@invarn/cibuild 2.7.1 → 2.7.3

package/dist/src/yaml/env-resolver.js

@@ -102,6 +102,11 @@ export class EnvResolver {
     envVars;
     referencedVars = new Set();
     secretsManager;
+    /**
+     * Every key the pipeline names in `app.envs` or `workflow.envs`, whether or
+     * not it gave one a value. Read by `importDeclaredFromProcessEnv`.
+     */
+    declaredVars = new Set();
     constructor(pipeline, workflow, workflowName, platform, stack, yamlFilePath) {
         this.envVars = new Map();
         this.secretsManager = new SecretsManager();
@@ -113,14 +118,21 @@ export class EnvResolver {
         for (const [key, value] of Object.entries(allSecrets)) {
             this.envVars.set(key, value);
         }
-        // Step 3: Add global environment variables (app.envs) — overrides secrets
+        // Step 3: Add global environment variables (app.envs) — overrides secrets,
+        // except with an empty placeholder: `mergeEnvVars` refuses to write `""`
+        // over a value that is already there, so `- KEYSTORE_BASE64: ""` declares
+        // the key without erasing a loaded secret of the same name.
         if (pipeline.app?.envs) {
             this.mergeEnvVars(pipeline.app.envs);
         }
-        // Step 4: Add workflow-level environment variables — highest priority, overrides everything
+        // Step 4: Add workflow-level environment variables — highest priority over
+        // steps 1-3, with the same empty-placeholder exception as step 3
         if (workflow.envs) {
             this.mergeEnvVars(workflow.envs);
         }
+        // Step 5: Last resort for a declared key that is still empty — the
+        // process environment. See importDeclaredFromProcessEnv.
+        this.importDeclaredFromProcessEnv();
     }
     /**
      * Gets the value of an environment variable
@@ -369,6 +381,8 @@ export class EnvResolver {
     mergeEnvVars(envArray) {
         for (const envObj of envArray) {
             for (const [key, value] of Object.entries(envObj)) {
+                // Naming the key is the declaration, whatever value follows it
+                this.declaredVars.add(key);
                 // First resolve any secret references
                 const secretResolved = this.resolveSecretReference(value);
                 // Then interpolate in case it references other env vars
@@ -383,6 +397,44 @@ export class EnvResolver {
             }
         }
     }
+    /**
+     * Fills a declared-but-still-empty variable from the process environment.
+     *
+     * This is how a credential dispatched by a build service arrives. The
+     * dispatch hands the value to the runner, the runner merges it into the
+     * environment of the `ci` invocation, and nothing else copies it anywhere —
+     * it writes no `.cibuild-secrets.json`, and that file is gitignored so the
+     * clone has none either. Without this step the value sits in the shell and
+     * is invisible to the steps that read this map: `file@1.0.0` reads
+     * `env[var_name]`, finds nothing, prints "not set — skipping" and reports
+     * success. Every credential a pipeline declared as an empty slot was
+     * dropped that way, on every dispatched build, with a green step.
+     *
+     * Scoped to keys the pipeline declares, deliberately. Copying `process.env`
+     * wholesale would turn arbitrary host environment into pipeline values and
+     * would change what every existing pipeline resolves. The declaration is
+     * the opt-in: `- GOOGLE_SERVICES_JSON: ""` is the pipeline saying "I read
+     * this key and I have no value for it", which is exactly the invitation the
+     * dispatched environment needs. A key nothing declares stays out, so `HOME`
+     * and the rest of the host's environment are not pipeline variables.
+     *
+     * Last, so anything an earlier source did supply wins — a developer's
+     * `.cibuild-secrets.json` still beats an inherited environment. The value
+     * is taken verbatim, with no interpolation, for the same reason step 2
+     * takes secrets verbatim: a credential is bytes, and a `$` inside one is
+     * not a variable reference.
+     */
+    importDeclaredFromProcessEnv() {
+        for (const key of this.declaredVars) {
+            // Any non-empty value from an earlier source stays. Only empty is open.
+            if (this.envVars.get(key))
+                continue;
+            const fromProcess = process.env[key];
+            if (!fromProcess)
+                continue;
+            this.envVars.set(key, fromProcess);
+        }
+    }
     /**
      * Resolves $SECRET{secret_id} references to actual secret values
      * @param value Value that may contain a secret reference

