@invarn/cibuild 2.6.8 → 2.7.0

package/dist/src/yaml/env-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAgEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;gBAGrC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IA0BnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAkBpB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}
+{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;gBAGrC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAqCnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAkBpB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}

package/dist/src/yaml/env-resolver.js

@@ -8,6 +8,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { execSync } from 'child_process';
 import { SecretsManager } from './secrets-manager.js';
+import { shellAssignedNamesIn } from './shell-assignments.js';
 /**
  * Hints for common variables that require user configuration
  */
@@ -174,21 +175,31 @@ export class EnvResolver {
      */
     interpolate(str, stepName) {
         let result = str;
+        // A name this very string assigns is the shell's own, and substituting it
+        // is worse than demanding it: `IOS_DIR=$(dirname "$IOS_PROJECT_PATH")`
+        // followed by `"$IOS_DIR"` would get a pipeline value pasted in instead of
+        // the one `dirname` had just computed, so a defined variable would corrupt
+        // the script and an undefined one would refuse the build. Left for the
+        // shell, which is the only thing that can evaluate it. Only the assignment
+        // target is spared — the right-hand side is still resolved here.
+        const selfAssigned = shellAssignedNamesIn(str);
         // Format 1: {{checksum "file"}}
         result = result.replace(/\{\{checksum "([^"]+)"\}\}/g, (match, filePath) => {
             return this.computeChecksum(filePath, stepName);
         });
-        // Format 2: {{getenv "VAR"}}
+        // Format 2: {{getenv "VAR"}} — an explicit request, so it is honoured even
+        // where the snippet also assigns that name. Asking by name is not the same
+        // as a bare `$VAR` the shell was always going to expand itself.
         result = result.replace(/\{\{getenv "([^"]+)"\}\}/g, (match, varName) => {
             return this.resolveVar(varName, stepName);
         });
         // Format 3: ${VAR}
         result = result.replace(/\$\{([A-Z_][A-Z0-9_]*)\}/g, (match, varName) => {
-            return this.resolveVar(varName, stepName);
+            return selfAssigned.has(varName) ? match : this.resolveVar(varName, stepName);
         });
         // Format 4: $VAR (must not be followed by alphanumeric or underscore)
         result = result.replace(/\$([A-Z_][A-Z0-9_]*)(?![A-Z0-9_])/g, (match, varName) => {
-            return this.resolveVar(varName, stepName);
+            return selfAssigned.has(varName) ? match : this.resolveVar(varName, stepName);
         });
         return result;
     }

package/dist/src/yaml/shell-assignments.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Which names a shell snippet binds for itself.
+ *
+ * Two different parts of this codebase scan a step's inputs for `$UPPERCASE`
+ * and act on every hit — the pre-execution validator, which demands each one
+ * be supplied, and the env resolver, which *substitutes* each one. For a
+ * `script` step the inputs are the shell body, so a variable the script
+ * computes is indistinguishable from one it needs handed to it. Both were
+ * wrong about the same thing, so they share one answer.
+ *
+ * A generated multiplatform pipeline made it plain. Its prepare step opens
+ *
+ *     INTEGRATION="$KMM_IOS_INTEGRATION"
+ *     IOS_DIR=$(dirname "$IOS_PROJECT_PATH")
+ *     for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do …
+ *
+ * and no build could start: the validator refused for three values nothing was
+ * meant to provide, and the resolver would have gone further and *rewritten*
+ * the body, replacing `"$IOS_DIR"` with a pipeline value instead of the one
+ * `dirname` had just computed. Substituting a shell local is not a missing
+ * value at all; it is a corrupted script.
+ *
+ * **Only the assignment target is collected, never the right-hand side.** That
+ * is what keeps this from being a hole: `INTEGRATION="$KMM_IOS_INTEGRATION"`
+ * still needs `KMM_IOS_INTEGRATION`, so a script cannot excuse itself from a
+ * value it reads by mentioning it.
+ *
+ * Assignment order is deliberately not modelled. A snippet that reads a
+ * variable before setting it is a bug in the snippet, and guessing about it
+ * here would trade one wrong answer for another; "does the script set this
+ * itself?" is the question worth asking.
+ */
+/** The names one snippet of shell assigns to itself. */
+export declare function shellAssignedNamesIn(text: string): Set<string>;
+/**
+ * The same question asked of a whole inputs object, walked recursively — what
+ * the validator needs, because it reasons about a step rather than a string.
+ */
+export declare function shellAssignedNames(obj: unknown): Set<string>;
+//# sourceMappingURL=shell-assignments.d.ts.map

