@invarn/cibuild 2.7.0 → 2.7.2

package/dist/src/yaml/env-resolver.js

@@ -102,6 +102,11 @@ export class EnvResolver {
     envVars;
     referencedVars = new Set();
     secretsManager;
+    /**
+     * Every key the pipeline names in `app.envs` or `workflow.envs`, whether or
+     * not it gave one a value. Read by `importDeclaredFromProcessEnv`.
+     */
+    declaredVars = new Set();
     constructor(pipeline, workflow, workflowName, platform, stack, yamlFilePath) {
         this.envVars = new Map();
         this.secretsManager = new SecretsManager();
@@ -113,14 +118,21 @@ export class EnvResolver {
         for (const [key, value] of Object.entries(allSecrets)) {
             this.envVars.set(key, value);
         }
-        // Step 3: Add global environment variables (app.envs) — overrides secrets
+        // Step 3: Add global environment variables (app.envs) — overrides secrets,
+        // except with an empty placeholder: `mergeEnvVars` refuses to write `""`
+        // over a value that is already there, so `- KEYSTORE_BASE64: ""` declares
+        // the key without erasing a loaded secret of the same name.
         if (pipeline.app?.envs) {
             this.mergeEnvVars(pipeline.app.envs);
         }
-        // Step 4: Add workflow-level environment variables — highest priority, overrides everything
+        // Step 4: Add workflow-level environment variables — highest priority over
+        // steps 1-3, with the same empty-placeholder exception as step 3
         if (workflow.envs) {
             this.mergeEnvVars(workflow.envs);
         }
+        // Step 5: Last resort for a declared key that is still empty — the
+        // process environment. See importDeclaredFromProcessEnv.
+        this.importDeclaredFromProcessEnv();
     }
     /**
      * Gets the value of an environment variable
@@ -369,6 +381,8 @@ export class EnvResolver {
     mergeEnvVars(envArray) {
         for (const envObj of envArray) {
             for (const [key, value] of Object.entries(envObj)) {
+                // Naming the key is the declaration, whatever value follows it
+                this.declaredVars.add(key);
                 // First resolve any secret references
                 const secretResolved = this.resolveSecretReference(value);
                 // Then interpolate in case it references other env vars
@@ -383,6 +397,44 @@ export class EnvResolver {
             }
         }
     }
+    /**
+     * Fills a declared-but-still-empty variable from the process environment.
+     *
+     * This is how a credential dispatched by a build service arrives. The
+     * dispatch hands the value to the runner, the runner merges it into the
+     * environment of the `ci` invocation, and nothing else copies it anywhere —
+     * it writes no `.cibuild-secrets.json`, and that file is gitignored so the
+     * clone has none either. Without this step the value sits in the shell and
+     * is invisible to the steps that read this map: `file@1.0.0` reads
+     * `env[var_name]`, finds nothing, prints "not set — skipping" and reports
+     * success. Every credential a pipeline declared as an empty slot was
+     * dropped that way, on every dispatched build, with a green step.
+     *
+     * Scoped to keys the pipeline declares, deliberately. Copying `process.env`
+     * wholesale would turn arbitrary host environment into pipeline values and
+     * would change what every existing pipeline resolves. The declaration is
+     * the opt-in: `- GOOGLE_SERVICES_JSON: ""` is the pipeline saying "I read
+     * this key and I have no value for it", which is exactly the invitation the
+     * dispatched environment needs. A key nothing declares stays out, so `HOME`
+     * and the rest of the host's environment are not pipeline variables.
+     *
+     * Last, so anything an earlier source did supply wins — a developer's
+     * `.cibuild-secrets.json` still beats an inherited environment. The value
+     * is taken verbatim, with no interpolation, for the same reason step 2
+     * takes secrets verbatim: a credential is bytes, and a `$` inside one is
+     * not a variable reference.
+     */
+    importDeclaredFromProcessEnv() {
+        for (const key of this.declaredVars) {
+            // Any non-empty value from an earlier source stays. Only empty is open.
+            if (this.envVars.get(key))
+                continue;
+            const fromProcess = process.env[key];
+            if (!fromProcess)
+                continue;
+            this.envVars.set(key, fromProcess);
+        }
+    }
     /**
      * Resolves $SECRET{secret_id} references to actual secret values
      * @param value Value that may contain a secret reference