package/dist/src/yaml/steps/file.d.ts

@@ -1,5 +1,20 @@
 import { BaseStepExecutor } from './base.js';
 import type { StepDef, CIConfig } from '../../types.js';
+/**
+ * A credential the pipeline declares, the build reads, and nobody supplied.
+ *
+ * Thrown at generation time, from the step that would have written the file,
+ * so the build stops before its own build tool fails for a reason that names
+ * the project instead of the value we dropped. Generation time is also the
+ * only place `is_skippable` cannot swallow it: the converter sets that flag on
+ * a StepDef *after* `execute()` returns, so a step which merely exited
+ * non-zero would be reported as "failed but marked skippable — continuing".
+ */
+export declare class MissingFileSecretError extends Error {
+    readonly varName: string;
+    readonly targetPath: string;
+    constructor(varName: string, targetPath: string);
+}
 export interface FileInputs {
     /** Path where the file should be written, relative to the project root. */
     target_path: string;
@@ -23,5 +38,15 @@ export interface FileInputs {
  */
 export declare class FileStepExecutor extends BaseStepExecutor {
     execute(inputs: FileInputs, env: Record<string, string>, _config: CIConfig): Promise<StepDef>;
+    /**
+     * Whether the build will find the file at `target_path` without this step.
+     *
+     * Asked at generation time, which is when the step decides, and answerable
+     * because generation happens inside the checkout — on the host path locally
+     * and on the sandbox path inside the guest. The path is composed exactly the
+     * way the generated script composes the one it writes to, so the two cannot
+     * disagree about which file is in question.
+     */
+    private fileAlreadyInCheckout;
 }
 //# sourceMappingURL=file.d.ts.map

package/dist/src/yaml/steps/file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/file.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,gBAAiB,SAAQ,gBAAgB;IAC9C,OAAO,CACX,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CA4BpB"}
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/file.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAExD;;;;;;;;;GASG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAyBhD;AAED,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,gBAAiB,SAAQ,gBAAgB;IAC9C,OAAO,CACX,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;IAiDnB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAI9B"}

package/dist/src/yaml/steps/file.js

@@ -1,5 +1,43 @@
-import { basename } from 'node:path';
+import { existsSync } from 'node:fs';
+import { basename, join } from 'node:path';
 import { BaseStepExecutor } from './base.js';
+/**
+ * A credential the pipeline declares, the build reads, and nobody supplied.
+ *
+ * Thrown at generation time, from the step that would have written the file,
+ * so the build stops before its own build tool fails for a reason that names
+ * the project instead of the value we dropped. Generation time is also the
+ * only place `is_skippable` cannot swallow it: the converter sets that flag on
+ * a StepDef *after* `execute()` returns, so a step which merely exited
+ * non-zero would be reported as "failed but marked skippable — continuing".
+ */
+export class MissingFileSecretError extends Error {
+    varName;
+    targetPath;
+    constructor(varName, targetPath) {
+        super(`file@1.0.0 cannot write ${targetPath}: ${varName} is declared in this ` +
+            `pipeline but no value reached the build.\n` +
+            `\n` +
+            `A slot declared and left empty means the value arrives as a secret. ` +
+            `None did:\n` +
+            `not the pipeline itself, not .cibuild-secrets.json, and not this ` +
+            `build's environment.\n` +
+            `\n` +
+            `Supply it in one of two places:\n` +
+            `\n` +
+            `  locally        ci secrets add ${varName}\n` +
+            `  remote build   add ${varName} as an organization or pipeline ` +
+            `secret, then\n` +
+            `                 run the build again\n` +
+            `\n` +
+            `If ${basename(targetPath)} belongs to the repository instead, commit ` +
+            `it at\n` +
+            `${targetPath} — a file already in the checkout is used as it is.`);
+        this.name = 'MissingFileSecretError';
+        this.varName = varName;
+        this.targetPath = targetPath;
+    }
+}
 /**
  * Writes a file to a target path at runtime.
  *
@@ -16,7 +54,29 @@ export class FileStepExecutor extends BaseStepExecutor {
         const filename = basename(targetPath);
         const content = env[varName];
         if (!content) {
-            return this.createScriptStep(`echo "⚠️  ${varName} not set — skipping ${filename}"`, 'file');
+            // Two absences, and they mean opposite things. A `var_name` nothing
+            // declares is a genuinely optional credential — a release keystore on a
+            // debug workflow — and skipping it is correct. A `var_name` the pipeline
+            // declares and leaves empty is a value that was supposed to arrive as a
+            // secret and did not: after issue 01 it is in none of the four places a
+            // value can come from, so the build is guaranteed red later, for a
+            // reason nothing in the log connects to this step. `mergeEnvVars` puts a
+            // declared key in the map even when its value is the empty placeholder,
+            // and nothing else puts a key there, so presence is the whole test.
+            //
+            // Except when the repository already carries the file. The Android
+            // generator declares KEYSTORE_BASE64 once, globally, but emits its
+            // `file@` step on every workflow including `pull-request`, where nothing
+            // signs anything — so "declared and empty" alone would refuse builds
+            // that are green today and rightly so. The question worth asking is the
+            // one the build will ask: will the file be there when it is read?
+            if (varName in env && !this.fileAlreadyInCheckout(targetPath, env)) {
+                throw new MissingFileSecretError(varName, targetPath);
+            }
+            const reason = varName in env
+                ? `${filename} is already in the checkout, using it`
+                : `skipping ${filename}`;
+            return this.createScriptStep(`echo "⚠️  ${varName} not set — ${reason}"`, 'file');
         }
         // Base64-encode the content so it can be embedded safely in the script
         // regardless of quotes, newlines, dollar signs, or any other special characters.
@@ -31,5 +91,18 @@ printf '%s' '${encoded}' | base64 -d > "\${CIBUILD_SOURCE_DIR:-$PWD}/${targetPat
 echo "✓ Written ${filename}"`;
         return this.createScriptStep(this.createBashScript(scriptContent, 'file'), 'file');
     }
+    /**
+     * Whether the build will find the file at `target_path` without this step.
+     *
+     * Asked at generation time, which is when the step decides, and answerable
+     * because generation happens inside the checkout — on the host path locally
+     * and on the sandbox path inside the guest. The path is composed exactly the
+     * way the generated script composes the one it writes to, so the two cannot
+     * disagree about which file is in question.
+     */
+    fileAlreadyInCheckout(targetPath, env) {
+        const sourceDir = env.CIBUILD_SOURCE_DIR || process.cwd();
+        return existsSync(join(sourceDir, targetPath));
+    }
 }
 //# sourceMappingURL=file.js.map

