@invarn/cibuild 2.6.3 → 2.6.4

package/dist/src/yaml/steps/cache-pull-daemon.test.js

@@ -25,6 +25,7 @@
  */
 import { describe, test, expect } from '@jest/globals';
 import { execFile } from 'child_process';
+import { createHash } from 'crypto';
 import { mkdtempSync, writeFileSync, rmSync, mkdirSync, chmodSync } from 'fs';
 import { createServer } from 'http';
 import { join } from 'path';
@@ -40,6 +41,14 @@ import { testConfigNoPeer } from './test-config.js';
  */
 const run = promisify(execFile);
 const CACHE_KEY = 'pods-abc123def456-release-1.4';
+/**
+ * An explicit `cache_key` is prefixed with a project scope so two repositories
+ * writing the same key don't share a tarball. These fixtures run outside a git
+ * remote, so the step's shell hashes the literal `"no-remote"` — derived here
+ * rather than pasted, so it tracks the step.
+ */
+const PROJECT_SCOPE = createHash('sha256').update('no-remote', 'utf8').digest('hex').slice(0, 8);
+const SCOPED_CACHE_KEY = `${PROJECT_SCOPE}-${CACHE_KEY}`;
 async function listen(handler, paths) {
     const server = createServer((req, res) => {
         const path = req.url ?? '/';
@@ -145,8 +154,8 @@ describe('cache-pull with an explicit key, over the daemon', () => {
         // 404 is the daemon's answer for `cache_miss`. The normal case on any
         // first build: it must not start printing warnings.
         const { stdout, paths } = await runPull({ keyStatus: 404 });
-        expect(paths).toEqual([`/cache/${CACHE_KEY}.tar.zst`]);
-        expect(stdout).toContain(`No cache found for key: ${CACHE_KEY}`);
+        expect(paths).toEqual([`/cache/${SCOPED_CACHE_KEY}.tar.zst`]);
+        expect(stdout).toContain(`No cache found for key: ${SCOPED_CACHE_KEY}`);
         expect(stdout).toContain('CACHE_SOURCE=cold');
         expect(stdout).not.toContain('Warning');
     });

package/dist/src/yaml/steps/cache-pull-restore-roots.test.js

@@ -40,6 +40,7 @@
  */
 import { describe, test, expect } from '@jest/globals';
 import { execFile } from 'child_process';
+import { createHash } from 'crypto';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, realpathSync, rmSync, chmodSync, } from 'fs';
 import { join } from 'path';
 import { tmpdir } from 'os';
@@ -48,6 +49,14 @@ import { CachePullStepExecutor } from './cache.js';
 import { testConfigNoPeer } from './test-config.js';
 const run = promisify(execFile);
 const CACHE_KEY = 'gradle-abc123def456-fingerprint';
+/**
+ * An explicit `cache_key` is prefixed with a project scope so two repositories
+ * that write the same key don't share one tarball. These fixtures run outside a
+ * git remote, so the step's shell falls back to hashing the literal
+ * `"no-remote"` — derived here rather than pasted, so it tracks the step.
+ */
+const PROJECT_SCOPE = createHash('sha256').update('no-remote', 'utf8').digest('hex').slice(0, 8);
+const SCOPED_CACHE_KEY = `${PROJECT_SCOPE}-${CACHE_KEY}`;
 async function restore(shape) {
     // Resolved: see the header — tar will not extract through a symlink, and on
     // macOS the temp root sits behind one.
@@ -83,7 +92,7 @@ async function restore(shape) {
         // `tar -cf - "${PATHS_TO_CACHE[@]}"` produces.
         const cacheDir = join(checkout, '.ci-cache');
         mkdirSync(cacheDir, { recursive: true });
-        const tarball = join(cacheDir, `${CACHE_KEY}.tar.zst`);
+        const tarball = join(cacheDir, `${SCOPED_CACHE_KEY}.tar.zst`);
         await run('tar', ['-cf', tarball, ...operands], { cwd: checkout });
         // Remove the originals: "it landed" is only meaningful if it was gone.
         for (const l of landings)

