@invarn/cibuild 2.7.3 → 2.7.5

package/dist/src/commands/build.d.ts

@@ -1,3 +1,5 @@
+import type { BuildWarning } from "./android-scanner.js";
+import type { WorkflowGroup } from "./file-secret-collector.js";
 export interface SetupOptions {
     keystore: boolean;
     keystoreProperties: boolean;
@@ -8,6 +10,44 @@ export interface SetupOptions {
     artifactType: 'apk' | 'aab';
     /** Resolved keystore file paths per workflow (relative to project root), if found on disk. */
     keystorePaths: Record<string, string>;
+    /**
+     * Where each workflow's `google-services.json` is written. It follows the
+     * **flavor** the workflow builds: Android gives every product flavor its own
+     * source set, each with its own copy of the file, and the plugin resolves by
+     * specificity — variant, build type, flavor, module root. A workflow
+     * building `ciDynamicDebug` therefore wants
+     * `app/src/ciDynamic/google-services.json`, and a workflow building
+     * `prodRelease` wants a different file at a different path.
+     *
+     * The *value* varies per workflow too, and that needs no second map: a
+     * secret is scoped to a workflow by its name — `CIBUILD_SW__PRIMARY__X`
+     * beside `CIBUILD_SW__RELEASE__X` — which `SecretsManager` decodes and
+     * `EnvResolver` resolves for the workflow being run. One `var_name` in the
+     * step, one declared slot, and the workflow picks the value.
+     */
+    googleServicesPaths: Record<string, string>;
+    /**
+     * The product flavor each workflow's variant builds, or null where the
+     * variant names none.
+     *
+     * `LOCAL_PROPERTIES` follows this rather than a target path, and it is the
+     * only credential that has to: every workflow writes the same
+     * `local.properties` to the same place, so nothing about the path says the
+     * bytes differ. What belongs *in* the file is the flavor's environment — a
+     * different base API URL plus twenty other keys the Secrets Gradle Plugin
+     * turns into `BuildConfig` — so two workflows on different flavors cannot
+     * share one value, and `credentialSlots` splits the slot when they disagree.
+     */
+    workflowFlavors: Record<string, string | null>;
+    /**
+     * Whether a build file applies the Google Secrets Gradle Plugin and reads a
+     * properties file the repository does not carry. The plugin's evaluation
+     * listener runs for **every** variant, so a debug build needs the file
+     * exactly as much as a release one does.
+     */
+    secretsProperties: boolean;
+    /** The properties file that plugin reads — `local.properties` unless configured. */
+    secretsPropertiesPath: string;
 }
 export interface WorkflowVariantConfig {
     /** Value for the VARIANT env var, e.g. "debug", "release", "stagingDebug". */
@@ -38,6 +78,110 @@ export interface IosSetupOptions {
     appStoreDeploy: boolean;
     bundleId: string;
 }
+/**
+ * The properties file the Secrets Gradle Plugin reads, out of the warnings the
+ * scanner produced for it.
+ *
+ * The two `secrets-plugin` warnings disagree about `location`, and reading the
+ * wrong one aims the `file@` step at a build file. The per-key warning carries
+ * the **properties file** there; the fallback warning carries the *build file
+ * that applies the plugin* and names the properties file only in its message.
+ */
+export declare function secretsPropertiesFileFrom(warnings: BuildWarning[]): string | null;
+/**
+ * The product flavor a variant builds, out of the flavors the scanner found —
+ * `ciDynamicDebug` is a build of `ciDynamic`, `prodRelease` of `prod`.
+ *
+ * An Android variant name is the flavor followed by the capitalised build
+ * type, so the character after the flavor has to be an upper-case one. That
+ * check is load-bearing: without it a flavor called `pro` would claim
+ * `prodRelease`. The longest match wins, so `ciDynamic` beats `ci` on a
+ * repository that declares both.
+ */
+export declare function flavorOfVariant(variant: string, productFlavors: string[]): string | null;
+/** Where a flavor's `google-services.json` belongs inside the app module. */
+export declare function googleServicesPathFor(flavor: string | null, module?: string): string;
+/**
+ * The per-workflow path and key maps for `SetupOptions`, from the variants the
+ * workflows build and the flavors the scanner found.
