@invarn/cibuild 2.7.0 → 2.7.2

package/dist/src/commands/ios-scanner.d.ts

@@ -44,18 +44,54 @@ export interface IosScanResult {
  *
  *  1. named after the project or workspace — the commonest case, and
  *     unambiguous;
- *  2. launches the product named after the project, and is not named like a
- *     companion. `thebaselab/codeapp` is why this outranks the next one: its
- *     `Code App` scheme launches `Code.app` and declares no tests at all,
- *     while `Code UI` has two test bundles and launches `CodeUI.app`;
- *  3. launches an `.app`, declares tests (the template runs them), and is not
- *     named like a companion; among several, the iOS or Debug one, then the
- *     shortest;
- *  4. launches an `.app` and is not named like a companion;
+ *  2. launches the product named after the project, and is not a companion.
+ *     `thebaselab/codeapp` is why this outranks the next one: its `Code App`
+ *     scheme launches `Code.app` and declares no tests at all, while `Code UI`
+ *     has two test bundles and launches `CodeUI.app`;
+ *  3. launches an `.app`, declares tests (the template runs them), and is not a
+ *     companion; among several, the iOS or Debug one, then the shortest;
+ *  4. launches an `.app` and is not a companion;
  *  5. whatever order it came in.
  *
  * Every scheme stays in the list — this reorders, it does not filter, so a
  * caller wanting the extension can still find it.
+ *
+ * **What "companion" has to mean, and why a name is not enough.**
+ * `mozilla-mobile/firefox-ios` broke tiers 1-4 without touching the directory
+ * order this function was written for. Its project is `Client.xcodeproj`, so
+ * `projectName` is `Client`. An app extension is launched *through its host
+ * app*, so the `Today` widget scheme's LaunchAction runnable is `Client.app` —
+ * identical to `Fennec`'s. Both landed in tier 1, neither name carries an `iOS`
+ * or `Debug` token, and the tie fell to name length:
+ *
+ *     "Today"  -> 5 characters      <- won
+ *     "Fennec" -> 6 characters
+ *
+ * The build then failed compiling `ActionExtension` rather than the browser
+ * (`bld_b1b38dda58f4111080415283`).
+ *
+ * Launching the app binary is therefore not sufficient, and the answer is not a
+ * longer name blocklist either — `Today` names nothing. Xcode states the fact
+ * outright: it writes `wasCreatedForAppExtension = "YES"` onto the `<Scheme>`
+ * element of a scheme it created for an extension target, so that is what is
+ * read.
+ *
+ * Measured over all 125 shared schemes in the thirty-app study's clones: 29
+ * carry the attribute, and **all 29 are extension schemes** — no false
+ * positive. It is also the only signal that would have worked. Two that were
+ * considered and are wrong on this same evidence:
+ *
+ *  - *require an `.app` among the BuildAction entries.* 27 of the 29 extension
+ *    schemes build the host app too — `Today` builds
+ *    `["Today.appex", "Client.app"]` — so this demotes 2 of 29 and leaves
+ *    firefox-ios picking `Today`.
+ *  - *demote anything building an `.appex`.* `chenqi92/primuse`'s `Primuse`
+ *    scheme is the real app scheme and builds two widget extensions alongside
+ *    `Primuse.app`.
+ *
+ * The attribute is a sufficient signal, not a necessary one: a hand-written or
+ * pre-Xcode-10 scheme may omit it, and its absence changes nothing, so nothing
+ * that ranked before can regress on a scheme that does not carry it.
  */
 export declare function rankSchemes(root: string, projectPath: string, schemes: string[]): string[];
 /** The ranking, plus the sentence explaining its first entry. */

package/dist/src/commands/ios-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ios-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/ios-scanner.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAC;AAE7F,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,YAAY,EAAE,OAAO,CAAC;IACtB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,eAAe,EAAE,MAAM,CAAC;CACzB;AA8ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB,MAAM,EAAE,CAEV;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA4CxC;AAmLD,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgGhF;AAaD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAkDjE"}
+{"version":3,"file":"ios-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/ios-scanner.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAC;AAE7F,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,YAAY,EAAE,OAAO,CAAC;IACtB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;IAChB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,eAAe,EAAE,MAAM,CAAC;CACzB;AAuFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB,MAAM,EAAE,CAEV;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EAAE,GAChB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA8CxC;AAmLD,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgGhF;AAaD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAkDjE"}