package/dist/src/yaml/steps/git-fetch-retry-exec.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Executes the generated shell rather than grepping it.
+ *
+ * The retry lives entirely in emitted bash, so string assertions prove only
+ * that the text was written. These run it: a first-attempt refusal followed by
+ * a second-attempt success has to actually pass, and a non-refusal has to fail
+ * without burning the retry budget.
+ */
+export {};
+//# sourceMappingURL=git-fetch-retry-exec.test.d.ts.map

package/dist/src/yaml/steps/git-fetch-retry-exec.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-fetch-retry-exec.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-fetch-retry-exec.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/src/yaml/steps/git-fetch-retry-exec.test.js

@@ -0,0 +1,156 @@
+/**
+ * Executes the generated shell rather than grepping it.
+ *
+ * The retry lives entirely in emitted bash, so string assertions prove only
+ * that the text was written. These run it: a first-attempt refusal followed by
+ * a second-attempt success has to actually pass, and a non-refusal has to fail
+ * without burning the retry budget.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { execFileSync } from 'child_process';
+import { mkdtempSync, writeFileSync, rmSync, readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { refusedFetchHelpers, retryOnRefusedFetch } from './git-fetch-retry.js';
+const REFUSAL = "fatal: could not read Username for 'https://github.com': terminal prompts disabled";
+/** Wraps the emitted block in the same preamble the real step scripts use. */
+function buildScript(command, attempts = 3) {
+    return [
+        '#!/bin/bash',
+        'set -e',
+        'set -o pipefail',
+        '',
+        ...refusedFetchHelpers(),
+        ...retryOnRefusedFetch({
+            label: 'Package resolution',
+            command,
+            attempts,
+            backoffSeconds: [0, 0, 0, 0],
+        }),
+        'echo "REACHED_THE_END"',
+    ].join('\n');
+}
+function run(command, attempts = 3) {
+    const dir = mkdtempSync(join(tmpdir(), 'cibuild-fetch-retry-'));
+    const scriptPath = join(dir, 'step.sh');
+    writeFileSync(scriptPath, buildScript(command, attempts), { mode: 0o755 });
+    try {
+        const output = execFileSync('bash', [scriptPath], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            cwd: dir,
+            env: { ...process.env, COUNTER: join(dir, 'attempts') },
+        });
+        return { status: 0, output };
+    }
+    catch (e) {
+        return {
+            status: e.status ?? -1,
+            output: `${e.stdout ?? ''}${e.stderr ?? ''}`,
+        };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+/**
+ * A command that records each invocation and refuses the first `n` of them the
+ * way git does, then succeeds.
+ */
+function refuseFirst(n) {
+    return (`bash -c 'echo x >> "$COUNTER"; ` +
+        `if [ "$(wc -l < "$COUNTER")" -le ${n} ]; then echo "${REFUSAL}" >&2; exit 128; fi; ` +
+        `echo RESOLVED_OK'`);
+}
+describe('retryOnRefusedFetch, executed', () => {
+    test('a first-attempt refusal and a second-attempt success still passes', () => {
+        const r = run(refuseFirst(1));
+        expect(r.status).toBe(0);
+        expect(r.output).toContain('RESOLVED_OK');
+        expect(r.output).toContain('REACHED_THE_END');
+        expect(r.output).toContain('was refused by the server (attempt 1 of 3)');
+    });
+    test('a command that succeeds first time is run exactly once', () => {
+        const r = run(refuseFirst(0));
+        expect(r.status).toBe(0);
+        expect(r.output).toContain('RESOLVED_OK');
+        expect(r.output).not.toContain('was refused by the server');
+    });
+    test('a refusal that never clears fails with the original exit code', () => {
