@invarn/cibuild 2.6.4 → 2.6.5

package/dist/src/yaml/preflight-validation.d.ts

@@ -1,8 +1,16 @@
 /**
- * Pre-flight validation for mandatory workflow requirements
- * Validates repository access before workflow execution begins
+ * Pre-flight validation hook that runs before any workflow step executes.
+ *
+ * It no longer checks anything. The checks it used to carry — that
+ * CIBUILD_GIT_REPOSITORY_URL is set and reachable, and that activate-ssh-key
+ * precedes git-clone — assumed cibuild would clone the repository itself. It
+ * does not: the source is already on disk when a pipeline runs (a runner
+ * checks out the dispatched commit before cibuild starts; locally it is the
+ * working copy), so there is no remote to validate before execution. The
+ * class and its `validate()` signature are kept so the call site in
+ * pipeline-with-secrets.ts is unchanged.
  */
-import { MissingEnvironmentVariableError } from './env-resolver.js';
+import type { MissingEnvironmentVariableError } from './env-resolver.js';
 import type { SecretsManager } from './secrets-manager.js';
 import type { YAMLWorkflow } from './types.js';
 /**
@@ -12,28 +20,9 @@ export interface PreFlightResult {
     success: boolean;
     error?: MissingEnvironmentVariableError;
 }
-/**
- * Validates that required environment variables exist and repository is accessible
- * This runs before any workflow steps execute
- */
 export declare class PreFlightValidator {
     /**
-     * Check if workflow has activate-ssh-key step before git-clone
-     * @param workflow The workflow to check
-     * @returns True if SSH key setup is in the workflow
-     */
-    private hasSSHKeySetup;
-    /**
-     * Validates CIBUILD_GIT_REPOSITORY_URL exists and is accessible
-     * @param env Environment variables
-     * @param secretsManager Secrets manager to check for stored secrets
-     * @param workflow The workflow to check for SSH key setup
-     * @returns Validation result
-     */
-    validateRepositoryAccess(env: Record<string, string>, secretsManager?: SecretsManager, workflow?: YAMLWorkflow): Promise<PreFlightResult>;
-    /**
-     * Run all pre-flight validations
-     * git-clone now uses the local checkout — no remote URL or connectivity check needed.
+     * Run all pre-flight validations. Always succeeds — see the file comment.
      */
     validate(_env: Record<string, string>, _secretsManager?: SecretsManager, _workflow?: YAMLWorkflow): Promise<PreFlightResult>;
 }

package/dist/src/yaml/preflight-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preflight-validation.d.ts","sourceRoot":"","sources":["../../../src/yaml/preflight-validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,+BAA+B,CAAC;CACzC;AAED;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B;;;;OAIG;IACH,OAAO,CAAC,cAAc;IA0BtB;;;;;;OAMG;IACG,wBAAwB,CAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,cAAc,CAAC,EAAE,cAAc,EAC/B,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,eAAe,CAAC;IA2H3B;;;OAGG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,eAAe,CAAC,EAAE,cAAc,EAChC,SAAS,CAAC,EAAE,YAAY,GACvB,OAAO,CAAC,eAAe,CAAC;CAG5B"}
+{"version":3,"file":"preflight-validation.d.ts","sourceRoot":"","sources":["../../../src/yaml/preflight-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,+BAA+B,CAAC;CACzC;AAED,qBAAa,kBAAkB;IAC7B;;OAEG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,eAAe,CAAC,EAAE,cAAc,EAChC,SAAS,CAAC,EAAE,YAAY,GACvB,OAAO,CAAC,eAAe,CAAC;CAG5B"}

