@invarn/cibuild 2.6.5 → 2.6.7

package/dist/src/commands/android-gms-guard.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A plugin applied inside `if (file("…").exists()) { … }` is conditional on a
+ * file the build may not have. Counting it as a hard credential requirement
+ * sends the user looking for a file the build never asks for — and, when the
+ * same rule is used to predict outcomes, reports projects as blocked that
+ * build green with no credential at all.
+ */
+export {};
+//# sourceMappingURL=android-gms-guard.test.d.ts.map

package/dist/src/commands/android-gms-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"android-gms-guard.test.d.ts","sourceRoot":"","sources":["../../../src/commands/android-gms-guard.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/src/commands/android-gms-guard.test.js

@@ -0,0 +1,78 @@
+/**
+ * A plugin applied inside `if (file("…").exists()) { … }` is conditional on a
+ * file the build may not have. Counting it as a hard credential requirement
+ * sends the user looking for a file the build never asks for — and, when the
+ * same rule is used to predict outcomes, reports projects as blocked that
+ * build green with no credential at all.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { stripExistenceGuardedBlocks } from './android-scanner.js';
+describe('stripExistenceGuardedBlocks', () => {
+    test('removes a Kotlin DSL existence guard and its body', () => {
+        const content = `
+plugins {
+  id("com.android.application")
+}
+
+if (file("google-services.json").exists()) {
+  apply(plugin = libs.plugins.gms.googleServices.get().pluginId)
+}
+`;
+        const stripped = stripExistenceGuardedBlocks(content);
+        expect(stripped).toContain('com.android.application');
+        expect(stripped).not.toContain('googleServices');
+    });
+    test('removes a Groovy existence guard', () => {
+        const content = `
+if (file('google-services.json').exists()) {
+    apply plugin: 'com.google.gms.google-services'
+}
+`;
+        expect(stripExistenceGuardedBlocks(content)).not.toContain('google-services');
+    });
+    test('removes a guard qualified by a project receiver', () => {
+        const content = `
+if (rootProject.file("app/google-services.json").exists()) {
+  apply(plugin = "com.google.gms.google-services")
+}
+`;
+        expect(stripExistenceGuardedBlocks(content)).not.toContain('google-services');
+    });
+    test('keeps nested braces inside the guard body together', () => {
+        const content = `
+if (file("google-services.json").exists()) {
+  android { buildTypes { release { } } }
+  apply(plugin = "com.google.gms.google-services")
+}
+val keep = "after"
+`;
+        const stripped = stripExistenceGuardedBlocks(content);
+        expect(stripped).not.toContain('google-services');
+        expect(stripped).toContain('val keep = "after"');
+    });
+    test('is not fooled by a brace inside a string literal', () => {
+        const content = `
+if (file("google-services.json").exists()) {
+  val template = "\${'{'}not a block"
+  apply(plugin = "com.google.gms.google-services")
+}
+val keep = "after"
+`;
+        const stripped = stripExistenceGuardedBlocks(content);
+        expect(stripped).not.toContain('google-services');
+        expect(stripped).toContain('val keep = "after"');
+    });
+    test('leaves an unguarded declaration exactly where it was', () => {
+        const content = `
+plugins {
+  id("com.google.gms.google-services")
+}
+`;
+        expect(stripExistenceGuardedBlocks(content)).toBe(content);
+    });
+    test('leaves content alone when the guard never closes', () => {
+        const content = 'if (file("google-services.json").exists()) {\n  apply(plugin = "x")\n';
+        expect(stripExistenceGuardedBlocks(content)).toBe(content);
+    });
+});
+//# sourceMappingURL=android-gms-guard.test.js.map

package/dist/src/commands/android-java-version.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Which JDK a generated Android pipeline asks for.
+ *
+ * Two constraints decide it and the old `Math.max(detected ?? 17, 17)` knew
+ * neither: build machines install a fixed set of JDKs, and Gradle refuses to
+ * start on a JDK newer than it knows about. Naming a JDK that is not
+ * installed fails at "Set the Java version", before a line compiles; raising
+ * a project onto a JDK its Gradle cannot run makes an old wrapper
+ * unbuildable by construction.
+ */
+export {};
+//# sourceMappingURL=android-java-version.test.d.ts.map

package/dist/src/commands/android-java-version.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"android-java-version.test.d.ts","sourceRoot":"","sources":["../../../src/commands/android-java-version.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/src/commands/android-java-version.test.js

