@invarn/cibuild 2.7.1 → 2.7.3

package/dist/src/yaml/a-declared-secret-reaches-the-file-step.test.d.ts

@@ -0,0 +1,20 @@
+/**
+ * A credential the pipeline declares and the dispatch delivers reaches the
+ * step that writes it.
+ *
+ * `file@1.0.0` decides at generation time, from the env map `EnvResolver`
+ * hands it: a value means a write script, no value means
+ * `echo "⚠️  X not set — skipping <file>"` and a green step. That map had
+ * four sources — built-ins, `.cibuild-secrets.json`, `app.envs`,
+ * `workflow.envs` — and a dispatched build supplies none of them. The runner
+ * merges the dispatch's secrets into the environment of the `ci` invocation
+ * and writes no secrets file, so every credential declared as an empty slot
+ * was dropped, on every dispatched build, and the step reported success.
+ *
+ * The two runs that make it unambiguous are here as the first two tests: the
+ * same pipeline, the same step, the same value, delivered once through the
+ * process environment and once through the local store. Before the fifth
+ * resolution step the first wrote nothing and the second wrote the file.
+ */
+export {};
+//# sourceMappingURL=a-declared-secret-reaches-the-file-step.test.d.ts.map

package/dist/src/yaml/a-declared-secret-reaches-the-file-step.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-declared-secret-reaches-the-file-step.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-declared-secret-reaches-the-file-step.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/src/yaml/a-declared-secret-reaches-the-file-step.test.js