package/dist/src/yaml/preflight-validation.js

@@ -1,149 +1,18 @@
 /**
- * Pre-flight validation for mandatory workflow requirements
- * Validates repository access before workflow execution begins
- */
-import { execSync } from 'child_process';
-import { MissingEnvironmentVariableError } from './env-resolver.js';
-/**
- * Validates that required environment variables exist and repository is accessible
- * This runs before any workflow steps execute
+ * Pre-flight validation hook that runs before any workflow step executes.
+ *
+ * It no longer checks anything. The checks it used to carry — that
+ * CIBUILD_GIT_REPOSITORY_URL is set and reachable, and that activate-ssh-key
+ * precedes git-clone — assumed cibuild would clone the repository itself. It
+ * does not: the source is already on disk when a pipeline runs (a runner
+ * checks out the dispatched commit before cibuild starts; locally it is the
+ * working copy), so there is no remote to validate before execution. The
+ * class and its `validate()` signature are kept so the call site in
+ * pipeline-with-secrets.ts is unchanged.
  */
 export class PreFlightValidator {
     /**
-     * Check if workflow has activate-ssh-key step before git-clone
-     * @param workflow The workflow to check
-     * @returns True if SSH key setup is in the workflow
-     */
-    hasSSHKeySetup(workflow) {
-        if (!workflow.steps || workflow.steps.length === 0) {
-            return false;
-        }
-        let foundSSHKeyStep = false;
-        for (const step of workflow.steps) {
-            // Step can be an object with step name as key
-            const stepName = typeof step === 'string' ? step : Object.keys(step)[0];
-            // Check for git-clone step first - if we hit it before finding SSH key, return false
-            if (stepName.startsWith('git-clone')) {
-                return foundSSHKeyStep; // Return true only if we found SSH key before this
-            }
-            // Check for activate-ssh-key step
-            if (stepName.startsWith('activate-ssh-key')) {
-                foundSSHKeyStep = true;
-            }
-        }
-        // If we got here, no git-clone step was found, so return if SSH key exists
-        return foundSSHKeyStep;
-    }
-    /**
-     * Validates CIBUILD_GIT_REPOSITORY_URL exists and is accessible
-     * @param env Environment variables
-     * @param secretsManager Secrets manager to check for stored secrets
-     * @param workflow The workflow to check for SSH key setup
-     * @returns Validation result
-     */
-    async validateRepositoryAccess(env, secretsManager, workflow) {
-        // Check environment variables first, then secrets manager
-        let repoUrl = env.CIBUILD_GIT_REPOSITORY_URL || env.GIT_REPOSITORY_URL || '';
-        // If not in env, check secrets manager
-        if ((!repoUrl || repoUrl.trim() === '') && secretsManager) {
-            const secretId = secretsManager.getSecretIdByName('CIBUILD_GIT_REPOSITORY_URL');
-            if (secretId) {
-                repoUrl = secretsManager.getSecret(secretId) || '';
-            }
-        }
-        // Check if repository URL is provided
-        if (!repoUrl || repoUrl.trim() === '') {
-            return {
-                success: false,
-                error: new MissingEnvironmentVariableError('CIBUILD_GIT_REPOSITORY_URL', 'preflight-validation', 'Git repository URL for cloning source code in CI/CD builds.\n\n' +
-                    'Expected format:\n' +
-                    '  ┌────────────────────────────────────────────────────────┐\n' +
-                    '  │ https://github.com/username/repository.git             │\n' +
-                    '  │ git@github.com:username/repository.git                 │\n' +
-                    '  │ https://gitlab.com/username/repository.git             │\n' +
-                    '  └────────────────────────────────────────────────────────┘\n\n' +
-                    'How to set it:\n' +
-                    '  • Environment variable: GIT_REPOSITORY_URL=<your-repo-url>\n' +
-                    '  • In YAML inputs: repository: <your-repo-url>\n' +
-                    '  • CI platform automatically provides this in most cases'),
-            };
-        }
-        // If the workflow uses activate-ssh-key, skip connectivity test entirely.
-        // SSH authentication isn't available pre-execution, so any network test would fail
-        // for private repos regardless of whether the URL is SSH or HTTPS format.
-        const hasSSHKeyInWorkflow = workflow ? this.hasSSHKeySetup(workflow) : false;
