@invarn/cibuild 2.7.2 → 2.7.3

package/dist/src/yaml/a-missing-credential-is-loud.test.d.ts

@@ -0,0 +1,32 @@
+/**
+ * A credential the pipeline declares and nobody supplied fails the build,
+ * naming itself, instead of being skipped with a warning.
+ *
+ * `file@1.0.0` carries `is_skippable: true` in every pipeline the Android
+ * generator emits, so an absent value printed `⚠️  X not set — skipping <file>`
+ * and returned success. The build then failed several steps later inside the
+ * project's own build tool, with an error naming the project rather than the
+ * value we dropped. Both failure modes in this defect were green, which is why
+ * it survived.
+ *
+ * The two absences are not the same absence, and the map the step already
+ * receives tells them apart by presence:
+ *
+ *   - a `var_name` the pipeline **declares** and leaves empty is a key of the
+ *     map with an empty value — the value was supposed to arrive as a secret
+ *     and did not. After issue 01 that means it is in none of the four places
+ *     a value can come from, so the diagnosis is not a guess.
+ *   - a `var_name` **nothing declares** is not a key of the map at all — a
+ *     release keystore on a debug workflow. Skipping is correct there.
+ *
+ * One case sits between them, and it decides the rule (issue 03 §2.3, Alex,
+ * 2026-09-08): the generator declares `KEYSTORE_BASE64` globally but emits its
+ * `file@` step in all three workflows, so a project that ran `ci init` with a
+ * keystore and never uploaded one would go from three green skips to three
+ * hard failures — including on `pull-request`, where nothing signs anything.
+ * So the question the step asks is the one that actually matters: **will the
+ * file be there when the build reads it?** A repository that carries the file
+ * keeps warning and building; only an absence with nothing behind it fails.
+ */
+export {};
+//# sourceMappingURL=a-missing-credential-is-loud.test.d.ts.map

package/dist/src/yaml/a-missing-credential-is-loud.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-missing-credential-is-loud.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-missing-credential-is-loud.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG"}