@@ -0,0 +1,201 @@
+/**
+ * A credential the pipeline declares and the dispatch delivers reaches the
+ * step that writes it.
+ *
+ * `file@1.0.0` decides at generation time, from the env map `EnvResolver`
+ * hands it: a value means a write script, no value means
+ * `echo "⚠️  X not set — skipping <file>"` and a green step. That map had
+ * four sources — built-ins, `.cibuild-secrets.json`, `app.envs`,
+ * `workflow.envs` — and a dispatched build supplies none of them. The runner
+ * merges the dispatch's secrets into the environment of the `ci` invocation
+ * and writes no secrets file, so every credential declared as an empty slot
+ * was dropped, on every dispatched build, and the step reported success.
+ *
+ * The two runs that make it unambiguous are here as the first two tests: the
+ * same pipeline, the same step, the same value, delivered once through the
+ * process environment and once through the local store. Before the fifth
+ * resolution step the first wrote nothing and the second wrote the file.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { convertYAMLToPipelineDef } from './converter.js';
+import { EnvResolver } from './env-resolver.js';
+import { clearRegistry, registerStep } from './steps/registry.js';
+import { FileStepExecutor } from './steps/file.js';
+const mockConfig = {
+    artifactsDir: '/test/artifacts',
+    maxConcurrentJobs: 1,
+    paths: {
+        buildsDir: '/test/builds',
+        cacheDir: '/test/cache',
+        derivedDataDir: '/test/derived-data',
+    },
+    interpreters: {
+        bash: '/bin/bash',
+        python: 'python3',
+        ruby: 'ruby',
+        node: 'node',
+    },
+};
+/** The 61-byte document from the PRD's reproduction. Synthetic. */
+const JSON_CREDENTIAL = '{"project_info":{"project_id":"synthetic-probe"},"client":[]}';
+const TARGET = 'app/google-services.json';
+let workdir;
+let previousCwd;
+beforeEach(() => {
+    clearRegistry();
+    registerStep('file', new FileStepExecutor());
+    previousCwd = process.cwd();
+    workdir = mkdtempSync(join(tmpdir(), 'cibuild-declared-secret-'));
+    process.chdir(workdir);
+    // `workdir` is the pre-symlink path on macOS; the steps resolve paths from
+    // CIBUILD_SOURCE_DIR, which is cwd, so read files back the same way.
+    workdir = process.cwd();
+    delete process.env.PLAIN_SECRET;
+    delete process.env.B64_SECRET;
+});
+afterEach(() => {
+    process.chdir(previousCwd);
+    rmSync(workdir, { recursive: true, force: true });
+    clearRegistry();
+    delete process.env.PLAIN_SECRET;
+    delete process.env.B64_SECRET;
+});
+/**
+ * The shape the Android generator emits: an empty slot under `app.envs` and a
+ * skippable `file@1.0.0` step naming it.
+ */
+function probePipeline(declared, fileInputs) {
+    const app = declared
+        ? { app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) } }
+        : {};
+    return {
+        format_version: '1',
+        ...app,
+        workflows: {
+            probe: {
+                steps: [
+                    {
+                        'file@1.0.0': {
+                            title: 'Setup credential',
+                            is_skippable: true,
+                            inputs: fileInputs,
+                        },
+                    },
+                ],
+            },
+        },
+    };
+}
+function writeSecretStore(global) {
+    writeFileSync(join(workdir, '.cibuild-secrets.json'), JSON.stringify({ global, workflows: {} }), { mode: 0o600 });
+}
+/**
+ * Converts the pipeline and runs the generated steps the way the runner does,
+ * then reads back whatever landed at `target`.
+ */
+async function land(pipeline, target = TARGET) {
+    const result = await convertYAMLToPipelineDef(pipeline, mockConfig, 'probe');
+    const chunks = [...result.warnings];
+    for (const step of result.pipeline.steps) {
+        const scriptPath = join(workdir, `__step_${step.id}.sh`);
+        writeFileSync(scriptPath, step.script, 'utf-8');
+        const proc = spawnSync('bash', [scriptPath], {
+            cwd: workdir,
+            encoding: 'utf-8',
+            env: { ...process.env },
+        });
+        // A step that cannot even run would make every other assertion here
+        // vacuous, so fail on it directly rather than through the file contents.
+        expect(proc.status).toBe(0);
+        chunks.push(proc.stdout ?? '', proc.stderr ?? '');
+    }
+    const landedAt = join(workdir, target);
+    return {
+        output: chunks.join('\n'),
+        bytes: existsSync(landedAt) ? readFileSync(landedAt) : undefined,
+    };
+}
+describe('a declared credential delivered through the process environment', () => {
+    test('reaches the file step and lands byte-exact — the dispatch path', async () => {
+        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
+        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(output).not.toContain('not set');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+        expect(bytes).toHaveLength(61);
+    });
+    test('still lands when the value comes from the local store instead', async () => {
+        writeSecretStore({ PLAIN_SECRET: JSON_CREDENTIAL });
+        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+    });
+    test('the local store wins when both carry the key', async () => {
+        writeSecretStore({ PLAIN_SECRET: 'from-the-local-store' });
+        process.env.PLAIN_SECRET = 'from-the-inherited-environment';
+        const { bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(bytes?.toString('utf-8')).toBe('from-the-local-store');
+    });
+    test('a value the YAML itself supplies is not replaced by the environment', async () => {
+        process.env.PLAIN_SECRET = 'from-the-inherited-environment';
+        const { bytes } = await land(probePipeline({ PLAIN_SECRET: 'from-the-pipeline' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(bytes?.toString('utf-8')).toBe('from-the-pipeline');
+    });
+    test('arrives verbatim — a $ in a credential is not a variable reference', async () => {
+        // A PEM passphrase, a Play service-account key, any credential at all may
+        // hold a `$`. Interpolating one would either paste a pipeline value into
+        // the middle of a secret or refuse the build over a name nothing declares.
+        const withDollars = 'prefix $NOT_A_DECLARED_VARIABLE ${ALSO_NOT_ONE} suffix';
+        process.env.PLAIN_SECRET = withDollars;
+        const { bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        expect(bytes?.toString('utf-8')).toBe(withDollars);
+    });
+    test('base64_encoded round-trips bytes a text channel cannot carry', async () => {
+        // NUL and a newline together: the two bytes a keystore has and an
+        // environment variable cannot hold, which is why the slot carries base64.
+        const payload = Buffer.from([
+            0x50, 0x4b, 0x03, 0x04, 0x00, 0x0a, 0x00, 0xff, 0x00, 0x0d, 0x0a, 0x7f,
+        ]);
+        process.env.B64_SECRET = payload.toString('base64');
+        const { output, bytes } = await land(probePipeline({ B64_SECRET: '' }, { target_path: 'release.keystore', var_name: 'B64_SECRET', base64_encoded: true }), 'release.keystore');
+        expect(output).toContain('✓ Written release.keystore');
+        expect(bytes?.equals(payload)).toBe(true);
+    });
+    test('the value never appears in what ci prints', async () => {
+        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
+        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: TARGET, var_name: 'PLAIN_SECRET' }));
+        // Asserted on the captured output, not read off a transcript.
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+        expect(output).not.toContain(JSON_CREDENTIAL);
+        expect(output).not.toContain('synthetic-probe');
+    });
+});
+describe('the host environment is not a source of pipeline variables', () => {
+    test('an undeclared key is not imported, even where a step reads it', async () => {
+        // HOME exists in every environment this runs in. If step 5 copied
+        // `process.env` in bulk this step would write the user's home directory
+        // to a file instead of skipping.
+        expect(process.env.HOME).toBeTruthy();
+        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
+        // PLAIN_SECRET is declared, so the import runs; HOME is not.
+        const { output, bytes } = await land(probePipeline({ PLAIN_SECRET: '' }, { target_path: 'home.txt', var_name: 'HOME' }), 'home.txt');
+        expect(output).toContain('HOME not set — skipping home.txt');
+        expect(bytes).toBeUndefined();
+    });
+    test('the resolver does not hold an undeclared host variable', () => {
+        const pipeline = probePipeline({ PLAIN_SECRET: '' }, {
+            target_path: TARGET,
+            var_name: 'PLAIN_SECRET',
+        });
+        process.env.PLAIN_SECRET = JSON_CREDENTIAL;
+        const resolver = new EnvResolver(pipeline, pipeline.workflows.probe, 'probe', 'linux');
+        expect(resolver.get('PLAIN_SECRET')).toBe(JSON_CREDENTIAL);
+        expect(resolver.has('HOME')).toBe(false);
+        expect(resolver.getAll()).not.toHaveProperty('HOME');
+    });
+});
+//# sourceMappingURL=a-declared-secret-reaches-the-file-step.test.js.map