package/dist/src/yaml/shell-assignments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-assignments.d.ts","sourceRoot":"","sources":["../../../src/yaml/shell-assignments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAaH,wDAAwD;AACxD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAa9D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAa5D"}

package/dist/src/yaml/shell-assignments.js

@@ -0,0 +1,77 @@
+/**
+ * Which names a shell snippet binds for itself.
+ *
+ * Two different parts of this codebase scan a step's inputs for `$UPPERCASE`
+ * and act on every hit — the pre-execution validator, which demands each one
+ * be supplied, and the env resolver, which *substitutes* each one. For a
+ * `script` step the inputs are the shell body, so a variable the script
+ * computes is indistinguishable from one it needs handed to it. Both were
+ * wrong about the same thing, so they share one answer.
+ *
+ * A generated multiplatform pipeline made it plain. Its prepare step opens
+ *
+ *     INTEGRATION="$KMM_IOS_INTEGRATION"
+ *     IOS_DIR=$(dirname "$IOS_PROJECT_PATH")
+ *     for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do …
+ *
+ * and no build could start: the validator refused for three values nothing was
+ * meant to provide, and the resolver would have gone further and *rewritten*
+ * the body, replacing `"$IOS_DIR"` with a pipeline value instead of the one
+ * `dirname` had just computed. Substituting a shell local is not a missing
+ * value at all; it is a corrupted script.
+ *
+ * **Only the assignment target is collected, never the right-hand side.** That
+ * is what keeps this from being a hole: `INTEGRATION="$KMM_IOS_INTEGRATION"`
+ * still needs `KMM_IOS_INTEGRATION`, so a script cannot excuse itself from a
+ * value it reads by mentioning it.
+ *
+ * Assignment order is deliberately not modelled. A snippet that reads a
+ * variable before setting it is a bug in the snippet, and guessing about it
+ * here would trade one wrong answer for another; "does the script set this
+ * itself?" is the question worth asking.
+ */
+/** `NAME=…`, `export NAME=…`, `local/readonly/declare/typeset NAME=…`, `NAME+=…` */
+const ASSIGNMENT = /(?:^|[\n;&|(]|\|\||&&)[ \t]*(?:(?:export|readonly|local|declare|typeset)[ \t]+)?([A-Z_][A-Z_0-9]*)\+?=/g;
+/** `for NAME in …`, `select NAME in …` */
+const LOOP = /(?:^|[\n;&|(])[ \t]*(?:for|select)[ \t]+([A-Z_][A-Z_0-9]*)[ \t]+in\b/g;
+/** `read NAME`, `read -r NAME OTHER`, `while read -r NAME` */
+const READ = /(?:^|[\n;&|(]|\|\||&&)[ \t]*(?:while[ \t]+)?read[ \t]+((?:-\S+[ \t]+)*)([A-Z_][A-Z_0-9]*(?:[ \t]+[A-Z_][A-Z_0-9]*)*)/g;
+/** The names one snippet of shell assigns to itself. */
+export function shellAssignedNamesIn(text) {
+    const names = new Set();
+    for (const re of [ASSIGNMENT, LOOP]) {
+        re.lastIndex = 0;
+        let m;
+        while ((m = re.exec(text)) !== null)
+            names.add(m[1]);
+    }
+    READ.lastIndex = 0;
+    let m;
+    while ((m = READ.exec(text)) !== null) {
+        for (const n of m[2].trim().split(/[ \t]+/))
+            names.add(n);
+    }
+    return names;
+}
+/**
+ * The same question asked of a whole inputs object, walked recursively — what
+ * the validator needs, because it reasons about a step rather than a string.
+ */
+export function shellAssignedNames(obj) {
+    const names = new Set();
+    const walk = (value) => {
+        if (typeof value === 'string') {
+            for (const n of shellAssignedNamesIn(value))
+                names.add(n);
+        }
+        else if (Array.isArray(value)) {
+            value.forEach(walk);
+        }
+        else if (value && typeof value === 'object') {
+            Object.values(value).forEach(walk);
+        }
+    };
+    walk(obj);
+    return names;
+}
+//# sourceMappingURL=shell-assignments.js.map