package/dist/src/yaml/steps/git-fetch-retry-exec.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Executes the generated shell rather than grepping it.
+ *
+ * The retry lives entirely in emitted bash, so string assertions prove only
+ * that the text was written. These run it: a first-attempt refusal followed by
+ * a second-attempt success has to actually pass, and a non-refusal has to fail
+ * without burning the retry budget.
+ */
+export {};
+//# sourceMappingURL=git-fetch-retry-exec.test.d.ts.map

package/dist/src/yaml/steps/git-fetch-retry-exec.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-fetch-retry-exec.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-fetch-retry-exec.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/src/yaml/steps/git-fetch-retry-exec.test.js

@@ -0,0 +1,162 @@
+/**
+ * Executes the generated shell rather than grepping it.
+ *
+ * The retry lives entirely in emitted bash, so string assertions prove only
+ * that the text was written. These run it: a first-attempt refusal followed by
+ * a second-attempt success has to actually pass, and a non-refusal has to fail
+ * without burning the retry budget.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { execFileSync } from 'child_process';
+import { mkdtempSync, writeFileSync, rmSync, readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { refusedFetchHelpers, retryOnRefusedFetch } from './git-fetch-retry.js';
+const REFUSAL = "fatal: could not read Username for 'https://github.com': terminal prompts disabled";
+/** Wraps the emitted block in the same preamble the real step scripts use. */
+function buildScript(command, attempts = 3) {
+    return [
+        '#!/bin/bash',
+        'set -e',
+        'set -o pipefail',
+        '',
+        ...refusedFetchHelpers(),
+        ...retryOnRefusedFetch({
+            label: 'Package resolution',
+            command,
+            attempts,
+            backoffSeconds: [0, 0, 0, 0],
+        }),
+        'echo "REACHED_THE_END"',
+    ].join('\n');
+}
+function run(command, attempts = 3) {
+    const dir = mkdtempSync(join(tmpdir(), 'cibuild-fetch-retry-'));
+    const scriptPath = join(dir, 'step.sh');
+    writeFileSync(scriptPath, buildScript(command, attempts), { mode: 0o755 });
+    try {
+        const output = execFileSync('bash', [scriptPath], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            cwd: dir,
+            env: { ...process.env, COUNTER: join(dir, 'attempts') },
+        });
+        return { status: 0, output };
+    }
+    catch (e) {
+        return {
+            status: e.status ?? -1,
+            output: `${e.stdout ?? ''}${e.stderr ?? ''}`,
+        };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+/**
+ * A command that records each invocation and refuses the first `n` of them the
+ * way git does, then succeeds.
+ */
+function refuseFirst(n) {
+    return (`bash -c 'echo x >> "$COUNTER"; ` +
+        `if [ "$(wc -l < "$COUNTER")" -le ${n} ]; then echo "${REFUSAL}" >&2; exit 128; fi; ` +
+        `echo RESOLVED_OK'`);
+}
+describe('retryOnRefusedFetch, executed', () => {
+    test('a first-attempt refusal and a second-attempt success still passes', () => {
+        const r = run(refuseFirst(1));
+        expect(r.status).toBe(0);
+        expect(r.output).toContain('RESOLVED_OK');
+        expect(r.output).toContain('REACHED_THE_END');
+        expect(r.output).toContain('was refused by the server (attempt 1 of 3)');
+    });
+    test('a command that succeeds first time is run exactly once', () => {
+        const r = run(refuseFirst(0));
+        expect(r.status).toBe(0);
+        expect(r.output).toContain('RESOLVED_OK');
+        expect(r.output).not.toContain('was refused by the server');
+    });
+    test('a refusal that never clears fails with the original exit code', () => {
+        const r = run(refuseFirst(99));
+        expect(r.status).toBe(128);
+        expect(r.output).not.toContain('REACHED_THE_END');
+        // and it explains itself rather than blaming a package
+        expect(r.output).toContain('A dependency fetch was refused.');