package/dist/src/yaml/a-missing-credential-is-loud.test.d.ts

@@ -0,0 +1,32 @@
+/**
+ * A credential the pipeline declares and nobody supplied fails the build,
+ * naming itself, instead of being skipped with a warning.
+ *
+ * `file@1.0.0` carries `is_skippable: true` in every pipeline the Android
+ * generator emits, so an absent value printed `⚠️  X not set — skipping <file>`
+ * and returned success. The build then failed several steps later inside the
+ * project's own build tool, with an error naming the project rather than the
+ * value we dropped. Both failure modes in this defect were green, which is why
+ * it survived.
+ *
+ * The two absences are not the same absence, and the map the step already
+ * receives tells them apart by presence:
+ *
+ *   - a `var_name` the pipeline **declares** and leaves empty is a key of the
+ *     map with an empty value — the value was supposed to arrive as a secret
+ *     and did not. After issue 01 that means it is in none of the four places
+ *     a value can come from, so the diagnosis is not a guess.
+ *   - a `var_name` **nothing declares** is not a key of the map at all — a
+ *     release keystore on a debug workflow. Skipping is correct there.
+ *
+ * One case sits between them, and it decides the rule (issue 03 §2.3, Alex,
+ * 2026-09-08): the generator declares `KEYSTORE_BASE64` globally but emits its
+ * `file@` step in all three workflows, so a project that ran `ci init` with a
+ * keystore and never uploaded one would go from three green skips to three
+ * hard failures — including on `pull-request`, where nothing signs anything.
+ * So the question the step asks is the one that actually matters: **will the
+ * file be there when the build reads it?** A repository that carries the file
+ * keeps warning and building; only an absence with nothing behind it fails.
+ */
+export {};
+//# sourceMappingURL=a-missing-credential-is-loud.test.d.ts.map

package/dist/src/yaml/a-missing-credential-is-loud.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-missing-credential-is-loud.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-missing-credential-is-loud.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG"}