+        const r = run(refuseFirst(99));
+        expect(r.status).toBe(128);
+        expect(r.output).not.toContain('REACHED_THE_END');
+        // and it explains itself rather than blaming a package
+        expect(r.output).toContain('A dependency fetch was refused.');
+        expect(r.output).toContain('HTTP 401');
+    });
+    test('it gives up after exactly the configured number of attempts', () => {
+        const r = run(refuseFirst(99), 3);
+        expect(r.output).toContain('(attempt 1 of 3)');
+        expect(r.output).toContain('(attempt 2 of 3)');
+        // the third attempt runs but is not announced as a retry
+        expect(r.output).not.toContain('(attempt 3 of 3)');
+    });
+    test('a failure that is NOT a refused fetch fails immediately', () => {
+        const r = run(`bash -c 'echo x >> "$COUNTER"; echo "error: no such module" >&2; exit 65'`);
+        expect(r.status).toBe(65);
+        // no retry, and no misleading refused-fetch diagnostic
+        expect(r.output).not.toContain('was refused by the server');
+        expect(r.output).not.toContain('A dependency fetch was refused.');
+    });
+    test('a non-refusal failure is attempted once, not three times', () => {
+        const dir = mkdtempSync(join(tmpdir(), 'cibuild-fetch-count-'));
+        const counter = join(dir, 'attempts');
+        const scriptPath = join(dir, 'step.sh');
+        writeFileSync(scriptPath, buildScript(`bash -c 'echo x >> "${counter}"; exit 65'`), { mode: 0o755 });
+        try {
+            execFileSync('bash', [scriptPath], { stdio: 'ignore', cwd: dir });
+        }
+        catch {
+            /* expected */
+        }
+        const attempts = existsSync(counter)
+            ? readFileSync(counter, 'utf-8').trim().split('\n').length
+            : 0;
+        expect(attempts).toBe(1);
+        rmSync(dir, { recursive: true, force: true });
+    });
+    test('the command output still reaches the log while being captured', () => {
+        const r = run(`bash -c 'echo x >> "$COUNTER"; echo VISIBLE_TO_THE_USER'`);
+        expect(r.output).toContain('VISIBLE_TO_THE_USER');
+    });
+});
+describe('the steps that embed it emit syntactically valid bash', () => {
+    // A syntax error in generated shell is not caught by any string assertion
+    // and would break every build of that type on the first run.
+    const parses = async (script) => {
+        const dir = mkdtempSync(join(tmpdir(), 'cibuild-syntax-'));
+        const p = join(dir, 'step.sh');
+        writeFileSync(p, script);
+        try {
+            execFileSync('bash', ['-n', p], { stdio: 'pipe' });
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    };
+    test('xcode-build-for-test', async () => {
+        const { XcodeBuildForTestStepExecutor } = await import('./xcode.js');
+        const { testConfig } = await import('./test-config.js');
+        const r = await new XcodeBuildForTestStepExecutor().execute({ project_path: "My App.xcworkspace", scheme: "My Scheme", xcconfig_content: 'ARCHS = arm64' }, {}, testConfig);
+        await parses(r.script);
+    });
+    test('xcodebuild', async () => {
+        const { XcodeBuildStepExecutor } = await import('./xcode.js');
+        const { testConfig } = await import('./test-config.js');
+        const r = await new XcodeBuildStepExecutor().execute({ project_path: 'MyApp.xcodeproj', scheme: 'MyApp', is_clean_build: true }, {}, testConfig);
+        await parses(r.script);
+    });
+    test('cocoapods-install', async () => {
+        const { CocoapodsInstallStepExecutor } = await import('./ios-deps.js');
+        const { testConfig } = await import('./test-config.js');
+        const r = await new CocoapodsInstallStepExecutor().execute({ verbose: true }, {}, testConfig);
+        await parses(r.script);
+    });
+});
+//# sourceMappingURL=git-fetch-retry-exec.test.js.map