+ *
+ * `app/google-services.json` used to be hardcoded here. For a flavored build
+ * that is the plugin's *fallback* location, not the right one, and writing
+ * there is silently wrong rather than loudly wrong: the plugin finds a file,
+ * parses it, and fails on a package name — which reads as a Firebase
+ * misconfiguration rather than as the wrong file having been delivered. That
+ * is what `bld_8e60d90ab4e55f85d2f72459` spent 1292 Gradle tasks proving.
+ */
+export declare function googleServicesTargets(variants: WorkflowVariants, productFlavors: string[], module?: string): Record<string, string>;
+/** The three workflows every generated pipeline has, in the order they are emitted. */
+export declare const GENERATED_WORKFLOWS: readonly ["primary", "pull-request", "release"];
+/**
+ * The `workflowFlavors` map for `SetupOptions`, from the variants the
+ * workflows build and the flavors the scanner found.
+ */
+export declare function variantFlavors(variants: WorkflowVariants, productFlavors: string[]): Record<string, string | null>;
+/** One `envs` slot to declare, and the workflow it belongs to. */
+export interface CredentialSlot {
+    slot: string;
+    /** null when one slot serves every workflow that reads the credential. */
+    workflow: string | null;
+}
+/**
+ * The `envs` slots one credential needs: one when every workflow that reads it
+ * wants the same bytes, one per workflow when they do not.
+ *
+ * What "the same bytes" means is the credential's own business — a keystore
+ * follows the target path the pipeline declares for it, `google-services.json`
+ * the flavor's source set, `local.properties` the flavor itself — so the
+ * caller passes the discriminator it already computed, one entry per workflow
+ * that reads the credential, and this decides only whether they agree. A
+ * credential only one workflow reads can never disagree, which is why the
+ * genuinely release-only ones keep one slot however flavored the repository
+ * is.
+ *
+ * A disagreement is declared under `CIBUILD_SW__<WORKFLOW>__<VAR>`: the name
+ * `ci secrets upload` already encodes a workflow-scoped value under, that
+ * `SecretsManager` already decodes, and that `EnvResolver` already resolves
+ * for the workflow being run. Invarn's secret scopes have no workflow column,
+ * but a flat key→value map carries a workflow perfectly well when the workflow
+ * is part of the key.
+ *
+ * Every workflow gets a slot, not only the odd one out. The encoded name is
+ * per workflow, so a workflow left without one would have neither a value nor
+ * the declaration `file@1.0.0` refuses over.
+ *
+ * The `file@` step's `var_name` stays unsuffixed either way. The decoding does
+ * the mapping; a second naming convention in the step would be a second way to
+ * say the same thing.
+ */
+export declare function credentialSlots(varName: string, discriminatorByWorkflow: Record<string, string | null | undefined>): CredentialSlot[];
+/** One group of workflows a credential's value is collected for, and what they share. */
+export interface CollectionGroup extends WorkflowGroup {
+    /** The value of whatever the credential follows, shared by this group's workflows. */
+    discriminator: string;
+}
+/**
+ * The groups `ci init` collects a credential's value in: one per distinct value
+ * of whatever that credential follows, in workflow order.
+ *
+ * The same discriminator `credentialSlots` splits the *declaration* by, and
+ * deliberately the same function computing it, so what `ci init` asks for and
+ * what the pipeline declares cannot drift apart. One group means one slot and
+ * one question; two groups mean one slot per workflow and a question per group.
+ */
+export declare function collectionGroups(discriminatorByWorkflow: Record<string, string>, label: (discriminator: string, workflows: string[]) => string): CollectionGroup[];
+/**
+ * The groups the Secrets Gradle Plugin's properties file is collected in: one
+ * per flavor.
+ *
+ * Unlike `google-services.json`, nothing about this credential's target says
+ * the bytes differ — every workflow writes the same file to the same path.
+ * What differs is the content: the plugin turns the file into `BuildConfig`,
+ * and a flavor is an environment. Asking once and storing one value gives
+ * `prod` the CI backend's base URL, on a green build.