package/dist/src/yaml/a-missing-credential-is-loud.test.js

@@ -0,0 +1,301 @@
+/**
+ * A credential the pipeline declares and nobody supplied fails the build,
+ * naming itself, instead of being skipped with a warning.
+ *
+ * `file@1.0.0` carries `is_skippable: true` in every pipeline the Android
+ * generator emits, so an absent value printed `⚠️  X not set — skipping <file>`
+ * and returned success. The build then failed several steps later inside the
+ * project's own build tool, with an error naming the project rather than the
+ * value we dropped. Both failure modes in this defect were green, which is why
+ * it survived.
+ *
+ * The two absences are not the same absence, and the map the step already
+ * receives tells them apart by presence:
+ *
+ *   - a `var_name` the pipeline **declares** and leaves empty is a key of the
+ *     map with an empty value — the value was supposed to arrive as a secret
+ *     and did not. After issue 01 that means it is in none of the four places
+ *     a value can come from, so the diagnosis is not a guess.
+ *   - a `var_name` **nothing declares** is not a key of the map at all — a
+ *     release keystore on a debug workflow. Skipping is correct there.
+ *
+ * One case sits between them, and it decides the rule (issue 03 §2.3, Alex,
+ * 2026-09-08): the generator declares `KEYSTORE_BASE64` globally but emits its
+ * `file@` step in all three workflows, so a project that ran `ci init` with a
+ * keystore and never uploaded one would go from three green skips to three
+ * hard failures — including on `pull-request`, where nothing signs anything.
+ * So the question the step asks is the one that actually matters: **will the
+ * file be there when the build reads it?** A repository that carries the file
+ * keeps warning and building; only an absence with nothing behind it fails.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync, } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { convertYAMLToPipelineDef } from './converter.js';
+import { StepValidator } from './step-validator.js';
+import { clearRegistry, registerStep } from './steps/registry.js';
+import { FileStepExecutor } from './steps/file.js';
+const mockConfig = {
+    artifactsDir: '/test/artifacts',
+    maxConcurrentJobs: 1,
+    paths: {
+        buildsDir: '/test/builds',
+        cacheDir: '/test/cache',
+        derivedDataDir: '/test/derived-data',
+    },
+    interpreters: {
+        bash: '/bin/bash',
+        python: 'python3',
+        ruby: 'ruby',
+        node: 'node',
+    },
+};
+/** The 61-byte document from the PRD's reproduction. Synthetic. */
+const JSON_CREDENTIAL = '{"project_info":{"project_id":"synthetic-probe"},"client":[]}';
+const TARGET = 'app/google-services.json';
+let workdir;
+let previousCwd;
+beforeEach(() => {
+    clearRegistry();
+    registerStep('file', new FileStepExecutor());
+    previousCwd = process.cwd();
+    workdir = mkdtempSync(join(tmpdir(), 'cibuild-missing-credential-'));
+    process.chdir(workdir);
+    // `workdir` is the pre-symlink path on macOS; the step resolves paths from
+    // CIBUILD_SOURCE_DIR, which is cwd, so read and write files the same way.
+    workdir = process.cwd();
+    delete process.env.GOOGLE_SERVICES_JSON;
+    delete process.env.KEYSTORE_BASE64;
+    delete process.env.OTHER_SECRET;
+});
+afterEach(() => {
+    process.chdir(previousCwd);
+    rmSync(workdir, { recursive: true, force: true });
+    clearRegistry();
+    delete process.env.GOOGLE_SERVICES_JSON;
+    delete process.env.KEYSTORE_BASE64;
+    delete process.env.OTHER_SECRET;
+});
+/**
+ * The shape the Android generator emits: empty slots under `app.envs` and one
+ * skippable `file@1.0.0` step per credential, in declaration order.
+ */
+function probePipeline(declared, fileSteps, options = {}) {
+    const skippable = options.skippable ?? true;
+    const app = declared
+        ? { app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) } }
+        : {};
+    return {
+        format_version: '1',
+        ...app,
+        workflows: {
+            probe: {
+                steps: fileSteps.map((inputs) => ({
+                    'file@1.0.0': {
+                        title: `Setup ${String(inputs.var_name)}`,
+                        is_skippable: skippable,
+                        inputs,
+                    },
+                })),
+            },
+        },
+    };
+}
+function writeSecretStore(global) {
+    writeFileSync(join(workdir, '.cibuild-secrets.json'), JSON.stringify({ global, workflows: {} }), { mode: 0o600 });
+}
+/** Puts a file in the checkout, the way a repository that carries one does. */
+function commitToCheckout(relPath, contents) {
+    const target = join(workdir, relPath);
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, contents, 'utf-8');
+}
+/**
+ * Converts the pipeline and runs the generated steps the way the runner does,
+ * then reads back whatever landed at `target`.
+ */
+async function land(pipeline, target = TARGET) {
+    const result = await convertYAMLToPipelineDef(pipeline, mockConfig, 'probe');
+    const chunks = [...result.warnings];
+    for (const step of result.pipeline.steps) {
+        const scriptPath = join(workdir, `__step_${step.id}.sh`);
+        writeFileSync(scriptPath, step.script, 'utf-8');
+        const proc = spawnSync('bash', [scriptPath], {
+            cwd: workdir,
+            encoding: 'utf-8',
+            env: { ...process.env },
+        });
+        expect(proc.status).toBe(0);
+        chunks.push(proc.stdout ?? '', proc.stderr ?? '');
+    }
+    const landedAt = join(workdir, target);
+    return {
+        output: chunks.join('\n'),
+        bytes: existsSync(landedAt) ? readFileSync(landedAt) : undefined,
+    };
+}
+/** The conversion's outcome, without letting a throw escape the assertion. */
+async function convert(pipeline) {
+    try {
+        const result = await convertYAMLToPipelineDef(pipeline, mockConfig, 'probe');
+        return { steps: result.pipeline.steps };
+    }
+    catch (error) {
+        return { error: error };
+    }
+}
+describe('a declared credential nothing supplied', () => {
+    test('fails, naming the key and the target path', async () => {
+        const { error, steps } = await convert(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(error).toBeDefined();
+        expect(error.message).toContain('GOOGLE_SERVICES_JSON');
+        expect(error.message).toContain(TARGET);
+        // Not a stack trace and not a step that runs: conversion is what builds
+        // the step list, so nothing at all is handed to the runner.
+        expect(steps).toBeUndefined();
+    });