package/dist/src/yaml/a-missing-credential-is-loud.test.js

@@ -0,0 +1,301 @@
+/**
+ * A credential the pipeline declares and nobody supplied fails the build,
+ * naming itself, instead of being skipped with a warning.
+ *
+ * `file@1.0.0` carries `is_skippable: true` in every pipeline the Android
+ * generator emits, so an absent value printed `⚠️  X not set — skipping <file>`
+ * and returned success. The build then failed several steps later inside the
+ * project's own build tool, with an error naming the project rather than the
+ * value we dropped. Both failure modes in this defect were green, which is why
+ * it survived.
+ *
+ * The two absences are not the same absence, and the map the step already
+ * receives tells them apart by presence:
+ *
+ *   - a `var_name` the pipeline **declares** and leaves empty is a key of the
+ *     map with an empty value — the value was supposed to arrive as a secret
+ *     and did not. After issue 01 that means it is in none of the four places
+ *     a value can come from, so the diagnosis is not a guess.
+ *   - a `var_name` **nothing declares** is not a key of the map at all — a
+ *     release keystore on a debug workflow. Skipping is correct there.
+ *
+ * One case sits between them, and it decides the rule (issue 03 §2.3, Alex,
+ * 2026-09-08): the generator declares `KEYSTORE_BASE64` globally but emits its
+ * `file@` step in all three workflows, so a project that ran `ci init` with a
+ * keystore and never uploaded one would go from three green skips to three
+ * hard failures — including on `pull-request`, where nothing signs anything.
+ * So the question the step asks is the one that actually matters: **will the
+ * file be there when the build reads it?** A repository that carries the file
+ * keeps warning and building; only an absence with nothing behind it fails.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync, } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { convertYAMLToPipelineDef } from './converter.js';
+import { StepValidator } from './step-validator.js';
+import { clearRegistry, registerStep } from './steps/registry.js';
+import { FileStepExecutor } from './steps/file.js';
+const mockConfig = {
+    artifactsDir: '/test/artifacts',
+    maxConcurrentJobs: 1,
+    paths: {
+        buildsDir: '/test/builds',
+        cacheDir: '/test/cache',
+        derivedDataDir: '/test/derived-data',
+    },
+    interpreters: {
+        bash: '/bin/bash',
+        python: 'python3',
+        ruby: 'ruby',
+        node: 'node',
+    },
+};
+/** The 61-byte document from the PRD's reproduction. Synthetic. */
+const JSON_CREDENTIAL = '{"project_info":{"project_id":"synthetic-probe"},"client":[]}';
+const TARGET = 'app/google-services.json';
+let workdir;
+let previousCwd;
+beforeEach(() => {
+    clearRegistry();
+    registerStep('file', new FileStepExecutor());
+    previousCwd = process.cwd();
+    workdir = mkdtempSync(join(tmpdir(), 'cibuild-missing-credential-'));
+    process.chdir(workdir);
+    // `workdir` is the pre-symlink path on macOS; the step resolves paths from
+    // CIBUILD_SOURCE_DIR, which is cwd, so read and write files the same way.
+    workdir = process.cwd();
+    delete process.env.GOOGLE_SERVICES_JSON;
+    delete process.env.KEYSTORE_BASE64;
+    delete process.env.OTHER_SECRET;
+});
+afterEach(() => {
+    process.chdir(previousCwd);
+    rmSync(workdir, { recursive: true, force: true });
+    clearRegistry();
+    delete process.env.GOOGLE_SERVICES_JSON;
+    delete process.env.KEYSTORE_BASE64;
+    delete process.env.OTHER_SECRET;
+});
+/**
+ * The shape the Android generator emits: empty slots under `app.envs` and one
+ * skippable `file@1.0.0` step per credential, in declaration order.
+ */
+function probePipeline(declared, fileSteps, options = {}) {
+    const skippable = options.skippable ?? true;
+    const app = declared
+        ? { app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) } }
+        : {};
+    return {
+        format_version: '1',
+        ...app,
+        workflows: {
+            probe: {
+                steps: fileSteps.map((inputs) => ({
+                    'file@1.0.0': {
+                        title: `Setup ${String(inputs.var_name)}`,
+                        is_skippable: skippable,
+                        inputs,
+                    },
+                })),
+            },
+        },
+    };
+}
+function writeSecretStore(global) {
+    writeFileSync(join(workdir, '.cibuild-secrets.json'), JSON.stringify({ global, workflows: {} }), { mode: 0o600 });
+}
+/** Puts a file in the checkout, the way a repository that carries one does. */
+function commitToCheckout(relPath, contents) {
+    const target = join(workdir, relPath);
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, contents, 'utf-8');
+}
+/**
+ * Converts the pipeline and runs the generated steps the way the runner does,
+ * then reads back whatever landed at `target`.
+ */
+async function land(pipeline, target = TARGET) {
+    const result = await convertYAMLToPipelineDef(pipeline, mockConfig, 'probe');
+    const chunks = [...result.warnings];
+    for (const step of result.pipeline.steps) {
+        const scriptPath = join(workdir, `__step_${step.id}.sh`);
+        writeFileSync(scriptPath, step.script, 'utf-8');
+        const proc = spawnSync('bash', [scriptPath], {
+            cwd: workdir,
+            encoding: 'utf-8',
+            env: { ...process.env },
+        });
+        expect(proc.status).toBe(0);
+        chunks.push(proc.stdout ?? '', proc.stderr ?? '');
+    }
+    const landedAt = join(workdir, target);
+    return {
+        output: chunks.join('\n'),
+        bytes: existsSync(landedAt) ? readFileSync(landedAt) : undefined,
+    };
+}
+/** The conversion's outcome, without letting a throw escape the assertion. */
+async function convert(pipeline) {
+    try {
+        const result = await convertYAMLToPipelineDef(pipeline, mockConfig, 'probe');
+        return { steps: result.pipeline.steps };
+    }
+    catch (error) {
+        return { error: error };
+    }
+}
+describe('a declared credential nothing supplied', () => {
+    test('fails, naming the key and the target path', async () => {
+        const { error, steps } = await convert(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(error).toBeDefined();
+        expect(error.message).toContain('GOOGLE_SERVICES_JSON');
+        expect(error.message).toContain(TARGET);
+        // Not a stack trace and not a step that runs: conversion is what builds
+        // the step list, so nothing at all is handed to the runner.
