@invarn/cibuild 2.6.2 → 2.6.4

package/dist/src/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AAMA,OAAO,uBAAuB,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AASA,OAAO,uBAAuB,CAAC"}

package/dist/src/cli.js

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 import { resolve, extname } from "node:path";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
+// Static — see the note in `yaml/steps/android.ts`. `pkg` cannot evaluate a
+// dynamic `import()` of a builtin.
+import { createInterface } from "node:readline";
 import prompts from "prompts";
 import { SecretsManager } from "./yaml/secrets-manager.js";
 import "./yaml/steps/index.js"; // Initialize step registry
@@ -255,7 +258,6 @@ Examples:
             }
             else {
                 // Collect value interactively via readline (handles multiline paste cleanly)
-                const { createInterface } = await import('node:readline');
                 console.log(`\n  Enter value for ${varName}`);
                 console.log('  Paste content, then type . on its own line and press Enter:\n');
                 if (process.stdin.isTTY) {

package/dist/src/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/run.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA0I3E"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/run.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAiJ3E"}

package/dist/src/commands/run.js

@@ -109,6 +109,13 @@ export async function handleRunCommand(opts = {}) {
             await runner.runPipeline(pipeline, conversionResult.warnings, conversionResult.skippedSteps);
         }
         else if (isJavaScriptModule) {
+            // The one dynamic import that has to stay dynamic: the specifier is a
+            // user-supplied path, so no bundler can inline it. That means this
+            // branch does NOT work in the `pkg`-built macOS binary — it throws
+            // `Invalid host defined options` before the module loads. Nothing
+            // reaches it today: every curated template is YAML, and the runner only
+            // ever executes YAML pipelines. If JS pipelines are ever exposed as a
+            // supported path, they need a loader that does not rely on `import()`.
             console.log(`Loading pipeline: ${pipelinePath}`);
             const pipelineUrl = pathToFileURL(pipelinePath).href;
             const pipelineModule = await import(pipelineUrl);

package/dist/src/yaml/interactive-prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interactive-prompts.d.ts","sourceRoot":"","sources":["../../../src/yaml/interactive-prompts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,CAAS;gBAEd,cAAc,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM;IAK7D;;;;;;OAMG;IACG,iBAAiB,CACrB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,YAAY,CAAC;IA4FxB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;;;OAIG;YACW,WAAW;IAWzB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAyBhB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;;OAGG;YACW,eAAe;IAuC7B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"interactive-prompts.d.ts","sourceRoot":"","sources":["../../../src/yaml/interactive-prompts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,CAAS;gBAEd,cAAc,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,MAAM;IAK7D;;;;;;OAMG;IACG,iBAAiB,CACrB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,YAAY,CAAC;IA4FxB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAe3B;;;;OAIG;YACW,WAAW;IAWzB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAyBhB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;;OAGG;YACW,eAAe;IAqC7B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd"}

package/dist/src/yaml/interactive-prompts.js

@@ -2,6 +2,9 @@
  * Interactive prompts for missing environment variables
  * Allows users to fill in missing values or cancel the build
  */
+// Static — see the note in `steps/android.ts`. `pkg` cannot evaluate a
+// dynamic `import()` of a builtin.
+import { spawn } from 'node:child_process';
 import prompts from 'prompts';
 /**
  * Interactive prompt manager for collecting missing environment variables
@@ -212,7 +215,6 @@ Finish with a short "Follow-up questions" numbered list only if clarification wo
      * @param text Text to copy
      */
     async copyToClipboard(text) {
-        const { spawn } = await import('child_process');
         return new Promise((resolve, reject) => {
             // Detect platform and use appropriate clipboard command
             const platform = process.platform;

