@invarn/cibuild 2.7.1 → 2.7.2

package/dist/src/yaml/a-declared-secret-reaches-the-file-step.test.d.ts

@@ -0,0 +1,20 @@
+/**
+ * A credential the pipeline declares and the dispatch delivers reaches the
+ * step that writes it.
+ *
+ * `file@1.0.0` decides at generation time, from the env map `EnvResolver`
+ * hands it: a value means a write script, no value means
+ * `echo "⚠️  X not set — skipping <file>"` and a green step. That map had
+ * four sources — built-ins, `.cibuild-secrets.json`, `app.envs`,
+ * `workflow.envs` — and a dispatched build supplies none of them. The runner
+ * merges the dispatch's secrets into the environment of the `ci` invocation
+ * and writes no secrets file, so every credential declared as an empty slot
+ * was dropped, on every dispatched build, and the step reported success.
+ *
+ * The two runs that make it unambiguous are here as the first two tests: the
+ * same pipeline, the same step, the same value, delivered once through the
+ * process environment and once through the local store. Before the fifth
+ * resolution step the first wrote nothing and the second wrote the file.
+ */
+export {};
+//# sourceMappingURL=a-declared-secret-reaches-the-file-step.test.d.ts.map

package/dist/src/yaml/a-declared-secret-reaches-the-file-step.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-declared-secret-reaches-the-file-step.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-declared-secret-reaches-the-file-step.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/src/yaml/a-declared-secret-reaches-the-file-step.test.js

