@invarn/cibuild 2.6.3 → 2.6.5

package/dist/src/yaml/preflight-validation.d.ts

@@ -1,8 +1,16 @@
 /**
- * Pre-flight validation for mandatory workflow requirements
- * Validates repository access before workflow execution begins
+ * Pre-flight validation hook that runs before any workflow step executes.
+ *
+ * It no longer checks anything. The checks it used to carry — that
+ * CIBUILD_GIT_REPOSITORY_URL is set and reachable, and that activate-ssh-key
+ * precedes git-clone — assumed cibuild would clone the repository itself. It
+ * does not: the source is already on disk when a pipeline runs (a runner
+ * checks out the dispatched commit before cibuild starts; locally it is the
+ * working copy), so there is no remote to validate before execution. The
+ * class and its `validate()` signature are kept so the call site in
+ * pipeline-with-secrets.ts is unchanged.
  */
-import { MissingEnvironmentVariableError } from './env-resolver.js';
+import type { MissingEnvironmentVariableError } from './env-resolver.js';
 import type { SecretsManager } from './secrets-manager.js';
 import type { YAMLWorkflow } from './types.js';
 /**
@@ -12,28 +20,9 @@ export interface PreFlightResult {
     success: boolean;
     error?: MissingEnvironmentVariableError;
 }
-/**
- * Validates that required environment variables exist and repository is accessible
- * This runs before any workflow steps execute
- */
 export declare class PreFlightValidator {
     /**
-     * Check if workflow has activate-ssh-key step before git-clone
-     * @param workflow The workflow to check
-     * @returns True if SSH key setup is in the workflow
-     */
-    private hasSSHKeySetup;
-    /**
-     * Validates CIBUILD_GIT_REPOSITORY_URL exists and is accessible
-     * @param env Environment variables
-     * @param secretsManager Secrets manager to check for stored secrets
-     * @param workflow The workflow to check for SSH key setup
-     * @returns Validation result
-     */
-    validateRepositoryAccess(env: Record<string, string>, secretsManager?: SecretsManager, workflow?: YAMLWorkflow): Promise<PreFlightResult>;
-    /**
-     * Run all pre-flight validations
-     * git-clone now uses the local checkout — no remote URL or connectivity check needed.
+     * Run all pre-flight validations. Always succeeds — see the file comment.
      */
     validate(_env: Record<string, string>, _secretsManager?: SecretsManager, _workflow?: YAMLWorkflow): Promise<PreFlightResult>;
 }

package/dist/src/yaml/preflight-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preflight-validation.d.ts","sourceRoot":"","sources":["../../../src/yaml/preflight-validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,+BAA+B,CAAC;CACzC;AAED;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B;;;;OAIG;IACH,OAAO,CAAC,cAAc;IA0BtB;;;;;;OAMG;IACG,wBAAwB,CAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,cAAc,CAAC,EAAE,cAAc,EAC/B,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,eAAe,CAAC;IA2H3B;;;OAGG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,eAAe,CAAC,EAAE,cAAc,EAChC,SAAS,CAAC,EAAE,YAAY,GACvB,OAAO,CAAC,eAAe,CAAC;CAG5B"}
+{"version":3,"file":"preflight-validation.d.ts","sourceRoot":"","sources":["../../../src/yaml/preflight-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,+BAA+B,CAAC;CACzC;AAED,qBAAa,kBAAkB;IAC7B;;OAEG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,eAAe,CAAC,EAAE,cAAc,EAChC,SAAS,CAAC,EAAE,YAAY,GACvB,OAAO,CAAC,eAAe,CAAC;CAG5B"}

