@invarn/cibuild 2.6.4 → 2.6.6

package/dist/src/yaml/cache-key-missing-file.test.js

@@ -0,0 +1,116 @@
+/**
+ * A cache key that cannot be computed costs a cache, not a pipeline.
+ *
+ * `cache_key: pods-{{checksum "Podfile.lock"}}` in a repository with no
+ * Podfile.lock used to abort conversion, so the build died at `cache-pull`
+ * before compiling a single file — including in repositories that use Swift
+ * Package Manager and have no reason to own a CocoaPods lockfile at all.
+ * Every other step keeps the hard failure: a checksum in a real input is a
+ * value that step needs.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { convertYAMLToPipelineDef } from './converter.js';
+import { clearRegistry, registerStep } from './steps/registry.js';
+import { ScriptStepExecutor } from './steps/script.js';
+import { CachePullStepExecutor, CachePushStepExecutor } from './steps/cache.js';
+const mockConfig = {
+    artifactsDir: '/test/artifacts',
+    maxConcurrentJobs: 1,
+    paths: {
+        buildsDir: '/test/builds',
+        cacheDir: '/test/cache',
+        derivedDataDir: '/test/derived-data',
+    },
+    interpreters: {
+        bash: '/bin/bash',
+        python: 'python3',
+        ruby: 'ruby',
+        node: 'node',
+    },
+};
+let workdir;
+let previousCwd;
+beforeEach(() => {
+    clearRegistry();
+    registerStep('script', new ScriptStepExecutor());
+    registerStep('cache-pull', new CachePullStepExecutor());
+    registerStep('cache-push', new CachePushStepExecutor());
+    previousCwd = process.cwd();
+    workdir = mkdtempSync(join(tmpdir(), 'cibuild-checksum-'));
+    process.chdir(workdir);
+});
+afterEach(() => {
+    process.chdir(previousCwd);
+    rmSync(workdir, { recursive: true, force: true });
+    clearRegistry();
+});
+function pipelineWithPodsCache() {
+    return {
+        format_version: '1',
+        workflows: {
+            primary: {
+                steps: [
+                    {
+                        'cache-pull': {
+                            inputs: {
+                                cache_key: 'pods-{{checksum "Podfile.lock"}}',
+                                cache_paths: ['Pods'],
+                            },
+                        },
+                    },
+                    {
+                        script: {
+                            title: 'Build',
+                            inputs: { content: 'echo building' },
+                        },
+                    },
+                    {
+                        'cache-push': {
+                            inputs: {
+                                cache_key: 'pods-{{checksum "Podfile.lock"}}',
+                                cache_paths: ['Pods'],
+                            },
+                        },
+                    },
+                ],
+            },
+        },
+    };
+}
+describe('a cache key naming a file this repository does not have', () => {
+    test('skips the cache steps and keeps the build', async () => {
+        const result = await convertYAMLToPipelineDef(pipelineWithPodsCache(), mockConfig, 'primary');
+        expect(result.skippedSteps).toBe(2);
+        expect(Object.keys(result.pipeline.steps ?? {})).toHaveLength(1);
+        expect(result.warnings.join('\n')).toContain('Podfile.lock');
+        expect(result.warnings.join('\n')).toContain('uncached');
+    });
+    test('keeps the cache steps once the file is there', async () => {
+        writeFileSync(join(workdir, 'Podfile.lock'), 'PODFILE CHECKSUM: abc\n');
+        const result = await convertYAMLToPipelineDef(pipelineWithPodsCache(), mockConfig, 'primary');
+        expect(result.skippedSteps).toBe(0);
+        expect(Object.keys(result.pipeline.steps ?? {})).toHaveLength(3);
+    });
+    test('still fails a non-cache step whose checksum names a missing file', async () => {
+        const pipeline = {
+            format_version: '1',
+            workflows: {
+                primary: {
+                    steps: [
+                        {
+                            script: {
+                                title: 'Build',
+                                inputs: { content: 'echo {{checksum "Podfile.lock"}}' },
+                            },
+                        },
+                    ],
+                },
+            },
+        };
+        await expect(convertYAMLToPipelineDef(pipeline, mockConfig, 'primary')).rejects.toThrow('Podfile.lock');
+    });
+});
+//# sourceMappingURL=cache-key-missing-file.test.js.map