@@ -0,0 +1,201 @@
+/**
+ * A credential the pipeline declares and the dispatch delivers reaches the
+ * step that writes it.
+ *
+ * `file@1.0.0` decides at generation time, from the env map `EnvResolver`
+ * hands it: a value means a write script, no value means
+ * `echo "⚠️  X not set — skipping <file>"` and a green step. That map had
+ * four sources — built-ins, `.cibuild-secrets.json`, `app.envs`,
+ * `workflow.envs` — and a dispatched build supplies none of them. The runner
+ * merges the dispatch's secrets into the environment of the `ci` invocation
+ * and writes no secrets file, so every credential declared as an empty slot
+ * was dropped, on every dispatched build, and the step reported success.
+ *
+ * The two runs that make it unambiguous are here as the first two tests: the
+ * same pipeline, the same step, the same value, delivered once through the
+ * process environment and once through the local store. Before the fifth
+ * resolution step the first wrote nothing and the second wrote the file.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { convertYAMLToPipelineDef } from './converter.js';
+import { EnvResolver } from './env-resolver.js';
+import { clearRegistry, registerStep } from './steps/registry.js';
+import { FileStepExecutor } from './steps/file.js';
+const mockConfig = {
+    artifactsDir: '/test/artifacts',
+    maxConcurrentJobs: 1,
+    paths: {
+        buildsDir: '/test/builds',
+        cacheDir: '/test/cache',
+        derivedDataDir: '/test/derived-data',
+    },
+    interpreters: {
+        bash: '/bin/bash',
+        python: 'python3',
+        ruby: 'ruby',
+        node: 'node',
+    },
+};
+/** The 61-byte document from the PRD's reproduction. Synthetic. */
+const JSON_CREDENTIAL = '{"project_info":{"project_id":"synthetic-probe"},"client":[]}';
+const TARGET = 'app/google-services.json';
+let workdir;
+let previousCwd;
+beforeEach(() => {
+    clearRegistry();
+    registerStep('file', new FileStepExecutor());
+    previousCwd = process.cwd();
+    workdir = mkdtempSync(join(tmpdir(), 'cibuild-declared-secret-'));
+    process.chdir(workdir);
+    // `workdir` is the pre-symlink path on macOS; the steps resolve paths from
+    // CIBUILD_SOURCE_DIR, which is cwd, so read files back the same way.
+    workdir = process.cwd();
+    delete process.env.PLAIN_SECRET;
+    delete process.env.B64_SECRET;
+});
+afterEach(() => {
+    process.chdir(previousCwd);
+    rmSync(workdir, { recursive: true, force: true });
+    clearRegistry();
+    delete process.env.PLAIN_SECRET;
+    delete process.env.B64_SECRET;
+});
+/**
+ * The shape the Android generator emits: an empty slot under `app.envs` and a
+ * skippable `file@1.0.0` step naming it.
+ */
+function probePipeline(declared, fileInputs) {
+    const app = declared
+        ? { app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) } }
+        : {};
+    return {
+        format_version: '1',
+        ...app,
+        workflows: {
+            probe: {
+                steps: [
+                    {
+                        'file@1.0.0': {
+                            title: 'Setup credential',
+                            is_skippable: true,
+                            inputs: fileInputs,
+                        },
+                    },
+                ],
+            },
+        },
+    };
+}
+function writeSecretStore(global) {
+    writeFileSync(join(workdir, '.cibuild-secrets.json'), JSON.stringify({ global, workflows: {} }), { mode: 0o600 });
+}
+/**
+ * Converts the pipeline and runs the generated steps the way the runner does,
+ * then reads back whatever landed at `target`.
+ */
+async function land(pipeline, target = TARGET) {
+    const result = await convertYAMLToPipelineDef(pipeline, mockConfig, 'probe');
+    const chunks = [...result.warnings];
+    for (const step of result.pipeline.steps) {
+        const scriptPath = join(workdir, `__step_${step.id}.sh`);
+        writeFileSync(scriptPath, step.script, 'utf-8');
+        const proc = spawnSync('bash', [scriptPath], {
+            cwd: workdir,
+            encoding: 'utf-8',
+            env: { ...process.env },
+        });
+        // A step that cannot even run would make every other assertion here
+        // vacuous, so fail on it directly rather than through the file contents.
+        expect(proc.status).toBe(0);
+        chunks.push(proc.stdout ?? '', proc.stderr ?? '');
+    }
+    const landedAt = join(workdir, target);
+    return {
+        output: chunks.join('\n'),
+        bytes: existsSync(landedAt) ? readFileSync(landedAt) : undefined,
+    };
+}
