@invarn/cibuild 2.6.8 → 2.6.9

package/dist/src/yaml/step-validator-self-assigned.test.d.ts

@@ -0,0 +1,23 @@
+/**
+ * A step does not owe itself the variables its own shell sets.
+ *
+ * Pre-execution validation auto-discovers every `$UPPERCASE` in a step's
+ * inputs and treats it as a value the pipeline must supply. For a `script`
+ * step the inputs *are* the shell body, so a variable the script computes was
+ * indistinguishable from one it needed handed to it — and because the check
+ * cannot prompt in a sandbox, the pipeline was refused before step 1 for
+ * values nothing was ever meant to provide.
+ *
+ * A generated multiplatform pipeline hit exactly that. Its prepare step opens
+ * with `INTEGRATION="$KMM_IOS_INTEGRATION"`, `IOS_DIR=$(dirname
+ * "$IOS_PROJECT_PATH")` and `for WORKSPACE in "$IOS_DIR"/*.xcworkspace`, and
+ * the run died on "3 required value(s) missing — INTEGRATION, IOS_DIR,
+ * WORKSPACE" while the two variables it genuinely reads were both declared and
+ * present. The iOS templates do the same thing with `IOS_DIR` alone.
+ *
+ * The load-bearing half of these tests is the second half: only the assignment
+ * *target* is excused, never the right-hand side, so a script cannot exempt
+ * itself from a value it reads by mentioning it.
+ */
+import '../yaml/steps/index.js';
+//# sourceMappingURL=step-validator-self-assigned.test.d.ts.map

package/dist/src/yaml/step-validator-self-assigned.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-validator-self-assigned.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator-self-assigned.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,wBAAwB,CAAC"}

package/dist/src/yaml/step-validator-self-assigned.test.js

@@ -0,0 +1,129 @@
+/**
+ * A step does not owe itself the variables its own shell sets.
+ *
+ * Pre-execution validation auto-discovers every `$UPPERCASE` in a step's
+ * inputs and treats it as a value the pipeline must supply. For a `script`
+ * step the inputs *are* the shell body, so a variable the script computes was
+ * indistinguishable from one it needed handed to it — and because the check
+ * cannot prompt in a sandbox, the pipeline was refused before step 1 for
+ * values nothing was ever meant to provide.
+ *
+ * A generated multiplatform pipeline hit exactly that. Its prepare step opens
+ * with `INTEGRATION="$KMM_IOS_INTEGRATION"`, `IOS_DIR=$(dirname
+ * "$IOS_PROJECT_PATH")` and `for WORKSPACE in "$IOS_DIR"/*.xcworkspace`, and
+ * the run died on "3 required value(s) missing — INTEGRATION, IOS_DIR,
+ * WORKSPACE" while the two variables it genuinely reads were both declared and
+ * present. The iOS templates do the same thing with `IOS_DIR` alone.
+ *
+ * The load-bearing half of these tests is the second half: only the assignment
+ * *target* is excused, never the right-hand side, so a script cannot exempt
+ * itself from a value it reads by mentioning it.
+ */
+import { describe, test, expect } from '@jest/globals';
+import '../yaml/steps/index.js';
+import { StepValidator, shellAssignedNames } from './step-validator.js';
+import { loadConfig } from '../config.js';
+const config = loadConfig();
+/** A one-script workflow, so the only issues are about its variables. */
+function scriptPipeline(content, envs = {}) {
+    return {
+        format_version: '1',
+        meta: { invarn: { stack: 'macos-xcode-26.4' } },
+        app: { envs: Object.entries(envs).map(([k, v]) => ({ [k]: v })) },
+        workflows: {
+            primary: {
+                steps: [{ 'script@1.0.0': { title: 'Prepare', inputs: { content } } }],
+            },
+        },
+    };
+}
+async function missingEnv(pipeline) {
+    const validator = new StepValidator(pipeline, 'primary', config);
+    const result = await validator.validateWorkflow();
+    return (result.issuesByCategory.get('environment') ?? [])
+        .map((i) => i.requirement.name)
+        .sort();
+}
+describe('shellAssignedNames', () => {
+    test('plain assignment, command substitution and quoted value', () => {
+        const found = shellAssignedNames({
+            content: [
+                'PLAIN=1',
+                'CAPTURED=$(dirname "$SOMEWHERE")',
+                'QUOTED="a b"',
+                'EMPTY=',
+            ].join('\n'),
+        });
+        expect([...found].sort()).toEqual(['CAPTURED', 'EMPTY', 'PLAIN', 'QUOTED']);
+    });
+    test('export, local, readonly, declare, typeset and append', () => {
+        const found = shellAssignedNames({
+            content: [
+                'export EXPORTED=1',
+                '  local SCOPED=2',
+                'readonly FROZEN=3',
+                'declare DECLARED=4',
+                'typeset TYPESET=5',
+                'APPENDED+=6',
+            ].join('\n'),
+        });
+        expect([...found].sort()).toEqual([
+            'APPENDED',
+            'DECLARED',
+            'EXPORTED',
+            'FROZEN',
+            'SCOPED',
+            'TYPESET',
+        ]);
+    });
+    test('loop and read bindings', () => {
+        const found = shellAssignedNames({
+            content: [
+                'for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do echo "$WORKSPACE"; done',
+                'select CHOICE in a b; do break; done',
+                'read -r LINE',
+                'echo x | while read -r KEY VALUE; do echo "$KEY"; done',
+            ].join('\n'),
+        });
+        expect([...found].sort()).toEqual(['CHOICE', 'KEY', 'LINE', 'VALUE', 'WORKSPACE']);
+    });
+    test('a flag that looks like an assignment is not one', () => {
+        const found = shellAssignedNames({
+            content: 'xcodebuild --setting FOO=1 -destination PLATFORM=iOS\ngradlew -PSOME=2',
+        });
+        expect([...found]).toEqual([]);
+    });
+    test('walks nested inputs, not just a top-level string', () => {
+        const found = shellAssignedNames({ inputs: { content: 'NESTED=1' }, other: ['ALSO=2'] });
+        expect([...found].sort()).toEqual(['ALSO', 'NESTED']);
+    });
+});
+describe('pre-execution validation and self-assigned variables', () => {
+    // The shape that was refused, reduced to its first three lines.
+    const PREPARE = [
+        'INTEGRATION="$KMM_IOS_INTEGRATION"',
+        'IOS_DIR=$(dirname "$IOS_PROJECT_PATH")',
+        'for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do echo "$WORKSPACE"; done',
+    ].join('\n');
+    test('asks for nothing when the script sets its own and the rest are declared', async () => {
+        expect(await missingEnv(scriptPipeline(PREPARE, {
+            KMM_IOS_INTEGRATION: 'direct',
+            IOS_PROJECT_PATH: 'iosApp/iosApp.xcodeproj',
+        }))).toEqual([]);
+    });
+    // The regression this relaxation could introduce, and the reason only the
+    // assignment target is excused: a script that READS a variable still needs
+    // it, even where it assigns something else from it on the same line.
+    test('still requires the right-hand side of a self-assignment', async () => {
+        expect(await missingEnv(scriptPipeline(PREPARE))).toEqual([
+            'IOS_PROJECT_PATH',
+            'KMM_IOS_INTEGRATION',
+        ]);
+    });
+    test('still requires a variable the script only reads', async () => {
+        expect(await missingEnv(scriptPipeline('SET_HERE=1\necho "$SET_HERE $NEVER_SET"'))).toEqual([
+            'NEVER_SET',
+        ]);
+    });
+});
+//# sourceMappingURL=step-validator-self-assigned.test.js.map