+ */
+export declare function propertiesFileGroups(workflowFlavors: Record<string, string | null>): CollectionGroup[];
+export declare function detectSetupNeeds(warnings: BuildWarning[]): Omit<SetupOptions, "keystorePaths" | "googleServicesPaths" | "workflowFlavors">;
 /**
  * The `trigger_map` block appended to every generated pipeline.
  *

package/dist/src/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoJD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAgL,EACvL,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA2NR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,sBAAsB,CAAC;AAMrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAIhE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;;;;;;;;OAWG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAiID;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAYjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CASxF;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,SAAQ,GAAG,MAAM,CAInF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,MAAM,EAAE,EACxB,MAAM,SAAQ,GACb,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,iDAAkD,CAAC;AAWnF;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAM/B;AAED,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GACjE,cAAc,EAAE,CAOlB;AAgBD,yFAAyF;AACzF,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,sFAAsF;IACtF,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/C,KAAK,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,MAAM,GAC5D,eAAe,EAAE,CAUnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAC7C,eAAe,EAAE,CAInB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,YAAY,EAAE,GACvB,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,CAAC,CAoBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAmS,EAC1S,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CAiSR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}

package/dist/src/commands/build.js

@@ -4,6 +4,7 @@ import prompts from "prompts";
 import { scanAndroidProject, formatScanResult, runnableJavaVersion, javaVersionProblem, } from "./android-scanner.js";
 import { scanIosProject, formatIosScanResult } from "./ios-scanner.js";
 import { SecretsManager } from "../yaml/secrets-manager.js";
+import { encodeSecretName } from "./secrets-upload.js";
 import { collectFileSecret } from "./file-secret-collector.js";
 import { generateGitHubActionsWorkflow } from "./github-workflow.js";
 import { detectDefaultBranch, FALLBACK_DEFAULT_BRANCH } from "../shared/git.js";
@@ -112,8 +113,182 @@ async function promptVariant(workflowLabel, defaultName, detectedVariants) {
     }
     return variantFromName(choice);
 }
-function detectSetupNeeds(warnings) {
+/**
+ * The properties file the Secrets Gradle Plugin reads, out of the warnings the
+ * scanner produced for it.
+ *
+ * The two `secrets-plugin` warnings disagree about `location`, and reading the
+ * wrong one aims the `file@` step at a build file. The per-key warning carries
+ * the **properties file** there; the fallback warning carries the *build file
+ * that applies the plugin* and names the properties file only in its message.
+ */
+export function secretsPropertiesFileFrom(warnings) {
+    const plugin = warnings.filter((w) => w.category === "secrets-plugin");
+    if (plugin.length === 0)
+        return null;
+    const fromLocation = plugin.find((w) => w.location?.endsWith(".properties"));
+    if (fromLocation?.location)
+        return fromLocation.location;
+    for (const w of plugin) {
+        const named = /reads '([^']+)'/.exec(w.message);
+        if (named)
+            return named[1];
+    }
+    return "local.properties";
+}
+/**
+ * The product flavor a variant builds, out of the flavors the scanner found —
+ * `ciDynamicDebug` is a build of `ciDynamic`, `prodRelease` of `prod`.
+ *
+ * An Android variant name is the flavor followed by the capitalised build
+ * type, so the character after the flavor has to be an upper-case one. That
+ * check is load-bearing: without it a flavor called `pro` would claim
+ * `prodRelease`. The longest match wins, so `ciDynamic` beats `ci` on a
+ * repository that declares both.
+ */
+export function flavorOfVariant(variant, productFlavors) {
+    const matches = productFlavors
+        .filter((flavor) => {
+        if (flavor.length === 0 || !variant.startsWith(flavor))
+            return false;
+        const head = variant.slice(flavor.length)[0];
+        return head !== undefined && head === head.toUpperCase() && head !== head.toLowerCase();
+    })
+        .sort((a, b) => b.length - a.length);
+    return matches[0] ?? null;
+}
+/** Where a flavor's `google-services.json` belongs inside the app module. */
+export function googleServicesPathFor(flavor, module = "app") {
+    return flavor
+        ? `${module}/src/${flavor}/google-services.json`
+        : `${module}/google-services.json`;
+}
+/**
+ * The per-workflow path and key maps for `SetupOptions`, from the variants the
+ * workflows build and the flavors the scanner found.
