+    // The declaration is about mixing, not about skipping the gate: a
+    // single-platform workflow was never at risk either way.
+    test('leaves a single-platform workflow alone whatever it declares', async () => {
+        const androidOnly = {
+            format_version: '1',
+            meta: { invarn: { stack: STACK, platform: 'kmm' } },
+            workflows: {
+                primary: {
+                    steps: [
+                        { 'gradle-build@1.0.0': { inputs: { project_location: '.', gradle_task: 'assembleDebug' } } },
+                    ],
+                },
+            },
+        };
+        expect(await platformIssues(androidOnly)).toEqual([]);
+    });
+    // Declaring the app's platform does not tell the detector which host OS to
+    // ask for, and a mixed workflow cannot be read off its steps. That refusal
+    // is `PlatformDetector`'s and comes first — it is not relaxed here, and its
+    // own message already says what to add.
+    test('does not substitute for the stack a mixed workflow still needs', async () => {
+        const noStack = kmmShapedPipeline({ invarn: { platform: 'kmm' } }, { stack: false });
+        expect(() => new StepValidator(noStack, 'primary', config)).toThrow(PlatformDetectionError);
+    });
+});
+//# sourceMappingURL=step-validator.test.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.6.1",
+  "version": "2.6.2",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",