package/dist/src/yaml/step-validator.d.ts

@@ -8,6 +8,38 @@
 import type { YAMLPipeline } from './types.js';
 import type { CIConfig } from '../types.js';
 import type { WorkflowValidationResult } from './validation-types.js';
+/**
+ * Names a shell snippet assigns to itself, in every form a step script uses.
+ *
+ * The auto-discovery below treats every `$UPPERCASE` it finds in a step's
+ * inputs as a value the pipeline must supply. For a `script` step the inputs
+ * *are* the shell body, so a variable the script computes reads exactly like
+ * one it needs handed to it — and the run is refused for a value nothing was
+ * ever supposed to provide.
+ *
+ * That is not hypothetical. A generated multiplatform pipeline whose prepare
+ * step opens with
+ *
+ *     INTEGRATION="$KMM_IOS_INTEGRATION"
+ *     IOS_DIR=$(dirname "$IOS_PROJECT_PATH")
+ *     for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do …
+ *
+ * was refused before step 1 on "3 required value(s) missing — INTEGRATION,
+ * IOS_DIR, WORKSPACE", while the two variables it genuinely reads were both
+ * declared and present. The shell was correct; the reader was not.
+ *
+ * Only the assignment *target* is collected, never the right-hand side, so
+ * `INTEGRATION="$KMM_IOS_INTEGRATION"` still requires `KMM_IOS_INTEGRATION`.
+ * That is what keeps this from becoming a hole: a script cannot excuse itself
+ * from a value it reads by mentioning it.
+ *
+ * Assignment order is deliberately not modelled. A snippet that reads `$FOO`
+ * before setting it is a bug in the snippet, and guessing about it here would
+ * trade a false refusal for a different false refusal; "the script sets this
+ * somewhere" is the question worth asking, and erring toward letting the build
+ * run is the right direction for a check that cannot prompt.
+ */
+export declare function shellAssignedNames(obj: unknown): Set<string>;
 /**
  * StepValidator orchestrates pre-execution validation for a workflow.
  * It iterates through all steps, collects validation requirements,

package/dist/src/yaml/step-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;IAKxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAGvC,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAkN3D;;OAEG;YACW,mBAAmB;IAmEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}
+{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CA6B5D;AAED;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;IAKxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAGvC,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAwN3D;;OAEG;YACW,mBAAmB;IAmEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}