package/dist/src/commands/ios-scanner.js

@@ -60,9 +60,13 @@ function readSchemeFacts(root, name) {
         if (!xml)
             continue;
         const launch = /<LaunchAction[\s\S]*?<\/LaunchAction>/.exec(xml)?.[0] ?? "";
+        // Attribute values carry no `>`, so the opening tag alone is a safe scope
+        // and no attribute deeper in the document can be mistaken for it.
+        const schemeTag = /<Scheme\b[^>]*>/.exec(xml)?.[0] ?? "";
         return {
             runnable: /BuildableName\s*=\s*"([^"]+)"/.exec(launch)?.[1],
             testable: /<TestableReference/.test(xml),
+            appExtension: /wasCreatedForAppExtension\s*=\s*"YES"/.test(schemeTag),
         };
     }
     return undefined;
@@ -84,18 +88,54 @@ function readSchemeFacts(root, name) {
  *
  *  1. named after the project or workspace — the commonest case, and
  *     unambiguous;
- *  2. launches the product named after the project, and is not named like a
- *     companion. `thebaselab/codeapp` is why this outranks the next one: its
- *     `Code App` scheme launches `Code.app` and declares no tests at all,
- *     while `Code UI` has two test bundles and launches `CodeUI.app`;
- *  3. launches an `.app`, declares tests (the template runs them), and is not
- *     named like a companion; among several, the iOS or Debug one, then the
- *     shortest;
- *  4. launches an `.app` and is not named like a companion;
+ *  2. launches the product named after the project, and is not a companion.
+ *     `thebaselab/codeapp` is why this outranks the next one: its `Code App`
+ *     scheme launches `Code.app` and declares no tests at all, while `Code UI`
+ *     has two test bundles and launches `CodeUI.app`;
+ *  3. launches an `.app`, declares tests (the template runs them), and is not a
+ *     companion; among several, the iOS or Debug one, then the shortest;
+ *  4. launches an `.app` and is not a companion;
  *  5. whatever order it came in.
  *
  * Every scheme stays in the list — this reorders, it does not filter, so a
  * caller wanting the extension can still find it.
+ *
+ * **What "companion" has to mean, and why a name is not enough.**
+ * `mozilla-mobile/firefox-ios` broke tiers 1-4 without touching the directory
+ * order this function was written for. Its project is `Client.xcodeproj`, so
+ * `projectName` is `Client`. An app extension is launched *through its host
+ * app*, so the `Today` widget scheme's LaunchAction runnable is `Client.app` —
+ * identical to `Fennec`'s. Both landed in tier 1, neither name carries an `iOS`
+ * or `Debug` token, and the tie fell to name length:
+ *
+ *     "Today"  -> 5 characters      <- won
+ *     "Fennec" -> 6 characters
+ *
+ * The build then failed compiling `ActionExtension` rather than the browser
+ * (`bld_b1b38dda58f4111080415283`).
+ *
+ * Launching the app binary is therefore not sufficient, and the answer is not a
+ * longer name blocklist either — `Today` names nothing. Xcode states the fact
+ * outright: it writes `wasCreatedForAppExtension = "YES"` onto the `<Scheme>`
+ * element of a scheme it created for an extension target, so that is what is
+ * read.
+ *
+ * Measured over all 125 shared schemes in the thirty-app study's clones: 29
+ * carry the attribute, and **all 29 are extension schemes** — no false
+ * positive. It is also the only signal that would have worked. Two that were
+ * considered and are wrong on this same evidence:
+ *
+ *  - *require an `.app` among the BuildAction entries.* 27 of the 29 extension
+ *    schemes build the host app too — `Today` builds
+ *    `["Today.appex", "Client.app"]` — so this demotes 2 of 29 and leaves
+ *    firefox-ios picking `Today`.
+ *  - *demote anything building an `.appex`.* `chenqi92/primuse`'s `Primuse`
+ *    scheme is the real app scheme and builds two widget extensions alongside
+ *    `Primuse.app`.
+ *
+ * The attribute is a sufficient signal, not a necessary one: a hand-written or
+ * pre-Xcode-10 scheme may omit it, and its absence changes nothing, so nothing
+ * that ranked before can regress on a scheme that does not carry it.
  */
 export function rankSchemes(root, projectPath, schemes) {
     return rankSchemesWithReason(root, projectPath, schemes).schemes;
@@ -107,10 +147,12 @@ export function rankSchemesWithReason(root, projectPath, schemes) {
     const projectName = projectPath.replace(/\.(xcodeproj|xcworkspace)$/, "").split("/").pop();
     const scored = schemes.map((name, index) => {
         const facts = readSchemeFacts(root, name);
-        const companion = COMPANION_SCHEME.test(name);
+        // Two ways to be a companion: the name says so, or Xcode does. Xcode's
+        // word outranks a name match, so it disqualifies tier 0 as well.
+        const companion = COMPANION_SCHEME.test(name) || (facts?.appExtension ?? false);
         const app = facts?.runnable?.endsWith(".app") ?? false;
         let tier = 4;
-        if (name === projectName)
+        if (name === projectName && !facts?.appExtension)
             tier = 0;
         else if (facts?.runnable === `${projectName}.app` && !companion)
             tier = 1;

