@invarn/cibuild 2.7.3 → 2.7.4

package/dist/src/commands/build.d.ts

@@ -1,3 +1,4 @@
+import type { BuildWarning } from "./android-scanner.js";
 export interface SetupOptions {
     keystore: boolean;
     keystoreProperties: boolean;
@@ -8,6 +9,15 @@ export interface SetupOptions {
     artifactType: 'apk' | 'aab';
     /** Resolved keystore file paths per workflow (relative to project root), if found on disk. */
     keystorePaths: Record<string, string>;
+    /**
+     * Whether a build file applies the Google Secrets Gradle Plugin and reads a
+     * properties file the repository does not carry. The plugin's evaluation
+     * listener runs for **every** variant, so a debug build needs the file
+     * exactly as much as a release one does.
+     */
+    secretsProperties: boolean;
+    /** The properties file that plugin reads — `local.properties` unless configured. */
+    secretsPropertiesPath: string;
 }
 export interface WorkflowVariantConfig {
     /** Value for the VARIANT env var, e.g. "debug", "release", "stagingDebug". */
@@ -38,6 +48,17 @@ export interface IosSetupOptions {
     appStoreDeploy: boolean;
     bundleId: string;
 }
+/**
+ * The properties file the Secrets Gradle Plugin reads, out of the warnings the
+ * scanner produced for it.
+ *
+ * The two `secrets-plugin` warnings disagree about `location`, and reading the
+ * wrong one aims the `file@` step at a build file. The per-key warning carries
+ * the **properties file** there; the fallback warning carries the *build file
+ * that applies the plugin* and names the properties file only in its message.
+ */
+export declare function secretsPropertiesFileFrom(warnings: BuildWarning[]): string | null;
+export declare function detectSetupNeeds(warnings: BuildWarning[]): Omit<SetupOptions, "keystorePaths">;
 /**
  * The `trigger_map` block appended to every generated pipeline.
  *

package/dist/src/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoJD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAgL,EACvL,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA2NR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,sBAAsB,CAAC;AAQrE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAiID;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAYjF;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAoB9F;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAqP,EAC5P,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CAmPR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}