-        if (hasSSHKeyInWorkflow) {
-            console.log('🔍 Pre-flight: Validating repository URL...');
-            console.log(`   Repository: ${repoUrl}`);
-            console.log('   SSH authentication will be configured by activate-ssh-key step');
-            console.log('✅ Pre-flight: Repository URL validated (connectivity test skipped)\n');
-            return { success: true };
-        }
-        // Test repository connectivity using git ls-remote
-        try {
-            console.log('🔍 Pre-flight: Validating repository access...');
-            console.log(`   Repository: ${repoUrl}`);
-            // Execute git ls-remote to check if repository is accessible
-            // This command lists remote references without cloning
-            // Timeout after 10 seconds to prevent hanging
-            execSync(`git ls-remote "${repoUrl}" HEAD`, {
-                stdio: 'pipe',
-                timeout: 10000,
-                encoding: 'utf-8',
-            });
-            console.log('✅ Pre-flight: Repository is accessible\n');
-            return { success: true };
-        }
-        catch (error) {
-            // Repository is not accessible - analyze the error
-            const errorMessage = error.message || String(error);
-            console.log(`❌ Pre-flight: Repository access failed`);
-            console.log(`   Error: ${errorMessage}\n`);
-            // Check if this is an SSH authentication error
-            const isSSHAuthError = errorMessage.includes('Permission denied') &&
-                errorMessage.includes('publickey');
-            const isSSHUrl = repoUrl.startsWith('git@') || repoUrl.includes('ssh://');
-            if (isSSHAuthError || (isSSHUrl && errorMessage.includes('Could not read from remote'))) {
-                // SSH authentication is the issue, not the repository URL
-                console.log('⚠️  Repository URL is valid, but SSH authentication is required.\n');
-                console.log('Please ensure:');
-                console.log('  1. SSH key is configured in your workflow (activate-ssh-key step)');
-                console.log('  2. SSH key has access to this repository');
-                console.log('  3. SSH key is added to your GitHub/GitLab account\n');
-                throw new Error('Pre-flight validation failed: SSH authentication required.\n\n' +
-                    `Repository: ${repoUrl}\n\n` +
-                    'The repository URL is valid but requires SSH authentication.\n' +
-                    'Make sure your workflow includes an "activate-ssh-key" step before "git-clone".\n\n' +
-                    'Example workflow:\n' +
-                    '  steps:\n' +
-                    '    - activate-ssh-key@4:  # Add SSH key first\n' +
-                    '        inputs:\n' +
-                    '          ssh_key_save_path: $HOME/.ssh/bitrise_rsa\n' +
-                    '    - git-clone@6:         # Then clone\n\n' +
-                    `Error details: ${errorMessage}`);
-            }
-            // For other errors (invalid URL, network issues, etc.), return error
-            return {
-                success: false,
-                error: new MissingEnvironmentVariableError('CIBUILD_GIT_REPOSITORY_URL', 'preflight-validation', 'Git repository URL validation failed. The repository is not accessible.\n\n' +
-                    'Expected format:\n' +
-                    '  ┌────────────────────────────────────────────────────────┐\n' +
-                    '  │ https://github.com/username/repository.git             │\n' +
-                    '  │ git@github.com:username/repository.git                 │\n' +
-                    '  │ https://gitlab.com/username/repository.git             │\n' +
-                    '  └────────────────────────────────────────────────────────┘\n\n' +
-                    'Common issues:\n' +
-                    '  • Invalid repository URL\n' +
-                    '  • Network connectivity issues\n' +
-                    '  • Repository does not exist or is private\n' +
-                    '  • Wrong URL format (check for typos)\n\n' +
-                    `Error details: ${errorMessage}`),
-            };
-        }
-    }
-    /**
-     * Run all pre-flight validations
-     * git-clone now uses the local checkout — no remote URL or connectivity check needed.
+     * Run all pre-flight validations. Always succeeds — see the file comment.
      */
     async validate(_env, _secretsManager, _workflow) {
         return { success: true };