package/dist/src/yaml/converter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converter.d.ts","sourceRoot":"","sources":["../../../src/yaml/converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAW,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AAMzE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAkCD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM,EACrB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CA0I3B;AAwGD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,EAAE,CAEtE"}
+{"version":3,"file":"converter.d.ts","sourceRoot":"","sources":["../../../src/yaml/converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAW,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AAMzE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AA6CD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM,EACrB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAgK3B;AAwGD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,EAAE,CAEtE"}

package/dist/src/yaml/converter.js

@@ -4,7 +4,7 @@
  */
 import { getInvarnMeta } from './meta-helpers.js';
 import { detectPlatformInfo } from './platform-detector.js';
-import { EnvResolver } from './env-resolver.js';
+import { EnvResolver, ChecksumFileMissingError } from './env-resolver.js';
 import { getStepExecutor, UnrecognizedStepError } from './steps/registry.js';
 export class YAMLConversionError extends Error {
     constructor(message) {
@@ -12,6 +12,15 @@ export class YAMLConversionError extends Error {
         this.name = 'YAMLConversionError';
     }
 }
+/**
+ * The steps whose whole job is to make a build faster. Nothing they do is
+ * required for the build to be correct, so an input they cannot resolve
+ * costs a cache, not a pipeline.
+ */
+const CACHE_STEPS = new Set(['cache-pull', 'cache-push']);
+function isCacheStep(stepName) {
+    return CACHE_STEPS.has(stepName);
+}
 /**
  * Mapping of common unsupported steps to CI Build alternatives
  */
@@ -123,7 +132,28 @@ export async function convertYAMLToPipelineDef(pipeline, config, workflowName, y
             throw error;
         }
         // Interpolate step inputs
-        const interpolatedInputs = envResolver.interpolateObject(parsedStep.inputs, parsedStep.title || parsedStep.name);
+        //
+        // A cache step whose key cannot be computed is not a broken pipeline. The
+        // key is usually `{{checksum "<lockfile>"}}`, and a repository without
+        // that lockfile has nothing to key a cache on — so there is no cache, and
+        // the build runs cold. Letting the error through instead killed five iOS
+        // builds in a thirty-repository study at `cache-pull`, before a single
+        // file compiled, on a CocoaPods lockfile that two of them had no reason
+        // to have. Every other step keeps the hard failure: a checksum in a real
+        // input is a value the step needs.
+        let interpolatedInputs;
+        try {
+            interpolatedInputs = envResolver.interpolateObject(parsedStep.inputs, parsedStep.title || parsedStep.name);
+        }
+        catch (error) {
+            if (error instanceof ChecksumFileMissingError && isCacheStep(resolvedStepName)) {
+                warnings.push(`⚠️  ${resolvedStepName}: no ${error.filePath} in this repository, so there is ` +
+                    `nothing to key the cache on (skipping — the build runs uncached)`);
+                skippedSteps++;
+                continue;
+            }
+            throw error;
+        }
         // Execute step to get script
         const stepDef = await stepExecutor.execute(interpolatedInputs, envResolver.getAll(), config);
         // Generate unique step ID

package/dist/src/yaml/env-resolver.d.ts

@@ -10,6 +10,19 @@ export declare class MissingEnvironmentVariableError extends Error {
     readonly hint?: string | undefined;
     constructor(variableName: string, stepName?: string | undefined, hint?: string | undefined);
 }
+/**
+ * A `{{checksum "path"}}` naming a file this checkout does not have.
+ *
+ * Distinct from a generic read failure because a caller can reasonably
+ * decide it does not matter. A cache key is the usual case: the file is
+ * absent, so there is nothing to key a cache on, so there is no cache — which
+ * is a slower build, not a broken one.
+ */
+export declare class ChecksumFileMissingError extends Error {
+    readonly filePath: string;
+    readonly stepName?: string | undefined;
+    constructor(filePath: string, stepName?: string | undefined);
+}
 /**
  * EnvResolver handles environment variable merging and interpolation
  */

package/dist/src/yaml/env-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAgEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;gBAGrC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IA0BnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAwBvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAkBpB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}
+{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAgEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;gBAGrC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IA0BnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAkBpB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}