+    test('says both places the value can come from', async () => {
+        const { error } = await convert(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        // A user reading this should not have to know that a slot, an upload and
+        // a `file@` step are three separate things.
+        expect(error.message).toContain('ci secrets add GOOGLE_SERVICES_JSON');
+        expect(error.message).toMatch(/organization or pipeline secret/);
+    });
+    test('is_skippable does not turn it into a pass', async () => {
+        // Every `file@` step the Android generator emits carries this, which is
+        // the whole reason the defect was invisible.
+        const skippable = await convert(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [{ target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' }], { skippable: true }));
+        const notSkippable = await convert(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [{ target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' }], { skippable: false }));
+        expect(skippable.error).toBeDefined();
+        expect(notSkippable.error).toBeDefined();
+    });
+    test('fails on the first unfilled slot, not the last and not all three', async () => {
+        // What a real Android pipeline carries: three slots, none filled.
+        const { error } = await convert(probePipeline({
+            KEYSTORE_BASE64: '',
+            KEYSTORE_PROPERTIES: '',
+            GOOGLE_SERVICES_JSON: '',
+        }, [
+            {
+                target_path: 'release.keystore',
+                var_name: 'KEYSTORE_BASE64',
+                base64_encoded: true,
+            },
+            { target_path: 'keystore.properties', var_name: 'KEYSTORE_PROPERTIES' },
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(error).toBeDefined();
+        expect(error.message).toContain('KEYSTORE_BASE64');
+        expect(error.message).not.toContain('KEYSTORE_PROPERTIES');
+        expect(error.message).not.toContain('GOOGLE_SERVICES_JSON');
+    });
+    test('no secret value appears in the message', async () => {
+        // The failing slot has no value by definition, so the assertion that
+        // means anything is about the values the build *does* hold.
+        process.env.OTHER_SECRET = JSON_CREDENTIAL;
+        const { error } = await convert(probePipeline({ OTHER_SECRET: '', GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(error).toBeDefined();
+        expect(error.message).not.toContain(JSON_CREDENTIAL);
+        expect(error.message).not.toContain('synthetic-probe');
+    });
+});
+describe('a credential the repository already carries', () => {
+    test('warns and proceeds — the file will be there when the build reads it', async () => {
+        // The `pull-request` collision: the generator declares KEYSTORE_BASE64
+        // globally and emits its step on every workflow, so a project whose
+        // keystore is in the repository must not be refused a build over a value
+        // it never needed.
+        commitToCheckout('release.keystore', 'a keystore the repository carries');
+        const { output } = await land(probePipeline({ KEYSTORE_BASE64: '' }, [
+            {
+                target_path: 'release.keystore',
+                var_name: 'KEYSTORE_BASE64',
+                base64_encoded: true,
+            },
+        ]), 'release.keystore');
+        expect(output).toContain('KEYSTORE_BASE64');
+        expect(output).toContain('release.keystore');
+        // The escape hatch has to be visible in the log, or a build that passes
+        // this way is unexplainable to whoever reads it later.
+        expect(output).toMatch(/already in the checkout/);
+    });
+    test('leaves the file it found exactly as it was', async () => {
+        const carried = 'the repository\'s own google-services.json';
+        commitToCheckout(TARGET, carried);
+        const { bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(bytes?.toString('utf-8')).toBe(carried);
+    });
+    test('an uploaded value still wins over the one in the checkout', async () => {
+        // A repository carrying a placeholder is the ordinary case for
+        // google-services.json, and the point of the upload is to replace it.
+        commitToCheckout(TARGET, 'placeholder committed for local development');
+        process.env.GOOGLE_SERVICES_JSON = JSON_CREDENTIAL;
+        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+    });
+});
+describe('what issue 03 must not change', () => {
+    test('an undeclared key still warns and passes, is_skippable and all', async () => {
+        // Issue 01's class-A case, and the one this change is most likely to
+        // break: HOME exists in every environment this runs in, and nothing
+        // declares it.
+        expect(process.env.HOME).toBeTruthy();
+        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: 'home.txt', var_name: 'HOME' },
+        ]), 'home.txt');
+        expect(output).toContain('HOME not set — skipping home.txt');
+        expect(bytes).toBeUndefined();
+    });
+    test('a declared value from the local store still writes', async () => {
+        writeSecretStore({ GOOGLE_SERVICES_JSON: JSON_CREDENTIAL });
+        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+    });
+    test('a declared value from the dispatched environment still writes', async () => {
+        process.env.GOOGLE_SERVICES_JSON = JSON_CREDENTIAL;
+        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+    });
+    test('a value the YAML itself supplies still writes', async () => {
+        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: JSON_CREDENTIAL }, [
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]));
+        expect(output).toContain('✓ Written google-services.json');
+        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
+    });
+    test('ci validate still passes on a pipeline with empty slots', async () => {
+        // Option 3 was rejected so validation does not start refusing builds
+        // that are green today. This is the line that holds it.
+        const pipeline = probePipeline({ KEYSTORE_BASE64: '', GOOGLE_SERVICES_JSON: '' }, [
+            {
+                target_path: 'release.keystore',
+                var_name: 'KEYSTORE_BASE64',
+                base64_encoded: true,
+            },
+            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
+        ]);
+        const validator = new StepValidator(pipeline, 'probe', mockConfig);
+        const result = await validator.validateWorkflow();
+        expect(result.valid).toBe(true);
+    });
+});
+//# sourceMappingURL=a-missing-credential-is-loud.test.js.map