+        expect(r.output).toContain('HTTP 401');
+    });
+    test('it gives up after exactly the configured number of attempts', () => {
+        const r = run(refuseFirst(99), 3);
+        expect(r.output).toContain('(attempt 1 of 3)');
+        expect(r.output).toContain('(attempt 2 of 3)');
+        // the third attempt runs but is not announced as a retry
+        expect(r.output).not.toContain('(attempt 3 of 3)');
+    });
+    test('a failure that is NOT a refused fetch fails immediately', () => {
+        const r = run(`bash -c 'echo x >> "$COUNTER"; echo "error: no such module" >&2; exit 65'`);
+        expect(r.status).toBe(65);
+        // no retry, and no misleading refused-fetch diagnostic
+        expect(r.output).not.toContain('was refused by the server');
+        expect(r.output).not.toContain('A dependency fetch was refused.');
+    });
+    test('a non-refusal failure is attempted once, not three times', () => {
+        const dir = mkdtempSync(join(tmpdir(), 'cibuild-fetch-count-'));
+        const counter = join(dir, 'attempts');
+        const scriptPath = join(dir, 'step.sh');
+        writeFileSync(scriptPath, buildScript(`bash -c 'echo x >> "${counter}"; exit 65'`), { mode: 0o755 });
+        try {
+            execFileSync('bash', [scriptPath], { stdio: 'ignore', cwd: dir });
+        }
+        catch {
+            /* expected */
+        }
+        const attempts = existsSync(counter)
+            ? readFileSync(counter, 'utf-8').trim().split('\n').length
+            : 0;
+        expect(attempts).toBe(1);
+        rmSync(dir, { recursive: true, force: true });
+    });
+    test('the command output still reaches the log while being captured', () => {
+        const r = run(`bash -c 'echo x >> "$COUNTER"; echo VISIBLE_TO_THE_USER'`);
+        expect(r.output).toContain('VISIBLE_TO_THE_USER');
+    });
+});
+describe('the steps that embed it emit syntactically valid bash', () => {
+    // A syntax error in generated shell is not caught by any string assertion
+    // and would break every build of that type on the first run.
+    const parses = async (script) => {
+        const dir = mkdtempSync(join(tmpdir(), 'cibuild-syntax-'));
+        const p = join(dir, 'step.sh');
+        writeFileSync(p, script);
+        try {
+            execFileSync('bash', ['-n', p], { stdio: 'pipe' });
+        }
+        finally {
+            rmSync(dir, { recursive: true, force: true });
+        }
+    };
+    test('xcode-build-for-test', async () => {
+        const { XcodeBuildForTestStepExecutor } = await import('./xcode.js');
+        const { testConfig } = await import('./test-config.js');
+        const r = await new XcodeBuildForTestStepExecutor().execute({ project_path: "My App.xcworkspace", scheme: "My Scheme", xcconfig_content: 'ARCHS = arm64' }, {}, testConfig);
+        await parses(r.script);
+    });
+    test('xcodebuild', async () => {
+        const { XcodeBuildStepExecutor } = await import('./xcode.js');
+        const { testConfig } = await import('./test-config.js');
+        const r = await new XcodeBuildStepExecutor().execute({ project_path: 'MyApp.xcodeproj', scheme: 'MyApp', is_clean_build: true }, {}, testConfig);
+        await parses(r.script);
+    });
+    test('xcode-build-for-simulator', async () => {
+        const { XcodeBuildForSimulatorStepExecutor } = await import('./xcode.js');
+        const { testConfig } = await import('./test-config.js');
+        const r = await new XcodeBuildForSimulatorStepExecutor().execute({ project_path: "My App.xcworkspace", scheme: "My Scheme", perform_clean_action: 'yes' }, {}, testConfig);
+        await parses(r.script);
+    });
+    test('cocoapods-install', async () => {
+        const { CocoapodsInstallStepExecutor } = await import('./ios-deps.js');
+        const { testConfig } = await import('./test-config.js');
+        const r = await new CocoapodsInstallStepExecutor().execute({ verbose: true }, {}, testConfig);
+        await parses(r.script);
+    });
+});
+//# sourceMappingURL=git-fetch-retry-exec.test.js.map