+ *
+ * `app/google-services.json` used to be hardcoded here. For a flavored build
+ * that is the plugin's *fallback* location, not the right one, and writing
+ * there is silently wrong rather than loudly wrong: the plugin finds a file,
+ * parses it, and fails on a package name — which reads as a Firebase
+ * misconfiguration rather than as the wrong file having been delivered. That
+ * is what `bld_8e60d90ab4e55f85d2f72459` spent 1292 Gradle tasks proving.
+ */
+export function googleServicesTargets(variants, productFlavors, module = "app") {
+    const paths = {};
+    for (const [workflow, config] of variantByWorkflow(variants)) {
+        const flavor = flavorOfVariant(config.variant, productFlavors);
+        paths[workflow] = googleServicesPathFor(flavor, module);
+    }
+    return paths;
+}
+/** The three workflows every generated pipeline has, in the order they are emitted. */
+export const GENERATED_WORKFLOWS = ["primary", "pull-request", "release"];
+/** The variant each workflow builds, keyed by the workflow's name in the YAML. */
+function variantByWorkflow(variants) {
+    return [
+        ["primary", variants.primary],
+        ["pull-request", variants.pullRequest],
+        ["release", variants.release],
+    ];
+}
+/**
+ * The `workflowFlavors` map for `SetupOptions`, from the variants the
+ * workflows build and the flavors the scanner found.
+ */
+export function variantFlavors(variants, productFlavors) {
+    const flavors = {};
+    for (const [workflow, config] of variantByWorkflow(variants)) {
+        flavors[workflow] = flavorOfVariant(config.variant, productFlavors);
+    }
+    return flavors;
+}
+/**
+ * The `envs` slots one credential needs: one when every workflow that reads it
+ * wants the same bytes, one per workflow when they do not.
+ *
+ * What "the same bytes" means is the credential's own business — a keystore
+ * follows the target path the pipeline declares for it, `google-services.json`
+ * the flavor's source set, `local.properties` the flavor itself — so the
+ * caller passes the discriminator it already computed, one entry per workflow
+ * that reads the credential, and this decides only whether they agree. A
+ * credential only one workflow reads can never disagree, which is why the
+ * genuinely release-only ones keep one slot however flavored the repository
+ * is.
+ *
+ * A disagreement is declared under `CIBUILD_SW__<WORKFLOW>__<VAR>`: the name
+ * `ci secrets upload` already encodes a workflow-scoped value under, that
+ * `SecretsManager` already decodes, and that `EnvResolver` already resolves
+ * for the workflow being run. Invarn's secret scopes have no workflow column,
+ * but a flat key→value map carries a workflow perfectly well when the workflow
+ * is part of the key.
+ *
+ * Every workflow gets a slot, not only the odd one out. The encoded name is
+ * per workflow, so a workflow left without one would have neither a value nor
+ * the declaration `file@1.0.0` refuses over.
+ *
+ * The `file@` step's `var_name` stays unsuffixed either way. The decoding does
+ * the mapping; a second naming convention in the step would be a second way to
+ * say the same thing.
+ */
+export function credentialSlots(varName, discriminatorByWorkflow) {
+    const distinct = new Set(Object.values(discriminatorByWorkflow));
+    if (distinct.size <= 1)
+        return [{ slot: varName, workflow: null }];
+    return Object.keys(discriminatorByWorkflow).map((workflow) => ({
+        slot: encodeSecretName(varName, workflow),
+        workflow,
+    }));
+}
+/**
+ * One discriminator per workflow, defaulted the way the step that writes the
+ * credential defaults its own input — so a repository whose scan resolved
+ * nothing does not read as three workflows that disagree.
+ */
+function discriminators(map, fallback) {
+    const out = {};
+    for (const workflow of GENERATED_WORKFLOWS)
+        out[workflow] = map[workflow] ?? fallback;
+    return out;
+}
+/**
+ * The groups `ci init` collects a credential's value in: one per distinct value
+ * of whatever that credential follows, in workflow order.
+ *
+ * The same discriminator `credentialSlots` splits the *declaration* by, and
+ * deliberately the same function computing it, so what `ci init` asks for and
+ * what the pipeline declares cannot drift apart. One group means one slot and
+ * one question; two groups mean one slot per workflow and a question per group.