package/dist/src/yaml/steps/cache-push-daemon.test.js

@@ -25,12 +25,21 @@
  */
 import { describe, test, expect } from '@jest/globals';
 import { execFileSync } from 'child_process';
+import { createHash } from 'crypto';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, existsSync, chmodSync } from 'fs';
 import { join } from 'path';
 import { tmpdir } from 'os';
 import { CachePushStepExecutor } from './cache.js';
 import { testConfigNoPeer } from './test-config.js';
 const CACHE_KEY = 'pods-abc123def456-main';
+/**
+ * An explicit `cache_key` is prefixed with a project scope so two repositories
+ * writing the same key don't share a tarball. These fixtures run outside a git
+ * remote, so the step's shell hashes the literal `"no-remote"` — derived here
+ * rather than pasted, so it tracks the step.
+ */
+const PROJECT_SCOPE = createHash('sha256').update('no-remote', 'utf8').digest('hex').slice(0, 8);
+const SCOPED_CACHE_KEY = `${PROJECT_SCOPE}-${CACHE_KEY}`;
 /**
  * Generates the explicit-key push step, runs it, and reports what `curl` was
  * actually asked to do.
@@ -107,7 +116,7 @@ describe('cache-push with an explicit key, over the daemon', () => {
     test('uploads under the key it was given', async () => {
         const { urls } = await runPush();
         expect(urls).toHaveLength(1);
-        expect(urls[0]).toBe(`http://daemon.invalid/cache/${CACHE_KEY}.tar.zst`);
+        expect(urls[0]).toBe(`http://daemon.invalid/cache/${SCOPED_CACHE_KEY}.tar.zst`);
     });
     test('never uploads to an empty key', async () => {
         // The defect, named. `<daemon>/cache/.tar.zst` is what an unassigned

package/dist/src/yaml/steps/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAubF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAmIzF,iBAAiB;CAkNhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAqKzF,iBAAiB;CAgJhC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AA4bF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAiJzF,iBAAiB;CAkNhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA2KzF,iBAAiB;CAgJhC"}