+describe('a declared credential delivered through the process environment', () => {
+    test('reaches the file step and lands byte-exact — the dispatch path', async () => {
+        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
+        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(output).not.toContain('not set');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+        expect(bytes).toHaveLength(61);
+    });
+    test('still lands when the value comes from the local store instead', async () => {
+        writeSecretStore({ PLAIN_SECRET: JSON_CREDENTIAL });
+        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+    });
+    test('the local store wins when both carry the key', async () => {
+        writeSecretStore({ PLAIN_SECRET: 'from-the-local-store' });
+        process.env.PLAIN_SECRET = 'from-the-inherited-environment';
+        const { bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(bytes?.toString('utf-8')).toBe('from-the-local-store');
+    });
+    test('a value the YAML itself supplies is not replaced by the environment', async () => {
+        process.env.PLAIN_SECRET = 'from-the-inherited-environment';
+        const { bytes } = await land(probePipeline({ PLAIN_SECRET: 'from-the-pipeline' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(bytes?.toString('utf-8')).toBe('from-the-pipeline');
+    });
+    test('arrives verbatim — a $ in a credential is not a variable reference', async () => {
+        // A PEM passphrase, a Play service-account key, any credential at all may
+        // hold a `$`. Interpolating one would either paste a pipeline value into
+        // the middle of a secret or refuse the build over a name nothing declares.
+        const withDollars = 'prefix $NOT_A_DECLARED_VARIABLE ${ALSO_NOT_ONE} suffix';
+        process.env.PLAIN_SECRET = withDollars;
+        const { bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(bytes?.toString('utf-8')).toBe(withDollars);
+    });
+    test('base64_encoded round-trips bytes a text channel cannot carry', async () => {
+        // NUL and a newline together: the two bytes a keystore has and an
+        // environment variable cannot hold, which is why the slot carries base64.
+        const payload = Buffer.from([
+            0x50, 0x4b, 0x03, 0x04, 0x00, 0x0a, 0x00, 0xff, 0x00, 0x0d, 0x0a, 0x7f,
+        ]);
+        process.env.B64_SECRET = payload.toString('base64');
+        const { output, bytes } = await land(probePipeline({ B64_SECRET: '' }, { target_path: 'release.keystore', var_name: 'B64_SECRET', base64_encoded: true }), 'release.keystore');
+        expect(output).toContain('✓ Written release.keystore');
+        expect(bytes?.equals(payload)).toBe(true);
+    });
+    test('the value never appears in what ci prints', async () => {
+        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
+        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        // Asserted on the captured output, not read off a transcript.
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+        expect(output).not.toContain(JSON_CREDENTIAL);
+        expect(output).not.toContain('synthetic-probe');
+    });
+});
+describe('the host environment is not a source of pipeline variables', () => {
+    test('an undeclared key is not imported, even where a step reads it', async () => {
+        // HOME exists in every environment this runs in. If step 5 copied
+        // `process.env` in bulk this step would write the user's home directory
+        // to a file instead of skipping.
+        expect(process.env.HOME).toBeTruthy();
+        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
+        // PLAIN_SECRET is declared, so the import runs; HOME is not.
+        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: 'home.txt', var_name: 'HOME' }), 'home.txt');
+        expect(output).toContain('HOME not set — skipping home.txt');
+        expect(bytes).toBeUndefined();
+    });
+    test('the resolver does not hold an undeclared host variable', () => {
+        const pipeline = probePipeline({ PLAIN_SECRET: '' }, {
+            target_path: TARGET,
+            var_name: 'PLAIN_SECRET',
+        });
+        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
+        const resolver = new EnvResolver(pipeline, pipeline.workflows.probe, 'probe', 'linux');
+        expect(resolver.get('PLAIN_SECRET')).toBe(JSON_CREDENTIAL);
+        expect(resolver.has('HOME')).toBe(false);
+        expect(resolver.getAll()).not.toHaveProperty('HOME');
+    });
+});
+//# sourceMappingURL=a-declared-secret-reaches-the-file-step.test.js.map