package/dist/src/yaml/step-validator-check-failure.test.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Unit tests for what happens when a pre-execution check cannot run.
+ *
+ * A check that *ran* and found nothing, and a check that *threw* before it
+ * tested anything, are different events. Until 2026-09-01 they were reported
+ * identically: the throw was wrapped in a `Check failed:` message and carried
+ * the requirement's own declared severity. For the Java JDK requirement that
+ * severity is `info` — chosen because the check looks in several places and a
+ * miss is not fatal — so a check that never looked anywhere at all was
+ * reported as information and read as noise.
+ *
+ * It was not noise. The released macOS binary is built with `pkg`, which
+ * cannot evaluate a dynamic `import()` of a module it did not bundle; the JDK
+ * check opened with two of them and threw `Invalid host defined options` on
+ * every macOS build. It went unseen for as long as the fleet has existed.
+ *
+ * Two rules are pinned here:
+ *   1. a throw is reported at `warning`, whatever the requirement declares;
+ *   2. no check may reach for a Node builtin through a dynamic import, because
+ *      nothing else in the test suite can see that failure — under plain
+ *      `node`, and in the npm bundle, the code works.
+ */
+export {};
+//# sourceMappingURL=step-validator-check-failure.test.d.ts.map

package/dist/src/yaml/step-validator-check-failure.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-validator-check-failure.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator-check-failure.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG"}

package/dist/src/yaml/step-validator-check-failure.test.js

@@ -0,0 +1,130 @@
+/**
+ * Unit tests for what happens when a pre-execution check cannot run.
+ *
+ * A check that *ran* and found nothing, and a check that *threw* before it
+ * tested anything, are different events. Until 2026-09-01 they were reported
+ * identically: the throw was wrapped in a `Check failed:` message and carried
+ * the requirement's own declared severity. For the Java JDK requirement that
+ * severity is `info` — chosen because the check looks in several places and a
+ * miss is not fatal — so a check that never looked anywhere at all was
+ * reported as information and read as noise.
+ *
+ * It was not noise. The released macOS binary is built with `pkg`, which
+ * cannot evaluate a dynamic `import()` of a module it did not bundle; the JDK
+ * check opened with two of them and threw `Invalid host defined options` on
+ * every macOS build. It went unseen for as long as the fleet has existed.
+ *
+ * Two rules are pinned here:
+ *   1. a throw is reported at `warning`, whatever the requirement declares;
+ *   2. no check may reach for a Node builtin through a dynamic import, because
+ *      nothing else in the test suite can see that failure — under plain
+ *      `node`, and in the npm bundle, the code works.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { registerStep } from './steps/registry.js';
+import { BaseStepExecutor } from './steps/base.js';
+import { StepValidator } from './step-validator.js';
+import { loadConfig } from '../config.js';
+const config = loadConfig();
+/** A step whose single requirement behaves however the test needs it to. */
+function stepWhoseCheck(severity, check) {
+    const name = `probe-${Math.random().toString(36).slice(2)}`;
+    class ProbeStep extends BaseStepExecutor {
+        async execute() {
+            return this.createScriptStep('echo probe', name);
+        }
+        getValidationRequirements() {
+            return [
+                {
+                    category: 'command',
+                    name: 'probe-tool',
+                    description: 'A tool the probe step needs',
+                    timing: 'pre-execution',
+                    severity,
+                    check,