package/dist/src/yaml/steps/file.d.ts

@@ -1,5 +1,20 @@
 import { BaseStepExecutor } from './base.js';
 import type { StepDef, CIConfig } from '../../types.js';
+/**
+ * A credential the pipeline declares, the build reads, and nobody supplied.
+ *
+ * Thrown at generation time, from the step that would have written the file,
+ * so the build stops before its own build tool fails for a reason that names
+ * the project instead of the value we dropped. Generation time is also the
+ * only place `is_skippable` cannot swallow it: the converter sets that flag on
+ * a StepDef *after* `execute()` returns, so a step which merely exited
+ * non-zero would be reported as "failed but marked skippable — continuing".
+ */
+export declare class MissingFileSecretError extends Error {
+    readonly varName: string;
+    readonly targetPath: string;
+    constructor(varName: string, targetPath: string);
+}
 export interface FileInputs {
     /** Path where the file should be written, relative to the project root. */
     target_path: string;
@@ -23,5 +38,15 @@ export interface FileInputs {
  */
 export declare class FileStepExecutor extends BaseStepExecutor {
     execute(inputs: FileInputs, env: Record<string, string>, _config: CIConfig): Promise<StepDef>;
+    /**
+     * Whether the build will find the file at `target_path` without this step.
+     *
+     * Asked at generation time, which is when the step decides, and answerable
+     * because generation happens inside the checkout — on the host path locally
+     * and on the sandbox path inside the guest. The path is composed exactly the
+     * way the generated script composes the one it writes to, so the two cannot
+     * disagree about which file is in question.
+     */
+    private fileAlreadyInCheckout;
 }
 //# sourceMappingURL=file.d.ts.map

package/dist/src/yaml/steps/file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/file.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,gBAAiB,SAAQ,gBAAgB;IAC9C,OAAO,CACX,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CA4BpB"}
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/file.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAExD;;;;;;;;;GASG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAyBhD;AAED,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,qBAAa,gBAAiB,SAAQ,gBAAgB;IAC9C,OAAO,CACX,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;IAiDnB;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;CAI9B"}