package/dist/src/yaml/steps/git-clone.d.ts

@@ -15,8 +15,14 @@ export interface GitCloneInputs {
     clone_into_dir?: string;
 }
 /**
- * Git clone step executor
- * Clones a git repository with optional branch and depth settings
+ * git-clone step executor.
+ *
+ * Does not clone. The source is already on disk when this runs — on a runner
+ * the dispatched commit was checked out before cibuild started (see
+ * cibuild-runner's GitCloneRunner); locally it is the developer's working copy.
+ * The step locates that checkout and republishes its commit metadata. Every
+ * input in GitCloneInputs is accepted so existing YAML keeps parsing, and none
+ * of them is read.
  */
 export declare class GitCloneStepExecutor extends BaseStepExecutor {
     getValidationRequirements(_inputs: GitCloneInputs, _env: Record<string, string>, _config: CIConfig): ValidationRequirement[];

package/dist/src/yaml/steps/git-clone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-clone.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-clone.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;IACxD,yBAAyB,CACvB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAU1B,UAAU,IAAI,UAAU,EAAE;IAkDpB,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAqD1G"}
+{"version":3,"file":"git-clone.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-clone.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;IACxD,yBAAyB,CACvB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAU1B,UAAU,IAAI,UAAU,EAAE;IAkDpB,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAqD1G"}

package/dist/src/yaml/steps/git-clone.js

@@ -3,8 +3,14 @@
  */
 import { BaseStepExecutor } from './base.js';
 /**
- * Git clone step executor
- * Clones a git repository with optional branch and depth settings
+ * git-clone step executor.
+ *
+ * Does not clone. The source is already on disk when this runs — on a runner
+ * the dispatched commit was checked out before cibuild started (see
+ * cibuild-runner's GitCloneRunner); locally it is the developer's working copy.
+ * The step locates that checkout and republishes its commit metadata. Every
+ * input in GitCloneInputs is accepted so existing YAML keeps parsing, and none
+ * of them is read.
  */
 export class GitCloneStepExecutor extends BaseStepExecutor {
     getValidationRequirements(_inputs, _env, _config) {

package/dist/src/yaml/steps/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4CH;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAq7C7C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4CH;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CA07C7C"}

package/dist/src/yaml/steps/index.js

@@ -32,28 +32,32 @@ import { UiFidelityRenderAndroidStepExecutor, DEFAULT_GRADLE_TASK, DEFAULT_PACKA
  */
 export function initializeStepRegistry() {
     // Git steps
+    // Does not clone. The source is already on disk when any step runs — on a
+    // runner the dispatched commit is checked out before cibuild starts; locally
+    // it is the developer's working copy. The inputs are kept so existing YAML
+    // keeps parsing; the executor never reads them.
     registerStep('git-clone', new GitCloneStepExecutor(), {
         name: 'git-clone',
-        description: 'Clone a git repository',
+        description: 'Locate the source checkout already on disk and record its commit. Does not clone — on a runner the dispatched commit is checked out before any step runs; locally it is your working copy. Inputs are ignored.',
         platform: 'all',
         inputs: {
             repository: {
-                description: 'Git repository URL',
+                description: 'Ignored — no clone is performed; the checkout already exists',
                 required: false,
                 default: '$CIBUILD_GIT_REPOSITORY_URL',
             },
             branch: {
-                description: 'Git branch to clone',
+                description: 'Ignored — on a runner the dispatched ref is checked out, not this value',
                 required: false,
                 default: '$CIBUILD_GIT_BRANCH or main',
             },
             clone_depth: {
-                description: 'Clone depth (0 for full clone)',
+                description: 'Ignored — no clone is performed; a runner checkout is always depth 1',
                 required: false,
                 default: 0,
             },
             clone_into_dir: {
-                description: 'Directory to clone into',
+                description: 'Ignored — the checkout location is not chosen by this step',
                 required: false,
                 default: '.',
             },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.6.4",
+  "version": "2.6.5",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",