package/dist/src/commands/build.js

@@ -112,8 +112,34 @@ async function promptVariant(workflowLabel, defaultName, detectedVariants) {
     }
     return variantFromName(choice);
 }
-function detectSetupNeeds(warnings) {
+/**
+ * The properties file the Secrets Gradle Plugin reads, out of the warnings the
+ * scanner produced for it.
+ *
+ * The two `secrets-plugin` warnings disagree about `location`, and reading the
+ * wrong one aims the `file@` step at a build file. The per-key warning carries
+ * the **properties file** there; the fallback warning carries the *build file
+ * that applies the plugin* and names the properties file only in its message.
+ */
+export function secretsPropertiesFileFrom(warnings) {
+    const plugin = warnings.filter((w) => w.category === "secrets-plugin");
+    if (plugin.length === 0)
+        return null;
+    const fromLocation = plugin.find((w) => w.location?.endsWith(".properties"));
+    if (fromLocation?.location)
+        return fromLocation.location;
+    for (const w of plugin) {
+        const named = /reads '([^']+)'/.exec(w.message);
+        if (named)
+            return named[1];
+    }
+    return "local.properties";
+}
+export function detectSetupNeeds(warnings) {
+    const secretsPropertiesPath = secretsPropertiesFileFrom(warnings);
     return {
+        secretsProperties: secretsPropertiesPath !== null,
+        secretsPropertiesPath: secretsPropertiesPath ?? "local.properties",
         keystore: warnings.some((w) => w.category === "missing-file" && /keystore/i.test(w.message)),
         keystoreProperties: warnings.some((w) => w.category === "missing-file" && /keystore\.properties/i.test(w.message)),
         googleServices: warnings.some((w) => w.category === "firebase" ||
@@ -148,7 +174,7 @@ trigger_map:
     workflow: pull-request
 `;
 }
-export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {} }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
+export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {}, secretsProperties: false, secretsPropertiesPath: 'local.properties' }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
     const keystoreStepFor = (wf) => {
         if (!setup.keystore)
             return "";
@@ -178,6 +204,29 @@ export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: fa
     const googlePlayEnv = setup.googlePlayDeploy
         ? `    - GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ""  # Set via: ci secrets add GOOGLE_PLAY_SERVICE_ACCOUNT_JSON -w release\n`
         : "";
+    // Declared globally and on purpose: `unsetEnvKeys` — what `invarn setup`
+    // searches the developer's machine by — reads `envs`, never step inputs. An
+    // undeclared LOCAL_PROPERTIES is never discovered and never offered for
+    // upload, however many steps name it.
+    const secretsPropertiesEnv = setup.secretsProperties
+        ? `    - LOCAL_PROPERTIES: ""         # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES\n`
+        : "";
+    /**
+     * The Secrets Gradle Plugin's properties file, written into every workflow
+     * that builds. Its evaluation listener runs for every variant, so a debug
+     * build fails to *configure* without it — the error names a module of the
+     * user's own project and nothing connects it to a missing credential.
+     */
+    const secretsPropertiesStep = setup.secretsProperties
+        ? `
+      - file@1.0.0:
+          title: Setup ${setup.secretsPropertiesPath}
+          is_skippable: true
+          inputs:
+            target_path: ${setup.secretsPropertiesPath}
+            var_name: LOCAL_PROPERTIES
+`
+        : "";
     const googleServicesStep = setup.googleServices
         ? `
       - file@1.0.0:
@@ -241,14 +290,14 @@ app:
     - MODULE: app
     - BUILD_TYPE: Debug
     - GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.parallel=true
-${keystoreEnv}${keystorePropertiesEnv}${googleServicesEnv}${googlePlayEnv}
+${keystoreEnv}${keystorePropertiesEnv}${googleServicesEnv}${googlePlayEnv}${secretsPropertiesEnv}
 workflows:
   primary:
     envs:
       - VARIANT: ${pv.variant}
 ${buildTypeEnvOverride(pv)}
     steps:
-${keystoreStepFor("primary")}${googleServicesStep}
+${keystoreStepFor("primary")}${googleServicesStep}${secretsPropertiesStep}
       - set-java-version@1.0.0:
           inputs:
             java_version: '${javaVersion}'
@@ -288,7 +337,7 @@ ${keystoreStepFor("primary")}${googleServicesStep}
       - VARIANT: ${prv.variant}
 ${buildTypeEnvOverride(prv)}
     steps:
-${keystoreStepFor("pull-request")}${googleServicesStep}
+${keystoreStepFor("pull-request")}${googleServicesStep}${secretsPropertiesStep}
       - set-java-version@1.0.0:
           inputs:
             java_version: '${javaVersion}'
@@ -327,7 +376,7 @@ ${keystoreStepFor("pull-request")}${googleServicesStep}
       - VARIANT: ${rv.variant}
 ${buildTypeEnvOverride(rv)}
     steps:
-${keystoreStepFor("release")}${keystorePropertiesStep}${googleServicesStep}
+${keystoreStepFor("release")}${keystorePropertiesStep}${googleServicesStep}${secretsPropertiesStep}
       - set-java-version@1.0.0:
           inputs:
             java_version: '${javaVersion}'
@@ -894,7 +943,7 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
     }
     // 4. Prompt to generate setup steps for detected file issues
     const setupNeeds = detectSetupNeeds(scanResult.warnings);
-    const setupOptions = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {} };
+    const setupOptions = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {}, secretsProperties: false, secretsPropertiesPath: setupNeeds.secretsPropertiesPath };
     const secretsManager = new SecretsManager();
     const keystoreWorkflowGroups = [
         { label: "debug builds (primary, pull-request)", workflows: ["primary", "pull-request"] },
@@ -998,6 +1047,34 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
             }, cwd, secretsManager, ni);
         }
     }
+    if (setupNeeds.secretsProperties) {
+        const propertiesFile = setupNeeds.secretsPropertiesPath;
+        if (ni) {
+            setupOptions.secretsProperties = true;
+        }
+        else {
+            const { create } = await prompts({
+                type: "confirm",
+                name: "create",
+                message: `Generate a setup step for '${propertiesFile}' (read by the Secrets Gradle Plugin)?`,
+                initial: true,
+            });
+            setupOptions.secretsProperties = !!create;
+        }
+        if (setupOptions.secretsProperties) {
+            // Every workflow, not just release: the plugin's evaluation listener
+            // runs for every variant, so a debug build cannot configure without it.
+            await collectFileSecret({
+                displayName: propertiesFile,
+                secretName: "LOCAL_PROPERTIES",
+                fileMatch: (name) => name === propertiesFile.split("/").pop(),
+                readAs: "text",
+                workflowGroups: [
+                    { label: "every workflow", workflows: ["primary", "pull-request", "release"] },
+                ],
+            }, cwd, secretsManager, ni);
+        }
+    }
     // 4b. Prompt for Google Play deployment setup — skip in non-interactive mode (requires package name + credentials)
     if (!ni) {
         const { setupGooglePlay } = await prompts({