@@ -0,0 +1,95 @@
+/**
+ * Which JDK a generated Android pipeline asks for.
+ *
+ * Two constraints decide it and the old `Math.max(detected ?? 17, 17)` knew
+ * neither: build machines install a fixed set of JDKs, and Gradle refuses to
+ * start on a JDK newer than it knows about. Naming a JDK that is not
+ * installed fails at "Set the Java version", before a line compiles; raising
+ * a project onto a JDK its Gradle cannot run makes an old wrapper
+ * unbuildable by construction.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { AVAILABLE_JAVA_VERSIONS, gradleJavaCeiling, gradleJavaFloor, javaVersionProblem, parseGradleWrapperVersion, runnableJavaVersion, } from './android-scanner.js';
+describe('parseGradleWrapperVersion', () => {
+    test('reads the version out of a distributionUrl', () => {
+        expect(parseGradleWrapperVersion('distributionUrl=https\\://services.gradle.org/distributions/gradle-8.9-bin.zip')).toBe('8.9');
+    });
+    test('reads an -all distribution and a three-part version', () => {
+        expect(parseGradleWrapperVersion('distributionUrl=https\\://services.gradle.org/distributions/gradle-5.2.1-all.zip')).toBe('5.2.1');
+    });
+    test('reads a release-candidate version', () => {
+        expect(parseGradleWrapperVersion('distributionUrl=https\\://services.gradle.org/distributions/gradle-9.0-rc-1-bin.zip')).toBe('9.0-rc-1');
+    });
+    test('returns undefined for a properties file that pins nothing', () => {
+        expect(parseGradleWrapperVersion('distributionBase=GRADLE_USER_HOME')).toBeUndefined();
+        expect(parseGradleWrapperVersion('')).toBeUndefined();
+    });
+});
+describe('gradleJavaCeiling / gradleJavaFloor', () => {
+    test('tracks what each Gradle line can run on', () => {
+        expect(gradleJavaCeiling('4.10.2')).toBe(8);
+        expect(gradleJavaCeiling('5.2.1')).toBe(11);
+        expect(gradleJavaCeiling('6.9')).toBe(15);
+        expect(gradleJavaCeiling('7.6.1')).toBe(17);
+        expect(gradleJavaCeiling('8.9')).toBe(21);
+        expect(gradleJavaCeiling('9.4.0')).toBe(24);
+    });
+    test('knows Gradle 9 dropped everything below 17', () => {
+        expect(gradleJavaFloor('8.9')).toBe(8);
+        expect(gradleJavaFloor('9.0')).toBe(17);
+    });
+    test('says nothing about a version it cannot read', () => {
+        expect(gradleJavaCeiling(undefined)).toBeUndefined();
+        expect(gradleJavaCeiling('nightly')).toBeUndefined();
+        expect(gradleJavaFloor(undefined)).toBeUndefined();
+    });
+});
+describe('runnableJavaVersion', () => {
+    test('stays on the default when the default covers the declaration', () => {
+        // 11 is installed, but AGP 8.x cannot run on it — a project declaring
+        // sourceCompatibility 11 must still be built on 17.
+        expect(runnableJavaVersion(11)).toBe(17);
+        expect(runnableJavaVersion(17)).toBe(17);
+        expect(runnableJavaVersion(21)).toBe(21);
+    });
+    test('defaults to the preferred JDK when nothing is declared', () => {
+        expect(runnableJavaVersion(undefined)).toBe(17);
+    });
+    test('steps down to 11 only when the wrapper rules the default out', () => {
+        expect(runnableJavaVersion(undefined, '5.2.1')).toBe(11);
+        expect(runnableJavaVersion(11, '5.2.1')).toBe(11);
+        expect(runnableJavaVersion(undefined, '6.9')).toBe(11);
+    });
+    test('never names a JDK no build machine has', () => {
+        expect(AVAILABLE_JAVA_VERSIONS).toContain(runnableJavaVersion(23));
+        expect(AVAILABLE_JAVA_VERSIONS).toContain(runnableJavaVersion(25, '8.9'));
+    });
+    test('lets an old wrapper cap a newer declaration', () => {
+        // Gradle 7.x tops out at 17 even though 21 is installed.
+        expect(runnableJavaVersion(21, '7.6.1')).toBe(17);
+    });
+    test('honours the Gradle 9 floor of 17', () => {
+        expect(runnableJavaVersion(8, '9.0')).toBe(17);
+    });
+});
+describe('javaVersionProblem', () => {
+    test('names a Gradle version no installed JDK can run', () => {
+        // 4.10.2 tops out at Java 8, and no image carries 8.
+        const problem = javaVersionProblem(undefined, '4.10.2');
+        expect(problem).toContain('Gradle 4.10.2');
+        expect(problem).toContain('Java 8');
+    });
+    test('names a declaration above every installed JDK', () => {
+        const problem = javaVersionProblem(23, '8.9');
+        expect(problem).toContain('Java 23');
+        expect(problem).toContain('11, 17 and 21');
+    });
+    test('is silent when every constraint was honoured', () => {
+        expect(javaVersionProblem(17, '8.9')).toBeUndefined();
+        expect(javaVersionProblem(undefined, '8.9')).toBeUndefined();
+        expect(javaVersionProblem(undefined, undefined)).toBeUndefined();
+        // 5.2.1 used to be a problem. The images carry 11 now, so it is not.
+        expect(javaVersionProblem(undefined, '5.2.1')).toBeUndefined();
+    });
+});
+//# sourceMappingURL=android-java-version.test.js.map