package/dist/src/yaml/steps/git-fetch-retry.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Retrying a refused third-party dependency fetch, and naming the reason when
+ * the retry does not save it.
+ *
+ * A build that resolves its dependencies from public git repositories fetches
+ * them anonymously. When a host answers one of those fetches with HTTP 401,
+ * git has no credential to fall back on and prints
+ *
+ *     fatal: could not read Username for 'https://<host>': terminal prompts disabled
+ *     fatal: expected flush after ref listing
+ *
+ * Those two lines are one failure, not two: the transport child asks for a
+ * username, cannot prompt, and dies; the parent then finds the ref listing
+ * truncated. git asks for a username *only* on a 401, which makes the first
+ * line an exact signature for "the server refused this fetch".
+ *
+ * Such a refusal has been observed to be transient — the same repository
+ * readable again a minute or two later, from the same machine and the same
+ * address — while landing in the middle of a dependency resolution and taking
+ * a multi-minute build down with it.
+ *
+ * Two things are emitted here, and they are deliberately separate:
+ *
+ *   - a retry around the fetch, gated on that signature, so a compile error
+ *     still fails on the first attempt instead of three attempts later; and
+ *   - a diagnostic that re-probes every refused URL and prints the HTTP status
+ *     it gets back. Nothing else in the pipeline records that status, so a
+ *     build failing this way otherwise reports a missing package rather than a
+ *     refused fetch, and a recurrence is unattributable after the fact. The
+ *     probe is the whole reason the second occurrence will be cheaper to
+ *     explain than the first.
+ *
+ * The emitted shell is bash and runs under `set -e` / `set -o pipefail`, which
+ * is why the exit code is measured explicitly rather than inferred.
+ */
+/**
+ * The line git prints when, and only when, a server answers a fetch with
+ * HTTP 401 and no credential is available.
+ */
+export declare const REFUSED_FETCH_SIGNATURE = "could not read Username for";
+export interface RefusedFetchRetryOptions {
+    /** What is being fetched, as it should read in a log line. */
+    label: string;
+    /** The command to run, exactly as it would appear on one shell line. */
+    command: string;
+    /** Total attempts, including the first. Defaults to 3. */
+    attempts?: number;
+    /** Seconds to wait before each retry. Defaults to 15s then 45s. */
+    backoffSeconds?: number[];
+}
+/**
+ * Shell functions and state the retry depends on. Emit once per script, before
+ * the first `retryOnRefusedFetch` block.
+ */
+export declare function refusedFetchHelpers(): string[];
+/**
+ * Runs `command`, retrying it while the failure looks like a refused fetch.
+ * On the last failure the diagnostic runs and the step exits with the
+ * command's own status, so the reported exit code is still the real one.
+ */
+export declare function retryOnRefusedFetch(options: RefusedFetchRetryOptions): string[];
+//# sourceMappingURL=git-fetch-retry.d.ts.map

package/dist/src/yaml/steps/git-fetch-retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-fetch-retry.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-fetch-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;GAGG;AACH,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAErE,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAiE9C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAuC/E"}