package/dist/src/yaml/env-resolver.d.ts

@@ -30,6 +30,11 @@ export declare class EnvResolver {
     private envVars;
     private referencedVars;
     private secretsManager;
+    /**
+     * Every key the pipeline names in `app.envs` or `workflow.envs`, whether or
+     * not it gave one a value. Read by `importDeclaredFromProcessEnv`.
+     */
+    private declaredVars;
     constructor(pipeline: YAMLPipeline, workflow: YAMLWorkflow, workflowName: string, platform: Platform, stack?: string, yamlFilePath?: string);
     /**
      * Gets the value of an environment variable
@@ -107,6 +112,34 @@ export declare class EnvResolver {
      * @param envArray Array of environment variable objects
      */
     private mergeEnvVars;
+    /**
+     * Fills a declared-but-still-empty variable from the process environment.
+     *
+     * This is how a credential dispatched by a build service arrives. The
+     * dispatch hands the value to the runner, the runner merges it into the
+     * environment of the `ci` invocation, and nothing else copies it anywhere —
+     * it writes no `.cibuild-secrets.json`, and that file is gitignored so the
+     * clone has none either. Without this step the value sits in the shell and
+     * is invisible to the steps that read this map: `file@1.0.0` reads
+     * `env[var_name]`, finds nothing, prints "not set — skipping" and reports
+     * success. Every credential a pipeline declared as an empty slot was
+     * dropped that way, on every dispatched build, with a green step.
+     *
+     * Scoped to keys the pipeline declares, deliberately. Copying `process.env`
+     * wholesale would turn arbitrary host environment into pipeline values and
+     * would change what every existing pipeline resolves. The declaration is
+     * the opt-in: `- GOOGLE_SERVICES_JSON: ""` is the pipeline saying "I read
+     * this key and I have no value for it", which is exactly the invitation the
+     * dispatched environment needs. A key nothing declares stays out, so `HOME`
+     * and the rest of the host's environment are not pipeline variables.
+     *
+     * Last, so anything an earlier source did supply wins — a developer's
+     * `.cibuild-secrets.json` still beats an inherited environment. The value
+     * is taken verbatim, with no interpolation, for the same reason step 2
+     * takes secrets verbatim: a credential is bytes, and a `$` inside one is
+     * not a variable reference.
+     */
+    private importDeclaredFromProcessEnv;
     /**
      * Resolves $SECRET{secret_id} references to actual secret values
      * @param value Value that may contain a secret reference