package/dist/src/yaml/steps/git-fetch-retry.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Retrying a refused third-party dependency fetch, and naming the reason when
+ * the retry does not save it.
+ *
+ * A build that resolves its dependencies from public git repositories fetches
+ * them anonymously. When a host answers one of those fetches with HTTP 401,
+ * git has no credential to fall back on and prints
+ *
+ *     fatal: could not read Username for 'https://<host>': terminal prompts disabled
+ *     fatal: expected flush after ref listing
+ *
+ * Those two lines are one failure, not two: the transport child asks for a
+ * username, cannot prompt, and dies; the parent then finds the ref listing
+ * truncated. git asks for a username *only* on a 401, which makes the first
+ * line an exact signature for "the server refused this fetch".
+ *
+ * Such a refusal has been observed to be transient — the same repository
+ * readable again a minute or two later, from the same machine and the same
+ * address — while landing in the middle of a dependency resolution and taking
+ * a multi-minute build down with it.
+ *
+ * Two things are emitted here, and they are deliberately separate:
+ *
+ *   - a retry around the fetch, gated on that signature, so a compile error
+ *     still fails on the first attempt instead of three attempts later; and
+ *   - a diagnostic that re-probes every refused URL and prints the HTTP status
+ *     it gets back. Nothing else in the pipeline records that status, so a
+ *     build failing this way otherwise reports a missing package rather than a
+ *     refused fetch, and a recurrence is unattributable after the fact. The
+ *     probe is the whole reason the second occurrence will be cheaper to
+ *     explain than the first.
+ *
+ * The emitted shell is bash and runs under `set -e` / `set -o pipefail`, which
+ * is why the exit code is measured explicitly rather than inferred.
+ */
+/**
+ * The line git prints when, and only when, a server answers a fetch with
+ * HTTP 401 and no credential is available.
+ */
+export declare const REFUSED_FETCH_SIGNATURE = "could not read Username for";
+export interface RefusedFetchRetryOptions {
+    /** What is being fetched, as it should read in a log line. */
+    label: string;
+    /** The command to run, exactly as it would appear on one shell line. */
+    command: string;
+    /** Total attempts, including the first. Defaults to 3. */
+    attempts?: number;
+    /** Seconds to wait before each retry. Defaults to 15s then 45s. */
+    backoffSeconds?: number[];
+}
+/**
+ * Shell functions and state the retry depends on. Emit once per script, before
+ * the first `retryOnRefusedFetch` block.
+ */
+export declare function refusedFetchHelpers(): string[];
+/**
+ * Runs `command`, retrying it while the failure looks like a refused fetch.
+ * On the last failure the diagnostic runs and the step exits with the
+ * command's own status, so the reported exit code is still the real one.
+ */
+export declare function retryOnRefusedFetch(options: RefusedFetchRetryOptions): string[];
+//# sourceMappingURL=git-fetch-retry.d.ts.map