package/dist/src/commands/ios-scheme-ranking.test.js

@@ -27,11 +27,11 @@ afterEach(() => {
     rmSync(root, { recursive: true, force: true });
 });
 /** An `.xcscheme` with the parts the ranking reads, in Xcode's own shape. */
-function scheme(project, name, { runnable, testable }) {
+function scheme(project, name, { runnable, testable, appExtension }) {
     const dir = join(root, `${project}.xcodeproj`, "xcshareddata", "xcschemes");
     mkdirSync(dir, { recursive: true });
     writeFileSync(join(dir, `${name}.xcscheme`), `<?xml version="1.0" encoding="UTF-8"?>
-<Scheme LastUpgradeVersion = "1600" version = "1.7">
+<Scheme LastUpgradeVersion = "1600"${appExtension ? `\n   wasCreatedForAppExtension = "YES"` : ""} version = "1.7">
    <TestAction buildConfiguration = "Debug">
       <Testables>${testable
         ? `
@@ -149,4 +149,111 @@ describe("rankSchemes", () => {
         expect(pick("Solo.xcodeproj", ["Solo", "Other"])).toBe("Solo");
     });
 });
+/**
+ * An app extension is launched *through its host app*, so an extension scheme's
+ * LaunchAction runnable is the host `.app` — the same value the app's own
+ * scheme carries. Launching the app binary is therefore not sufficient to be
+ * the app scheme, and no name blocklist reaches the case: `Today` names nothing.
+ *
+ * Xcode states the fact itself, on the `<Scheme>` element of any scheme it
+ * created for an extension target. Measured across all 125 shared schemes in
+ * the thirty-app study's clones: 29 carry `wasCreatedForAppExtension`, all 29
+ * are extension schemes, and 27 of them build the host `.app` too — which is
+ * why "require an `.app` among the BuildAction entries" does not separate them.
+ */
+describe("rankSchemes and app-extension schemes", () => {
+    /**
+     * `mozilla-mobile/firefox-ios`, all thirteen schemes of
+     * `firefox-ios/Client.xcodeproj`, read off the clone. The project is
+     * `Client.xcodeproj`, so five schemes launch `Client.app` and land in the
+     * same tier; none carries an `iOS` or `Debug` token, so the tie fell to name
+     * length and `Today` (5) beat `Fennec` (6). The build then failed compiling
+     * `ActionExtension` — `bld_b1b38dda58f4111080415283`.
+     */
+    const FIREFOX_IOS = [
+        ["Account", { runnable: "libAccount.a", testable: true }],
+        ["Fennec", { runnable: "Client.app", testable: true }],
+        ["Fennec_Enterprise", { runnable: "Client.app", testable: true }],
+        ["Firefox", { runnable: "Client.app", testable: true }],
+        ["FirefoxBeta", { runnable: "Client.app", testable: true }],
+        ["FirefoxStaging", { runnable: "Client.app", testable: true }],
+        ["L10nSnapshotTests", { runnable: "L10nSnapshotTests.xctest", testable: true }],
+        ["Periphery", {}],
+        ["ShareTo", { runnable: "ShareTo.appex", appExtension: true }],
+        ["Storage", { runnable: "libStorage.a", testable: true }],
+        ["Sync", { runnable: "Sync.framework", testable: true }],
+        ["Telemetry", { runnable: "libSyncTelemetry.a", testable: true }],
+        ["Today", { runnable: "Client.app", testable: true, appExtension: true }],
+    ];
+    function firefoxIos() {
+        for (const [name, shape] of FIREFOX_IOS)
+            scheme("Client", name, shape);
+        return FIREFOX_IOS.map(([name]) => name);
+    }
+    test("picks the browser, not its widget", () => {
+        const names = firefoxIos();
+        expect(pick("Client.xcodeproj", names)).toBe("Fennec");
+    });
+    // The defect only became visible because a five-character extension name won
+    // a length tiebreak. The answer must not depend on the order either.
+    test("picks the browser whatever order the filesystem lists", () => {
+        const names = firefoxIos();
+        const orders = [
+            names,
+            [...names].reverse(),
+            ["Today", ...names.filter((n) => n !== "Today")],
+            ["ShareTo", "Today", ...names.filter((n) => n !== "Today" && n !== "ShareTo")],
+        ];
+        for (const order of orders) {
+            expect([order[0], pick("Client.xcodeproj", order)]).toEqual([order[0], "Fennec"]);
+        }
+    });
+    test("still keeps every scheme in the list", () => {
+        const names = firefoxIos();
+        expect([...rankSchemes(root, "Client.xcodeproj", names)].sort()).toEqual([...names].sort());
+    });
+    // The narrow statement, without the other twelve schemes around it.
+    test("an extension scheme launching the host app is not the app scheme", () => {
+        scheme("Client", "Fennec", { runnable: "Client.app", testable: true });
+        scheme("Client", "Today", { runnable: "Client.app", testable: true, appExtension: true });
+        expect(pick("Client.xcodeproj", ["Today", "Fennec"])).toBe("Fennec");
+    });
+    // Xcode's own word about the target outranks a name coincidence, so it
+    // disqualifies the name-match tier too.
+    test("outranks a scheme named exactly after the project", () => {
+        scheme("Widget", "Widget", { runnable: "Host.app", appExtension: true });
+        scheme("Widget", "HostApp", { runnable: "Host.app", testable: true });
+        expect(pick("Widget.xcodeproj", ["Widget", "HostApp"])).toBe("HostApp");
+    });
+    /**
+     * The attribute is a sufficient signal, not a necessary one — a hand-written
+     * or pre-Xcode-10 scheme may omit it. Its absence must change nothing, or
+     * every scheme that ranked correctly before this could regress.
+     *
+     * `chenqi92/primuse` is the row that makes the point concrete: its `Primuse`
+     * scheme is the real app scheme and builds two widget `.appex` bundles
+     * alongside `Primuse.app`, so "demote anything that builds an extension"
+     * would have taken the wrong one.
+     */
+    test("an untagged app scheme ranks exactly as it did before", () => {
+        scheme("Primuse", "Primuse", { runnable: "Primuse.app", testable: true });
+        scheme("Primuse", "PrimuseWidgets", { runnable: "Primuse.app" });
+        expect(pick("Primuse.xcodeproj", ["PrimuseWidgets", "Primuse"])).toBe("Primuse");
+    });
+    // When every candidate is an extension scheme there is no app scheme to
+    // find. Both land in the bottom tier, nothing is filtered out, and the
+    // pre-existing within-tier rule decides — so the caller still gets a
+    // deterministic answer rather than one that depends on the directory order.
+    test("still answers deterministically when every scheme is an extension", () => {
+        scheme("Client", "ShareTo", { runnable: "ShareTo.appex", appExtension: true });
+        scheme("Client", "Today", { runnable: "Client.app", appExtension: true });
+        for (const order of [
+            ["Today", "ShareTo"],
+            ["ShareTo", "Today"],
+        ]) {
+            expect([order[0], pick("Client.xcodeproj", order)]).toEqual([order[0], "Today"]);
+        }
+        expect(rankSchemes(root, "Client.xcodeproj", ["ShareTo", "Today"])).toHaveLength(2);
+    });
+});
 //# sourceMappingURL=ios-scheme-ranking.test.js.map