package/dist/src/yaml/steps/cache.js

@@ -36,7 +36,12 @@ export const CACHE_PRESETS = {
 function emitProjectScopeCommands() {
     return [
         '__ci_git_remote=$(git config --get remote.origin.url 2>/dev/null | sed -E "s#(://)[^@/]+@#\\1#" || echo "no-remote")',
-        '__ci_proj=$(printf "%s" "${__ci_git_remote:-no-remote}" | shasum -a 256 | cut -c1-8)',
+        // `shasum` is Perl-provided and is not guaranteed on a slim Linux image;
+        // `sha256sum` is coreutils and is absent from macOS. Both print
+        // `<hex>  -`, so either yields the same 8-char project id — which is what
+        // keeps this byte-identical to `deriveProjectId` in the runner.
+        '__ci_sha256() { if command -v shasum >/dev/null 2>&1; then shasum -a 256; else sha256sum; fi; }',
+        '__ci_proj=$(printf "%s" "${__ci_git_remote:-no-remote}" | __ci_sha256 | cut -c1-8)',
     ];
 }
 /**
@@ -458,7 +463,6 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         const isDebugMode = this.getInput(inputs, 'is_debug_mode', false);
         const commands = [];
         commands.push('# Cache Pull');
-        commands.push(`echo "Cache key: ${this.escapeBash(cacheKey)}"`);
         // Create cache directory if it doesn't exist
         commands.push('');
         commands.push('# Ensure cache directory exists');
@@ -468,11 +472,25 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // longer mounted into the VM — an unconditional mkdir would abort the
         // whole step under errexit.
         commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
+        // Project scope: an explicit `cache_key` is author-written and carries no
+        // repo identity, so two projects that happen to write the same key (e.g.
+        // `gradle-{{checksum "gradle/wrapper/gradle-wrapper.properties"}}`, which
+        // depends only on the Gradle version) would share one tarball on a shared
+        // runner. Prefixing the project id keeps each repo's cache its own.
+        //
+        // The id goes at the FRONT, deliberately. The preset path spells its key
+        // `<keyPrefix>-<projectId>-<checksum>`, and that middle-segment shape is
+        // load-bearing elsewhere: it is how a scope is recovered from a tarball
+        // filename. An explicit key is author-written and must stay outside the
+        // scope model, so it must not be able to imitate that shape by accident.
+        commands.push('');
+        commands.push(...emitProjectScopeCommands());
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
-        commands.push(`CACHE_KEY="${this.escapeBash(cacheKey)}"`);
+        commands.push(`CACHE_KEY="\${__ci_proj}-${this.escapeBash(cacheKey)}"`);
         commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
+        commands.push('echo "Cache key: $CACHE_KEY"');
         if (isDebugMode) {
             commands.push('echo "Debug mode enabled"');
             commands.push('echo "Cache file: $CACHE_FILE"');
@@ -482,7 +500,7 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         if (peerCacheDir) {
             commands.push('');
             commands.push(`PEER_CACHE_DIR="${this.escapeBash(peerCacheDir)}"`);
-            commands.push(`PEER_CACHE_FILE="$PEER_CACHE_DIR/${this.escapeBash(cacheKey)}.tar.zst"`);
+            commands.push('PEER_CACHE_FILE="$PEER_CACHE_DIR/$CACHE_KEY.tar.zst"');
         }
         // Where each class of member is restored to. Emitted before every
         // transport, because all of them extract.
@@ -501,7 +519,7 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         commands.push('    echo "CACHE_SOURCE=daemon"');
         commands.push('  else');
         commands.push(...emitDaemonPullFailureDiagnosis('    ', '$CACHE_KEY'));
-        commands.push(`    echo "No cache found for key: ${this.escapeBash(cacheKey)}"`);
+        commands.push('    echo "No cache found for key: $CACHE_KEY"');
         commands.push('    echo "CACHE_SOURCE=cold"');
         commands.push('  fi');
         commands.push('  rm -f "$__ci_cache_diag"');
@@ -522,7 +540,7 @@ export class CachePullStepExecutor extends BaseStepExecutor {
             commands.push('  echo "CACHE_SOURCE=peer"');
         }
         commands.push('else');
-        commands.push(`  echo "No cache found for key: ${this.escapeBash(cacheKey)}"`);
+        commands.push('  echo "No cache found for key: $CACHE_KEY"');
         commands.push('  echo "CACHE_SOURCE=cold"');
         commands.push('fi');
         // Closes the daemon/filesystem transport split.
@@ -766,7 +784,6 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         const ignoreCheckOnPaths = this.getInput(inputs, 'ignore_check_on_paths', false);
         const commands = [];
         commands.push('# Cache Push');
-        commands.push(`echo "Cache key: ${this.escapeBash(cacheKey)}"`);
         // Create cache directory if it doesn't exist
         commands.push('');
         commands.push('# Ensure cache directory exists');
@@ -776,14 +793,20 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         // longer mounted into the VM — an unconditional mkdir would abort the
         // whole step under errexit.
         commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
+        // Project scope — must match the pull side exactly, or a push writes a
+        // tarball no pull can ever find. See the note there for why an explicit
+        // key needs the repo identity prefixed.
+        commands.push('');
+        commands.push(...emitProjectScopeCommands());
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
         // CACHE_KEY first, CACHE_FILE derived from it — exactly as the pull side
         // does. This step used to set only CACHE_FILE while the daemon URL below
         // interpolated `$CACHE_KEY`; see emitDaemonPushCommands.
-        commands.push(`CACHE_KEY="${this.escapeBash(cacheKey)}"`);
+        commands.push(`CACHE_KEY="\${__ci_proj}-${this.escapeBash(cacheKey)}"`);
         commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
+        commands.push('echo "Cache key: $CACHE_KEY"');
         if (isDebugMode) {
             commands.push('echo "Debug mode enabled"');
             commands.push('echo "Cache file: $CACHE_FILE"');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.6.3",
+  "version": "2.6.4",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",