@invarn/cibuild 2.6.9 → 2.7.0

package/dist/src/yaml/env-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAgEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;gBAGrC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IA0BnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAkBpB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}
+{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;gBAGrC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAqCnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAkBpB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}

package/dist/src/yaml/env-resolver.js

@@ -8,6 +8,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { execSync } from 'child_process';
 import { SecretsManager } from './secrets-manager.js';
+import { shellAssignedNamesIn } from './shell-assignments.js';
 /**
  * Hints for common variables that require user configuration
  */
@@ -174,21 +175,31 @@ export class EnvResolver {
      */
     interpolate(str, stepName) {
         let result = str;
+        // A name this very string assigns is the shell's own, and substituting it
+        // is worse than demanding it: `IOS_DIR=$(dirname "$IOS_PROJECT_PATH")`
+        // followed by `"$IOS_DIR"` would get a pipeline value pasted in instead of
+        // the one `dirname` had just computed, so a defined variable would corrupt
+        // the script and an undefined one would refuse the build. Left for the
+        // shell, which is the only thing that can evaluate it. Only the assignment
+        // target is spared — the right-hand side is still resolved here.
+        const selfAssigned = shellAssignedNamesIn(str);
         // Format 1: {{checksum "file"}}
         result = result.replace(/\{\{checksum "([^"]+)"\}\}/g, (match, filePath) => {
             return this.computeChecksum(filePath, stepName);
         });
-        // Format 2: {{getenv "VAR"}}
+        // Format 2: {{getenv "VAR"}} — an explicit request, so it is honoured even
+        // where the snippet also assigns that name. Asking by name is not the same
+        // as a bare `$VAR` the shell was always going to expand itself.
         result = result.replace(/\{\{getenv "([^"]+)"\}\}/g, (match, varName) => {
             return this.resolveVar(varName, stepName);
         });
         // Format 3: ${VAR}
         result = result.replace(/\$\{([A-Z_][A-Z0-9_]*)\}/g, (match, varName) => {
-            return this.resolveVar(varName, stepName);
+            return selfAssigned.has(varName) ? match : this.resolveVar(varName, stepName);
         });
         // Format 4: $VAR (must not be followed by alphanumeric or underscore)
         result = result.replace(/\$([A-Z_][A-Z0-9_]*)(?![A-Z0-9_])/g, (match, varName) => {
-            return this.resolveVar(varName, stepName);
+            return selfAssigned.has(varName) ? match : this.resolveVar(varName, stepName);
         });
         return result;
     }

package/dist/src/yaml/shell-assignments.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Which names a shell snippet binds for itself.
+ *
+ * Two different parts of this codebase scan a step's inputs for `$UPPERCASE`
+ * and act on every hit — the pre-execution validator, which demands each one
+ * be supplied, and the env resolver, which *substitutes* each one. For a
+ * `script` step the inputs are the shell body, so a variable the script
+ * computes is indistinguishable from one it needs handed to it. Both were
+ * wrong about the same thing, so they share one answer.
+ *
+ * A generated multiplatform pipeline made it plain. Its prepare step opens
+ *
+ *     INTEGRATION="$KMM_IOS_INTEGRATION"
+ *     IOS_DIR=$(dirname "$IOS_PROJECT_PATH")
+ *     for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do …
+ *
+ * and no build could start: the validator refused for three values nothing was
+ * meant to provide, and the resolver would have gone further and *rewritten*
+ * the body, replacing `"$IOS_DIR"` with a pipeline value instead of the one
+ * `dirname` had just computed. Substituting a shell local is not a missing
+ * value at all; it is a corrupted script.
+ *
+ * **Only the assignment target is collected, never the right-hand side.** That
+ * is what keeps this from being a hole: `INTEGRATION="$KMM_IOS_INTEGRATION"`
+ * still needs `KMM_IOS_INTEGRATION`, so a script cannot excuse itself from a
+ * value it reads by mentioning it.
+ *
+ * Assignment order is deliberately not modelled. A snippet that reads a
+ * variable before setting it is a bug in the snippet, and guessing about it
+ * here would trade one wrong answer for another; "does the script set this
+ * itself?" is the question worth asking.
+ */
+/** The names one snippet of shell assigns to itself. */
+export declare function shellAssignedNamesIn(text: string): Set<string>;
+/**
+ * The same question asked of a whole inputs object, walked recursively — what
+ * the validator needs, because it reasons about a step rather than a string.
+ */
+export declare function shellAssignedNames(obj: unknown): Set<string>;
+//# sourceMappingURL=shell-assignments.d.ts.map