package/dist/src/yaml/a-declared-secret-reaches-the-file-step.test.d.ts

@@ -0,0 +1,20 @@
+/**
+ * A credential the pipeline declares and the dispatch delivers reaches the
+ * step that writes it.
+ *
+ * `file@1.0.0` decides at generation time, from the env map `EnvResolver`
+ * hands it: a value means a write script, no value means
+ * `echo "⚠️  X not set — skipping <file>"` and a green step. That map had
+ * four sources — built-ins, `.cibuild-secrets.json`, `app.envs`,
+ * `workflow.envs` — and a dispatched build supplies none of them. The runner
+ * merges the dispatch's secrets into the environment of the `ci` invocation
+ * and writes no secrets file, so every credential declared as an empty slot
+ * was dropped, on every dispatched build, and the step reported success.
+ *
+ * The two runs that make it unambiguous are here as the first two tests: the
+ * same pipeline, the same step, the same value, delivered once through the
+ * process environment and once through the local store. Before the fifth
+ * resolution step the first wrote nothing and the second wrote the file.
+ */
+export {};
+//# sourceMappingURL=a-declared-secret-reaches-the-file-step.test.d.ts.map

package/dist/src/yaml/a-declared-secret-reaches-the-file-step.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-declared-secret-reaches-the-file-step.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-declared-secret-reaches-the-file-step.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/src/yaml/a-declared-secret-reaches-the-file-step.test.js