package/dist/src/yaml/steps/git-fetch-retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-fetch-retry.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-fetch-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;GAGG;AACH,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAErE,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAiE9C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAuC/E"}

package/dist/src/yaml/steps/git-fetch-retry.js

@@ -0,0 +1,155 @@
+/**
+ * Retrying a refused third-party dependency fetch, and naming the reason when
+ * the retry does not save it.
+ *
+ * A build that resolves its dependencies from public git repositories fetches
+ * them anonymously. When a host answers one of those fetches with HTTP 401,
+ * git has no credential to fall back on and prints
+ *
+ *     fatal: could not read Username for 'https://<host>': terminal prompts disabled
+ *     fatal: expected flush after ref listing
+ *
+ * Those two lines are one failure, not two: the transport child asks for a
+ * username, cannot prompt, and dies; the parent then finds the ref listing
+ * truncated. git asks for a username *only* on a 401, which makes the first
+ * line an exact signature for "the server refused this fetch".
+ *
+ * Such a refusal has been observed to be transient — the same repository
+ * readable again a minute or two later, from the same machine and the same
+ * address — while landing in the middle of a dependency resolution and taking
+ * a multi-minute build down with it.
+ *
+ * Two things are emitted here, and they are deliberately separate:
+ *
+ *   - a retry around the fetch, gated on that signature, so a compile error
+ *     still fails on the first attempt instead of three attempts later; and
+ *   - a diagnostic that re-probes every refused URL and prints the HTTP status
+ *     it gets back. Nothing else in the pipeline records that status, so a
+ *     build failing this way otherwise reports a missing package rather than a
+ *     refused fetch, and a recurrence is unattributable after the fact. The
+ *     probe is the whole reason the second occurrence will be cheaper to
+ *     explain than the first.
+ *
+ * The emitted shell is bash and runs under `set -e` / `set -o pipefail`, which
+ * is why the exit code is measured explicitly rather than inferred.
+ */
+/**
+ * The line git prints when, and only when, a server answers a fetch with
+ * HTTP 401 and no credential is available.
+ */
+export const REFUSED_FETCH_SIGNATURE = 'could not read Username for';
+/**
+ * Shell functions and state the retry depends on. Emit once per script, before
+ * the first `retryOnRefusedFetch` block.
+ */
+export function refusedFetchHelpers() {
+    return [
+        '# --- refused dependency fetch: retry, then explain -------------------------',
+        'CIBUILD_FETCH_LOG="$(mktemp -t cibuild-fetch)"',
+        '',
+        '# git asks for a username only when a server answers with HTTP 401, so this',
+        '# line means the fetch was refused, not that a package is missing.',
+        'cibuild_fetch_was_refused() {',
+        `  grep -q '${REFUSED_FETCH_SIGNATURE}' "$CIBUILD_FETCH_LOG" 2>/dev/null`,
+        '}',
+        '',
+        '# The status that caused the refusal is recorded nowhere, so ask again and',
+        '# put it in the build log where the next person will find it.',
+        'cibuild_diagnose_refused_fetch() {',
+        '  echo ""',
+        '  echo "──────────────────────────────────────────────────────────────"',
+        '  echo "A dependency fetch was refused."',
+        '  echo ""',
+        '  echo "git asked for a username, which it does only when the server answered"',
+        '  echo "with HTTP 401. That is an authentication refusal, not a missing"',
+        '  echo "package. Re-probing each repository named above:"',
+        '  echo ""',
+        // Every stage here can legitimately match nothing, and under `set -e` with
+        // `pipefail` an empty grep would abort the step and replace the command's
+        // real exit code with 1. The diagnostic must never do that: it runs on the
+        // failure path, and its whole job is to explain a failure it did not cause.
+        `  grep -oE 'https://[^ "'"'"']+' "$CIBUILD_FETCH_LOG" 2>/dev/null \\`,