package/dist/src/yaml/steps/git-fetch-retry.js

@@ -0,0 +1,155 @@
+/**
+ * Retrying a refused third-party dependency fetch, and naming the reason when
+ * the retry does not save it.
+ *
+ * A build that resolves its dependencies from public git repositories fetches
+ * them anonymously. When a host answers one of those fetches with HTTP 401,
+ * git has no credential to fall back on and prints
+ *
+ *     fatal: could not read Username for 'https://<host>': terminal prompts disabled
+ *     fatal: expected flush after ref listing
+ *
+ * Those two lines are one failure, not two: the transport child asks for a
+ * username, cannot prompt, and dies; the parent then finds the ref listing
+ * truncated. git asks for a username *only* on a 401, which makes the first
+ * line an exact signature for "the server refused this fetch".
+ *
+ * Such a refusal has been observed to be transient — the same repository
+ * readable again a minute or two later, from the same machine and the same
+ * address — while landing in the middle of a dependency resolution and taking
+ * a multi-minute build down with it.
+ *
+ * Two things are emitted here, and they are deliberately separate:
+ *
+ *   - a retry around the fetch, gated on that signature, so a compile error
+ *     still fails on the first attempt instead of three attempts later; and
+ *   - a diagnostic that re-probes every refused URL and prints the HTTP status
+ *     it gets back. Nothing else in the pipeline records that status, so a
+ *     build failing this way otherwise reports a missing package rather than a
+ *     refused fetch, and a recurrence is unattributable after the fact. The
+ *     probe is the whole reason the second occurrence will be cheaper to
+ *     explain than the first.
+ *
+ * The emitted shell is bash and runs under `set -e` / `set -o pipefail`, which
+ * is why the exit code is measured explicitly rather than inferred.
+ */
+/**
+ * The line git prints when, and only when, a server answers a fetch with
+ * HTTP 401 and no credential is available.
+ */
+export const REFUSED_FETCH_SIGNATURE = 'could not read Username for';
+/**
+ * Shell functions and state the retry depends on. Emit once per script, before
+ * the first `retryOnRefusedFetch` block.
+ */
+export function refusedFetchHelpers() {
+    return [
+        '# --- refused dependency fetch: retry, then explain -------------------------',
+        'CIBUILD_FETCH_LOG="$(mktemp -t cibuild-fetch)"',
+        '',
+        '# git asks for a username only when a server answers with HTTP 401, so this',
+        '# line means the fetch was refused, not that a package is missing.',
+        'cibuild_fetch_was_refused() {',
+        `  grep -q '${REFUSED_FETCH_SIGNATURE}' "$CIBUILD_FETCH_LOG" 2>/dev/null`,
+        '}',
+        '',
+        '# The status that caused the refusal is recorded nowhere, so ask again and',
+        '# put it in the build log where the next person will find it.',
+        'cibuild_diagnose_refused_fetch() {',
+        '  echo ""',
+        '  echo "──────────────────────────────────────────────────────────────"',
+        '  echo "A dependency fetch was refused."',
+        '  echo ""',
+        '  echo "git asked for a username, which it does only when the server answered"',
+        '  echo "with HTTP 401. That is an authentication refusal, not a missing"',
+        '  echo "package. Re-probing each repository named above:"',
+        '  echo ""',
+        // Every stage here can legitimately match nothing, and under `set -e` with
+        // `pipefail` an empty grep would abort the step and replace the command's
+        // real exit code with 1. The diagnostic must never do that: it runs on the
+        // failure path, and its whole job is to explain a failure it did not cause.
+        `  grep -oE 'https://[^ "'"'"']+' "$CIBUILD_FETCH_LOG" 2>/dev/null \\`,