package/dist/src/yaml/preflight-validation.js

@@ -1,149 +1,18 @@
 /**
- * Pre-flight validation for mandatory workflow requirements
- * Validates repository access before workflow execution begins
- */
-import { execSync } from 'child_process';
-import { MissingEnvironmentVariableError } from './env-resolver.js';
-/**
- * Validates that required environment variables exist and repository is accessible
- * This runs before any workflow steps execute
+ * Pre-flight validation hook that runs before any workflow step executes.
+ *
+ * It no longer checks anything. The checks it used to carry — that
+ * CIBUILD_GIT_REPOSITORY_URL is set and reachable, and that activate-ssh-key
+ * precedes git-clone — assumed cibuild would clone the repository itself. It
+ * does not: the source is already on disk when a pipeline runs (a runner
+ * checks out the dispatched commit before cibuild starts; locally it is the
+ * working copy), so there is no remote to validate before execution. The
+ * class and its `validate()` signature are kept so the call site in
+ * pipeline-with-secrets.ts is unchanged.
  */
 export class PreFlightValidator {
     /**
-     * Check if workflow has activate-ssh-key step before git-clone
-     * @param workflow The workflow to check
-     * @returns True if SSH key setup is in the workflow
-     */
-    hasSSHKeySetup(workflow) {
-        if (!workflow.steps || workflow.steps.length === 0) {
-            return false;
-        }
-        let foundSSHKeyStep = false;
-        for (const step of workflow.steps) {
-            // Step can be an object with step name as key
-            const stepName = typeof step === 'string' ? step : Object.keys(step)[0];
-            // Check for git-clone step first - if we hit it before finding SSH key, return false
-            if (stepName.startsWith('git-clone')) {
-                return foundSSHKeyStep; // Return true only if we found SSH key before this
-            }
-            // Check for activate-ssh-key step
-            if (stepName.startsWith('activate-ssh-key')) {
-                foundSSHKeyStep = true;
-            }
-        }
-        // If we got here, no git-clone step was found, so return if SSH key exists
-        return foundSSHKeyStep;
-    }
-    /**
-     * Validates CIBUILD_GIT_REPOSITORY_URL exists and is accessible
-     * @param env Environment variables
-     * @param secretsManager Secrets manager to check for stored secrets
-     * @param workflow The workflow to check for SSH key setup
-     * @returns Validation result
-     */
-    async validateRepositoryAccess(env, secretsManager, workflow) {
-        // Check environment variables first, then secrets manager
-        let repoUrl = env.CIBUILD_GIT_REPOSITORY_URL || env.GIT_REPOSITORY_URL || '';
-        // If not in env, check secrets manager
-        if ((!repoUrl || repoUrl.trim() === '') && secretsManager) {
-            const secretId = secretsManager.getSecretIdByName('CIBUILD_GIT_REPOSITORY_URL');
-            if (secretId) {
-                repoUrl = secretsManager.getSecret(secretId) || '';
-            }
-        }
-        // Check if repository URL is provided
-        if (!repoUrl || repoUrl.trim() === '') {
-            return {
-                success: false,
-                error: new MissingEnvironmentVariableError('CIBUILD_GIT_REPOSITORY_URL', 'preflight-validation', 'Git repository URL for cloning source code in CI/CD builds.\n\n' +
-                    'Expected format:\n' +
-                    '  ┌────────────────────────────────────────────────────────┐\n' +
-                    '  │ https://github.com/username/repository.git             │\n' +
-                    '  │ git@github.com:username/repository.git                 │\n' +
-                    '  │ https://gitlab.com/username/repository.git             │\n' +
-                    '  └────────────────────────────────────────────────────────┘\n\n' +
-                    'How to set it:\n' +
-                    '  • Environment variable: GIT_REPOSITORY_URL=<your-repo-url>\n' +
-                    '  • In YAML inputs: repository: <your-repo-url>\n' +
-                    '  • CI platform automatically provides this in most cases'),
-            };
-        }
-        // If the workflow uses activate-ssh-key, skip connectivity test entirely.
-        // SSH authentication isn't available pre-execution, so any network test would fail
-        // for private repos regardless of whether the URL is SSH or HTTPS format.
-        const hasSSHKeyInWorkflow = workflow ? this.hasSSHKeySetup(workflow) : false;