+ */
+export function collectionGroups(discriminatorByWorkflow, label) {
+    const byDiscriminator = new Map();
+    for (const [workflow, value] of Object.entries(discriminatorByWorkflow)) {
+        byDiscriminator.set(value, [...(byDiscriminator.get(value) ?? []), workflow]);
+    }
+    return [...byDiscriminator].map(([discriminator, workflows]) => ({
+        label: label(discriminator, workflows),
+        workflows,
+        discriminator,
+    }));
+}
+/**
+ * The groups the Secrets Gradle Plugin's properties file is collected in: one
+ * per flavor.
+ *
+ * Unlike `google-services.json`, nothing about this credential's target says
+ * the bytes differ — every workflow writes the same file to the same path.
+ * What differs is the content: the plugin turns the file into `BuildConfig`,
+ * and a flavor is an environment. Asking once and storing one value gives
+ * `prod` the CI backend's base URL, on a green build.
+ */
+export function propertiesFileGroups(workflowFlavors) {
+    return collectionGroups(discriminators(workflowFlavors, ""), (flavor, workflows) => flavor ? `the ${flavor} flavor (${workflows.join(", ")})` : "every workflow");
+}
+export function detectSetupNeeds(warnings) {
+    const secretsPropertiesPath = secretsPropertiesFileFrom(warnings);
     return {
+        secretsProperties: secretsPropertiesPath !== null,
+        secretsPropertiesPath: secretsPropertiesPath ?? "local.properties",
         keystore: warnings.some((w) => w.category === "missing-file" && /keystore/i.test(w.message)),
         keystoreProperties: warnings.some((w) => w.category === "missing-file" && /keystore\.properties/i.test(w.message)),
         googleServices: warnings.some((w) => w.category === "firebase" ||
@@ -148,7 +323,7 @@ trigger_map:
     workflow: pull-request
 `;
 }
-export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {} }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
+export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {}, googleServicesPaths: {}, workflowFlavors: {}, secretsProperties: false, secretsPropertiesPath: 'local.properties' }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
     const keystoreStepFor = (wf) => {
         if (!setup.keystore)
             return "";
@@ -165,28 +340,80 @@ export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: fa
     };
     // Add BUILD_TYPE override to workflow envs when it differs from the global default ("Debug")
     const buildTypeEnvOverride = (v) => v.buildType !== "Debug" ? `      - BUILD_TYPE: ${v.buildType}\n` : "";
-    // Optional env var stubs (empty defaults — filled via ci secrets add)
+    // Optional env var stubs (empty defaults — filled via ci secrets add).
+    //
+    // Declared globally and on purpose: `unsetEnvKeys` — what `invarn setup`
+    // searches the developer's machine by — reads `envs`, never step inputs. An
+    // undeclared credential is never discovered and never offered for upload,
+    // however many steps name it.
+    //
+    // One slot per credential where every workflow that reads it wants the same
+    // bytes, and one per workflow where they do not — see `credentialSlots`.
+    // The `var_name` in the step below stays unsuffixed either way.
+    const declare = (varName, discriminatorByWorkflow, comment) => credentialSlots(varName, discriminatorByWorkflow)
+        .map(({ slot, workflow }) => `    - ${slot}: ""${comment(workflow)}\n`)
+        .join("");
     const keystoreEnv = setup.keystore
-        ? `    - KEYSTORE_BASE64: ""         # Set via: ci secrets add KEYSTORE_BASE64 -w primary\n`
+        ? declare("KEYSTORE_BASE64", discriminators(setup.keystorePaths, "keystore.jks"), (wf) => wf
+            ? `  # Set via: ci secrets add KEYSTORE_BASE64 -w ${wf}`
+            : `         # Set via: ci secrets add KEYSTORE_BASE64 -w primary`)
         : "";
+    // Release-only, and legitimately so: nothing but `release` signs a release
+    // or talks to Google Play, so there is no second workflow to disagree with.