package/dist/src/commands/android-scanner.d.ts

@@ -11,6 +11,8 @@ export interface ScanResult {
     warnings: BuildWarning[];
     /** Highest Java version requirement detected in Gradle files (e.g. 17, 21). */
     detectedJavaVersion?: number;
+    /** Gradle version the wrapper pins, e.g. "8.9". Undefined when there is no wrapper. */
+    detectedGradleVersion?: string;
     /** Build types, product flavors, and all variant combinations detected in Gradle files. */
     buildVariants: BuildVariants;
 }
@@ -22,6 +24,88 @@ export interface BuildVariants {
     /** All variant combinations. Equals buildTypes when no product flavors are defined. */
     variants: string[];
 }
+/**
+ * Removes `if (file("…").exists()) { … }` blocks from build-file content.
+ *
+ * A plugin applied inside one of these is *conditional on a file the build
+ * may not have*. Projects use the idiom precisely so a checkout without the
+ * credential still builds:
+ *
+ *     if (file("google-services.json").exists()) {
+ *       apply(plugin = libs.plugins.gms.googleServices.get().pluginId)
+ *     }
+ *
+ * Reading the declaration and ignoring the guard turns "this project builds
+ * fine without a credential" into "this project cannot build without one" —
+ * a warning that sends the user looking for a file the build never asks for.
+ *
+ * Brace matching skips quoted strings so a `{` inside a literal cannot end
+ * the block early. Anything it cannot match to a close brace is left alone:
+ * losing a real declaration is worse than keeping a guarded one.
+ */
+export declare function stripExistenceGuardedBlocks(content: string): string;
+/**
+ * The Gradle version a wrapper pins, read out of its `distributionUrl`.
+ * `…/gradle-8.9-bin.zip` → `8.9`.
+ *
+ * This bounds which JDK the project can build on: Gradle refuses to start on
+ * a JDK newer than it knows about, so the wrapper is a hard ceiling that no
+ * `sourceCompatibility` declaration can raise.
+ *
+ * The trailing `-bin` / `-all` belongs to the file name rather than the
+ * version, and a release candidate spends two more hyphens on `-rc-1`, so the
+ * version group has to be able to give its last segment back.
+ */
+export declare function parseGradleWrapperVersion(content: string): string | undefined;
+/**
+ * The newest Java release a given Gradle version can run on, or undefined
+ * when the version string says nothing usable.
+ */
+export declare function gradleJavaCeiling(gradleVersion: string | undefined): number | undefined;
+/** The oldest Java release a given Gradle version will start on. */
+export declare function gradleJavaFloor(gradleVersion: string | undefined): number | undefined;
+/**
+ * The JDKs a build machine installs, and therefore the only values the
+ * generated `set-java-version` step can satisfy.
+ *
+ * 11 joined the images on 2026-09-05, for Gradle 5.x and 6.x — which cannot
+ * *start* on 17, whatever the sources declare. It is a fallback, never a
+ * preference; see `PREFERRED_JAVA_VERSION`.
+ */
+export declare const AVAILABLE_JAVA_VERSIONS: number[];
+/**
+ * The JDK to write whenever nothing forces otherwise.
+ *
+ * This is what makes 11 safe to list. The selection below used to answer with
+ * the *lowest* usable JDK, which was harmless while the lowest was 17. With 11
+ * installed that rule would write `JAVA_VERSION: 11` for every project whose
+ * `sourceCompatibility` is 11 — and AGP 8.x will not run on JDK 11, so
+ * pipelines that build today would stop building.
+ */
+export declare const PREFERRED_JAVA_VERSION = 17;
+/**
+ * The Java version to write into a generated pipeline: `PREFERRED_JAVA_VERSION`
+ * whenever it satisfies both what the sources declare and what the Gradle
+ * wrapper can run on, and the nearest available JDK that does when it cannot.
+ *
+ * Source compatibility is a floor, not an exact request — a project
+ * declaring 11 compiles fine on 17 — but it is not the only constraint.
+ * Gradle starts before it reads a single `sourceCompatibility`, so a wrapper
+ * pinning an old Gradle caps the JDK no matter what the sources say, and a
+ * declaration above every installed JDK cannot be honoured at all.
+ *
+ * Falls back to the preferred JDK — not the lowest — when the constraints
+ * cannot all be met, because a pipeline has to name something and the
+ * unsatisfiable cases are overwhelmingly "declared something newer than we
+ * have", where 17 is a far better guess than 11. `javaVersionProblem` says
+ * what was given up so the caller can warn.
+ */
+export declare function runnableJavaVersion(detectedJavaVersion: number | undefined, gradleVersion?: string): number;
+/**
+ * What `runnableJavaVersion` could not honour, as a sentence, or undefined
+ * when it honoured everything.
+ */
+export declare function javaVersionProblem(detectedJavaVersion: number | undefined, gradleVersion?: string): string | undefined;
 /**
  * Detects build types and product flavors from Gradle files by static parsing.
  * Always includes "debug" and "release" as defaults.