@@ -0,0 +1,201 @@
+/**
+ * A credential the pipeline declares and the dispatch delivers reaches the
+ * step that writes it.
+ *
+ * `file@1.0.0` decides at generation time, from the env map `EnvResolver`
+ * hands it: a value means a write script, no value means
+ * `echo "⚠️  X not set — skipping <file>"` and a green step. That map had
+ * four sources — built-ins, `.cibuild-secrets.json`, `app.envs`,
+ * `workflow.envs` — and a dispatched build supplies none of them. The runner
+ * merges the dispatch's secrets into the environment of the `ci` invocation
+ * and writes no secrets file, so every credential declared as an empty slot
+ * was dropped, on every dispatched build, and the step reported success.
+ *
+ * The two runs that make it unambiguous are here as the first two tests: the
+ * same pipeline, the same step, the same value, delivered once through the
+ * process environment and once through the local store. Before the fifth
+ * resolution step the first wrote nothing and the second wrote the file.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { convertYAMLToPipelineDef } from './converter.js';
+import { EnvResolver } from './env-resolver.js';
+import { clearRegistry, registerStep } from './steps/registry.js';
+import { FileStepExecutor } from './steps/file.js';
+const mockConfig = {
+    artifactsDir: '/test/artifacts',
+    maxConcurrentJobs: 1,
+    paths: {
+        buildsDir: '/test/builds',
+        cacheDir: '/test/cache',
+        derivedDataDir: '/test/derived-data',
+    },
+    interpreters: {
+        bash: '/bin/bash',
+        python: 'python3',
+        ruby: 'ruby',
+        node: 'node',
+    },
+};
+/** The 61-byte document from the PRD's reproduction. Synthetic. */
+const JSON_CREDENTIAL = '{"project_info":{"project_id":"synthetic-probe"},"client":[]}';
+const TARGET = 'app/google-services.json';
+let workdir;
+let previousCwd;
+beforeEach(() => {
+    clearRegistry();
+    registerStep('file', new FileStepExecutor());
+    previousCwd = process.cwd();
+    workdir = mkdtempSync(join(tmpdir(), 'cibuild-declared-secret-'));
+    process.chdir(workdir);
+    // `workdir` is the pre-symlink path on macOS; the steps resolve paths from
+    // CIBUILD_SOURCE_DIR, which is cwd, so read files back the same way.
+    workdir = process.cwd();
+    delete process.env.PLAIN_SECRET;
+    delete process.env.B64_SECRET;
+});
+afterEach(() => {
+    process.chdir(previousCwd);
+    rmSync(workdir, { recursive: true, force: true });
+    clearRegistry();
+    delete process.env.PLAIN_SECRET;
+    delete process.env.B64_SECRET;
+});
+/**
+ * The shape the Android generator emits: an empty slot under `app.envs` and a
+ * skippable `file@1.0.0` step naming it.
+ */
+function probePipeline(declared, fileInputs) {
+    const app = declared
+        ? { app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) } }
+        : {};
+    return {
+        format_version: '1',
+        ...app,
+        workflows: {
+            probe: {
+                steps: [
+                    {
+                        'file@1.0.0': {
+                            title: 'Setup credential',
+                            is_skippable: true,
+                            inputs: fileInputs,
+                        },
+                    },
+                ],
+            },
+        },
+    };
+}
+function writeSecretStore(global) {
+    writeFileSync(join(workdir, '.cibuild-secrets.json'), JSON.stringify({ global, workflows: {} }), { mode: 0o600 });
+}
+/**
+ * Converts the pipeline and runs the generated steps the way the runner does,
+ * then reads back whatever landed at `target`.
+ */
+async function land(pipeline, target = TARGET) {
+    const result = await convertYAMLToPipelineDef(pipeline, mockConfig, 'probe');
+    const chunks = [...result.warnings];
+    for (const step of result.pipeline.steps) {
+        const scriptPath = join(workdir, `__step_${step.id}.sh`);
+        writeFileSync(scriptPath, step.script, 'utf-8');
+        const proc = spawnSync('bash', [scriptPath], {
+            cwd: workdir,
+            encoding: 'utf-8',
+            env: { ...process.env },
+        });
+        // A step that cannot even run would make every other assertion here
+        // vacuous, so fail on it directly rather than through the file contents.
+        expect(proc.status).toBe(0);
+        chunks.push(proc.stdout ?? '', proc.stderr ?? '');
+    }
+    const landedAt = join(workdir, target);
+    return {
+        output: chunks.join('\n'),
+        bytes: existsSync(landedAt) ? readFileSync(landedAt) : undefined,
+    };
+}