     const keystorePropertiesEnv = setup.keystoreProperties
         ? `    - KEYSTORE_PROPERTIES: ""      # Release signing — set via: ci secrets add KEYSTORE_PROPERTIES -w release\n`
         : "";
     const googleServicesEnv = setup.googleServices
-        ? `    - GOOGLE_SERVICES_JSON: ""     # Set via: ci secrets add GOOGLE_SERVICES_JSON\n`
+        ? declare("GOOGLE_SERVICES_JSON", discriminators(setup.googleServicesPaths, "app/google-services.json"), (wf) => wf
+            ? `  # Set via: ci secrets add GOOGLE_SERVICES_JSON -w ${wf}`
+            : `     # Set via: ci secrets add GOOGLE_SERVICES_JSON`)
         : "";
     const googlePlayEnv = setup.googlePlayDeploy
         ? `    - GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ""  # Set via: ci secrets add GOOGLE_PLAY_SERVICE_ACCOUNT_JSON -w release\n`
         : "";
-    const googleServicesStep = setup.googleServices
+    const secretsPropertiesEnv = setup.secretsProperties
+        ? declare("LOCAL_PROPERTIES", discriminators(setup.workflowFlavors, ""), (wf) => wf
+            ? `  # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES -w ${wf}`
+            : `         # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES`)
+        : "";
+    /**
+     * The Secrets Gradle Plugin's properties file, written into every workflow
+     * that builds. Its evaluation listener runs for every variant, so a debug
+     * build fails to *configure* without it — the error names a module of the
+     * user's own project and nothing connects it to a missing credential.
+     */
+    const secretsPropertiesStep = setup.secretsProperties
         ? `
       - file@1.0.0:
+          title: Setup ${setup.secretsPropertiesPath}
           is_skippable: true
           inputs:
-            target_path: app/google-services.json
-            var_name: GOOGLE_SERVICES_JSON
+            target_path: ${setup.secretsPropertiesPath}
+            var_name: LOCAL_PROPERTIES
 `
         : "";
+    /**
+     * Per workflow, exactly as the keystore is: the flavor a workflow builds
+     * decides where the file is written. A workflow whose variant names no
+     * flavor is unchanged — `app/google-services.json`.
+     *
+     * The `var_name` is the same in every workflow on purpose. Scoping a value
+     * to a workflow is the *secret's* job, not the step's: `CIBUILD_SW__<WF>__X`
+     * is decoded by `SecretsManager` and resolved by `EnvResolver` for the
+     * workflow being run, so one name here reads a different value there.
+     */
+    const googleServicesStepFor = (wf) => {
+        if (!setup.googleServices)
+            return "";
+        const path = setup.googleServicesPaths[wf] ?? "app/google-services.json";
+        return `
+      - file@1.0.0:
+          is_skippable: true
+          inputs:
+            target_path: ${path}
+            var_name: GOOGLE_SERVICES_JSON
+`;
+    };
     const googlePlayStep = setup.googlePlayDeploy
         ? `
       - file@1.0.0:
@@ -241,14 +468,14 @@ app:
     - MODULE: app
     - BUILD_TYPE: Debug
     - GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.parallel=true
-${keystoreEnv}${keystorePropertiesEnv}${googleServicesEnv}${googlePlayEnv}
+${keystoreEnv}${keystorePropertiesEnv}${googleServicesEnv}${googlePlayEnv}${secretsPropertiesEnv}
 workflows:
   primary:
     envs:
       - VARIANT: ${pv.variant}
 ${buildTypeEnvOverride(pv)}
     steps:
-${keystoreStepFor("primary")}${googleServicesStep}
+${keystoreStepFor("primary")}${googleServicesStepFor("primary")}${secretsPropertiesStep}
       - set-java-version@1.0.0:
           inputs:
             java_version: '${javaVersion}'
@@ -288,7 +515,7 @@ ${keystoreStepFor("primary")}${googleServicesStep}
       - VARIANT: ${prv.variant}
 ${buildTypeEnvOverride(prv)}
     steps:
-${keystoreStepFor("pull-request")}${googleServicesStep}
+${keystoreStepFor("pull-request")}${googleServicesStepFor("pull-request")}${secretsPropertiesStep}
       - set-java-version@1.0.0:
           inputs:
             java_version: '${javaVersion}'
@@ -327,7 +554,7 @@ ${keystoreStepFor("pull-request")}${googleServicesStep}
       - VARIANT: ${rv.variant}
 ${buildTypeEnvOverride(rv)}
     steps:
-${keystoreStepFor("release")}${keystorePropertiesStep}${googleServicesStep}
+${keystoreStepFor("release")}${keystorePropertiesStep}${googleServicesStepFor("release")}${secretsPropertiesStep}
       - set-java-version@1.0.0:
           inputs:
             java_version: '${javaVersion}'
@@ -894,7 +1121,13 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
     }
     // 4. Prompt to generate setup steps for detected file issues
     const setupNeeds = detectSetupNeeds(scanResult.warnings);
-    const setupOptions = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {} };
+    // Which flavor each workflow builds decides where its google-services.json
+    // is written, and — with no path to give it away — whether the properties
+    // file can be one value or has to be one per workflow. Both maps are
+    // derived from the variants chosen just above.