package/dist/src/yaml/env-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;gBAGrC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAqCnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAkBpB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}
+{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;IACvC;;;OAGG;IACH,OAAO,CAAC,YAAY,CAA0B;gBAG5C,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IAkCvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAqCnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAoBpB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,4BAA4B;IAUpC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}

package/dist/src/yaml/env-resolver.js

@@ -102,6 +102,11 @@ export class EnvResolver {
     envVars;
     referencedVars = new Set();
     secretsManager;
+    /**
+     * Every key the pipeline names in `app.envs` or `workflow.envs`, whether or
+     * not it gave one a value. Read by `importDeclaredFromProcessEnv`.
+     */
+    declaredVars = new Set();
     constructor(pipeline, workflow, workflowName, platform, stack, yamlFilePath) {
         this.envVars = new Map();
         this.secretsManager = new SecretsManager();
@@ -113,14 +118,21 @@ export class EnvResolver {
         for (const [key, value] of Object.entries(allSecrets)) {
             this.envVars.set(key, value);
         }
-        // Step 3: Add global environment variables (app.envs) — overrides secrets
+        // Step 3: Add global environment variables (app.envs) — overrides secrets,
+        // except with an empty placeholder: `mergeEnvVars` refuses to write `""`
+        // over a value that is already there, so `- KEYSTORE_BASE64: ""` declares
+        // the key without erasing a loaded secret of the same name.
         if (pipeline.app?.envs) {
             this.mergeEnvVars(pipeline.app.envs);
         }
-        // Step 4: Add workflow-level environment variables — highest priority, overrides everything
+        // Step 4: Add workflow-level environment variables — highest priority over
+        // steps 1-3, with the same empty-placeholder exception as step 3
         if (workflow.envs) {
             this.mergeEnvVars(workflow.envs);
         }
+        // Step 5: Last resort for a declared key that is still empty — the
+        // process environment. See importDeclaredFromProcessEnv.
+        this.importDeclaredFromProcessEnv();
     }
     /**
      * Gets the value of an environment variable
@@ -369,6 +381,8 @@ export class EnvResolver {
     mergeEnvVars(envArray) {
         for (const envObj of envArray) {
             for (const [key, value] of Object.entries(envObj)) {
+                // Naming the key is the declaration, whatever value follows it
+                this.declaredVars.add(key);
                 // First resolve any secret references
                 const secretResolved = this.resolveSecretReference(value);
                 // Then interpolate in case it references other env vars
@@ -383,6 +397,44 @@ export class EnvResolver {
             }
         }
     }
+    /**
+     * Fills a declared-but-still-empty variable from the process environment.
+     *
+     * This is how a credential dispatched by a build service arrives. The
+     * dispatch hands the value to the runner, the runner merges it into the
+     * environment of the `ci` invocation, and nothing else copies it anywhere —
+     * it writes no `.cibuild-secrets.json`, and that file is gitignored so the
+     * clone has none either. Without this step the value sits in the shell and
+     * is invisible to the steps that read this map: `file@1.0.0` reads
+     * `env[var_name]`, finds nothing, prints "not set — skipping" and reports
+     * success. Every credential a pipeline declared as an empty slot was
+     * dropped that way, on every dispatched build, with a green step.
+     *
+     * Scoped to keys the pipeline declares, deliberately. Copying `process.env`
+     * wholesale would turn arbitrary host environment into pipeline values and
+     * would change what every existing pipeline resolves. The declaration is
+     * the opt-in: `- GOOGLE_SERVICES_JSON: ""` is the pipeline saying "I read
+     * this key and I have no value for it", which is exactly the invitation the
+     * dispatched environment needs. A key nothing declares stays out, so `HOME`
+     * and the rest of the host's environment are not pipeline variables.
+     *
+     * Last, so anything an earlier source did supply wins — a developer's
+     * `.cibuild-secrets.json` still beats an inherited environment. The value
+     * is taken verbatim, with no interpolation, for the same reason step 2
+     * takes secrets verbatim: a credential is bytes, and a `$` inside one is
+     * not a variable reference.
+     */
+    importDeclaredFromProcessEnv() {
+        for (const key of this.declaredVars) {
+            // Any non-empty value from an earlier source stays. Only empty is open.
+            if (this.envVars.get(key))
+                continue;
+            const fromProcess = process.env[key];
+            if (!fromProcess)
+                continue;
+            this.envVars.set(key, fromProcess);
+        }
+    }
     /**
      * Resolves $SECRET{secret_id} references to actual secret values
      * @param value Value that may contain a secret reference