-        if (hasSSHKeyInWorkflow) {
-            console.log('🔍 Pre-flight: Validating repository URL...');
-            console.log(`   Repository: ${repoUrl}`);
-            console.log('   SSH authentication will be configured by activate-ssh-key step');
-            console.log('✅ Pre-flight: Repository URL validated (connectivity test skipped)\n');
-            return { success: true };
-        }
-        // Test repository connectivity using git ls-remote
-        try {
-            console.log('🔍 Pre-flight: Validating repository access...');
-            console.log(`   Repository: ${repoUrl}`);
-            // Execute git ls-remote to check if repository is accessible
-            // This command lists remote references without cloning
-            // Timeout after 10 seconds to prevent hanging
-            execSync(`git ls-remote "${repoUrl}" HEAD`, {
-                stdio: 'pipe',
-                timeout: 10000,
-                encoding: 'utf-8',
-            });
-            console.log('✅ Pre-flight: Repository is accessible\n');
-            return { success: true };
-        }
-        catch (error) {
-            // Repository is not accessible - analyze the error
-            const errorMessage = error.message || String(error);
-            console.log(`❌ Pre-flight: Repository access failed`);
-            console.log(`   Error: ${errorMessage}\n`);
-            // Check if this is an SSH authentication error
-            const isSSHAuthError = errorMessage.includes('Permission denied') &&
-                errorMessage.includes('publickey');
-            const isSSHUrl = repoUrl.startsWith('git@') || repoUrl.includes('ssh://');
-            if (isSSHAuthError || (isSSHUrl && errorMessage.includes('Could not read from remote'))) {
-                // SSH authentication is the issue, not the repository URL
-                console.log('⚠️  Repository URL is valid, but SSH authentication is required.\n');
-                console.log('Please ensure:');
-                console.log('  1. SSH key is configured in your workflow (activate-ssh-key step)');
-                console.log('  2. SSH key has access to this repository');
-                console.log('  3. SSH key is added to your GitHub/GitLab account\n');
-                throw new Error('Pre-flight validation failed: SSH authentication required.\n\n' +
-                    `Repository: ${repoUrl}\n\n` +
-                    'The repository URL is valid but requires SSH authentication.\n' +
-                    'Make sure your workflow includes an "activate-ssh-key" step before "git-clone".\n\n' +
-                    'Example workflow:\n' +
-                    '  steps:\n' +
-                    '    - activate-ssh-key@4:  # Add SSH key first\n' +
-                    '        inputs:\n' +
-                    '          ssh_key_save_path: $HOME/.ssh/bitrise_rsa\n' +
-                    '    - git-clone@6:         # Then clone\n\n' +
-                    `Error details: ${errorMessage}`);
-            }
-            // For other errors (invalid URL, network issues, etc.), return error
-            return {
-                success: false,
-                error: new MissingEnvironmentVariableError('CIBUILD_GIT_REPOSITORY_URL', 'preflight-validation', 'Git repository URL validation failed. The repository is not accessible.\n\n' +
-                    'Expected format:\n' +
-                    '  ┌────────────────────────────────────────────────────────┐\n' +
-                    '  │ https://github.com/username/repository.git             │\n' +
-                    '  │ git@github.com:username/repository.git                 │\n' +
-                    '  │ https://gitlab.com/username/repository.git             │\n' +
-                    '  └────────────────────────────────────────────────────────┘\n\n' +
-                    'Common issues:\n' +
-                    '  • Invalid repository URL\n' +
-                    '  • Network connectivity issues\n' +
-                    '  • Repository does not exist or is private\n' +
-                    '  • Wrong URL format (check for typos)\n\n' +
-                    `Error details: ${errorMessage}`),
-            };
-        }
-    }
-    /**
-     * Run all pre-flight validations
-     * git-clone now uses the local checkout — no remote URL or connectivity check needed.
+     * Run all pre-flight validations. Always succeeds — see the file comment.
      */
     async validate(_env, _secretsManager, _workflow) {
         return { success: true };