package/dist/src/yaml/shell-assignments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-assignments.d.ts","sourceRoot":"","sources":["../../../src/yaml/shell-assignments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAaH,wDAAwD;AACxD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAa9D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAa5D"}

package/dist/src/yaml/shell-assignments.js

@@ -0,0 +1,77 @@
+/**
+ * Which names a shell snippet binds for itself.
+ *
+ * Two different parts of this codebase scan a step's inputs for `$UPPERCASE`
+ * and act on every hit — the pre-execution validator, which demands each one
+ * be supplied, and the env resolver, which *substitutes* each one. For a
+ * `script` step the inputs are the shell body, so a variable the script
+ * computes is indistinguishable from one it needs handed to it. Both were
+ * wrong about the same thing, so they share one answer.
+ *
+ * A generated multiplatform pipeline made it plain. Its prepare step opens
+ *
+ *     INTEGRATION="$KMM_IOS_INTEGRATION"
+ *     IOS_DIR=$(dirname "$IOS_PROJECT_PATH")
+ *     for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do …
+ *
+ * and no build could start: the validator refused for three values nothing was
+ * meant to provide, and the resolver would have gone further and *rewritten*
+ * the body, replacing `"$IOS_DIR"` with a pipeline value instead of the one
+ * `dirname` had just computed. Substituting a shell local is not a missing
+ * value at all; it is a corrupted script.
+ *
+ * **Only the assignment target is collected, never the right-hand side.** That
+ * is what keeps this from being a hole: `INTEGRATION="$KMM_IOS_INTEGRATION"`
+ * still needs `KMM_IOS_INTEGRATION`, so a script cannot excuse itself from a
+ * value it reads by mentioning it.
+ *
+ * Assignment order is deliberately not modelled. A snippet that reads a
+ * variable before setting it is a bug in the snippet, and guessing about it
+ * here would trade one wrong answer for another; "does the script set this
+ * itself?" is the question worth asking.
+ */
+/** `NAME=…`, `export NAME=…`, `local/readonly/declare/typeset NAME=…`, `NAME+=…` */
+const ASSIGNMENT = /(?:^|[\n;&|(]|\|\||&&)[ \t]*(?:(?:export|readonly|local|declare|typeset)[ \t]+)?([A-Z_][A-Z_0-9]*)\+?=/g;
+/** `for NAME in …`, `select NAME in …` */
+const LOOP = /(?:^|[\n;&|(])[ \t]*(?:for|select)[ \t]+([A-Z_][A-Z_0-9]*)[ \t]+in\b/g;
+/** `read NAME`, `read -r NAME OTHER`, `while read -r NAME` */
+const READ = /(?:^|[\n;&|(]|\|\||&&)[ \t]*(?:while[ \t]+)?read[ \t]+((?:-\S+[ \t]+)*)([A-Z_][A-Z_0-9]*(?:[ \t]+[A-Z_][A-Z_0-9]*)*)/g;
+/** The names one snippet of shell assigns to itself. */
+export function shellAssignedNamesIn(text) {
+    const names = new Set();
+    for (const re of [ASSIGNMENT, LOOP]) {
+        re.lastIndex = 0;
+        let m;
+        while ((m = re.exec(text)) !== null)
+            names.add(m[1]);
+    }
+    READ.lastIndex = 0;
+    let m;
+    while ((m = READ.exec(text)) !== null) {
+        for (const n of m[2].trim().split(/[ \t]+/))
+            names.add(n);
+    }
+    return names;
+}
+/**
+ * The same question asked of a whole inputs object, walked recursively — what
+ * the validator needs, because it reasons about a step rather than a string.
+ */
+export function shellAssignedNames(obj) {
+    const names = new Set();
+    const walk = (value) => {
+        if (typeof value === 'string') {
+            for (const n of shellAssignedNamesIn(value))
+                names.add(n);
+        }
+        else if (Array.isArray(value)) {
+            value.forEach(walk);
+        }
+        else if (value && typeof value === 'object') {
+            Object.values(value).forEach(walk);
+        }
+    };
+    walk(obj);
+    return names;
+}
+//# sourceMappingURL=shell-assignments.js.map