package/dist/src/yaml/step-validator-self-assigned.test.d.ts

@@ -0,0 +1,23 @@
+/**
+ * A step does not owe itself the variables its own shell sets.
+ *
+ * Pre-execution validation auto-discovers every `$UPPERCASE` in a step's
+ * inputs and treats it as a value the pipeline must supply. For a `script`
+ * step the inputs *are* the shell body, so a variable the script computes was
+ * indistinguishable from one it needed handed to it — and because the check
+ * cannot prompt in a sandbox, the pipeline was refused before step 1 for
+ * values nothing was ever meant to provide.
+ *
+ * A generated multiplatform pipeline hit exactly that. Its prepare step opens
+ * with `INTEGRATION="$KMM_IOS_INTEGRATION"`, `IOS_DIR=$(dirname
+ * "$IOS_PROJECT_PATH")` and `for WORKSPACE in "$IOS_DIR"/*.xcworkspace`, and
+ * the run died on "3 required value(s) missing — INTEGRATION, IOS_DIR,
+ * WORKSPACE" while the two variables it genuinely reads were both declared and
+ * present. The iOS templates do the same thing with `IOS_DIR` alone.
+ *
+ * The load-bearing half of these tests is the second half: only the assignment
+ * *target* is excused, never the right-hand side, so a script cannot exempt
+ * itself from a value it reads by mentioning it.
+ */
+import '../yaml/steps/index.js';
+//# sourceMappingURL=step-validator-self-assigned.test.d.ts.map

package/dist/src/yaml/step-validator-self-assigned.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-validator-self-assigned.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator-self-assigned.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,wBAAwB,CAAC"}