+        `    | sed -e "s/[.,:;')]*$//" -e 's/\\.git$//' \\`,
+        `    | grep -E '^https://[^/]+/[^/]+/[^/]+$' \\`,
+        '    | sort -u | head -20 \\',
+        '    | while IFS= read -r CIBUILD_FETCH_PROBE_URL; do',
+        '        CIBUILD_FETCH_PROBE_CODE="$(curl -sS -o /dev/null -m 20 \\',
+        `          -w '%{http_code}' \\`,
+        '          "$CIBUILD_FETCH_PROBE_URL/info/refs?service=git-upload-pack" 2>/dev/null)" \\',
+        '          || CIBUILD_FETCH_PROBE_CODE="000"',
+        '        case "$CIBUILD_FETCH_PROBE_CODE" in',
+        '          200)',
+        '            echo "  200  $CIBUILD_FETCH_PROBE_URL"',
+        '            echo "       readable anonymously now — the refusal was transient"',
+        '            ;;',
+        '          401|403)',
+        '            echo "  $CIBUILD_FETCH_PROBE_CODE  $CIBUILD_FETCH_PROBE_URL"',
+        '            echo "       still refused — this repository needs a credential, or the"',
+        '            echo "       host is refusing anonymous reads from this machine"',
+        '            ;;',
+        '          404)',
+        '            echo "  404  $CIBUILD_FETCH_PROBE_URL"',
+        '            echo "       no such repository — check the dependency URL"',
+        '            ;;',
+        '          000)',
+        '            echo "  ---  $CIBUILD_FETCH_PROBE_URL"',
+        '            echo "       unreachable from this machine — network, DNS or TLS"',
+        '            ;;',
+        '          *)',
+        '            echo "  $CIBUILD_FETCH_PROBE_CODE  $CIBUILD_FETCH_PROBE_URL"',
+        '            ;;',
+        '        esac',
+        '      done || true',
+        '  echo ""',
+        '  echo "A 200 above means the fetch would succeed if it ran again now."',
+        '  echo "──────────────────────────────────────────────────────────────"',
+        '  echo ""',
+        '}',
+        '',
+    ];
+}
+/**
+ * Runs `command`, retrying it while the failure looks like a refused fetch.
+ * On the last failure the diagnostic runs and the step exits with the
+ * command's own status, so the reported exit code is still the real one.
+ */
+export function retryOnRefusedFetch(options) {
+    const attempts = options.attempts ?? 3;
+    const backoff = options.backoffSeconds ?? [15, 45];
+    const label = options.label.replace(/"/g, '\\"');
+    return [
+        `CIBUILD_FETCH_MAX_ATTEMPTS=${attempts}`,
+        `CIBUILD_FETCH_BACKOFF=(${backoff.join(' ')})`,
+        'CIBUILD_FETCH_ATTEMPT=1',
+        'while :; do',
+        '  set +e',
+        `  ${options.command} 2>&1 | tee "$CIBUILD_FETCH_LOG"`,
+        '  CIBUILD_FETCH_RC=${PIPESTATUS[0]}',
+        '  set -e',
+        '  if [ "$CIBUILD_FETCH_RC" -eq 0 ]; then',
+        '    break',
+        '  fi',
+        // Anything that is not a refused fetch is a real failure: fail now.
+        '  if ! cibuild_fetch_was_refused; then',
+        '    break',
+        '  fi',
+        '  if [ "$CIBUILD_FETCH_ATTEMPT" -ge "$CIBUILD_FETCH_MAX_ATTEMPTS" ]; then',
+        '    break',
+        '  fi',
+        '  CIBUILD_FETCH_WAIT="${CIBUILD_FETCH_BACKOFF[$((CIBUILD_FETCH_ATTEMPT - 1))]:-30}"',
+        `  echo "⚠️  ${label} was refused by the server (attempt $CIBUILD_FETCH_ATTEMPT of $CIBUILD_FETCH_MAX_ATTEMPTS)."`,
+        '  echo "   A refused anonymous fetch is usually transient. Retrying in ${CIBUILD_FETCH_WAIT}s..."',
+        '  sleep "$CIBUILD_FETCH_WAIT"',
+        '  CIBUILD_FETCH_ATTEMPT=$((CIBUILD_FETCH_ATTEMPT + 1))',
+        'done',
+        '',
+        'if [ "$CIBUILD_FETCH_RC" -ne 0 ]; then',
+        '  if cibuild_fetch_was_refused; then',
+        '    cibuild_diagnose_refused_fetch',
+        '  fi',
+        '  exit "$CIBUILD_FETCH_RC"',
+        'fi',
+        '',
+    ];
+}
+//# sourceMappingURL=git-fetch-retry.js.map

package/dist/src/yaml/steps/git-fetch-retry.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Tests for retrying a refused third-party dependency fetch.
+ */
+export {};
+//# sourceMappingURL=git-fetch-retry.test.d.ts.map

package/dist/src/yaml/steps/git-fetch-retry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-fetch-retry.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-fetch-retry.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}