+                },
+            ];
+        }
+    }
+    registerStep(name, new ProbeStep());
+    return name;
+}
+async function validate(stepName) {
+    const validator = new StepValidator({
+        format_version: '1',
+        meta: { invarn: { stack: 'macos-xcode-26.4' } },
+        workflows: { primary: { steps: [{ [`${stepName}@1.0.0`]: { inputs: {} } }] } },
+    }, 'primary', config);
+    return validator.validateWorkflow();
+}
+describe('a check that could not run', () => {
+    test('is reported as a warning even though the requirement declares info', async () => {
+        const name = stepWhoseCheck('info', async () => {
+            throw new Error('Invalid host defined options');
+        });
+        const result = await validate(name);
+        expect(result.counts).toMatchObject({ errors: 0, warnings: 1, info: 0 });
+        expect(result.issues[0].requirement.severity).toBe('warning');
+        expect(result.issues[0].result.message).toBe('Check failed: Invalid host defined options');
+    });
+    test('does not turn a hard requirement into a soft one', async () => {
+        const name = stepWhoseCheck('error', async () => {
+            throw new Error('boom');
+        });
+        const result = await validate(name);
+        // An `error` requirement whose check throws must not be downgraded — that
+        // would let a pipeline proceed past a requirement nothing verified.
+        expect(result.counts).toMatchObject({ errors: 1, warnings: 0, info: 0 });
+        expect(result.valid).toBe(false);
+    });
+    test('leaves a check that ran and failed at its declared severity', async () => {
+        const name = stepWhoseCheck('info', async () => ({
+            passed: false,
+            message: 'Java 17 not found',
+        }));
+        const result = await validate(name);
+        // The whole point of the distinction: this check *worked*. `info` is the
+        // right severity for it and must survive.
+        expect(result.counts).toMatchObject({ errors: 0, warnings: 0, info: 1 });
+        expect(result.issues[0].result.message).toBe('Java 17 not found');
+    });
+});
+/**
+ * The structural half.
+ *
+ * esbuild leaves a dynamic `import()` of a Node builtin in the bundle — the
+ * builtins are external — and `pkg` then cannot evaluate it. Relative
+ * specifiers are inlined by the bundler and are unaffected, which is why
+ * `envman` and `fidelity-trim` work while the JDK check did not.
+ *
+ * There is no runtime test that can catch this: it reproduces only in a
+ * `pkg`-built binary, and `./test.sh` runs under plain `node`. So the rule is
+ * enforced on the source.
+ */
+describe('no source file reaches for a Node builtin through a dynamic import', () => {
+    const BUILTIN = /await import\(\s*['"](?:node:)?(fs|path|os|child_process|readline|crypto|util|url|http|https|net|stream|zlib|tty|events)(?:\/[\w-]+)?['"]\s*\)/;
+    function sourceFiles(dir) {
+        return readdirSync(dir).flatMap((entry) => {
+            const full = join(dir, entry);
+            if (statSync(full).isDirectory())
+                return sourceFiles(full);
+            if (!full.endsWith('.ts') || full.endsWith('.test.ts'))
+                return [];
+            return [full];
+        });
+    }
+    test('src is clean', () => {
+        // Jest runs from the package root; `src` is the whole surface that gets
+        // bundled into the released binary.
+        const offenders = sourceFiles(join(process.cwd(), 'src'))
+            .flatMap((file) => readFileSync(file, 'utf8')
+            .split('\n')
+            .map((line, i) => ({ file, line: line.trim(), n: i + 1 }))
+            .filter(({ line }) => BUILTIN.test(line)))
+            .map(({ file, n, line }) => `${file.replace(/.*\/src\//, 'src/')}:${n}  ${line}`);
+        expect(offenders).toEqual([]);
+    });
+});
+//# sourceMappingURL=step-validator-check-failure.test.js.map