package/dist/src/commands/android-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/android-scanner.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2FAA2F;IAC3F,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wFAAwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAoYD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAmCxE;AAMD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA2PjF;AAgBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAgD3D"}
+{"version":3,"file":"android-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/android-scanner.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wFAAwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA+JD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAcnE;AAoKD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7E;AAQD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CASvF;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIrF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,UAAe,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAYR;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAkBpB;AA6FD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAmCxE;AAMD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA4PjF;AAgBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAyD3D"}

package/dist/src/commands/android-scanner.js

@@ -135,11 +135,74 @@ function parsePropertyKeys(propertiesContent) {
         .map((l) => l.split("=")[0].trim())
         .filter(Boolean);
 }
-/** Returns true if the GMS google-services plugin is applied in this content. */
+/**
+ * Removes `if (file("…").exists()) { … }` blocks from build-file content.
+ *
+ * A plugin applied inside one of these is *conditional on a file the build
+ * may not have*. Projects use the idiom precisely so a checkout without the
+ * credential still builds:
+ *
+ *     if (file("google-services.json").exists()) {
+ *       apply(plugin = libs.plugins.gms.googleServices.get().pluginId)
+ *     }
+ *
+ * Reading the declaration and ignoring the guard turns "this project builds
+ * fine without a credential" into "this project cannot build without one" —
+ * a warning that sends the user looking for a file the build never asks for.
+ *
+ * Brace matching skips quoted strings so a `{` inside a literal cannot end
+ * the block early. Anything it cannot match to a close brace is left alone:
+ * losing a real declaration is worse than keeping a guarded one.
+ */
+export function stripExistenceGuardedBlocks(content) {
+    const guard = /if\s*\(\s*[A-Za-z0-9_.]*file\s*\(\s*[^)]*\)\s*\.exists\s*\(\s*\)\s*\)\s*\{/g;
+    let out = "";
+    let cursor = 0;
+    let match;
+    while ((match = guard.exec(content)) !== null) {
+        const bodyStart = match.index + match[0].length;
+        const end = matchingBrace(content, bodyStart);
+        if (end === -1)
+            continue;
+        out += content.slice(cursor, match.index);
+        cursor = end + 1;
+        guard.lastIndex = cursor;
+    }
+    return out + content.slice(cursor);
+}
+/** Index of the `}` closing a block whose body starts at `start`, or -1. */
+function matchingBrace(content, start) {
+    let depth = 1;
+    let quote = null;
+    for (let i = start; i < content.length; i++) {
+        const ch = content[i];
+        if (quote) {
+            if (ch === "\\")
+                i++;
+            else if (ch === quote)
+                quote = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'")
+            quote = ch;
+        else if (ch === "{")
+            depth++;
+        else if (ch === "}" && --depth === 0)
+            return i;
+    }
+    return -1;
+}
+/**
+ * Returns true if the GMS google-services plugin is applied unconditionally
+ * in this content. A declaration guarded by the presence of
+ * `google-services.json` is not a credential requirement — see
+ * `stripExistenceGuardedBlocks`.
+ */
 function detectGmsPlugin(content) {
-    return (/apply\s+plugin\s*:\s*['"]com\.google\.gms\.google-services['"]/.test(content) ||
-        /id\s*\(\s*["']com\.google\.gms\.google-services["']\s*\)/.test(content) ||
-        /id\s*["']com\.google\.gms\.google-services["']/.test(content));