+        expect(steps).toBeUndefined();
+    });
+    test('says both places the value can come from', async () => {
+        const { error } = await convert(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        // A user reading this should not have to know that a slot, an upload and
+        // a `file@` step are three separate things.
+        expect(error.message).toContain('ci secrets add GOOGLE_SERVICES_JSON');
+        expect(error.message).toMatch(/organization or pipeline secret/);
+    });
+    test('is_skippable does not turn it into a pass', async () => {
+        // Every `file@` step the Android generator emits carries this, which is
+        // the whole reason the defect was invisible.
+        const skippable = await convert(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [{ target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' }], { skippable: true }));
+        const notSkippable = await convert(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [{ target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' }], { skippable: false }));
+        expect(skippable.error).toBeDefined();
+        expect(notSkippable.error).toBeDefined();
+    });
+    test('fails on the first unfilled slot, not the last and not all three', async () => {
+        // What a real Android pipeline carries: three slots, none filled.
+        const { error } = await convert(probePipeline({
+            KEYSTORE_BASE64: '',
+            KEYSTORE_PROPERTIES: '',
+            GOOGLE_SERVICES_JSON: '',
+        }, [
+            {
+                target_path: 'release.keystore',
+                var_name: 'KEYSTORE_BASE64',
+                base64_encoded: true,
+            },
+            { target_path: 'keystore.properties', var_name: 'KEYSTORE_PROPERTIES' },
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(error).toBeDefined();
+        expect(error.message).toContain('KEYSTORE_BASE64');
+        expect(error.message).not.toContain('KEYSTORE_PROPERTIES');
+        expect(error.message).not.toContain('GOOGLE_SERVICES_JSON');
+    });
+    test('no secret value appears in the message', async () => {
+        // The failing slot has no value by definition, so the assertion that
+        // means anything is about the values the build *does* hold.
+        process.env.OTHER_SECRET = JSON_CREDENTIAL;
+        const { error } = await convert(probePipeline({ OTHER_SECRET: '', GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(error).toBeDefined();
+        expect(error.message).not.toContain(JSON_CREDENTIAL);
+        expect(error.message).not.toContain('synthetic-probe');
+    });
+});
+describe('a credential the repository already carries', () => {
+    test('warns and proceeds — the file will be there when the build reads it', async () => {
+        // The `pull-request` collision: the generator declares KEYSTORE_BASE64
+        // globally and emits its step on every workflow, so a project whose
+        // keystore is in the repository must not be refused a build over a value
+        // it never needed.
+        commitToCheckout('release.keystore', 'a keystore the repository carries');
+        const { output } = await land(probePipeline({ KEYSTORE_BASE64: '' }, [
+            {
+                target_path: 'release.keystore',
+                var_name: 'KEYSTORE_BASE64',
+                base64_encoded: true,
+            },
+        ]), 'release.keystore');
+        expect(output).toContain('KEYSTORE_BASE64');
+        expect(output).toContain('release.keystore');
+        // The escape hatch has to be visible in the log, or a build that passes
+        // this way is unexplainable to whoever reads it later.
+        expect(output).toMatch(/already in the checkout/);
+    });
+    test('leaves the file it found exactly as it was', async () => {
+        const carried = 'the repository\'s own google-services.json';
+        commitToCheckout(TARGET, carried);
+        const { bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(bytes?.toString('utf-8')).toBe(carried);
+    });
+    test('an uploaded value still wins over the one in the checkout', async () => {
+        // A repository carrying a placeholder is the ordinary case for
+        // google-services.json, and the point of the upload is to replace it.
+        commitToCheckout(TARGET, 'placeholder committed for local development');
+        process.env.GOOGLE_SERVICES_JSON = JSON_CREDENTIAL;
+        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+    });
+});
+describe('what issue 03 must not change', () => {
+    test('an undeclared key still warns and passes, is_skippable and all', async () => {
+        // Issue 01's class-A case, and the one this change is most likely to
+        // break: HOME exists in every environment this runs in, and nothing
+        // declares it.
+        expect(process.env.HOME).toBeTruthy();
+        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: 'home.txt', var_name: 'HOME' },
+        ]), 'home.txt');
+        expect(output).toContain('HOME not set — skipping home.txt');
+        expect(bytes).toBeUndefined();
+    });
+    test('a declared value from the local store still writes', async () => {
+        writeSecretStore({ GOOGLE_SERVICES_JSON: JSON_CREDENTIAL });
+        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+    });
+    test('a declared value from the dispatched environment still writes', async () => {
+        process.env.GOOGLE_SERVICES_JSON = JSON_CREDENTIAL;
+        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+    });
+    test('a value the YAML itself supplies still writes', async () => {
+        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: JSON_CREDENTIAL }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+    });
+    test('ci validate still passes on a pipeline with empty slots', async () => {
+        // Option 3 was rejected so validation does not start refusing builds
+        // that are green today. This is the line that holds it.
+        const pipeline = probePipeline({ KEYSTORE_BASE64: '', GOOGLE_SERVICES_JSON: '' }, [
+            {
+                target_path: 'release.keystore',
+                var_name: 'KEYSTORE_BASE64',
+                base64_encoded: true,
+            },
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]);
+        const validator = new StepValidator(pipeline, 'probe', mockConfig);
+        const result = await validator.validateWorkflow();
+        expect(result.valid).toBe(true);
+    });
+});
+//# sourceMappingURL=a-missing-credential-is-loud.test.js.map