+        `    | sed -e "s/[.,:;')]*$//" -e 's/\\.git$//' \\`,
+        `    | grep -E '^https://[^/]+/[^/]+/[^/]+$' \\`,
+        '    | sort -u | head -20 \\',
+        '    | while IFS= read -r CIBUILD_FETCH_PROBE_URL; do',
+        '        CIBUILD_FETCH_PROBE_CODE="$(curl -sS -o /dev/null -m 20 \\',
+        `          -w '%{http_code}' \\`,
+        '          "$CIBUILD_FETCH_PROBE_URL/info/refs?service=git-upload-pack" 2>/dev/null)" \\',
+        '          || CIBUILD_FETCH_PROBE_CODE="000"',
+        '        case "$CIBUILD_FETCH_PROBE_CODE" in',
+        '          200)',
+        '            echo "  200  $CIBUILD_FETCH_PROBE_URL"',
+        '            echo "       readable anonymously now — the refusal was transient"',
+        '            ;;',
+        '          401|403)',
+        '            echo "  $CIBUILD_FETCH_PROBE_CODE  $CIBUILD_FETCH_PROBE_URL"',
+        '            echo "       still refused — this repository needs a credential, or the"',
+        '            echo "       host is refusing anonymous reads from this machine"',
+        '            ;;',
+        '          404)',
+        '            echo "  404  $CIBUILD_FETCH_PROBE_URL"',
+        '            echo "       no such repository — check the dependency URL"',
+        '            ;;',
+        '          000)',
+        '            echo "  ---  $CIBUILD_FETCH_PROBE_URL"',
+        '            echo "       unreachable from this machine — network, DNS or TLS"',
+        '            ;;',
+        '          *)',
+        '            echo "  $CIBUILD_FETCH_PROBE_CODE  $CIBUILD_FETCH_PROBE_URL"',
+        '            ;;',
+        '        esac',
+        '      done || true',
+        '  echo ""',
+        '  echo "A 200 above means the fetch would succeed if it ran again now."',
+        '  echo "──────────────────────────────────────────────────────────────"',
+        '  echo ""',
+        '}',
+        '',
+    ];
+}
+/**
+ * Runs `command`, retrying it while the failure looks like a refused fetch.
+ * On the last failure the diagnostic runs and the step exits with the
+ * command's own status, so the reported exit code is still the real one.
+ */
+export function retryOnRefusedFetch(options) {
+    const attempts = options.attempts ?? 3;
+    const backoff = options.backoffSeconds ?? [15, 45];
+    const label = options.label.replace(/"/g, '\\"');
+    return [
+        `CIBUILD_FETCH_MAX_ATTEMPTS=${attempts}`,
+        `CIBUILD_FETCH_BACKOFF=(${backoff.join(' ')})`,
+        'CIBUILD_FETCH_ATTEMPT=1',
+        'while :; do',
+        '  set +e',
+        `  ${options.command} 2>&1 | tee "$CIBUILD_FETCH_LOG"`,
+        '  CIBUILD_FETCH_RC=${PIPESTATUS[0]}',
+        '  set -e',
+        '  if [ "$CIBUILD_FETCH_RC" -eq 0 ]; then',
+        '    break',
+        '  fi',
+        // Anything that is not a refused fetch is a real failure: fail now.
+        '  if ! cibuild_fetch_was_refused; then',
+        '    break',
+        '  fi',
+        '  if [ "$CIBUILD_FETCH_ATTEMPT" -ge "$CIBUILD_FETCH_MAX_ATTEMPTS" ]; then',
+        '    break',
+        '  fi',
+        '  CIBUILD_FETCH_WAIT="${CIBUILD_FETCH_BACKOFF[$((CIBUILD_FETCH_ATTEMPT - 1))]:-30}"',
+        `  echo "⚠️  ${label} was refused by the server (attempt $CIBUILD_FETCH_ATTEMPT of $CIBUILD_FETCH_MAX_ATTEMPTS)."`,
+        '  echo "   A refused anonymous fetch is usually transient. Retrying in ${CIBUILD_FETCH_WAIT}s..."',
+        '  sleep "$CIBUILD_FETCH_WAIT"',
+        '  CIBUILD_FETCH_ATTEMPT=$((CIBUILD_FETCH_ATTEMPT + 1))',
+        'done',
+        '',
+        'if [ "$CIBUILD_FETCH_RC" -ne 0 ]; then',
+        '  if cibuild_fetch_was_refused; then',
+        '    cibuild_diagnose_refused_fetch',
+        '  fi',
+        '  exit "$CIBUILD_FETCH_RC"',
+        'fi',
+        '',
+    ];
+}
+//# sourceMappingURL=git-fetch-retry.js.map