package/dist/src/yaml/step-validator-self-assigned.test.js

@@ -0,0 +1,191 @@
+/**
+ * A step does not owe itself the variables its own shell sets.
+ *
+ * Pre-execution validation auto-discovers every `$UPPERCASE` in a step's
+ * inputs and treats it as a value the pipeline must supply. For a `script`
+ * step the inputs *are* the shell body, so a variable the script computes was
+ * indistinguishable from one it needed handed to it — and because the check
+ * cannot prompt in a sandbox, the pipeline was refused before step 1 for
+ * values nothing was ever meant to provide.
+ *
+ * A generated multiplatform pipeline hit exactly that. Its prepare step opens
+ * with `INTEGRATION="$KMM_IOS_INTEGRATION"`, `IOS_DIR=$(dirname
+ * "$IOS_PROJECT_PATH")` and `for WORKSPACE in "$IOS_DIR"/*.xcworkspace`, and
+ * the run died on "3 required value(s) missing — INTEGRATION, IOS_DIR,
+ * WORKSPACE" while the two variables it genuinely reads were both declared and
+ * present. The iOS templates do the same thing with `IOS_DIR` alone.
+ *
+ * The load-bearing half of these tests is the second half: only the assignment
+ * *target* is excused, never the right-hand side, so a script cannot exempt
+ * itself from a value it reads by mentioning it.
+ */
+import { describe, test, expect } from '@jest/globals';
+import '../yaml/steps/index.js';
+import { StepValidator } from './step-validator.js';
+import { EnvResolver } from './env-resolver.js';
+import { shellAssignedNames } from './shell-assignments.js';
+import { loadConfig } from '../config.js';
+const config = loadConfig();
+/** A one-script workflow, so the only issues are about its variables. */
+function scriptPipeline(content, envs = {}) {
+    return {
+        format_version: '1',
+        meta: { invarn: { stack: 'macos-xcode-26.4' } },
+        app: { envs: Object.entries(envs).map(([k, v]) => ({ [k]: v })) },
+        workflows: {
+            primary: {
+                steps: [{ 'script@1.0.0': { title: 'Prepare', inputs: { content } } }],
+            },
+        },
+    };
+}
+async function missingEnv(pipeline) {
+    const validator = new StepValidator(pipeline, 'primary', config);
+    const result = await validator.validateWorkflow();
+    return (result.issuesByCategory.get('environment') ?? [])
+        .map((i) => i.requirement.name)
+        .sort();
+}
+describe('shellAssignedNames', () => {
+    test('plain assignment, command substitution and quoted value', () => {
+        const found = shellAssignedNames({
+            content: [
+                'PLAIN=1',
+                'CAPTURED=$(dirname "$SOMEWHERE")',
+                'QUOTED="a b"',
+                'EMPTY=',
+            ].join('\n'),
+        });
+        expect([...found].sort()).toEqual(['CAPTURED', 'EMPTY', 'PLAIN', 'QUOTED']);
+    });
+    test('export, local, readonly, declare, typeset and append', () => {
+        const found = shellAssignedNames({
+            content: [
+                'export EXPORTED=1',
+                '  local SCOPED=2',
+                'readonly FROZEN=3',
+                'declare DECLARED=4',
+                'typeset TYPESET=5',
+                'APPENDED+=6',
+            ].join('\n'),
+        });
+        expect([...found].sort()).toEqual([
+            'APPENDED',
+            'DECLARED',
+            'EXPORTED',
+            'FROZEN',
+            'SCOPED',
+            'TYPESET',
+        ]);
+    });
+    test('loop and read bindings', () => {
+        const found = shellAssignedNames({
+            content: [
+                'for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do echo "$WORKSPACE"; done',
+                'select CHOICE in a b; do break; done',
+                'read -r LINE',
+                'echo x | while read -r KEY VALUE; do echo "$KEY"; done',
+            ].join('\n'),
+        });
+        expect([...found].sort()).toEqual(['CHOICE', 'KEY', 'LINE', 'VALUE', 'WORKSPACE']);
+    });
+    test('a flag that looks like an assignment is not one', () => {
+        const found = shellAssignedNames({
+            content: 'xcodebuild --setting FOO=1 -destination PLATFORM=iOS\ngradlew -PSOME=2',
+        });
+        expect([...found]).toEqual([]);
+    });
+    test('walks nested inputs, not just a top-level string', () => {
+        const found = shellAssignedNames({ inputs: { content: 'NESTED=1' }, other: ['ALSO=2'] });
+        expect([...found].sort()).toEqual(['ALSO', 'NESTED']);
+    });
+});
+describe('pre-execution validation and self-assigned variables', () => {
+    // The shape that was refused, reduced to its first three lines.
+    const PREPARE = [
+        'INTEGRATION="$KMM_IOS_INTEGRATION"',
+        'IOS_DIR=$(dirname "$IOS_PROJECT_PATH")',
+        'for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do echo "$WORKSPACE"; done',
+    ].join('\n');
+    test('asks for nothing when the script sets its own and the rest are declared', async () => {
+        expect(await missingEnv(scriptPipeline(PREPARE, {
+            KMM_IOS_INTEGRATION: 'direct',
+            IOS_PROJECT_PATH: 'iosApp/iosApp.xcodeproj',
+        }))).toEqual([]);
+    });
+    // The regression this relaxation could introduce, and the reason only the
+    // assignment target is excused: a script that READS a variable still needs
+    // it, even where it assigns something else from it on the same line.
+    test('still requires the right-hand side of a self-assignment', async () => {
+        expect(await missingEnv(scriptPipeline(PREPARE))).toEqual([
+            'IOS_PROJECT_PATH',
+            'KMM_IOS_INTEGRATION',
+        ]);
+    });
+    test('still requires a variable the script only reads', async () => {
+        expect(await missingEnv(scriptPipeline('SET_HERE=1\necho "$SET_HERE $NEVER_SET"'))).toEqual([
+            'NEVER_SET',
+        ]);
+    });
+});
+/**
+ * The resolver half, and the worse half.
+ *
+ * `StepValidator` only *demands* a script's own locals. `EnvResolver`
+ * SUBSTITUTES them — so a defined `IOS_DIR` would paste a pipeline value over
+ * the one `dirname` had just computed, and an undefined one refuses the build.
+ * Both are wrong; leaving the reference for the shell is the only correct
+ * answer, and it is the same thing `registerStepOutput` already does for a
+ * value a previous step exports.
+ */
+describe('EnvResolver leaves a script its own locals', () => {
+    const PREPARE = [
+        'INTEGRATION="$KMM_IOS_INTEGRATION"',
+        'IOS_DIR=$(dirname "$IOS_PROJECT_PATH")',
+        'echo "$INTEGRATION in $IOS_DIR"',
+        'for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do echo "$WORKSPACE"; done',
+    ].join('\n');
+    function resolver(envs) {
+        const pipeline = {
+            format_version: '1',
+            app: { envs: Object.entries(envs).map(([k, v]) => ({ [k]: v })) },
+            workflows: { primary: { steps: [] } },
+        };
+        return new EnvResolver(pipeline, pipeline.workflows.primary, 'primary', 'macos');
+    }
+    test('does not substitute or demand what the snippet assigns', () => {
+        const out = resolver({
+            KMM_IOS_INTEGRATION: 'cocoapods',
+            IOS_PROJECT_PATH: 'iosApp/iosApp.xcodeproj',
+        }).interpolate(PREPARE, 'Prepare the iOS build');
+        // The right-hand sides ARE resolved…
+        expect(out).toContain('INTEGRATION="cocoapods"');
+        expect(out).toContain('IOS_DIR=$(dirname "iosApp/iosApp.xcodeproj")');
+        // …and the locals are left for the shell, verbatim.
+        expect(out).toContain('echo "$INTEGRATION in $IOS_DIR"');
+        expect(out).toContain('for WORKSPACE in "$IOS_DIR"/*.xcworkspace');
+        expect(out).toContain('echo "$WORKSPACE"');
+    });
+    // Before the fix this threw MissingEnvironmentVariableError for INTEGRATION,
+    // which is what stopped every generated KMM and iOS pipeline before step 1.
+    test('does not throw for a local the snippet assigns', () => {
+        expect(() => resolver({
+            KMM_IOS_INTEGRATION: 'direct',
+            IOS_PROJECT_PATH: 'iosApp/iosApp.xcodeproj',
+        }).interpolate(PREPARE, 'Prepare the iOS build')).not.toThrow();
+    });
+    // The regression guard: a value the script only READS is still required.
+    test('still throws for a variable the snippet only reads', () => {
+        expect(() => resolver({}).interpolate(PREPARE, 'Prepare the iOS build')).toThrow(/Missing environment variable: 'KMM_IOS_INTEGRATION'/);
+    });
+    test('substitutes normally where the snippet assigns nothing', () => {
+        expect(resolver({ IOS_SCHEME: 'Hush iOS' }).interpolate('xcodebuild -scheme "$IOS_SCHEME"'))
+            .toBe('xcodebuild -scheme "Hush iOS"');
+    });
+    // `{{getenv "X"}}` is an explicit request by name, not a bare shell
+    // expansion, so it is honoured even where the snippet also assigns X.
+    test('still honours an explicit {{getenv}} for an assigned name', () => {
+        expect(resolver({ IOS_DIR: 'from-pipeline' }).interpolate('IOS_DIR=x\necho {{getenv "IOS_DIR"}}')).toContain('echo from-pipeline');
+    });
+});
+//# sourceMappingURL=step-validator-self-assigned.test.js.map