package/dist/src/yaml/step-validator.js

@@ -30,6 +30,71 @@ const POSIX_ENV_ALLOWLIST = new Set([
     'CIBUILD_SCRATCH',
     'JAVA_HOME',
 ]);
+/**
+ * Names a shell snippet assigns to itself, in every form a step script uses.
+ *
+ * The auto-discovery below treats every `$UPPERCASE` it finds in a step's
+ * inputs as a value the pipeline must supply. For a `script` step the inputs
+ * *are* the shell body, so a variable the script computes reads exactly like
+ * one it needs handed to it — and the run is refused for a value nothing was
+ * ever supposed to provide.
+ *
+ * That is not hypothetical. A generated multiplatform pipeline whose prepare
+ * step opens with
+ *
+ *     INTEGRATION="$KMM_IOS_INTEGRATION"
+ *     IOS_DIR=$(dirname "$IOS_PROJECT_PATH")
+ *     for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do …
+ *
+ * was refused before step 1 on "3 required value(s) missing — INTEGRATION,
+ * IOS_DIR, WORKSPACE", while the two variables it genuinely reads were both
+ * declared and present. The shell was correct; the reader was not.
+ *
+ * Only the assignment *target* is collected, never the right-hand side, so
+ * `INTEGRATION="$KMM_IOS_INTEGRATION"` still requires `KMM_IOS_INTEGRATION`.
+ * That is what keeps this from becoming a hole: a script cannot excuse itself
+ * from a value it reads by mentioning it.
+ *
+ * Assignment order is deliberately not modelled. A snippet that reads `$FOO`
+ * before setting it is a bug in the snippet, and guessing about it here would
+ * trade a false refusal for a different false refusal; "the script sets this
+ * somewhere" is the question worth asking, and erring toward letting the build
+ * run is the right direction for a check that cannot prompt.
+ */
+export function shellAssignedNames(obj) {
+    const names = new Set();
+    const collect = (text) => {
+        // `NAME=…`, `export NAME=…`, `local/readonly/declare/typeset NAME=…`, and
+        // `NAME+=…`. Anchored to the start of a command — line start, or after a
+        // separator — so `--flag=X` and `foo BAR=1` inside a longer word are not
+        // mistaken for assignments.
+        const assignment = /(?:^|[\n;&|(]|\|\||&&)[ \t]*(?:(?:export|readonly|local|declare|typeset)[ \t]+)?([A-Z_][A-Z_0-9]*)\+?=/g;
+        // `for NAME in …`, `select NAME in …`
+        const loop = /(?:^|[\n;&|(])[ \t]*(?:for|select)[ \t]+([A-Z_][A-Z_0-9]*)[ \t]+in\b/g;
+        // `read NAME`, `read -r NAME OTHER`, `while read -r NAME; do`
+        const read = /(?:^|[\n;&|(]|\|\||&&)[ \t]*(?:while[ \t]+)?read[ \t]+((?:-\S+[ \t]+)*)([A-Z_][A-Z_0-9]*(?:[ \t]+[A-Z_][A-Z_0-9]*)*)/g;
+        for (const re of [assignment, loop]) {
+            let m;
+            while ((m = re.exec(text)) !== null)
+                names.add(m[1]);
+        }
+        let m;
+        while ((m = read.exec(text)) !== null) {
+            for (const n of m[2].trim().split(/[ \t]+/))
+                names.add(n);
+        }
+    };
+    const walk = (value) => {
+        if (typeof value === 'string')
+            collect(value);
+        else if (Array.isArray(value))
+            value.forEach(walk);
+        else if (value && typeof value === 'object')
+            Object.values(value).forEach(walk);
+    };
+    walk(obj);
+    return names;
+}
 /**
  * StepValidator orchestrates pre-execution validation for a workflow.
  * It iterates through all steps, collects validation requirements,
@@ -169,10 +234,17 @@ export class StepValidator {
                 const resolvedEnv = this.envResolver.getAll();
                 const alreadyDeclared = new Set(requirements.map((r) => r.name));
                 const referencedVars = this.extractVariableReferences(parsedStep.inputs);
+                // Variables the step's own shell sets are not values anyone owes it.
+                const selfAssigned = shellAssignedNames(parsedStep.inputs);
                 for (const varName of referencedVars) {
                     // Skip POSIX vars the shell always provides
                     if (POSIX_ENV_ALLOWLIST.has(varName))
                         continue;
+                    // Skip anything this step's script assigns itself — a computed local
+                    // reads like a required input, and refusing on one stops a pipeline
+                    // for a value nothing was ever meant to supply.
+                    if (selfAssigned.has(varName))
+                        continue;
                     // Skip if already in resolved env (use hasOwnProperty so empty-string
                     // values set by the YAML/secrets are still treated as "provided")
                     if (Object.prototype.hasOwnProperty.call(resolvedEnv, varName))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.6.8",
+  "version": "2.6.9",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",