package/dist/src/yaml/step-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;IAKxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAGvC,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAkN3D;;OAEG;YACW,mBAAmB;IAsDjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}
+{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;IAKxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAGvC,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAkN3D;;OAEG;YACW,mBAAmB;IAmEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}

package/dist/src/yaml/step-validator.js

@@ -280,10 +280,22 @@ export class StepValidator {
                 }
             }
             catch (error) {
+                // A check that threw did not run. That is a different event from a
+                // check that ran and found nothing, and it must not inherit the
+                // severity chosen for the latter: `info` is a reasonable verdict for
+                // "looked in several places, found no JDK" and a useless one for
+                // "never looked". Reported at `warning` so it is visible on the first
+                // build — a check whose own failure reads as information can stay
+                // broken for as long as nobody reads carefully.
+                //
+                // `error` is never downgraded. A hard requirement nothing could verify
+                // is not softer than one that was verified and failed.
                 return {
                     stepName,
                     stepIndex,
-                    requirement,
+                    requirement: requirement.severity === 'error'
+                        ? requirement
+                        : { ...requirement, severity: 'warning' },
                     result: {
                         passed: false,
                         message: `Check failed: ${error instanceof Error ? error.message : String(error)}`,

package/dist/src/yaml/steps/android.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/android.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,yBAAyB,CACvB,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmB1B;;;OAGG;YACW,4BAA4B;IA8E1C,UAAU,IAAI,UAAU,EAAE;IAUpB,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAoH7G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,UAAU,IAAI,UAAU,EAAE;IAe1B,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyP1G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAiL1G;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,yBAAyB,CACvB,OAAO,EAAE,qBAAqB,EAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA4L9G;AAMD,MAAM,WAAW,8BAA8B;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,oCAAqC,SAAQ,gBAAgB;IACxE,yBAAyB,CACvB,OAAO,EAAE,8BAA8B,EACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAsEzH"}
+{"version":3,"file":"android.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/android.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,yBAAyB,CACvB,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmB1B;;;OAGG;YACW,4BAA4B;IA0E1C,UAAU,IAAI,UAAU,EAAE;IAUpB,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAoH7G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,UAAU,IAAI,UAAU,EAAE;IAe1B,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyP1G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAiL1G;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,yBAAyB,CACvB,OAAO,EAAE,qBAAqB,EAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA4L9G;AAMD,MAAM,WAAW,8BAA8B;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,oCAAqC,SAAQ,gBAAgB;IACxE,yBAAyB,CACvB,OAAO,EAAE,8BAA8B,EACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAsEzH"}

package/dist/src/yaml/steps/android.js

@@ -1,6 +1,13 @@
 /**
  * Android step implementations (set-java-version, gradle-build, android-lint, android-unit-test)
  */
+// Static, deliberately. The released macOS binary is built with `pkg`, which
+// cannot evaluate a dynamic `import()` of a builtin — esbuild leaves those
+// external, so they survive into the bundle as real imports and throw
+// `Invalid host defined options` at runtime. A validation check that reaches
+// for one never runs on a runner.
+import { existsSync, readFileSync } from 'node:fs';
+import { execSync } from 'node:child_process';
 import { BaseStepExecutor } from './base.js';
 /**
  * Set Java version step executor
@@ -28,8 +35,6 @@ export class SetJavaVersionStepExecutor extends BaseStepExecutor {
      * Matches the logic in execute() method
      */
     async checkJavaVersionWithHomebrew(version) {
-        const { existsSync } = await import('node:fs');
-        const { execSync } = await import('node:child_process');
         // Check Homebrew paths first (same order as execute())
         const homebrewPaths = [
             `/opt/homebrew/opt/openjdk@${version}`, // Apple Silicon
@@ -48,7 +53,6 @@ export class SetJavaVersionStepExecutor extends BaseStepExecutor {
             const jbrPath = '/Applications/Android Studio.app/Contents/jbr/Contents/Home';
             if (existsSync(jbrPath)) {
                 try {
-                    const { readFileSync } = await import('node:fs');
                     const releaseContent = readFileSync(`${jbrPath}/release`, 'utf-8');
                     const jbrVersionMatch = /JAVA_VERSION="(\d+)/.exec(releaseContent);
                     if (jbrVersionMatch && jbrVersionMatch[1] === String(version)) {

package/dist/src/yaml/steps/bitrise-android-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bitrise-android-tools.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/bitrise-android-tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,gBAAgB;IACnE,yBAAyB,CACvB,OAAO,EAAE,yBAAyB,EAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiD1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyJlH"}
+{"version":3,"file":"bitrise-android-tools.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/bitrise-android-tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,gBAAgB;IACnE,yBAAyB,CACvB,OAAO,EAAE,yBAAyB,EAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IA+C1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyJlH"}

package/dist/src/yaml/steps/bitrise-android-tools.js

@@ -2,6 +2,10 @@
  * Bitrise install-missing-android-tools step implementation
  * Maps Bitrise install-missing-android-tools@* to CI Build Android environment setup
  */
+// Static — see the note in `android.ts`. A dynamic `import()` of a builtin
+// throws under the `pkg`-built binary the macOS runners use.
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { BaseStepExecutor } from './base.js';
 /**
  * Bitrise install-missing-android-tools step executor (FR-3)
@@ -28,8 +32,6 @@ export class BitriseAndroidToolsStepExecutor extends BaseStepExecutor {
                         };
                     }
                     // Check if we can auto-detect
-                    const { existsSync } = await import('node:fs');
-                    const { homedir } = await import('node:os');
                     const homeDir = homedir();
                     const commonPaths = [
                         `${homeDir}/Library/Android/sdk`, // macOS