package/dist/src/yaml/steps/cache-pull-daemon.test.js

@@ -25,6 +25,7 @@
  */
 import { describe, test, expect } from '@jest/globals';
 import { execFile } from 'child_process';
+import { createHash } from 'crypto';
 import { mkdtempSync, writeFileSync, rmSync, mkdirSync, chmodSync } from 'fs';
 import { createServer } from 'http';
 import { join } from 'path';
@@ -40,6 +41,14 @@ import { testConfigNoPeer } from './test-config.js';
  */
 const run = promisify(execFile);
 const CACHE_KEY = 'pods-abc123def456-release-1.4';
+/**
+ * An explicit `cache_key` is prefixed with a project scope so two repositories
+ * writing the same key don't share a tarball. These fixtures run outside a git
+ * remote, so the step's shell hashes the literal `"no-remote"` — derived here
+ * rather than pasted, so it tracks the step.
+ */
+const PROJECT_SCOPE = createHash('sha256').update('no-remote', 'utf8').digest('hex').slice(0, 8);
+const SCOPED_CACHE_KEY = `${PROJECT_SCOPE}-${CACHE_KEY}`;
 async function listen(handler, paths) {
     const server = createServer((req, res) => {
         const path = req.url ?? '/';
@@ -145,8 +154,8 @@ describe('cache-pull with an explicit key, over the daemon', () => {
         // 404 is the daemon's answer for `cache_miss`. The normal case on any
         // first build: it must not start printing warnings.
         const { stdout, paths } = await runPull({ keyStatus: 404 });
-        expect(paths).toEqual([`/cache/${CACHE_KEY}.tar.zst`]);
-        expect(stdout).toContain(`No cache found for key: ${CACHE_KEY}`);
+        expect(paths).toEqual([`/cache/${SCOPED_CACHE_KEY}.tar.zst`]);
+        expect(stdout).toContain(`No cache found for key: ${SCOPED_CACHE_KEY}`);
         expect(stdout).toContain('CACHE_SOURCE=cold');
         expect(stdout).not.toContain('Warning');
     });

package/dist/src/yaml/steps/cache-pull-restore-roots.test.js

@@ -40,6 +40,7 @@
  */
 import { describe, test, expect } from '@jest/globals';
 import { execFile } from 'child_process';
+import { createHash } from 'crypto';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, realpathSync, rmSync, chmodSync, } from 'fs';
 import { join } from 'path';
 import { tmpdir } from 'os';
@@ -48,6 +49,14 @@ import { CachePullStepExecutor } from './cache.js';
 import { testConfigNoPeer } from './test-config.js';
 const run = promisify(execFile);
 const CACHE_KEY = 'gradle-abc123def456-fingerprint';
+/**
+ * An explicit `cache_key` is prefixed with a project scope so two repositories
+ * that write the same key don't share one tarball. These fixtures run outside a
+ * git remote, so the step's shell falls back to hashing the literal
+ * `"no-remote"` — derived here rather than pasted, so it tracks the step.
+ */
+const PROJECT_SCOPE = createHash('sha256').update('no-remote', 'utf8').digest('hex').slice(0, 8);
+const SCOPED_CACHE_KEY = `${PROJECT_SCOPE}-${CACHE_KEY}`;
 async function restore(shape) {
     // Resolved: see the header — tar will not extract through a symlink, and on
     // macOS the temp root sits behind one.
@@ -83,7 +92,7 @@ async function restore(shape) {
         // `tar -cf - "${PATHS_TO_CACHE[@]}"` produces.
         const cacheDir = join(checkout, '.ci-cache');
         mkdirSync(cacheDir, { recursive: true });
-        const tarball = join(cacheDir, `${CACHE_KEY}.tar.zst`);
+        const tarball = join(cacheDir, `${SCOPED_CACHE_KEY}.tar.zst`);
         await run('tar', ['-cf', tarball, ...operands], { cwd: checkout });
         // Remove the originals: "it landed" is only meaningful if it was gone.
         for (const l of landings)