package/dist/src/yaml/steps/file.js

@@ -1,5 +1,43 @@
-import { basename } from 'node:path';
+import { existsSync } from 'node:fs';
+import { basename, join } from 'node:path';
 import { BaseStepExecutor } from './base.js';
+/**
+ * A credential the pipeline declares, the build reads, and nobody supplied.
+ *
+ * Thrown at generation time, from the step that would have written the file,
+ * so the build stops before its own build tool fails for a reason that names
+ * the project instead of the value we dropped. Generation time is also the
+ * only place `is_skippable` cannot swallow it: the converter sets that flag on
+ * a StepDef *after* `execute()` returns, so a step which merely exited
+ * non-zero would be reported as "failed but marked skippable — continuing".
+ */
+export class MissingFileSecretError extends Error {
+    varName;
+    targetPath;
+    constructor(varName, targetPath) {
+        super(`file@1.0.0 cannot write ${targetPath}: ${varName} is declared in this ` +
+            `pipeline but no value reached the build.\n` +
+            `\n` +
+            `A slot declared and left empty means the value arrives as a secret. ` +
+            `None did:\n` +
+            `not the pipeline itself, not .cibuild-secrets.json, and not this ` +
+            `build's environment.\n` +
+            `\n` +
+            `Supply it in one of two places:\n` +
+            `\n` +
+            `  locally        ci secrets add ${varName}\n` +
+            `  remote build   add ${varName} as an organization or pipeline ` +
+            `secret, then\n` +
+            `                 run the build again\n` +
+            `\n` +
+            `If ${basename(targetPath)} belongs to the repository instead, commit ` +
+            `it at\n` +
+            `${targetPath} — a file already in the checkout is used as it is.`);
+        this.name = 'MissingFileSecretError';
+        this.varName = varName;
+        this.targetPath = targetPath;
+    }
+}
 /**
  * Writes a file to a target path at runtime.
  *
@@ -16,7 +54,29 @@ export class FileStepExecutor extends BaseStepExecutor {
         const filename = basename(targetPath);
         const content = env[varName];
         if (!content) {
-            return this.createScriptStep(`echo "⚠️  ${varName} not set — skipping ${filename}"`, 'file');
+            // Two absences, and they mean opposite things. A `var_name` nothing
+            // declares is a genuinely optional credential — a release keystore on a
+            // debug workflow — and skipping it is correct. A `var_name` the pipeline
+            // declares and leaves empty is a value that was supposed to arrive as a
+            // secret and did not: after issue 01 it is in none of the four places a
+            // value can come from, so the build is guaranteed red later, for a
+            // reason nothing in the log connects to this step. `mergeEnvVars` puts a
+            // declared key in the map even when its value is the empty placeholder,
+            // and nothing else puts a key there, so presence is the whole test.
+            //
+            // Except when the repository already carries the file. The Android
+            // generator declares KEYSTORE_BASE64 once, globally, but emits its
+            // `file@` step on every workflow including `pull-request`, where nothing
+            // signs anything — so "declared and empty" alone would refuse builds
+            // that are green today and rightly so. The question worth asking is the
+            // one the build will ask: will the file be there when it is read?
+            if (varName in env && !this.fileAlreadyInCheckout(targetPath, env)) {
+                throw new MissingFileSecretError(varName, targetPath);
+            }
+            const reason = varName in env
+                ? `${filename} is already in the checkout, using it`
+                : `skipping ${filename}`;
+            return this.createScriptStep(`echo "⚠️  ${varName} not set — ${reason}"`, 'file');
         }
         // Base64-encode the content so it can be embedded safely in the script
         // regardless of quotes, newlines, dollar signs, or any other special characters.
@@ -31,5 +91,18 @@ printf '%s' '${encoded}' | base64 -d > "\${CIBUILD_SOURCE_DIR:-$PWD}/${targetPat
 echo "✓ Written ${filename}"`;
         return this.createScriptStep(this.createBashScript(scriptContent, 'file'), 'file');
     }
+    /**
+     * Whether the build will find the file at `target_path` without this step.
+     *
+     * Asked at generation time, which is when the step decides, and answerable
+     * because generation happens inside the checkout — on the host path locally
+     * and on the sandbox path inside the guest. The path is composed exactly the
+     * way the generated script composes the one it writes to, so the two cannot
+     * disagree about which file is in question.
+     */
+    fileAlreadyInCheckout(targetPath, env) {
+        const sourceDir = env.CIBUILD_SOURCE_DIR || process.cwd();
+        return existsSync(join(sourceDir, targetPath));
+    }
 }
 //# sourceMappingURL=file.js.map