package/dist/src/yaml/env-resolver.js

@@ -76,6 +76,24 @@ export class MissingEnvironmentVariableError extends Error {
         this.name = 'MissingEnvironmentVariableError';
     }
 }
+/**
+ * A `{{checksum "path"}}` naming a file this checkout does not have.
+ *
+ * Distinct from a generic read failure because a caller can reasonably
+ * decide it does not matter. A cache key is the usual case: the file is
+ * absent, so there is nothing to key a cache on, so there is no cache — which
+ * is a slower build, not a broken one.
+ */
+export class ChecksumFileMissingError extends Error {
+    filePath;
+    stepName;
+    constructor(filePath, stepName) {
+        super(`Failed to compute checksum for "${filePath}": File not found: ${filePath}`);
+        this.filePath = filePath;
+        this.stepName = stepName;
+        this.name = 'ChecksumFileMissingError';
+    }
+}
 /**
  * EnvResolver handles environment variable merging and interpolation
  */
@@ -158,7 +176,7 @@ export class EnvResolver {
         let result = str;
         // Format 1: {{checksum "file"}}
         result = result.replace(/\{\{checksum "([^"]+)"\}\}/g, (match, filePath) => {
-            return this.computeChecksum(filePath);
+            return this.computeChecksum(filePath, stepName);
         });
         // Format 2: {{getenv "VAR"}}
         result = result.replace(/\{\{getenv "([^"]+)"\}\}/g, (match, varName) => {
@@ -230,14 +248,16 @@ export class EnvResolver {
      * @returns MD5 hash of file contents
      * @throws Error if file does not exist or cannot be read
      */
-    computeChecksum(filePath) {
+    computeChecksum(filePath, stepName) {
+        // Resolve relative path to absolute path
+        const absolutePath = path.resolve(process.cwd(), filePath);
+        // A file this checkout does not have gets its own error type, so a
+        // caller that can carry on without it — a cache key — can tell it apart
+        // from a file that exists and could not be read.
+        if (!fs.existsSync(absolutePath)) {
+            throw new ChecksumFileMissingError(filePath, stepName);
+        }
         try {
-            // Resolve relative path to absolute path
-            const absolutePath = path.resolve(process.cwd(), filePath);
-            // Check if file exists
-            if (!fs.existsSync(absolutePath)) {
-                throw new Error(`File not found: ${filePath}`);
-            }
             // Read file and compute MD5 hash
             const fileBuffer = fs.readFileSync(absolutePath);
             const hash = crypto.createHash('md5');

package/dist/src/yaml/preflight-validation.d.ts

@@ -1,8 +1,16 @@
 /**
- * Pre-flight validation for mandatory workflow requirements
- * Validates repository access before workflow execution begins
+ * Pre-flight validation hook that runs before any workflow step executes.
+ *
+ * It no longer checks anything. The checks it used to carry — that
+ * CIBUILD_GIT_REPOSITORY_URL is set and reachable, and that activate-ssh-key
+ * precedes git-clone — assumed cibuild would clone the repository itself. It
+ * does not: the source is already on disk when a pipeline runs (a runner
+ * checks out the dispatched commit before cibuild starts; locally it is the
+ * working copy), so there is no remote to validate before execution. The
+ * class and its `validate()` signature are kept so the call site in
+ * pipeline-with-secrets.ts is unchanged.
  */
-import { MissingEnvironmentVariableError } from './env-resolver.js';
+import type { MissingEnvironmentVariableError } from './env-resolver.js';
 import type { SecretsManager } from './secrets-manager.js';
 import type { YAMLWorkflow } from './types.js';
 /**
@@ -12,28 +20,9 @@ export interface PreFlightResult {
     success: boolean;
     error?: MissingEnvironmentVariableError;
 }
-/**
- * Validates that required environment variables exist and repository is accessible
- * This runs before any workflow steps execute
- */
 export declare class PreFlightValidator {
     /**
-     * Check if workflow has activate-ssh-key step before git-clone
-     * @param workflow The workflow to check
-     * @returns True if SSH key setup is in the workflow
-     */
-    private hasSSHKeySetup;
-    /**
-     * Validates CIBUILD_GIT_REPOSITORY_URL exists and is accessible
-     * @param env Environment variables
-     * @param secretsManager Secrets manager to check for stored secrets
-     * @param workflow The workflow to check for SSH key setup
-     * @returns Validation result
-     */
-    validateRepositoryAccess(env: Record<string, string>, secretsManager?: SecretsManager, workflow?: YAMLWorkflow): Promise<PreFlightResult>;
-    /**
-     * Run all pre-flight validations
-     * git-clone now uses the local checkout — no remote URL or connectivity check needed.
+     * Run all pre-flight validations. Always succeeds — see the file comment.
      */
     validate(_env: Record<string, string>, _secretsManager?: SecretsManager, _workflow?: YAMLWorkflow): Promise<PreFlightResult>;
 }