package/dist/src/yaml/steps/git-fetch-retry-exec.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Executes the generated shell rather than grepping it.
+ *
+ * The retry lives entirely in emitted bash, so string assertions prove only
+ * that the text was written. These run it: a first-attempt refusal followed by
+ * a second-attempt success has to actually pass, and a non-refusal has to fail
+ * without burning the retry budget.
+ */
+export {};
+//# sourceMappingURL=git-fetch-retry-exec.test.d.ts.map

package/dist/src/yaml/steps/git-fetch-retry-exec.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-fetch-retry-exec.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-fetch-retry-exec.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/src/yaml/steps/git-fetch-retry-exec.test.js

@@ -0,0 +1,156 @@
+/**
+ * Executes the generated shell rather than grepping it.
+ *
+ * The retry lives entirely in emitted bash, so string assertions prove only
+ * that the text was written. These run it: a first-attempt refusal followed by
+ * a second-attempt success has to actually pass, and a non-refusal has to fail
+ * without burning the retry budget.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { execFileSync } from 'child_process';
+import { mkdtempSync, writeFileSync, rmSync, readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { refusedFetchHelpers, retryOnRefusedFetch } from './git-fetch-retry.js';
+const REFUSAL = "fatal: could not read Username for 'https://github.com': terminal prompts disabled";
+/** Wraps the emitted block in the same preamble the real step scripts use. */
+function buildScript(command, attempts = 3) {
+    return [
+        '#!/bin/bash',
+        'set -e',
+        'set -o pipefail',
+        '',
+        ...refusedFetchHelpers(),
+        ...retryOnRefusedFetch({
+            label: 'Package resolution',
+            command,
+            attempts,
+            backoffSeconds: [0, 0, 0, 0],
+        }),
+        'echo "REACHED_THE_END"',
+    ].join('\n');
+}
+function run(command, attempts = 3) {
+    const dir = mkdtempSync(join(tmpdir(), 'cibuild-fetch-retry-'));
+    const scriptPath = join(dir, 'step.sh');
+    writeFileSync(scriptPath, buildScript(command, attempts), { mode: 0o755 });
+    try {
+        const output = execFileSync('bash', [scriptPath], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            cwd: dir,
+            env: { ...process.env, COUNTER: join(dir, 'attempts') },
+        });
+        return { status: 0, output };
+    }
+    catch (e) {
+        return {
+            status: e.status ?? -1,
+            output: `${e.stdout ?? ''}${e.stderr ?? ''}`,
+        };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+/**
+ * A command that records each invocation and refuses the first `n` of them the
+ * way git does, then succeeds.
+ */
+function refuseFirst(n) {
+    return (`bash -c 'echo x >> "$COUNTER"; ` +
+        `if [ "$(wc -l < "$COUNTER")" -le ${n} ]; then echo "${REFUSAL}" >&2; exit 128; fi; ` +
+        `echo RESOLVED_OK'`);
+}
+describe('retryOnRefusedFetch, executed', () => {
+    test('a first-attempt refusal and a second-attempt success still passes', () => {
+        const r = run(refuseFirst(1));
+        expect(r.status).toBe(0);
+        expect(r.output).toContain('RESOLVED_OK');
+        expect(r.output).toContain('REACHED_THE_END');
+        expect(r.output).toContain('was refused by the server (attempt 1 of 3)');
+    });
+    test('a command that succeeds first time is run exactly once', () => {
+        const r = run(refuseFirst(0));
+        expect(r.status).toBe(0);
+        expect(r.output).toContain('RESOLVED_OK');
+        expect(r.output).not.toContain('was refused by the server');
+    });
+    test('a refusal that never clears fails with the original exit code', () => {
+        const r = run(refuseFirst(99));
+        expect(r.status).toBe(128);
+        expect(r.output).not.toContain('REACHED_THE_END');
+        // and it explains itself rather than blaming a package
+        expect(r.output).toContain('A dependency fetch was refused.');
+        expect(r.output).toContain('HTTP 401');
+    });
+    test('it gives up after exactly the configured number of attempts', () => {
+        const r = run(refuseFirst(99), 3);
+        expect(r.output).toContain('(attempt 1 of 3)');
+        expect(r.output).toContain('(attempt 2 of 3)');
+        // the third attempt runs but is not announced as a retry
+        expect(r.output).not.toContain('(attempt 3 of 3)');
+    });
+    test('a failure that is NOT a refused fetch fails immediately', () => {
+        const r = run(`bash -c 'echo x >> "$COUNTER"; echo "error: no such module" >&2; exit 65'`);
+        expect(r.status).toBe(65);
+        // no retry, and no misleading refused-fetch diagnostic
+        expect(r.output).not.toContain('was refused by the server');
+        expect(r.output).not.toContain('A dependency fetch was refused.');
+    });
+    test('a non-refusal failure is attempted once, not three times', () => {
+        const dir = mkdtempSync(join(tmpdir(), 'cibuild-fetch-count-'));
+        const counter = join(dir, 'attempts');
+        const scriptPath = join(dir, 'step.sh');
+        writeFileSync(scriptPath, buildScript(`bash -c 'echo x >> "${counter}"; exit 65'`), { mode: 0o755 });
+        try {
+            execFileSync('bash', [scriptPath], { stdio: 'ignore', cwd: dir });
+        }
+        catch {
+            /* expected */
+        }
+        const attempts = existsSync(counter)
+            ? readFileSync(counter, 'utf-8').trim().split('\n').length
+            : 0;
+        expect(attempts).toBe(1);
+        rmSync(dir, { recursive: true, force: true });
+    });
+    test('the command output still reaches the log while being captured', () => {
+        const r = run(`bash -c 'echo x >> "$COUNTER"; echo VISIBLE_TO_THE_USER'`);
+        expect(r.output).toContain('VISIBLE_TO_THE_USER');
+    });
+});
+describe('the steps that embed it emit syntactically valid bash', () => {
+    // A syntax error in generated shell is not caught by any string assertion
+    // and would break every build of that type on the first run.
+    const parses = async (script) => {
+        const dir = mkdtempSync(join(tmpdir(), 'cibuild-syntax-'));
+        const p = join(dir, 'step.sh');
+        writeFileSync(p, script);
+        try {
+            execFileSync('bash', ['-n', p], { stdio: 'pipe' });
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    };
+    test('xcode-build-for-test', async () => {
+        const { XcodeBuildForTestStepExecutor } = await import('./xcode.js');
+        const { testConfig } = await import('./test-config.js');
+        const r = await new XcodeBuildForTestStepExecutor().execute({ project_path: "My App.xcworkspace", scheme: "My Scheme", xcconfig_content: 'ARCHS = arm64' }, {}, testConfig);
+        await parses(r.script);
+    });
+    test('xcodebuild', async () => {
+        const { XcodeBuildStepExecutor } = await import('./xcode.js');
+        const { testConfig } = await import('./test-config.js');
+        const r = await new XcodeBuildStepExecutor().execute({ project_path: 'MyApp.xcodeproj', scheme: 'MyApp', is_clean_build: true }, {}, testConfig);
+        await parses(r.script);
+    });
+    test('cocoapods-install', async () => {
+        const { CocoapodsInstallStepExecutor } = await import('./ios-deps.js');
+        const { testConfig } = await import('./test-config.js');
+        const r = await new CocoapodsInstallStepExecutor().execute({ verbose: true }, {}, testConfig);
+        await parses(r.script);
+    });
+});
+//# sourceMappingURL=git-fetch-retry-exec.test.js.map