+    const unguarded = stripExistenceGuardedBlocks(content);
+    return (/apply\s+plugin\s*:\s*['"]com\.google\.gms\.google-services['"]/.test(unguarded) ||
+        /id\s*\(\s*["']com\.google\.gms\.google-services["']\s*\)/.test(unguarded) ||
+        /id\s*["']com\.google\.gms\.google-services["']/.test(unguarded));
 }
 /** Returns true if a signingConfigs block exists. */
 function detectSigningConfigs(content) {
@@ -260,6 +323,126 @@ function detectRequiredJavaVersion(gradleFiles) {
     }
     return versions.length > 0 ? Math.max(...versions) : undefined;
 }
+/**
+ * The Gradle version a wrapper pins, read out of its `distributionUrl`.
+ * `…/gradle-8.9-bin.zip` → `8.9`.
+ *
+ * This bounds which JDK the project can build on: Gradle refuses to start on
+ * a JDK newer than it knows about, so the wrapper is a hard ceiling that no
+ * `sourceCompatibility` declaration can raise.
+ *
+ * The trailing `-bin` / `-all` belongs to the file name rather than the
+ * version, and a release candidate spends two more hyphens on `-rc-1`, so the
+ * version group has to be able to give its last segment back.
+ */
+export function parseGradleWrapperVersion(content) {
+    const match = /gradle-(\d+(?:\.\d+)*(?:-[A-Za-z0-9.]+)*)-(?:bin|all)\.zip/.exec(content);
+    return match ? match[1] : undefined;
+}
+function detectGradleWrapperVersion(projectRoot) {
+    const path = resolve(projectRoot, "gradle", "wrapper", "gradle-wrapper.properties");
+    if (!existsSync(path))
+        return undefined;
+    return parseGradleWrapperVersion(safeRead(path));
+}
+/**
+ * The newest Java release a given Gradle version can run on, or undefined
+ * when the version string says nothing usable.
+ */
+export function gradleJavaCeiling(gradleVersion) {
+    const major = Number(/^(\d+)\./.exec(gradleVersion ?? "")?.[1]);
+    if (!Number.isInteger(major))
+        return undefined;
+    if (major <= 4)
+        return 8;
+    if (major === 5)
+        return 11;
+    if (major === 6)
+        return 15;
+    if (major === 7)
+        return 17;
+    if (major === 8)
+        return 21;
+    return 24;
+}
+/** The oldest Java release a given Gradle version will start on. */
+export function gradleJavaFloor(gradleVersion) {
+    const major = Number(/^(\d+)\./.exec(gradleVersion ?? "")?.[1]);
+    if (!Number.isInteger(major))
+        return undefined;
+    return major >= 9 ? 17 : 8;
+}
+/**
+ * The JDKs a build machine installs, and therefore the only values the
+ * generated `set-java-version` step can satisfy.
+ *
+ * 11 joined the images on 2026-09-05, for Gradle 5.x and 6.x — which cannot
+ * *start* on 17, whatever the sources declare. It is a fallback, never a
+ * preference; see `PREFERRED_JAVA_VERSION`.
+ */
+export const AVAILABLE_JAVA_VERSIONS = [11, 17, 21];
+/**
+ * The JDK to write whenever nothing forces otherwise.
+ *
+ * This is what makes 11 safe to list. The selection below used to answer with
+ * the *lowest* usable JDK, which was harmless while the lowest was 17. With 11
+ * installed that rule would write `JAVA_VERSION: 11` for every project whose
+ * `sourceCompatibility` is 11 — and AGP 8.x will not run on JDK 11, so
+ * pipelines that build today would stop building.
+ */
+export const PREFERRED_JAVA_VERSION = 17;
+/**
+ * The Java version to write into a generated pipeline: `PREFERRED_JAVA_VERSION`
+ * whenever it satisfies both what the sources declare and what the Gradle
+ * wrapper can run on, and the nearest available JDK that does when it cannot.
+ *
+ * Source compatibility is a floor, not an exact request — a project
+ * declaring 11 compiles fine on 17 — but it is not the only constraint.
+ * Gradle starts before it reads a single `sourceCompatibility`, so a wrapper
+ * pinning an old Gradle caps the JDK no matter what the sources say, and a
+ * declaration above every installed JDK cannot be honoured at all.
+ *
+ * Falls back to the preferred JDK — not the lowest — when the constraints
+ * cannot all be met, because a pipeline has to name something and the
+ * unsatisfiable cases are overwhelmingly "declared something newer than we
+ * have", where 17 is a far better guess than 11. `javaVersionProblem` says