package/dist/src/yaml/env-resolver.d.ts

@@ -30,6 +30,11 @@ export declare class EnvResolver {
     private envVars;
     private referencedVars;
     private secretsManager;
+    /**
+     * Every key the pipeline names in `app.envs` or `workflow.envs`, whether or
+     * not it gave one a value. Read by `importDeclaredFromProcessEnv`.
+     */
+    private declaredVars;
     constructor(pipeline: YAMLPipeline, workflow: YAMLWorkflow, workflowName: string, platform: Platform, stack?: string, yamlFilePath?: string);
     /**
      * Gets the value of an environment variable
@@ -107,6 +112,34 @@ export declare class EnvResolver {
      * @param envArray Array of environment variable objects
      */
     private mergeEnvVars;
+    /**
+     * Fills a declared-but-still-empty variable from the process environment.
+     *
+     * This is how a credential dispatched by a build service arrives. The
+     * dispatch hands the value to the runner, the runner merges it into the
+     * environment of the `ci` invocation, and nothing else copies it anywhere —
+     * it writes no `.cibuild-secrets.json`, and that file is gitignored so the
+     * clone has none either. Without this step the value sits in the shell and
+     * is invisible to the steps that read this map: `file@1.0.0` reads
+     * `env[var_name]`, finds nothing, prints "not set — skipping" and reports
+     * success. Every credential a pipeline declared as an empty slot was
+     * dropped that way, on every dispatched build, with a green step.
+     *
+     * Scoped to keys the pipeline declares, deliberately. Copying `process.env`
+     * wholesale would turn arbitrary host environment into pipeline values and
+     * would change what every existing pipeline resolves. The declaration is
+     * the opt-in: `- GOOGLE_SERVICES_JSON: ""` is the pipeline saying "I read
+     * this key and I have no value for it", which is exactly the invitation the
+     * dispatched environment needs. A key nothing declares stays out, so `HOME`
+     * and the rest of the host's environment are not pipeline variables.
+     *
+     * Last, so anything an earlier source did supply wins — a developer's
+     * `.cibuild-secrets.json` still beats an inherited environment. The value
+     * is taken verbatim, with no interpolation, for the same reason step 2
+     * takes secrets verbatim: a credential is bytes, and a `$` inside one is
+     * not a variable reference.
+     */
+    private importDeclaredFromProcessEnv;
     /**
      * Resolves $SECRET{secret_id} references to actual secret values
      * @param value Value that may contain a secret reference

package/dist/src/yaml/env-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;gBAGrC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IA0BvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAqCnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAkBpB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}
+{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;IACvC;;;OAGG;IACH,OAAO,CAAC,YAAY,CAA0B;gBAG5C,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IAkCvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAqCnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAoBpB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,4BAA4B;IAUpC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}