package/dist/src/yaml/steps/git-fetch-retry.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Tests for retrying a refused third-party dependency fetch.
+ */
+export {};
+//# sourceMappingURL=git-fetch-retry.test.d.ts.map

package/dist/src/yaml/steps/git-fetch-retry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-fetch-retry.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-fetch-retry.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/src/yaml/steps/git-fetch-retry.test.js

@@ -0,0 +1,86 @@
+/**
+ * Tests for retrying a refused third-party dependency fetch.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { REFUSED_FETCH_SIGNATURE, refusedFetchHelpers, retryOnRefusedFetch, } from './git-fetch-retry.js';
+const helpers = () => refusedFetchHelpers().join('\n');
+const retry = (o) => retryOnRefusedFetch(o).join('\n');
+describe('refusedFetchHelpers', () => {
+    test('keys off the line git prints only for an HTTP 401', () => {
+        expect(REFUSED_FETCH_SIGNATURE).toBe('could not read Username for');
+        expect(helpers()).toContain(REFUSED_FETCH_SIGNATURE);
+    });
+    test('captures output to a log the diagnostic can re-read', () => {
+        const script = helpers();
+        expect(script).toContain('CIBUILD_FETCH_LOG=');
+        expect(script).toContain('mktemp');
+    });
+    test('re-probes each refused URL for its HTTP status', () => {
+        const script = helpers();
+        // The whole point: the 401 is recorded nowhere, so ask again and print it.
+        expect(script).toContain('info/refs?service=git-upload-pack');
+        expect(script).toContain("-w '%{http_code}'");
+        expect(script).toContain('cibuild_diagnose_refused_fetch()');
+    });
+    test('explains each status it can get back', () => {
+        const script = helpers();
+        expect(script).toContain('200)');
+        expect(script).toContain('401|403)');
+        expect(script).toContain('404)');
+        // An unreachable host must not be reported as a refusal.
+        expect(script).toContain('000)');
+        expect(script).toContain('unreachable from this machine');
+    });
+    test('never lets a probe failure abort the step', () => {
+        // The diagnostic runs on the failure path; it must not mask the real error.
+        expect(helpers()).toContain('|| CIBUILD_FETCH_PROBE_CODE="000"');
+    });
+});
+describe('retryOnRefusedFetch', () => {
+    const opts = { label: 'Package resolution', command: 'xcodebuild -resolvePackageDependencies' };
+    test('runs the command it was given', () => {
+        expect(retry(opts)).toContain('xcodebuild -resolvePackageDependencies');
+    });
+    test('streams output live while still capturing it', () => {
+        const script = retry(opts);
+        expect(script).toContain('| tee "$CIBUILD_FETCH_LOG"');
+        // tee would otherwise mask the command's own exit code.
+        expect(script).toContain('${PIPESTATUS[0]}');
+    });
+    test('retries only when the failure is a refused fetch', () => {
+        const script = retry(opts);
+        // A compile error must fail on the first attempt, not after three.
+        expect(script).toContain('if ! cibuild_fetch_was_refused; then');
+        expect(script).toContain('break');
+    });
+    test('backs off between attempts', () => {
+        const script = retry({ ...opts, attempts: 3, backoffSeconds: [15, 45] });
+        expect(script).toContain('CIBUILD_FETCH_BACKOFF=(15 45)');
+        expect(script).toContain('sleep');
+    });
+    test('defaults to three attempts', () => {
+        expect(retry(opts)).toContain('CIBUILD_FETCH_MAX_ATTEMPTS=3');
+    });
+    test('honours a custom attempt count', () => {
+        expect(retry({ ...opts, attempts: 5 })).toContain('CIBUILD_FETCH_MAX_ATTEMPTS=5');
+    });
+    test('diagnoses and then fails with the original exit code', () => {
+        const script = retry(opts);
+        expect(script).toContain('cibuild_diagnose_refused_fetch');
+        expect(script).toContain('exit "$CIBUILD_FETCH_RC"');
+    });
+    test('names the thing being fetched in its retry message', () => {
+        expect(retry(opts)).toContain('Package resolution');
+    });
+    test('does not use a bare && before break, which set -e would trip on', () => {
+        // `[ x ] && break` returns 1 when the test is false and aborts under set -e.
+        expect(retry(opts)).not.toMatch(/\]\s*&&\s*break/);
+    });
+    test('restores set -e after measuring the exit code', () => {
+        const script = retry(opts);
+        expect(script).toContain('set +e');
+        expect(script).toContain('set -e');
+        expect(script.indexOf('set +e')).toBeLessThan(script.lastIndexOf('set -e'));
+    });
+});
+//# sourceMappingURL=git-fetch-retry.test.js.map