+ * what was given up so the caller can warn.
+ */
+export function runnableJavaVersion(detectedJavaVersion, gradleVersion) {
+    const ceiling = gradleJavaCeiling(gradleVersion) ?? Infinity;
+    const floor = Math.max(detectedJavaVersion ?? 0, gradleJavaFloor(gradleVersion) ?? 0);
+    const usable = AVAILABLE_JAVA_VERSIONS.filter((v) => v >= floor && v <= ceiling).sort((a, b) => a - b);
+    if (usable.length === 0)
+        return PREFERRED_JAVA_VERSION;
+    if (usable.includes(PREFERRED_JAVA_VERSION))
+        return PREFERRED_JAVA_VERSION;
+    // Forced off the default: below it take the newest that fits under the
+    // ceiling, above it the oldest that clears the floor.
+    const below = usable.filter((v) => v < PREFERRED_JAVA_VERSION);
+    return below.length > 0 ? below[below.length - 1] : usable[0];
+}
+/**
+ * What `runnableJavaVersion` could not honour, as a sentence, or undefined
+ * when it honoured everything.
+ */
+export function javaVersionProblem(detectedJavaVersion, gradleVersion) {
+    // "11, 17 and 21", not "11 and 17 and 21" — a human reads this next to a
+    // build that will not start.
+    const sorted = [...AVAILABLE_JAVA_VERSIONS].sort((a, b) => a - b);
+    const installed = sorted.length > 1
+        ? `${sorted.slice(0, -1).join(", ")} and ${sorted[sorted.length - 1]}`
+        : String(sorted[0]);
+    const ceiling = gradleJavaCeiling(gradleVersion);
+    const lowest = Math.min(...AVAILABLE_JAVA_VERSIONS);
+    if (ceiling !== undefined && ceiling < lowest) {
+        return `Gradle ${gradleVersion} runs on Java ${ceiling} at most, and build machines carry only ${installed}. This pipeline will very likely fail before it compiles anything — upgrade the Gradle wrapper.`;
+    }
+    const highest = Math.max(...AVAILABLE_JAVA_VERSIONS);
+    if ((detectedJavaVersion ?? 0) > highest) {
+        return `This project declares Java ${detectedJavaVersion}, and build machines carry only ${installed}. Writing Java ${runnableJavaVersion(detectedJavaVersion, gradleVersion)} instead — asking for ${detectedJavaVersion} would fail at "Set the Java version".`;
+    }
+    return undefined;
+}
 // ---------------------------------------------------------------------------
 // Gitignore helper
 // ---------------------------------------------------------------------------
@@ -399,6 +582,7 @@ export async function scanAndroidProject(projectRoot) {
     // ------------------------------------------------------------------
     const gradleFiles = findGradleFiles(projectRoot);
     const detectedJavaVersion = detectRequiredJavaVersion(gradleFiles);
+    const detectedGradleVersion = detectGradleWrapperVersion(projectRoot);
     const buildVariants = detectBuildVariants(gradleFiles);
     // ------------------------------------------------------------------
     // 3. Scan Gradle files
@@ -605,7 +789,7 @@ export async function scanAndroidProject(projectRoot) {
             });
         }
     }
-    return { warnings, detectedJavaVersion, buildVariants };
+    return { warnings, detectedJavaVersion, detectedGradleVersion, buildVariants };
 }
 // ---------------------------------------------------------------------------
 // Formatter
@@ -622,9 +806,13 @@ const CATEGORY_LABELS = {
 export function formatScanResult(result) {
     const lines = [];
     const sep = "─".repeat(50);
-    // Always show the detected Java version
+    // Always show the detected Java version, and the one the pipeline will
+    // actually name — they differ whenever the declaration is below the oldest
+    // installed JDK or above the newest, and saying only the first made the
+    // second look like it had been honoured.
     if (result.detectedJavaVersion !== undefined) {
-        lines.push(`ℹ  Detected Java ${result.detectedJavaVersion} requirement — pipeline will use Java ${result.detectedJavaVersion}`);
+        const willUse = runnableJavaVersion(result.detectedJavaVersion, result.detectedGradleVersion);
+        lines.push(`ℹ  Detected Java ${result.detectedJavaVersion} requirement — pipeline will use Java ${willUse}`);
         lines.push("");
     }
     if (result.warnings.length === 0) {