package/dist/src/yaml/steps/cache-push-daemon.test.js

@@ -25,12 +25,21 @@
  */
 import { describe, test, expect } from '@jest/globals';
 import { execFileSync } from 'child_process';
+import { createHash } from 'crypto';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, existsSync, chmodSync } from 'fs';
 import { join } from 'path';
 import { tmpdir } from 'os';
 import { CachePushStepExecutor } from './cache.js';
 import { testConfigNoPeer } from './test-config.js';
 const CACHE_KEY = 'pods-abc123def456-main';
+/**
+ * An explicit `cache_key` is prefixed with a project scope so two repositories
+ * writing the same key don't share a tarball. These fixtures run outside a git
+ * remote, so the step's shell hashes the literal `"no-remote"` — derived here
+ * rather than pasted, so it tracks the step.
+ */
+const PROJECT_SCOPE = createHash('sha256').update('no-remote', 'utf8').digest('hex').slice(0, 8);
+const SCOPED_CACHE_KEY = `${PROJECT_SCOPE}-${CACHE_KEY}`;
 /**
  * Generates the explicit-key push step, runs it, and reports what `curl` was
  * actually asked to do.
@@ -107,7 +116,7 @@ describe('cache-push with an explicit key, over the daemon', () => {
     test('uploads under the key it was given', async () => {
         const { urls } = await runPush();
         expect(urls).toHaveLength(1);
-        expect(urls[0]).toBe(`http://daemon.invalid/cache/${CACHE_KEY}.tar.zst`);
+        expect(urls[0]).toBe(`http://daemon.invalid/cache/${SCOPED_CACHE_KEY}.tar.zst`);
     });
     test('never uploads to an empty key', async () => {
         // The defect, named. `<daemon>/cache/.tar.zst` is what an unassigned

package/dist/src/yaml/steps/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AAubF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAmIzF,iBAAiB;CAkNhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAqKzF,iBAAiB;CAgJhC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAkBxD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,4HAA4H;IAC5H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAUrD,CAAC;AA4bF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YAiJzF,iBAAiB;CAkNhC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACnD,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;YA2KzF,iBAAiB;CAgJhC"}