package/dist/src/yaml/steps/git-fetch-retry-exec.test.js

@@ -146,6 +146,12 @@ describe('the steps that embed it emit syntactically valid bash', () => {
         const r = await new XcodeBuildStepExecutor().execute({ project_path: 'MyApp.xcodeproj', scheme: 'MyApp', is_clean_build: true }, {}, testConfig);
         await parses(r.script);
     });
+    test('xcode-build-for-simulator', async () => {
+        const { XcodeBuildForSimulatorStepExecutor } = await import('./xcode.js');
+        const { testConfig } = await import('./test-config.js');
+        const r = await new XcodeBuildForSimulatorStepExecutor().execute({ project_path: "My App.xcworkspace", scheme: "My Scheme", perform_clean_action: 'yes' }, {}, testConfig);
+        await parses(r.script);
+    });
     test('cocoapods-install', async () => {
         const { CocoapodsInstallStepExecutor } = await import('./ios-deps.js');
         const { testConfig } = await import('./test-config.js');

package/dist/src/yaml/steps/xcode-resolve-retry.test.js

@@ -6,7 +6,7 @@
  * expensive one. These assert the split actually lands in the emitted script.
  */
 import { describe, test, expect } from '@jest/globals';
-import { XcodeBuildStepExecutor, XcodeBuildForTestStepExecutor } from './xcode.js';
+import { XcodeBuildStepExecutor, XcodeBuildForTestStepExecutor, XcodeBuildForSimulatorStepExecutor, } from './xcode.js';
 import { CocoapodsInstallStepExecutor } from './ios-deps.js';
 import { testConfig } from './test-config.js';
 const countOccurrences = (haystack, needle) => haystack.split(needle).length - 1;
@@ -83,6 +83,41 @@ describe('xcodebuild resolves before it builds', () => {
         expect(await build({ is_clean_build: true })).toContain('xcodebuild clean build');
     });
 });
+describe('xcode-build-for-simulator resolves before it builds', () => {
+    // This is the step the iOS template's "Build App" is, and it is the first
+    // step in that pipeline that resolves a package graph — so it is the one a
+    // refused fetch actually lands on. It was missed on the first pass.
+    const build = async (inputs = {}) => {
+        const executor = new XcodeBuildForSimulatorStepExecutor();
+        const result = await executor.execute({ project_path: 'MyApp.xcodeproj', scheme: 'MyApp', ...inputs }, {}, testConfig);
+        return result.script;
+    };
+    test('resolves package dependencies before building', async () => {
+        const script = await build();
+        expect(script).toContain('xcodebuild -resolvePackageDependencies');
+        expect(script.indexOf('xcodebuild -resolvePackageDependencies')).toBeLessThan(script.indexOf('xcodebuild build '));
+    });
+    test('wraps the resolve in the refused-fetch retry', async () => {
+        const script = await build();
+        expect(script).toContain('cibuild_fetch_was_refused');
+        expect(script).toContain('CIBUILD_FETCH_MAX_ATTEMPTS');
+    });
+    test('leaves the build invocation itself unwrapped', async () => {
+        expect(countOccurrences(await build(), 'CIBUILD_FETCH_MAX_ATTEMPTS=')).toBe(1);
+    });
+    test('passes the same project type and scheme as the build', async () => {
+        const resolveLine = (await build())
+            .split('\n')
+            .find((l) => l.includes('-resolvePackageDependencies'));
+        expect(resolveLine).toContain('"$PROJECT_TYPE"');
+        expect(resolveLine).toContain("-scheme 'MyApp'");
+    });
+    test('still honours a clean action and still finds the .app', async () => {
+        const script = await build({ perform_clean_action: 'yes' });
+        expect(script).toContain('xcodebuild clean build');
+        expect(script).toContain('CIBUILD_APP_DIR_PATH');
+    });
+});
 describe('cocoapods-install retries a refused pod source fetch', () => {
     const build = async (inputs = {}) => {
         const executor = new CocoapodsInstallStepExecutor();