package/dist/src/yaml/steps/cache-pull-daemon.test.js

@@ -25,6 +25,7 @@
  */
 import { describe, test, expect } from '@jest/globals';
 import { execFile } from 'child_process';
+import { createHash } from 'crypto';
 import { mkdtempSync, writeFileSync, rmSync, mkdirSync, chmodSync } from 'fs';
 import { createServer } from 'http';
 import { join } from 'path';
@@ -40,6 +41,14 @@ import { testConfigNoPeer } from './test-config.js';
  */
 const run = promisify(execFile);
 const CACHE_KEY = 'pods-abc123def456-release-1.4';
+/**
+ * An explicit `cache_key` is prefixed with a project scope so two repositories
+ * writing the same key don't share a tarball. These fixtures run outside a git
+ * remote, so the step's shell hashes the literal `"no-remote"` — derived here
+ * rather than pasted, so it tracks the step.
+ */
+const PROJECT_SCOPE = createHash('sha256').update('no-remote', 'utf8').digest('hex').slice(0, 8);
+const SCOPED_CACHE_KEY = `${PROJECT_SCOPE}-${CACHE_KEY}`;
 async function listen(handler, paths) {
     const server = createServer((req, res) => {
         const path = req.url ?? '/';
@@ -145,8 +154,8 @@ describe('cache-pull with an explicit key, over the daemon', () => {
         // 404 is the daemon's answer for `cache_miss`. The normal case on any
         // first build: it must not start printing warnings.
         const { stdout, paths } = await runPull({ keyStatus: 404 });
-        expect(paths).toEqual([`/cache/${CACHE_KEY}.tar.zst`]);
-        expect(stdout).toContain(`No cache found for key: ${CACHE_KEY}`);
+        expect(paths).toEqual([`/cache/${SCOPED_CACHE_KEY}.tar.zst`]);
+        expect(stdout).toContain(`No cache found for key: ${SCOPED_CACHE_KEY}`);
         expect(stdout).toContain('CACHE_SOURCE=cold');
         expect(stdout).not.toContain('Warning');
     });

package/dist/src/yaml/steps/cache-pull-restore-roots.test.js

@@ -40,6 +40,7 @@
  */
 import { describe, test, expect } from '@jest/globals';
 import { execFile } from 'child_process';
+import { createHash } from 'crypto';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, realpathSync, rmSync, chmodSync, } from 'fs';
 import { join } from 'path';
 import { tmpdir } from 'os';
@@ -48,6 +49,14 @@ import { CachePullStepExecutor } from './cache.js';
 import { testConfigNoPeer } from './test-config.js';
 const run = promisify(execFile);
 const CACHE_KEY = 'gradle-abc123def456-fingerprint';
+/**
+ * An explicit `cache_key` is prefixed with a project scope so two repositories
+ * that write the same key don't share one tarball. These fixtures run outside a
+ * git remote, so the step's shell falls back to hashing the literal
+ * `"no-remote"` — derived here rather than pasted, so it tracks the step.
+ */
+const PROJECT_SCOPE = createHash('sha256').update('no-remote', 'utf8').digest('hex').slice(0, 8);
+const SCOPED_CACHE_KEY = `${PROJECT_SCOPE}-${CACHE_KEY}`;
 async function restore(shape) {
     // Resolved: see the header — tar will not extract through a symlink, and on
     // macOS the temp root sits behind one.
@@ -83,7 +92,7 @@ async function restore(shape) {
         // `tar -cf - "${PATHS_TO_CACHE[@]}"` produces.
         const cacheDir = join(checkout, '.ci-cache');
         mkdirSync(cacheDir, { recursive: true });
-        const tarball = join(cacheDir, `${CACHE_KEY}.tar.zst`);
+        const tarball = join(cacheDir, `${SCOPED_CACHE_KEY}.tar.zst`);
         await run('tar', ['-cf', tarball, ...operands], { cwd: checkout });
         // Remove the originals: "it landed" is only meaningful if it was gone.
         for (const l of landings)