package/dist/src/yaml/steps/cache.js

@@ -36,7 +36,12 @@ export const CACHE_PRESETS = {
 function emitProjectScopeCommands() {
     return [
         '__ci_git_remote=$(git config --get remote.origin.url 2>/dev/null | sed -E "s#(://)[^@/]+@#\\1#" || echo "no-remote")',
-        '__ci_proj=$(printf "%s" "${__ci_git_remote:-no-remote}" | shasum -a 256 | cut -c1-8)',
+        // `shasum` is Perl-provided and is not guaranteed on a slim Linux image;
+        // `sha256sum` is coreutils and is absent from macOS. Both print
+        // `<hex>  -`, so either yields the same 8-char project id — which is what
+        // keeps this byte-identical to `deriveProjectId` in the runner.
+        '__ci_sha256() { if command -v shasum >/dev/null 2>&1; then shasum -a 256; else sha256sum; fi; }',
+        '__ci_proj=$(printf "%s" "${__ci_git_remote:-no-remote}" | __ci_sha256 | cut -c1-8)',
     ];
 }
 /**
@@ -458,7 +463,6 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         const isDebugMode = this.getInput(inputs, 'is_debug_mode', false);
         const commands = [];
         commands.push('# Cache Pull');
-        commands.push(`echo "Cache key: ${this.escapeBash(cacheKey)}"`);
         // Create cache directory if it doesn't exist
         commands.push('');
         commands.push('# Ensure cache directory exists');
@@ -468,11 +472,25 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         // longer mounted into the VM — an unconditional mkdir would abort the
         // whole step under errexit.
         commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
+        // Project scope: an explicit `cache_key` is author-written and carries no
+        // repo identity, so two projects that happen to write the same key (e.g.
+        // `gradle-{{checksum "gradle/wrapper/gradle-wrapper.properties"}}`, which
+        // depends only on the Gradle version) would share one tarball on a shared
+        // runner. Prefixing the project id keeps each repo's cache its own.
+        //
+        // The id goes at the FRONT, deliberately. The preset path spells its key
+        // `<keyPrefix>-<projectId>-<checksum>`, and that middle-segment shape is
+        // load-bearing elsewhere: it is how a scope is recovered from a tarball
+        // filename. An explicit key is author-written and must stay outside the
+        // scope model, so it must not be able to imitate that shape by accident.
+        commands.push('');
+        commands.push(...emitProjectScopeCommands());
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
-        commands.push(`CACHE_KEY="${this.escapeBash(cacheKey)}"`);
+        commands.push(`CACHE_KEY="\${__ci_proj}-${this.escapeBash(cacheKey)}"`);
         commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
+        commands.push('echo "Cache key: $CACHE_KEY"');
         if (isDebugMode) {
             commands.push('echo "Debug mode enabled"');
             commands.push('echo "Cache file: $CACHE_FILE"');
@@ -482,7 +500,7 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         if (peerCacheDir) {
             commands.push('');
             commands.push(`PEER_CACHE_DIR="${this.escapeBash(peerCacheDir)}"`);
-            commands.push(`PEER_CACHE_FILE="$PEER_CACHE_DIR/${this.escapeBash(cacheKey)}.tar.zst"`);
+            commands.push('PEER_CACHE_FILE="$PEER_CACHE_DIR/$CACHE_KEY.tar.zst"');
         }
         // Where each class of member is restored to. Emitted before every
         // transport, because all of them extract.
@@ -501,7 +519,7 @@ export class CachePullStepExecutor extends BaseStepExecutor {
         commands.push('    echo "CACHE_SOURCE=daemon"');
         commands.push('  else');
         commands.push(...emitDaemonPullFailureDiagnosis('    ', '$CACHE_KEY'));
-        commands.push(`    echo "No cache found for key: ${this.escapeBash(cacheKey)}"`);
+        commands.push('    echo "No cache found for key: $CACHE_KEY"');
         commands.push('    echo "CACHE_SOURCE=cold"');
         commands.push('  fi');
         commands.push('  rm -f "$__ci_cache_diag"');
@@ -522,7 +540,7 @@ export class CachePullStepExecutor extends BaseStepExecutor {
             commands.push('  echo "CACHE_SOURCE=peer"');
         }
         commands.push('else');
-        commands.push(`  echo "No cache found for key: ${this.escapeBash(cacheKey)}"`);
+        commands.push('  echo "No cache found for key: $CACHE_KEY"');
         commands.push('  echo "CACHE_SOURCE=cold"');
         commands.push('fi');
         // Closes the daemon/filesystem transport split.
@@ -766,7 +784,6 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         const ignoreCheckOnPaths = this.getInput(inputs, 'ignore_check_on_paths', false);
         const commands = [];
         commands.push('# Cache Push');
-        commands.push(`echo "Cache key: ${this.escapeBash(cacheKey)}"`);
         // Create cache directory if it doesn't exist
         commands.push('');
         commands.push('# Ensure cache directory exists');
@@ -776,14 +793,20 @@ export class CachePushStepExecutor extends BaseStepExecutor {
         // longer mounted into the VM — an unconditional mkdir would abort the
         // whole step under errexit.
         commands.push('[ -n "$CIBUILD_CACHE_DAEMON" ] || mkdir -p "$CACHE_DIR"');
+        // Project scope — must match the pull side exactly, or a push writes a
+        // tarball no pull can ever find. See the note there for why an explicit
+        // key needs the repo identity prefixed.
+        commands.push('');
+        commands.push(...emitProjectScopeCommands());
         // Generate cache file name based on cache key
         commands.push('');
         commands.push('# Generate cache file path');
         // CACHE_KEY first, CACHE_FILE derived from it — exactly as the pull side
         // does. This step used to set only CACHE_FILE while the daemon URL below
         // interpolated `$CACHE_KEY`; see emitDaemonPushCommands.
-        commands.push(`CACHE_KEY="${this.escapeBash(cacheKey)}"`);
+        commands.push(`CACHE_KEY="\${__ci_proj}-${this.escapeBash(cacheKey)}"`);
         commands.push('CACHE_FILE="$CACHE_DIR/$CACHE_KEY.tar.zst"');
+        commands.push('echo "Cache key: $CACHE_KEY"');
         if (isDebugMode) {
             commands.push('echo "Debug mode enabled"');
             commands.push('echo "Cache file: $CACHE_FILE"');