package/dist/src/yaml/steps/git-fetch-retry.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Retrying a refused third-party dependency fetch, and naming the reason when
+ * the retry does not save it.
+ *
+ * A build that resolves its dependencies from public git repositories fetches
+ * them anonymously. When a host answers one of those fetches with HTTP 401,
+ * git has no credential to fall back on and prints
+ *
+ *     fatal: could not read Username for 'https://<host>': terminal prompts disabled
+ *     fatal: expected flush after ref listing
+ *
+ * Those two lines are one failure, not two: the transport child asks for a
+ * username, cannot prompt, and dies; the parent then finds the ref listing
+ * truncated. git asks for a username *only* on a 401, which makes the first
+ * line an exact signature for "the server refused this fetch".
+ *
+ * Such a refusal has been observed to be transient — the same repository
+ * readable again a minute or two later, from the same machine and the same
+ * address — while landing in the middle of a dependency resolution and taking
+ * a multi-minute build down with it.
+ *
+ * Two things are emitted here, and they are deliberately separate:
+ *
+ *   - a retry around the fetch, gated on that signature, so a compile error
+ *     still fails on the first attempt instead of three attempts later; and
+ *   - a diagnostic that re-probes every refused URL and prints the HTTP status
+ *     it gets back. Nothing else in the pipeline records that status, so a
+ *     build failing this way otherwise reports a missing package rather than a
+ *     refused fetch, and a recurrence is unattributable after the fact. The
+ *     probe is the whole reason the second occurrence will be cheaper to
+ *     explain than the first.
+ *
+ * The emitted shell is bash and runs under `set -e` / `set -o pipefail`, which
+ * is why the exit code is measured explicitly rather than inferred.
+ */
+/**
+ * The line git prints when, and only when, a server answers a fetch with
+ * HTTP 401 and no credential is available.
+ */
+export declare const REFUSED_FETCH_SIGNATURE = "could not read Username for";
+export interface RefusedFetchRetryOptions {
+    /** What is being fetched, as it should read in a log line. */
+    label: string;
+    /** The command to run, exactly as it would appear on one shell line. */
+    command: string;
+    /** Total attempts, including the first. Defaults to 3. */
+    attempts?: number;
+    /** Seconds to wait before each retry. Defaults to 15s then 45s. */
+    backoffSeconds?: number[];
+}
+/**
+ * Shell functions and state the retry depends on. Emit once per script, before
+ * the first `retryOnRefusedFetch` block.
+ */
+export declare function refusedFetchHelpers(): string[];
+/**
+ * Runs `command`, retrying it while the failure looks like a refused fetch.
+ * On the last failure the diagnostic runs and the step exits with the
+ * command's own status, so the reported exit code is still the real one.
+ */
+export declare function retryOnRefusedFetch(options: RefusedFetchRetryOptions): string[];
+//# sourceMappingURL=git-fetch-retry.d.ts.map

package/dist/src/yaml/steps/git-fetch-retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-fetch-retry.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-fetch-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;GAGG;AACH,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAErE,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAiE9C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAuC/E"}