package/dist/src/yaml/step-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;IAKxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAGvC,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAkN3D;;OAEG;YACW,mBAAmB;IAmEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}
+{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;IAKxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAGvC,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAwN3D;;OAEG;YACW,mBAAmB;IAmEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}

package/dist/src/yaml/step-validator.js

@@ -7,6 +7,7 @@
  */
 import { getStepExecutor, hasStep, getStepMetadata } from './steps/registry.js';
 import { EnvResolver } from './env-resolver.js';
+import { shellAssignedNames } from './shell-assignments.js';
 import { detectPlatformInfo } from './platform-detector.js';
 import { declaresMultiplatformApp } from './meta-helpers.js';
 // POSIX env vars the shell always provides — don't flag these as undeclared.
@@ -169,10 +170,17 @@ export class StepValidator {
                 const resolvedEnv = this.envResolver.getAll();
                 const alreadyDeclared = new Set(requirements.map((r) => r.name));
                 const referencedVars = this.extractVariableReferences(parsedStep.inputs);
+                // Variables the step's own shell sets are not values anyone owes it.
+                const selfAssigned = shellAssignedNames(parsedStep.inputs);
                 for (const varName of referencedVars) {
                     // Skip POSIX vars the shell always provides
                     if (POSIX_ENV_ALLOWLIST.has(varName))
                         continue;
+                    // Skip anything this step's script assigns itself — a computed local
+                    // reads like a required input, and refusing on one stops a pipeline
+                    // for a value nothing was ever meant to supply.
+                    if (selfAssigned.has(varName))
+                        continue;
                     // Skip if already in resolved env (use hasOwnProperty so empty-string
                     // values set by the YAML/secrets are still treated as "provided")
                     if (Object.prototype.hasOwnProperty.call(resolvedEnv, varName))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.6.8",
+  "version": "2.7.0",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",