package/dist/src/yaml/steps/cache-push-daemon.test.js

@@ -25,12 +25,21 @@
  */
 import { describe, test, expect } from '@jest/globals';
 import { execFileSync } from 'child_process';
+import { createHash } from 'crypto';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, existsSync, chmodSync } from 'fs';
 import { join } from 'path';
 import { tmpdir } from 'os';
 import { CachePushStepExecutor } from './cache.js';
 import { testConfigNoPeer } from './test-config.js';
 const CACHE_KEY = 'pods-abc123def456-main';
+/**
+ * An explicit `cache_key` is prefixed with a project scope so two repositories
+ * writing the same key don't share a tarball. These fixtures run outside a git
+ * remote, so the step's shell hashes the literal `"no-remote"` — derived here
+ * rather than pasted, so it tracks the step.
+ */
+const PROJECT_SCOPE = createHash('sha256').update('no-remote', 'utf8').digest('hex').slice(0, 8);
+const SCOPED_CACHE_KEY = `${PROJECT_SCOPE}-${CACHE_KEY}`;
 /**
  * Generates the explicit-key push step, runs it, and reports what `curl` was
  * actually asked to do.
@@ -107,7 +116,7 @@ describe('cache-push with an explicit key, over the daemon', () => {
     test('uploads under the key it was given', async () => {
         const { urls } = await runPush();
         expect(urls).toHaveLength(1);
-        expect(urls[0]).toBe(`http://daemon.invalid/cache/${CACHE_KEY}.tar.zst`);
+        expect(urls[0]).toBe(`http://daemon.invalid/cache/${SCOPED_CACHE_KEY}.tar.zst`);
     });
     test('never uploads to an empty key', async () => {
         // The defect, named. `<daemon>/cache/.tar.zst` is what an unassigned

package/dist/src/yaml/steps/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAubF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAmIzF,iBAAiB;CAkNhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAqKzF,iBAAiB;CAgJhC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AA4bF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAiJzF,iBAAiB;CAkNhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA2KzF,iBAAiB;CAgJhC"}