package/dist/src/yaml/steps/ios-deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ios-deps.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/ios-deps.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAc,MAAM,wBAAwB,CAAC;AAMhF,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,gBAAgB;IAChE,yBAAyB,CACvB,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAUpB,OAAO,CACX,MAAM,EAAE,sBAAsB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CAuEpB;AAMD,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;IACxD,yBAAyB,CACvB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAUpB,OAAO,CACX,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CAyDpB"}
+{"version":3,"file":"ios-deps.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/ios-deps.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAc,MAAM,wBAAwB,CAAC;AAMhF,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,gBAAgB;IAChE,yBAAyB,CACvB,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAUpB,OAAO,CACX,MAAM,EAAE,sBAAsB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CAkFpB;AAMD,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;IACxD,yBAAyB,CACvB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAUpB,OAAO,CACX,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CAyDpB"}

package/dist/src/yaml/steps/ios-deps.js

@@ -2,6 +2,7 @@
  * iOS dependency management steps: cocoapods-install, carthage
  */
 import { BaseStepExecutor } from './base.js';
+import { refusedFetchHelpers, retryOnRefusedFetch } from './git-fetch-retry.js';
 /**
  * Runs `pod install` or `pod update`.
  * Auto-detects Gemfile and uses `bundle exec pod` when appropriate.
@@ -66,13 +67,22 @@ export class CocoapodsInstallStepExecutor extends BaseStepExecutor {
         const verboseFlag = verbose ? ' --verbose' : '';
         commands.push(`POD_CMD="${this.escapeBash(command)}${verboseFlag}"`);
         commands.push('');
+        // One invocation, chosen up front, so the retry wraps it once rather than
+        // once per branch. `pod install` clones each pod's source over https, and a
+        // refused anonymous clone there fails the step exactly as it does during a
+        // Swift package resolve — same signature, same fix.
         commands.push('if [ "$USE_BUNDLE_EXEC" = "true" ]; then');
-        commands.push('  echo "Running: bundle exec pod $POD_CMD"');
-        commands.push('  bundle exec pod $POD_CMD');
+        commands.push('  POD_INVOCATION="bundle exec pod"');
         commands.push('else');
-        commands.push('  echo "Running: pod $POD_CMD"');
-        commands.push('  pod $POD_CMD');
+        commands.push('  POD_INVOCATION="pod"');
         commands.push('fi');
+        commands.push('echo "Running: $POD_INVOCATION $POD_CMD"');
+        commands.push('');
+        commands.push(...refusedFetchHelpers());
+        commands.push(...retryOnRefusedFetch({
+            label: 'CocoaPods dependency fetch',
+            command: '$POD_INVOCATION $POD_CMD',
+        }));
         commands.push('');
         commands.push('echo "✅ CocoaPods ${POD_CMD%% *} completed"');
         const script = this.createBashScriptFromCommands(commands, stepName);

package/dist/src/yaml/steps/xcode-resolve-retry.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Dependency resolution is separated from the build and retried.
+ *
+ * Resolution takes seconds and the build that follows takes minutes, so a
+ * refused fetch should cost a retry of the cheap half, not a re-run of the
+ * expensive one. These assert the split actually lands in the emitted script.
+ */
+export {};
+//# sourceMappingURL=xcode-resolve-retry.test.d.ts.map

package/dist/src/yaml/steps/xcode-resolve-retry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xcode-resolve-retry.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/xcode-resolve-retry.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}