+describe('a declared credential delivered through the process environment', () => {
+    test('reaches the file step and lands byte-exact — the dispatch path', async () => {
+        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
+        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(output).not.toContain('not set');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+        expect(bytes).toHaveLength(61);
+    });
+    test('still lands when the value comes from the local store instead', async () => {
+        writeSecretStore({ PLAIN_SECRET: JSON_CREDENTIAL });
+        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+    });
+    test('the local store wins when both carry the key', async () => {
+        writeSecretStore({ PLAIN_SECRET: 'from-the-local-store' });
+        process.env.PLAIN_SECRET = 'from-the-inherited-environment';
+        const { bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(bytes?.toString('utf-8')).toBe('from-the-local-store');
+    });
+    test('a value the YAML itself supplies is not replaced by the environment', async () => {
+        process.env.PLAIN_SECRET = 'from-the-inherited-environment';
+        const { bytes } = await land(probePipeline({ PLAIN_SECRET: 'from-the-pipeline' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(bytes?.toString('utf-8')).toBe('from-the-pipeline');
+    });
+    test('arrives verbatim — a $ in a credential is not a variable reference', async () => {
+        // A PEM passphrase, a Play service-account key, any credential at all may
+        // hold a `$`. Interpolating one would either paste a pipeline value into
+        // the middle of a secret or refuse the build over a name nothing declares.
+        const withDollars = 'prefix $NOT_A_DECLARED_VARIABLE ${ALSO_NOT_ONE} suffix';
+        process.env.PLAIN_SECRET = withDollars;
+        const { bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(bytes?.toString('utf-8')).toBe(withDollars);
+    });
+    test('base64_encoded round-trips bytes a text channel cannot carry', async () => {
+        // NUL and a newline together: the two bytes a keystore has and an
+        // environment variable cannot hold, which is why the slot carries base64.
+        const payload = Buffer.from([
+            0x50, 0x4b, 0x03, 0x04, 0x00, 0x0a, 0x00, 0xff, 0x00, 0x0d, 0x0a, 0x7f,
+        ]);
+        process.env.B64_SECRET = payload.toString('base64');
+        const { output, bytes } = await land(probePipeline({ B64_SECRET: '' }, { target_path: 'release.keystore', var_name: 'B64_SECRET', base64_encoded: true }), 'release.keystore');
+        expect(output).toContain('✓ Written release.keystore');
+        expect(bytes?.equals(payload)).toBe(true);
+    });
+    test('the value never appears in what ci prints', async () => {
+        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
+        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        // Asserted on the captured output, not read off a transcript.
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+        expect(output).not.toContain(JSON_CREDENTIAL);
+        expect(output).not.toContain('synthetic-probe');
+    });
+});
+describe('the host environment is not a source of pipeline variables', () => {
+    test('an undeclared key is not imported, even where a step reads it', async () => {
+        // HOME exists in every environment this runs in. If step 5 copied
+        // `process.env` in bulk this step would write the user's home directory
+        // to a file instead of skipping.
+        expect(process.env.HOME).toBeTruthy();
+        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
+        // PLAIN_SECRET is declared, so the import runs; HOME is not.
+        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: 'home.txt', var_name: 'HOME' }), 'home.txt');
+        expect(output).toContain('HOME not set — skipping home.txt');
+        expect(bytes).toBeUndefined();
+    });
+    test('the resolver does not hold an undeclared host variable', () => {
+        const pipeline = probePipeline({ PLAIN_SECRET: '' }, {
+            target_path: TARGET,
+            var_name: 'PLAIN_SECRET',
+        });
+        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
+        const resolver = new EnvResolver(pipeline, pipeline.workflows.probe, 'probe', 'linux');
+        expect(resolver.get('PLAIN_SECRET')).toBe(JSON_CREDENTIAL);
+        expect(resolver.has('HOME')).toBe(false);
+        expect(resolver.getAll()).not.toHaveProperty('HOME');
+    });
+});
+//# sourceMappingURL=a-declared-secret-reaches-the-file-step.test.js.map