package/dist/src/yaml/preflight-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preflight-validation.d.ts","sourceRoot":"","sources":["../../../src/yaml/preflight-validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,+BAA+B,CAAC;CACzC;AAED;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B;;;;OAIG;IACH,OAAO,CAAC,cAAc;IA0BtB;;;;;;OAMG;IACG,wBAAwB,CAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,cAAc,CAAC,EAAE,cAAc,EAC/B,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,eAAe,CAAC;IA2H3B;;;OAGG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,eAAe,CAAC,EAAE,cAAc,EAChC,SAAS,CAAC,EAAE,YAAY,GACvB,OAAO,CAAC,eAAe,CAAC;CAG5B"}
+{"version":3,"file":"preflight-validation.d.ts","sourceRoot":"","sources":["../../../src/yaml/preflight-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,+BAA+B,CAAC;CACzC;AAED,qBAAa,kBAAkB;IAC7B;;OAEG;IACG,QAAQ,CACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,eAAe,CAAC,EAAE,cAAc,EAChC,SAAS,CAAC,EAAE,YAAY,GACvB,OAAO,CAAC,eAAe,CAAC;CAG5B"}

package/dist/src/yaml/preflight-validation.js

@@ -1,149 +1,18 @@
 /**
- * Pre-flight validation for mandatory workflow requirements
- * Validates repository access before workflow execution begins
- */
-import { execSync } from 'child_process';
-import { MissingEnvironmentVariableError } from './env-resolver.js';
-/**
- * Validates that required environment variables exist and repository is accessible
- * This runs before any workflow steps execute
+ * Pre-flight validation hook that runs before any workflow step executes.
+ *
+ * It no longer checks anything. The checks it used to carry — that
+ * CIBUILD_GIT_REPOSITORY_URL is set and reachable, and that activate-ssh-key
+ * precedes git-clone — assumed cibuild would clone the repository itself. It
+ * does not: the source is already on disk when a pipeline runs (a runner
+ * checks out the dispatched commit before cibuild starts; locally it is the
+ * working copy), so there is no remote to validate before execution. The
+ * class and its `validate()` signature are kept so the call site in
+ * pipeline-with-secrets.ts is unchanged.
  */
 export class PreFlightValidator {
     /**
-     * Check if workflow has activate-ssh-key step before git-clone
-     * @param workflow The workflow to check
-     * @returns True if SSH key setup is in the workflow
-     */
-    hasSSHKeySetup(workflow) {
-        if (!workflow.steps || workflow.steps.length === 0) {
-            return false;
-        }
-        let foundSSHKeyStep = false;
-        for (const step of workflow.steps) {
-            // Step can be an object with step name as key
-            const stepName = typeof step === 'string' ? step : Object.keys(step)[0];
-            // Check for git-clone step first - if we hit it before finding SSH key, return false
-            if (stepName.startsWith('git-clone')) {
-                return foundSSHKeyStep; // Return true only if we found SSH key before this
-            }
-            // Check for activate-ssh-key step
-            if (stepName.startsWith('activate-ssh-key')) {
-                foundSSHKeyStep = true;
-            }
-        }
-        // If we got here, no git-clone step was found, so return if SSH key exists
-        return foundSSHKeyStep;
-    }
-    /**
-     * Validates CIBUILD_GIT_REPOSITORY_URL exists and is accessible
-     * @param env Environment variables
-     * @param secretsManager Secrets manager to check for stored secrets
-     * @param workflow The workflow to check for SSH key setup
-     * @returns Validation result
-     */
-    async validateRepositoryAccess(env, secretsManager, workflow) {
-        // Check environment variables first, then secrets manager
-        let repoUrl = env.CIBUILD_GIT_REPOSITORY_URL || env.GIT_REPOSITORY_URL || '';
-        // If not in env, check secrets manager
-        if ((!repoUrl || repoUrl.trim() === '') && secretsManager) {
-            const secretId = secretsManager.getSecretIdByName('CIBUILD_GIT_REPOSITORY_URL');
-            if (secretId) {
-                repoUrl = secretsManager.getSecret(secretId) || '';
-            }
-        }
-        // Check if repository URL is provided
-        if (!repoUrl || repoUrl.trim() === '') {
-            return {
-                success: false,
-                error: new MissingEnvironmentVariableError('CIBUILD_GIT_REPOSITORY_URL', 'preflight-validation', 'Git repository URL for cloning source code in CI/CD builds.\n\n' +
-                    'Expected format:\n' +
-                    '  ┌────────────────────────────────────────────────────────┐\n' +
-                    '  │ https://github.com/username/repository.git             │\n' +
-                    '  │ git@github.com:username/repository.git                 │\n' +
-                    '  │ https://gitlab.com/username/repository.git             │\n' +
-                    '  └────────────────────────────────────────────────────────┘\n\n' +
-                    'How to set it:\n' +
-                    '  • Environment variable: GIT_REPOSITORY_URL=<your-repo-url>\n' +