package/dist/src/yaml/step-validator-self-assigned.test.js

@@ -21,7 +21,9 @@
  */
 import { describe, test, expect } from '@jest/globals';
 import '../yaml/steps/index.js';
-import { StepValidator, shellAssignedNames } from './step-validator.js';
+import { StepValidator } from './step-validator.js';
+import { EnvResolver } from './env-resolver.js';
+import { shellAssignedNames } from './shell-assignments.js';
 import { loadConfig } from '../config.js';
 const config = loadConfig();
 /** A one-script workflow, so the only issues are about its variables. */
@@ -126,4 +128,64 @@ describe('pre-execution validation and self-assigned variables', () => {
         ]);
     });
 });
+/**
+ * The resolver half, and the worse half.
+ *
+ * `StepValidator` only *demands* a script's own locals. `EnvResolver`
+ * SUBSTITUTES them — so a defined `IOS_DIR` would paste a pipeline value over
+ * the one `dirname` had just computed, and an undefined one refuses the build.
+ * Both are wrong; leaving the reference for the shell is the only correct
+ * answer, and it is the same thing `registerStepOutput` already does for a
+ * value a previous step exports.
+ */
+describe('EnvResolver leaves a script its own locals', () => {
+    const PREPARE = [
+        'INTEGRATION="$KMM_IOS_INTEGRATION"',
+        'IOS_DIR=$(dirname "$IOS_PROJECT_PATH")',
+        'echo "$INTEGRATION in $IOS_DIR"',
+        'for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do echo "$WORKSPACE"; done',
+    ].join('\n');
+    function resolver(envs) {
+        const pipeline = {
+            format_version: '1',
+            app: { envs: Object.entries(envs).map(([k, v]) => ({ [k]: v })) },
+            workflows: { primary: { steps: [] } },
+        };
+        return new EnvResolver(pipeline, pipeline.workflows.primary, 'primary', 'macos');
+    }
+    test('does not substitute or demand what the snippet assigns', () => {
+        const out = resolver({
+            KMM_IOS_INTEGRATION: 'cocoapods',
+            IOS_PROJECT_PATH: 'iosApp/iosApp.xcodeproj',
+        }).interpolate(PREPARE, 'Prepare the iOS build');
+        // The right-hand sides ARE resolved…
+        expect(out).toContain('INTEGRATION="cocoapods"');
+        expect(out).toContain('IOS_DIR=$(dirname "iosApp/iosApp.xcodeproj")');
+        // …and the locals are left for the shell, verbatim.
+        expect(out).toContain('echo "$INTEGRATION in $IOS_DIR"');
+        expect(out).toContain('for WORKSPACE in "$IOS_DIR"/*.xcworkspace');
+        expect(out).toContain('echo "$WORKSPACE"');
+    });
+    // Before the fix this threw MissingEnvironmentVariableError for INTEGRATION,
+    // which is what stopped every generated KMM and iOS pipeline before step 1.
+    test('does not throw for a local the snippet assigns', () => {
+        expect(() => resolver({
+            KMM_IOS_INTEGRATION: 'direct',
+            IOS_PROJECT_PATH: 'iosApp/iosApp.xcodeproj',
+        }).interpolate(PREPARE, 'Prepare the iOS build')).not.toThrow();
+    });
+    // The regression guard: a value the script only READS is still required.
+    test('still throws for a variable the snippet only reads', () => {
+        expect(() => resolver({}).interpolate(PREPARE, 'Prepare the iOS build')).toThrow(/Missing environment variable: 'KMM_IOS_INTEGRATION'/);
+    });
+    test('substitutes normally where the snippet assigns nothing', () => {
+        expect(resolver({ IOS_SCHEME: 'Hush iOS' }).interpolate('xcodebuild -scheme "$IOS_SCHEME"'))
+            .toBe('xcodebuild -scheme "Hush iOS"');
+    });
+    // `{{getenv "X"}}` is an explicit request by name, not a bare shell
+    // expansion, so it is honoured even where the snippet also assigns X.
+    test('still honours an explicit {{getenv}} for an assigned name', () => {
+        expect(resolver({ IOS_DIR: 'from-pipeline' }).interpolate('IOS_DIR=x\necho {{getenv "IOS_DIR"}}')).toContain('echo from-pipeline');
+    });
+});
 //# sourceMappingURL=step-validator-self-assigned.test.js.map