package/dist/src/commands/local-properties-reaches-every-workflow.test.d.ts

@@ -0,0 +1,30 @@
+/**
+ * A properties file the Secrets Gradle Plugin reads is a credential like any
+ * other, and it has to reach every workflow that builds — not just `release`.
+ *
+ * The scanner has always found this one: it emits a `secrets-plugin` warning
+ * whenever a build file applies the plugin and the properties file it reads is
+ * gitignored, and `ci init` prints *"The file is gitignored — inject it as a
+ * file step before building"* along with the exact step to write. Then it
+ * generates a pipeline without that step. The advice was correct and nobody
+ * acted on it, so the pipeline it wrote could not configure Gradle at all.
+ *
+ * Measured, not supposed: the first build in the record to consume an uploaded
+ * credential (`bld_f5167b731b95974e61350390`, 2026-09-09) got past
+ * google-services and died four steps later on
+ *
+ *     A problem occurred configuring project ':analytics'.
+ *        > The file '<repo>/local.properties' could not be found
+ *
+ * on a repository whose `release` workflow had a `file@` step for it and whose
+ * `primary` and `pull-request` did not. The plugin's evaluation listener runs
+ * for every variant, so a debug build needs the file exactly as much as a
+ * release one does.
+ *
+ * Declaring the slot matters as much as the step. `unsetEnvKeys` — what
+ * `invarn setup` searches by — reads `envs`, not step inputs, so an undeclared
+ * `LOCAL_PROPERTIES` is never discovered on the developer's machine and never
+ * offered for upload, however many steps name it.
+ */
+export {};
+//# sourceMappingURL=local-properties-reaches-every-workflow.test.d.ts.map

package/dist/src/commands/local-properties-reaches-every-workflow.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-properties-reaches-every-workflow.test.d.ts","sourceRoot":"","sources":["../../../src/commands/local-properties-reaches-every-workflow.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG"}