-                    '  • In YAML inputs: repository: <your-repo-url>\n' +
-                    '  • CI platform automatically provides this in most cases'),
-            };
-        }
-        // If the workflow uses activate-ssh-key, skip connectivity test entirely.
-        // SSH authentication isn't available pre-execution, so any network test would fail
-        // for private repos regardless of whether the URL is SSH or HTTPS format.
-        const hasSSHKeyInWorkflow = workflow ? this.hasSSHKeySetup(workflow) : false;
-        if (hasSSHKeyInWorkflow) {
-            console.log('🔍 Pre-flight: Validating repository URL...');
-            console.log(`   Repository: ${repoUrl}`);
-            console.log('   SSH authentication will be configured by activate-ssh-key step');
-            console.log('✅ Pre-flight: Repository URL validated (connectivity test skipped)\n');
-            return { success: true };
-        }
-        // Test repository connectivity using git ls-remote
-        try {
-            console.log('🔍 Pre-flight: Validating repository access...');
-            console.log(`   Repository: ${repoUrl}`);
-            // Execute git ls-remote to check if repository is accessible
-            // This command lists remote references without cloning
-            // Timeout after 10 seconds to prevent hanging
-            execSync(`git ls-remote "${repoUrl}" HEAD`, {
-                stdio: 'pipe',
-                timeout: 10000,
-                encoding: 'utf-8',
-            });
-            console.log('✅ Pre-flight: Repository is accessible\n');
-            return { success: true };
-        }
-        catch (error) {
-            // Repository is not accessible - analyze the error
-            const errorMessage = error.message || String(error);
-            console.log(`❌ Pre-flight: Repository access failed`);
-            console.log(`   Error: ${errorMessage}\n`);
-            // Check if this is an SSH authentication error
-            const isSSHAuthError = errorMessage.includes('Permission denied') &&
-                errorMessage.includes('publickey');
-            const isSSHUrl = repoUrl.startsWith('git@') || repoUrl.includes('ssh://');
-            if (isSSHAuthError || (isSSHUrl && errorMessage.includes('Could not read from remote'))) {
-                // SSH authentication is the issue, not the repository URL
-                console.log('⚠️  Repository URL is valid, but SSH authentication is required.\n');
-                console.log('Please ensure:');
-                console.log('  1. SSH key is configured in your workflow (activate-ssh-key step)');
-                console.log('  2. SSH key has access to this repository');
-                console.log('  3. SSH key is added to your GitHub/GitLab account\n');
-                throw new Error('Pre-flight validation failed: SSH authentication required.\n\n' +
-                    `Repository: ${repoUrl}\n\n` +
-                    'The repository URL is valid but requires SSH authentication.\n' +
-                    'Make sure your workflow includes an "activate-ssh-key" step before "git-clone".\n\n' +
-                    'Example workflow:\n' +
-                    '  steps:\n' +
-                    '    - activate-ssh-key@4:  # Add SSH key first\n' +
-                    '        inputs:\n' +
-                    '          ssh_key_save_path: $HOME/.ssh/bitrise_rsa\n' +
-                    '    - git-clone@6:         # Then clone\n\n' +
-                    `Error details: ${errorMessage}`);
-            }
-            // For other errors (invalid URL, network issues, etc.), return error
-            return {
-                success: false,
-                error: new MissingEnvironmentVariableError('CIBUILD_GIT_REPOSITORY_URL', 'preflight-validation', 'Git repository URL validation failed. The repository is not accessible.\n\n' +
-                    'Expected format:\n' +
-                    '  ┌────────────────────────────────────────────────────────┐\n' +
-                    '  │ https://github.com/username/repository.git             │\n' +
-                    '  │ git@github.com:username/repository.git                 │\n' +
-                    '  │ https://gitlab.com/username/repository.git             │\n' +
-                    '  └────────────────────────────────────────────────────────┘\n\n' +
-                    'Common issues:\n' +
-                    '  • Invalid repository URL\n' +
-                    '  • Network connectivity issues\n' +
-                    '  • Repository does not exist or is private\n' +
-                    '  • Wrong URL format (check for typos)\n\n' +
-                    `Error details: ${errorMessage}`),
-            };
-        }
-    }
-    /**
-     * Run all pre-flight validations
-     * git-clone now uses the local checkout — no remote URL or connectivity check needed.
+     * Run all pre-flight validations. Always succeeds — see the file comment.
      */
     async validate(_env, _secretsManager, _workflow) {
         return { success: true };