package/dist/src/yaml/step-validator.d.ts

@@ -8,38 +8,6 @@
 import type { YAMLPipeline } from './types.js';
 import type { CIConfig } from '../types.js';
 import type { WorkflowValidationResult } from './validation-types.js';
-/**
- * Names a shell snippet assigns to itself, in every form a step script uses.
- *
- * The auto-discovery below treats every `$UPPERCASE` it finds in a step's
- * inputs as a value the pipeline must supply. For a `script` step the inputs
- * *are* the shell body, so a variable the script computes reads exactly like
- * one it needs handed to it — and the run is refused for a value nothing was
- * ever supposed to provide.
- *
- * That is not hypothetical. A generated multiplatform pipeline whose prepare
- * step opens with
- *
- *     INTEGRATION="$KMM_IOS_INTEGRATION"
- *     IOS_DIR=$(dirname "$IOS_PROJECT_PATH")
- *     for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do …
- *
- * was refused before step 1 on "3 required value(s) missing — INTEGRATION,
- * IOS_DIR, WORKSPACE", while the two variables it genuinely reads were both
- * declared and present. The shell was correct; the reader was not.
- *
- * Only the assignment *target* is collected, never the right-hand side, so
- * `INTEGRATION="$KMM_IOS_INTEGRATION"` still requires `KMM_IOS_INTEGRATION`.
- * That is what keeps this from becoming a hole: a script cannot excuse itself
- * from a value it reads by mentioning it.
- *
- * Assignment order is deliberately not modelled. A snippet that reads `$FOO`
- * before setting it is a bug in the snippet, and guessing about it here would
- * trade a false refusal for a different false refusal; "the script sets this
- * somewhere" is the question worth asking, and erring toward letting the build
- * run is the right direction for a check that cannot prompt.
- */
-export declare function shellAssignedNames(obj: unknown): Set<string>;
 /**
  * StepValidator orchestrates pre-execution validation for a workflow.
  * It iterates through all steps, collects validation requirements,

package/dist/src/yaml/step-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CA6B5D;AAED;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;IAKxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAGvC,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAwN3D;;OAEG;YACW,mBAAmB;IAmEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}
+{"version":3,"file":"step-validator.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAGV,wBAAwB,EAGzB,MAAM,uBAAuB,CAAC;AAwB/B;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAC,CAAS;IAG9B,OAAO,CAAC,gBAAgB,CAAoE;IAG5F,OAAO,CAAC,mBAAmB,CAA6B;IAKxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;gBAGvC,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;OAGG;IACG,gBAAgB,IAAI,OAAO,CAAC,wBAAwB,CAAC;IAwN3D;;OAEG;YACW,mBAAmB;IAmEjC;;;;;;;;;OASG;IACH,OAAO,CAAC,yBAAyB;IAsBjC;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAoB3B;;OAEG;IACH,OAAO,CAAC,SAAS;CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA4D/E"}