package/dist/src/commands/local-properties-reaches-every-workflow.test.js

@@ -0,0 +1,144 @@
+/**
+ * A properties file the Secrets Gradle Plugin reads is a credential like any
+ * other, and it has to reach every workflow that builds — not just `release`.
+ *
+ * The scanner has always found this one: it emits a `secrets-plugin` warning
+ * whenever a build file applies the plugin and the properties file it reads is
+ * gitignored, and `ci init` prints *"The file is gitignored — inject it as a
+ * file step before building"* along with the exact step to write. Then it
+ * generates a pipeline without that step. The advice was correct and nobody
+ * acted on it, so the pipeline it wrote could not configure Gradle at all.
+ *
+ * Measured, not supposed: the first build in the record to consume an uploaded
+ * credential (`bld_f5167b731b95974e61350390`, 2026-09-09) got past
+ * google-services and died four steps later on
+ *
+ *     A problem occurred configuring project ':analytics'.
+ *        > The file '<repo>/local.properties' could not be found
+ *
+ * on a repository whose `release` workflow had a `file@` step for it and whose
+ * `primary` and `pull-request` did not. The plugin's evaluation listener runs
+ * for every variant, so a debug build needs the file exactly as much as a
+ * release one does.
+ *
+ * Declaring the slot matters as much as the step. `unsetEnvKeys` — what
+ * `invarn setup` searches by — reads `envs`, not step inputs, so an undeclared
+ * `LOCAL_PROPERTIES` is never discovered on the developer's machine and never
+ * offered for upload, however many steps name it.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { load } from 'js-yaml';
+import { generateAndroidPipeline, detectSetupNeeds } from './build.js';
+const BASE = {
+    keystore: false,
+    keystoreProperties: false,
+    googleServices: false,
+    googlePlayDeploy: false,
+    googlePlayPackageName: '',
+    artifactType: 'apk',
+    keystorePaths: {},
+    secretsProperties: false,
+    secretsPropertiesPath: 'local.properties',
+};
+function parse(yaml) {
+    return load(yaml);
+}
+function envs(parsed) {
+    return Object.assign({}, ...(parsed.app?.envs ?? []));
+}
+function stepNames(parsed, workflow) {
+    return (parsed.workflows?.[workflow]?.steps ?? []).map((s) => Object.keys(s)[0]);
+}
+function fileStepsOf(parsed, workflow) {
+    return (parsed.workflows?.[workflow]?.steps ?? [])
+        .filter((s) => Object.keys(s)[0] === 'file@1.0.0')
+        .map((s) => s['file@1.0.0']);
+}
+describe('a properties file the build reads at configuration time', () => {
+    test('is declared once and written in every workflow that builds', () => {
+        const parsed = parse(generateAndroidPipeline(17, { ...BASE, secretsProperties: true }));
+        expect(envs(parsed).LOCAL_PROPERTIES).toBe('');
+        // One object per workflow so a failure names the workflow that lost it.
+        const written = ['primary', 'pull-request', 'release'].map((workflow) => {
+            const step = fileStepsOf(parsed, workflow).find((s) => s.inputs.var_name === 'LOCAL_PROPERTIES');
+            return {
+                workflow,
+                target: step?.inputs.target_path,
+                // Text, not binary: re-encoding a properties file as base64 would
+                // write base64 to disk and the plugin would read gibberish.
+                base64: step?.inputs.base64_encoded,
+            };
+        });
+        expect(written).toEqual([
+            { workflow: 'primary', target: 'local.properties', base64: undefined },
+            { workflow: 'pull-request', target: 'local.properties', base64: undefined },
+            { workflow: 'release', target: 'local.properties', base64: undefined },
+        ]);
+    });
+    test('is written before anything that could read it', () => {
+        const parsed = parse(generateAndroidPipeline(17, { ...BASE, secretsProperties: true }));
+        const order = ['primary', 'pull-request', 'release'].map((workflow) => {
+            const names = stepNames(parsed, workflow);
+            const wrote = names.indexOf('file@1.0.0');
+            const firstBuildTool = names.findIndex((n) => /^(gradle-build|android-lint|android-unit-test)@/.test(n));
+            return { workflow, writesBeforeBuilding: wrote >= 0 && firstBuildTool > wrote };
+        });
+        expect(order).toEqual([
+            { workflow: 'primary', writesBeforeBuilding: true },
+            { workflow: 'pull-request', writesBeforeBuilding: true },
+            { workflow: 'release', writesBeforeBuilding: true },
+        ]);
+    });
+    test('follows the plugin to a properties file that is not local.properties', () => {
+        const parsed = parse(generateAndroidPipeline(17, {
+            ...BASE,
+            secretsProperties: true,
+            secretsPropertiesPath: 'config/secrets.properties',
+        }));
+        const written = fileStepsOf(parsed, 'primary').find((s) => s.inputs.var_name === 'LOCAL_PROPERTIES');
+        expect(written.inputs.target_path).toBe('config/secrets.properties');
+    });
+    test('appears nowhere in a repository that does not use the plugin', () => {
+        // The whole point of scanning: a pipeline must not declare a slot the
+        // build never reads. After issue 03 a declared-and-empty slot fails the
+        // build, so an unnecessary one turns a working repository red.
+        const yaml = generateAndroidPipeline(17, BASE);
+        expect(yaml).not.toContain('LOCAL_PROPERTIES');
+        expect(fileStepsOf(parse(yaml), 'primary')).toEqual([]);
+    });
+});
+describe('the scan that decides it', () => {
+    const warning = (over) => ({
+        category: 'secrets-plugin',
+        severity: 'warning',
+        message: 'Secrets plugin key: MAPS_API_KEY',
+        location: 'local.properties',
+        ...over,
+    });
+    test('takes the properties file from the per-key warning', () => {
+        const needs = detectSetupNeeds([warning({})]);
+        expect(needs.secretsProperties).toBe(true);
+        expect(needs.secretsPropertiesPath).toBe('local.properties');
+    });
+    test('takes it from the message when the warning has no defaults file', () => {
+        // The two `secrets-plugin` warnings disagree about `location`: the
+        // per-key one carries the properties file, the fallback one carries the
+        // *build file* that applies the plugin. Reading the wrong one would point
+        // the step at `app/build.gradle.kts`.
+        const needs = detectSetupNeeds([
+            warning({
+                message: "Google Secrets Gradle Plugin reads 'config/secrets.properties' which is absent in CI",
+                location: 'app/build.gradle.kts',
+            }),
+        ]);
+        expect(needs.secretsProperties).toBe(true);
+        expect(needs.secretsPropertiesPath).toBe('config/secrets.properties');
+    });
+    test('is off when nothing reports the plugin', () => {
+        const needs = detectSetupNeeds([
+            { category: 'missing-file', severity: 'warning', message: 'keystore.properties not found' },
+        ]);
+        expect(needs.secretsProperties).toBe(false);
+    });
+});
+//# sourceMappingURL=local-properties-reaches-every-workflow.test.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.7.3",
+  "version": "2.7.4",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",