package/dist/src/yaml/steps/android.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/android.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,yBAAyB,CACvB,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmB1B;;;OAGG;YACW,4BAA4B;IA0E1C,UAAU,IAAI,UAAU,EAAE;IAUpB,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAoH7G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,UAAU,IAAI,UAAU,EAAE;IAe1B,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyP1G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAiL1G;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,yBAAyB,CACvB,OAAO,EAAE,qBAAqB,EAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA4L9G;AAMD,MAAM,WAAW,8BAA8B;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,oCAAqC,SAAQ,gBAAgB;IACxE,yBAAyB,CACvB,OAAO,EAAE,8BAA8B,EACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAsEzH"}
+{"version":3,"file":"android.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/android.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,gBAAgB;IAC9D,yBAAyB,CACvB,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAyB1B;;;OAGG;YACW,4BAA4B;IAqF1C,UAAU,IAAI,UAAU,EAAE;IAUpB,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAoH7G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,UAAU,IAAI,UAAU,EAAE;IAe1B,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyP1G;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAC3D,yBAAyB,CACvB,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAiL1G;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,yBAAyB,CACvB,OAAO,EAAE,qBAAqB,EAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAiBpB,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA4L9G;AAMD,MAAM,WAAW,8BAA8B;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,oCAAqC,SAAQ,gBAAgB;IACxE,yBAAyB,CACvB,OAAO,EAAE,8BAA8B,EACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAsEzH"}

package/dist/src/yaml/steps/android.js

@@ -22,7 +22,13 @@ export class SetJavaVersionStepExecutor extends BaseStepExecutor {
                 name: `java-${javaVersion}`,
                 description: `Java ${javaVersion} JDK`,
                 timing: 'pre-execution',
-                severity: 'info', // Info because we check multiple locations including Homebrew
+                // The step this validates ends in `exit 1` when it cannot find the
+                // JDK, so a failed check is a build that is already lost. Reported as
+                // info, it printed "Java <n> not found", let the run proceed, and the
+                // pipeline died at the very next step — the same message, one VM
+                // later. The check now looks in every place the step looks, so the
+                // two can only disagree about a JDK that is genuinely absent.
+                severity: 'error',
                 hint: process.platform === 'darwin'
                     ? `Install: brew install openjdk@${javaVersion}`
                     : `Install: sudo apt install openjdk-${javaVersion}-jdk`,
@@ -81,6 +87,16 @@ export class SetJavaVersionStepExecutor extends BaseStepExecutor {
                 }
             }
         }
+        // GitHub Actions publishes each preinstalled JDK as JAVA_HOME_<ver>_X64.
+        // The step reads it; without this the check could fail a build that the
+        // step itself would have run perfectly well.
+        const actionsHome = process.env[`JAVA_HOME_${version}_X64`];
+        if (actionsHome && existsSync(actionsHome)) {
+            return {
+                passed: true,
+                message: `Java ${version} found at: ${actionsHome} (GitHub Actions)`,
+            };
+        }
         // Check Linux paths
         const linuxPaths = [
             `/usr/lib/jvm/java-${version}-openjdk-amd64`,