package/dist/src/yaml/steps/git-clone.d.ts

@@ -15,8 +15,14 @@ export interface GitCloneInputs {
     clone_into_dir?: string;
 }
 /**
- * Git clone step executor
- * Clones a git repository with optional branch and depth settings
+ * git-clone step executor.
+ *
+ * Does not clone. The source is already on disk when this runs — on a runner
+ * the dispatched commit was checked out before cibuild started (see
+ * cibuild-runner's GitCloneRunner); locally it is the developer's working copy.
+ * The step locates that checkout and republishes its commit metadata. Every
+ * input in GitCloneInputs is accepted so existing YAML keeps parsing, and none
+ * of them is read.
  */
 export declare class GitCloneStepExecutor extends BaseStepExecutor {
     getValidationRequirements(_inputs: GitCloneInputs, _env: Record<string, string>, _config: CIConfig): ValidationRequirement[];

package/dist/src/yaml/steps/git-clone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-clone.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-clone.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;IACxD,yBAAyB,CACvB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAU1B,UAAU,IAAI,UAAU,EAAE;IAkDpB,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAqD1G"}
+{"version":3,"file":"git-clone.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-clone.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;IACxD,yBAAyB,CACvB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAU1B,UAAU,IAAI,UAAU,EAAE;IAkDpB,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAqD1G"}

package/dist/src/yaml/steps/git-clone.js

@@ -3,8 +3,14 @@
  */
 import { BaseStepExecutor } from './base.js';
 /**
- * Git clone step executor
- * Clones a git repository with optional branch and depth settings
+ * git-clone step executor.
+ *
+ * Does not clone. The source is already on disk when this runs — on a runner
+ * the dispatched commit was checked out before cibuild started (see
+ * cibuild-runner's GitCloneRunner); locally it is the developer's working copy.
+ * The step locates that checkout and republishes its commit metadata. Every
+ * input in GitCloneInputs is accepted so existing YAML keeps parsing, and none
+ * of them is read.
  */
 export class GitCloneStepExecutor extends BaseStepExecutor {
     getValidationRequirements(_inputs, _env, _config) {

package/dist/src/yaml/steps/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4CH;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAq7C7C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4CH;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CA07C7C"}

package/dist/src/yaml/steps/index.js

@@ -32,28 +32,32 @@ import { UiFidelityRenderAndroidStepExecutor, DEFAULT_GRADLE_TASK, DEFAULT_PACKA
  */
 export function initializeStepRegistry() {
     // Git steps
+    // Does not clone. The source is already on disk when any step runs — on a
+    // runner the dispatched commit is checked out before cibuild starts; locally
+    // it is the developer's working copy. The inputs are kept so existing YAML
+    // keeps parsing; the executor never reads them.
     registerStep('git-clone', new GitCloneStepExecutor(), {
         name: 'git-clone',
-        description: 'Clone a git repository',
+        description: 'Locate the source checkout already on disk and record its commit. Does not clone — on a runner the dispatched commit is checked out before any step runs; locally it is your working copy. Inputs are ignored.',
         platform: 'all',
         inputs: {
             repository: {
-                description: 'Git repository URL',
+                description: 'Ignored — no clone is performed; the checkout already exists',
                 required: false,
                 default: '$CIBUILD_GIT_REPOSITORY_URL',
             },
             branch: {
-                description: 'Git branch to clone',
+                description: 'Ignored — on a runner the dispatched ref is checked out, not this value',
                 required: false,
                 default: '$CIBUILD_GIT_BRANCH or main',
             },
             clone_depth: {
-                description: 'Clone depth (0 for full clone)',
+                description: 'Ignored — no clone is performed; a runner checkout is always depth 1',
                 required: false,
                 default: 0,
             },
             clone_into_dir: {
-                description: 'Directory to clone into',
+                description: 'Ignored — the checkout location is not chosen by this step',
                 required: false,
                 default: '.',
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.6.3",
+  "version": "2.6.5",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",