package/dist/src/yaml/steps/cache.js

@@ -36,7 +36,12 @@ export const CACHE_PRESETS = {
 function emitProjectScopeCommands() {
     return [
         '__ci_git_remote=$(git config --get remote.origin.url 2>/dev/null | sed -E "s#(://)[^@/]+@#\\1#" || echo "no-remote")',
-        '__ci_proj=$(printf "%s" "${__ci_git_remote:-no-remote}" | shasum -a 256 | cut -c1-8)',
+        // `shasum` is Perl-provided and is not guaranteed on a slim Linux image;
+        // `sha256sum` is coreutils and is absent from macOS. Both print
+        // `<hex>  -`, so either yields the same 8-char project id — which is what
+        // keeps this byte-identical to `deriveProjectId` in the runner.
+        '__ci_sha256() { if command -v shasum >/dev/null 2>&1; then shasum -a 256; else sha256sum; fi; }',
+        '__ci_proj=$(printf "%s" "${__ci_git_remote:-no-remote}" | __ci_sha256 | cut -c1-8)',
     ];
 }
 /**
@@ -458,7 +463,6 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         const isDebugMode = this.getInput(inputs, 'is_debug_mode', false);
         const commands = [];
         commands.push('# Cache Pull');
-        commands.push(`echo "Cache key: ${this.escapeBash(cacheKey)}"`);
         // Create cache directory if it doesn't exist
         commands.push('');
         commands.push('# Ensure cache directory exists');
@@ -468,11 +472,25 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // longer mounted into the VM — an unconditional mkdir would abort the
         // whole step under errexit.
         commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
+        // Project scope: an explicit `cache_key` is author-written and carries no
+        // repo identity, so two projects that happen to write the same key (e.g.
+        // `gradle-{{checksum "gradle/wrapper/gradle-wrapper.properties"}}`, which
+        // depends only on the Gradle version) would share one tarball on a shared
+        // runner. Prefixing the project id keeps each repo's cache its own.
+        //
+        // The id goes at the FRONT, deliberately. The preset path spells its key
+        // `<keyPrefix>-<projectId>-<checksum>`, and that middle-segment shape is
+        // load-bearing elsewhere: it is how a scope is recovered from a tarball
+        // filename. An explicit key is author-written and must stay outside the
+        // scope model, so it must not be able to imitate that shape by accident.
+        commands.push('');
+        commands.push(...emitProjectScopeCommands());
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
-        commands.push(`CACHE_KEY="${this.escapeBash(cacheKey)}"`);
+        commands.push(`CACHE_KEY="\${__ci_proj}-${this.escapeBash(cacheKey)}"`);
         commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
+        commands.push('echo "Cache key: $CACHE_KEY"');
         if (isDebugMode) {
             commands.push('echo "Debug mode enabled"');
             commands.push('echo "Cache file: $CACHE_FILE"');
@@ -482,7 +500,7 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         if (peerCacheDir) {
             commands.push('');
             commands.push(`PEER_CACHE_DIR="${this.escapeBash(peerCacheDir)}"`);
-            commands.push(`PEER_CACHE_FILE="$PEER_CACHE_DIR/${this.escapeBash(cacheKey)}.tar.zst"`);
+            commands.push('PEER_CACHE_FILE="$PEER_CACHE_DIR/$CACHE_KEY.tar.zst"');
         }
         // Where each class of member is restored to. Emitted before every
         // transport, because all of them extract.
@@ -501,7 +519,7 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         commands.push('    echo "CACHE_SOURCE=daemon"');
         commands.push('  else');
         commands.push(...emitDaemonPullFailureDiagnosis('    ', '$CACHE_KEY'));
-        commands.push(`    echo "No cache found for key: ${this.escapeBash(cacheKey)}"`);
+        commands.push('    echo "No cache found for key: $CACHE_KEY"');
         commands.push('    echo "CACHE_SOURCE=cold"');
         commands.push('  fi');
         commands.push('  rm -f "$__ci_cache_diag"');
@@ -522,7 +540,7 @@ export class CachePullStepExecutor extends BaseStepExecutor {
             commands.push('  echo "CACHE_SOURCE=peer"');
         }
         commands.push('else');
-        commands.push(`  echo "No cache found for key: ${this.escapeBash(cacheKey)}"`);
+        commands.push('  echo "No cache found for key: $CACHE_KEY"');
         commands.push('  echo "CACHE_SOURCE=cold"');
         commands.push('fi');
         // Closes the daemon/filesystem transport split.
@@ -766,7 +784,6 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         const ignoreCheckOnPaths = this.getInput(inputs, 'ignore_check_on_paths', false);
         const commands = [];
         commands.push('# Cache Push');
-        commands.push(`echo "Cache key: ${this.escapeBash(cacheKey)}"`);
         // Create cache directory if it doesn't exist
         commands.push('');
         commands.push('# Ensure cache directory exists');
@@ -776,14 +793,20 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         // longer mounted into the VM — an unconditional mkdir would abort the
         // whole step under errexit.
         commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
+        // Project scope — must match the pull side exactly, or a push writes a
+        // tarball no pull can ever find. See the note there for why an explicit
+        // key needs the repo identity prefixed.
+        commands.push('');
+        commands.push(...emitProjectScopeCommands());
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
         // CACHE_KEY first, CACHE_FILE derived from it — exactly as the pull side
         // does. This step used to set only CACHE_FILE while the daemon URL below
         // interpolated `$CACHE_KEY`; see emitDaemonPushCommands.
-        commands.push(`CACHE_KEY="${this.escapeBash(cacheKey)}"`);
+        commands.push(`CACHE_KEY="\${__ci_proj}-${this.escapeBash(cacheKey)}"`);
         commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
+        commands.push('echo "Cache key: $CACHE_KEY"');
         if (isDebugMode) {
             commands.push('echo "Debug mode enabled"');
             commands.push('echo "Cache file: $CACHE_FILE"');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.6.2",
+  "version": "2.6.4",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",