package/dist/src/yaml/env-resolver.d.ts

@@ -30,6 +30,11 @@ export declare class EnvResolver {
     private envVars;
     private referencedVars;
     private secretsManager;
+    /**
+     * Every key the pipeline names in `app.envs` or `workflow.envs`, whether or
+     * not it gave one a value. Read by `importDeclaredFromProcessEnv`.
+     */
+    private declaredVars;
     constructor(pipeline: YAMLPipeline, workflow: YAMLWorkflow, workflowName: string, platform: Platform, stack?: string, yamlFilePath?: string);
     /**
      * Gets the value of an environment variable
@@ -107,6 +112,34 @@ export declare class EnvResolver {
      * @param envArray Array of environment variable objects
      */
     private mergeEnvVars;
+    /**
+     * Fills a declared-but-still-empty variable from the process environment.
+     *
+     * This is how a credential dispatched by a build service arrives. The
+     * dispatch hands the value to the runner, the runner merges it into the
+     * environment of the `ci` invocation, and nothing else copies it anywhere —
+     * it writes no `.cibuild-secrets.json`, and that file is gitignored so the
+     * clone has none either. Without this step the value sits in the shell and
+     * is invisible to the steps that read this map: `file@1.0.0` reads
+     * `env[var_name]`, finds nothing, prints "not set — skipping" and reports
+     * success. Every credential a pipeline declared as an empty slot was
+     * dropped that way, on every dispatched build, with a green step.
+     *
+     * Scoped to keys the pipeline declares, deliberately. Copying `process.env`
+     * wholesale would turn arbitrary host environment into pipeline values and
+     * would change what every existing pipeline resolves. The declaration is
+     * the opt-in: `- GOOGLE_SERVICES_JSON: ""` is the pipeline saying "I read
+     * this key and I have no value for it", which is exactly the invitation the
+     * dispatched environment needs. A key nothing declares stays out, so `HOME`
+     * and the rest of the host's environment are not pipeline variables.
+     *
+     * Last, so anything an earlier source did supply wins — a developer's
+     * `.cibuild-secrets.json` still beats an inherited environment. The value
+     * is taken verbatim, with no interpolation, for the same reason step 2
+     * takes secrets verbatim: a credential is bytes, and a `$` inside one is
+     * not a variable reference.
+     */
+    private importDeclaredFromProcessEnv;
     /**
      * Resolves $SECRET{secret_id} references to actual secret values
      * @param value Value that may contain a secret reference

package/dist/src/yaml/env-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;gBAGrC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAqCnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAkBpB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}
+{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;IACvC;;;OAGG;IACH,OAAO,CAAC,YAAY,CAA0B;gBAG5C,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IAkCvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAqCnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAoBpB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,4BAA4B;IAUpC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}