package/dist/src/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoJD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAgL,EACvL,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA2NR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoJD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAgL,EACvL,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA2NR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}

package/dist/src/commands/build.js

@@ -1,7 +1,7 @@
 import { resolve } from "node:path";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import prompts from "prompts";
-import { scanAndroidProject, formatScanResult } from "./android-scanner.js";
+import { scanAndroidProject, formatScanResult, runnableJavaVersion, javaVersionProblem, } from "./android-scanner.js";
 import { scanIosProject, formatIosScanResult } from "./ios-scanner.js";
 import { SecretsManager } from "../yaml/secrets-manager.js";
 import { collectFileSecret } from "./file-secret-collector.js";
@@ -1064,10 +1064,10 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
         }
     }
     // 7. Generate and write the pipeline
-    // Source/target compatibility (e.g. VERSION_11) doesn't mean the build needs
-    // that exact JDK — a newer JDK can cross-compile. Enforce a minimum of 17
-    // since ubuntu-latest runners ship with JDK 17+ and JDK <17 is unavailable.
-    const javaVersion = Math.max(scanResult.detectedJavaVersion ?? 17, 17);
+    const javaVersion = runnableJavaVersion(scanResult.detectedJavaVersion, scanResult.detectedGradleVersion);
+    const javaProblem = javaVersionProblem(scanResult.detectedJavaVersion, scanResult.detectedGradleVersion);
+    if (javaProblem)
+        console.log(`\n⚠️  ${javaProblem}`);
     const yaml = generateAndroidPipeline(javaVersion, setupOptions, variants, cacheTechnology, options.metaNamespace, detectDefaultBranch());
     writeFileSync(outputPath, yaml, "utf-8");
     console.log("\n✅ Generated .ci/pipelines/cibuild.yml");

package/dist/src/yaml/cache-key-missing-file.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * A cache key that cannot be computed costs a cache, not a pipeline.
+ *
+ * `cache_key: pods-{{checksum "Podfile.lock"}}` in a repository with no
+ * Podfile.lock used to abort conversion, so the build died at `cache-pull`
+ * before compiling a single file — including in repositories that use Swift
+ * Package Manager and have no reason to own a CocoaPods lockfile at all.
+ * Every other step keeps the hard failure: a checksum in a real input is a
+ * value that step needs.
+ */
+export {};
+//# sourceMappingURL=cache-key-missing-file.test.d.ts.map

package/dist/src/yaml/cache-key-missing-file.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-key-missing-file.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/cache-key-missing-file.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}