package/dist/src/yaml/step-validator.js

@@ -7,6 +7,7 @@
  */
 import { getStepExecutor, hasStep, getStepMetadata } from './steps/registry.js';
 import { EnvResolver } from './env-resolver.js';
+import { shellAssignedNames } from './shell-assignments.js';
 import { detectPlatformInfo } from './platform-detector.js';
 import { declaresMultiplatformApp } from './meta-helpers.js';
 // POSIX env vars the shell always provides — don't flag these as undeclared.
@@ -30,71 +31,6 @@ const POSIX_ENV_ALLOWLIST = new Set([
     'CIBUILD_SCRATCH',
     'JAVA_HOME',
 ]);
-/**
- * Names a shell snippet assigns to itself, in every form a step script uses.
- *
- * The auto-discovery below treats every `$UPPERCASE` it finds in a step's
- * inputs as a value the pipeline must supply. For a `script` step the inputs
- * *are* the shell body, so a variable the script computes reads exactly like
- * one it needs handed to it — and the run is refused for a value nothing was
- * ever supposed to provide.
- *
- * That is not hypothetical. A generated multiplatform pipeline whose prepare
- * step opens with
- *
- *     INTEGRATION="$KMM_IOS_INTEGRATION"
- *     IOS_DIR=$(dirname "$IOS_PROJECT_PATH")
- *     for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do …
- *
- * was refused before step 1 on "3 required value(s) missing — INTEGRATION,
- * IOS_DIR, WORKSPACE", while the two variables it genuinely reads were both
- * declared and present. The shell was correct; the reader was not.
- *
- * Only the assignment *target* is collected, never the right-hand side, so
- * `INTEGRATION="$KMM_IOS_INTEGRATION"` still requires `KMM_IOS_INTEGRATION`.
- * That is what keeps this from becoming a hole: a script cannot excuse itself
- * from a value it reads by mentioning it.
- *
- * Assignment order is deliberately not modelled. A snippet that reads `$FOO`
- * before setting it is a bug in the snippet, and guessing about it here would
- * trade a false refusal for a different false refusal; "the script sets this
- * somewhere" is the question worth asking, and erring toward letting the build
- * run is the right direction for a check that cannot prompt.
- */
-export function shellAssignedNames(obj) {
-    const names = new Set();
-    const collect = (text) => {
-        // `NAME=…`, `export NAME=…`, `local/readonly/declare/typeset NAME=…`, and
-        // `NAME+=…`. Anchored to the start of a command — line start, or after a
-        // separator — so `--flag=X` and `foo BAR=1` inside a longer word are not
-        // mistaken for assignments.
-        const assignment = /(?:^|[\n;&|(]|\|\||&&)[ \t]*(?:(?:export|readonly|local|declare|typeset)[ \t]+)?([A-Z_][A-Z_0-9]*)\+?=/g;
-        // `for NAME in …`, `select NAME in …`
-        const loop = /(?:^|[\n;&|(])[ \t]*(?:for|select)[ \t]+([A-Z_][A-Z_0-9]*)[ \t]+in\b/g;
-        // `read NAME`, `read -r NAME OTHER`, `while read -r NAME; do`
-        const read = /(?:^|[\n;&|(]|\|\||&&)[ \t]*(?:while[ \t]+)?read[ \t]+((?:-\S+[ \t]+)*)([A-Z_][A-Z_0-9]*(?:[ \t]+[A-Z_][A-Z_0-9]*)*)/g;
-        for (const re of [assignment, loop]) {
-            let m;
-            while ((m = re.exec(text)) !== null)
-                names.add(m[1]);
-        }
-        let m;
-        while ((m = read.exec(text)) !== null) {
-            for (const n of m[2].trim().split(/[ \t]+/))
-                names.add(n);
-        }
-    };
-    const walk = (value) => {
-        if (typeof value === 'string')
-            collect(value);
-        else if (Array.isArray(value))
-            value.forEach(walk);
-        else if (value && typeof value === 'object')
-            Object.values(value).forEach(walk);
-    };
-    walk(obj);
-    return names;
-}
 /**
  * StepValidator orchestrates pre-execution validation for a workflow.
  * It iterates through all steps, collects validation requirements,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.6.9",
+  "version": "2.7.0",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",