package/dist/src/yaml/steps/git-clone.d.ts

@@ -15,8 +15,14 @@ export interface GitCloneInputs {
     clone_into_dir?: string;
 }
 /**
- * Git clone step executor
- * Clones a git repository with optional branch and depth settings
+ * git-clone step executor.
+ *
+ * Does not clone. The source is already on disk when this runs — on a runner
+ * the dispatched commit was checked out before cibuild started (see
+ * cibuild-runner's GitCloneRunner); locally it is the developer's working copy.
+ * The step locates that checkout and republishes its commit metadata. Every
+ * input in GitCloneInputs is accepted so existing YAML keeps parsing, and none
+ * of them is read.
  */
 export declare class GitCloneStepExecutor extends BaseStepExecutor {
     getValidationRequirements(_inputs: GitCloneInputs, _env: Record<string, string>, _config: CIConfig): ValidationRequirement[];

package/dist/src/yaml/steps/git-clone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-clone.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-clone.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;IACxD,yBAAyB,CACvB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAU1B,UAAU,IAAI,UAAU,EAAE;IAkDpB,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAqD1G"}
+{"version":3,"file":"git-clone.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-clone.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;IACxD,yBAAyB,CACvB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAU1B,UAAU,IAAI,UAAU,EAAE;IAkDpB,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAqD1G"}

package/dist/src/yaml/steps/git-clone.js

@@ -3,8 +3,14 @@
  */
 import { BaseStepExecutor } from './base.js';
 /**
- * Git clone step executor
- * Clones a git repository with optional branch and depth settings
+ * git-clone step executor.
+ *
+ * Does not clone. The source is already on disk when this runs — on a runner
+ * the dispatched commit was checked out before cibuild started (see
+ * cibuild-runner's GitCloneRunner); locally it is the developer's working copy.
+ * The step locates that checkout and republishes its commit metadata. Every
+ * input in GitCloneInputs is accepted so existing YAML keeps parsing, and none
+ * of them is read.
  */
 export class GitCloneStepExecutor extends BaseStepExecutor {
     getValidationRequirements(_inputs, _env, _config) {

package/dist/src/yaml/steps/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4CH;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAq7C7C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4CH;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CA07C7C"}

package/dist/src/yaml/steps/index.js

@@ -32,28 +32,32 @@ import { UiFidelityRenderAndroidStepExecutor, DEFAULT_GRADLE_TASK, DEFAULT_PACKA
  */
 export function initializeStepRegistry() {
     // Git steps
+    // Does not clone. The source is already on disk when any step runs — on a
+    // runner the dispatched commit is checked out before cibuild starts; locally
+    // it is the developer's working copy. The inputs are kept so existing YAML
+    // keeps parsing; the executor never reads them.
     registerStep('git-clone', new GitCloneStepExecutor(), {
         name: 'git-clone',
-        description: 'Clone a git repository',
+        description: 'Locate the source checkout already on disk and record its commit. Does not clone — on a runner the dispatched commit is checked out before any step runs; locally it is your working copy. Inputs are ignored.',
         platform: 'all',
         inputs: {
             repository: {
-                description: 'Git repository URL',
+                description: 'Ignored — no clone is performed; the checkout already exists',
                 required: false,
                 default: '$CIBUILD_GIT_REPOSITORY_URL',
             },
             branch: {
-                description: 'Git branch to clone',
+                description: 'Ignored — on a runner the dispatched ref is checked out, not this value',
                 required: false,
                 default: '$CIBUILD_GIT_BRANCH or main',
             },
             clone_depth: {
-                description: 'Clone depth (0 for full clone)',
+                description: 'Ignored — no clone is performed; a runner checkout is always depth 1',
                 required: false,
                 default: 0,
             },
             clone_into_dir: {
-                description: 'Directory to clone into',
+                description: 'Ignored — the checkout location is not chosen by this step',
                 required: false,
                 default: '.',
             },