package/dist/src/yaml/steps/xcode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xcode.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/xcode.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,yBAAyB,CACvB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmDpB,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA4HzG;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACzD,yBAAyB,CACvB,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmDpB,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAuExG;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kCAAkC;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;iEAC6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;qDAGiD;IACjD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,gBAAgB;IAC5D,yBAAyB,CACvB,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IA6B1B,UAAU,IAAI,UAAU,EAAE;IASpB,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAwU3G;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,yBAAyB,CACvB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IA4BpB,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyEzG;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;sDACkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,yBAAyB,CACvB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAS1B,UAAU;;;;;IAUJ,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAuH3G;AAMD,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,gBAAgB;IACjE,yBAAyB,CACvB,MAAM,EAAE,uBAAuB,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAsB1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA6GlH;AAMD,MAAM,WAAW,8BAA8B;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,qBAAa,oCAAqC,SAAQ,gBAAgB;IACxE,yBAAyB,CACvB,MAAM,EAAE,8BAA8B,EACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAgB1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAkFzH;AAMD,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,kCAAmC,SAAQ,gBAAgB;IACtE,yBAAyB,CACvB,MAAM,EAAE,4BAA4B,EACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAsB1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA0FvH;AAMD,MAAM,WAAW,qBAAqB;IACpC,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yCAAyC;IACzC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,yBAAyB,CACvB,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAkHhH"}
+{"version":3,"file":"xcode.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/xcode.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,yBAAyB,CACvB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmDpB,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA4HzG;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACzD,yBAAyB,CACvB,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmDpB,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAuExG;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kCAAkC;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;iEAC6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;qDAGiD;IACjD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,gBAAgB;IAC5D,yBAAyB,CACvB,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IA6B1B,UAAU,IAAI,UAAU,EAAE;IASpB,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAwU3G;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,yBAAyB,CACvB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IA4BpB,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyEzG;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;sDACkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,yBAAyB,CACvB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAS1B,UAAU;;;;;IAUJ,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAuH3G;AAMD,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,gBAAgB;IACjE,yBAAyB,CACvB,MAAM,EAAE,uBAAuB,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAsB1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA6GlH;AAMD,MAAM,WAAW,8BAA8B;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,qBAAa,oCAAqC,SAAQ,gBAAgB;IACxE,yBAAyB,CACvB,MAAM,EAAE,8BAA8B,EACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAgB1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAkFzH;AAMD,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,kCAAmC,SAAQ,gBAAgB;IACtE,yBAAyB,CACvB,MAAM,EAAE,4BAA4B,EACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAsB1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA2GvH;AAMD,MAAM,WAAW,qBAAqB;IACpC,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yCAAyC;IACzC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,yBAAyB,CACvB,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAkHhH"}

package/dist/src/yaml/steps/xcode.js

@@ -1011,6 +1011,19 @@ export class XcodeBuildForSimulatorStepExecutor extends BaseStepExecutor {
         commands.push('  PROJECT_TYPE="-project"');
         commands.push('fi');
         commands.push('');
+        // Resolve the package graph before building, under the refused-fetch
+        // retry. This is the step an iOS app is normally built with, so it is the
+        // one a refused dependency fetch lands on first. No -derivedDataPath: the
+        // build below does not set one either, so both use the default location
+        // and the build finds the graph this just resolved.
+        commands.push('# Resolve package dependencies first — see git-fetch-retry');
+        commands.push(...refusedFetchHelpers());
+        commands.push(...retryOnRefusedFetch({
+            label: 'Package resolution',
+            command: 'xcodebuild -resolvePackageDependencies' +
+                ` "$PROJECT_TYPE" '${escapedPath}'` +
+                ` -scheme '${escapedScheme}'`,
+        }));
         // Build command
         let cmd = 'xcodebuild';
         if (performClean === 'yes') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.7.2",
+  "version": "2.7.3",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",