+    const googleServicesPaths = googleServicesTargets(variants, productFlavors);
+    const workflowFlavors = variantFlavors(variants, productFlavors);
+    const setupOptions = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {}, googleServicesPaths, workflowFlavors, secretsProperties: false, secretsPropertiesPath: setupNeeds.secretsPropertiesPath };
     const secretsManager = new SecretsManager();
     const keystoreWorkflowGroups = [
         { label: "debug builds (primary, pull-request)", workflows: ["primary", "pull-request"] },
@@ -986,15 +1219,69 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
             setupOptions.googleServices = !!create;
         }
         if (setupOptions.googleServices) {
+            // One collection per distinct target path. Workflows building the same
+            // flavor write to the same place and are collected together; workflows
+            // building different flavors need different files, so each is asked
+            // separately and pinned to its own source set — which is what lets a
+            // flavored repository auto-select rather than guess.
+            //
+            // The secret name is the same every time, and the *value* is stored per
+            // workflow. That is what `SecretsManager` has always done, what
+            // `ci secrets upload` encodes as `CIBUILD_SW__<WF>__<VAR>`, and what
+            // `EnvResolver` resolves for the workflow being run.
+            const byTarget = collectionGroups(discriminators(setupOptions.googleServicesPaths, "app/google-services.json"), (_path, workflows) => workflows.join(", "));
+            for (const group of byTarget) {
+                const flavorDir = /\/src\/([^/]+)\//.exec(group.discriminator)?.[1] ?? null;
+                await collectFileSecret({
+                    displayName: flavorDir
+                        ? `google-services.json for the ${flavorDir} flavor`
+                        : "google-services.json",
+                    secretName: "GOOGLE_SERVICES_JSON",
+                    fileMatch: (name) => name === "google-services.json",
+                    // A flavored target takes the copy from that flavor's source set. An
+                    // unflavored one takes anything that is *not* a flavor's copy, so
+                    // the module root wins rather than an arbitrary source set.
+                    pathMatch: flavorDir
+                        ? (rel) => rel.includes(`/src/${flavorDir}/`) || rel.startsWith(`src/${flavorDir}/`)
+                        : (rel) => !/(?:^|\/)src\/[^/]+\//.test(rel),
+                    readAs: "text",
+                    // One group per call, not all of them: each group narrows the search
+                    // to its own flavor's source set, which is what lets a flavored
+                    // repository auto-select rather than ask.
+                    workflowGroups: [group],
+                }, cwd, secretsManager, ni);
+            }
+        }
+    }
+    if (setupNeeds.secretsProperties) {
+        const propertiesFile = setupNeeds.secretsPropertiesPath;
+        if (ni) {
+            setupOptions.secretsProperties = true;
+        }
+        else {
+            const { create } = await prompts({
+                type: "confirm",
+                name: "create",
+                message: `Generate a setup step for '${propertiesFile}' (read by the Secrets Gradle Plugin)?`,
+                initial: true,
+            });
+            setupOptions.secretsProperties = !!create;
+        }
+        if (setupOptions.secretsProperties) {
+            // Every workflow, not just release: the plugin's evaluation listener
+            // runs for every variant, so a debug build cannot configure without it.
+            //
+            // And one group per flavor, because the plugin turns this file into
+            // BuildConfig and a flavor is an environment. Every group in one call,
+            // unlike google-services.json above: there is no per-flavor path
+            // convention for a properties file to narrow the search by, so the
+            // groups differ only in which answer they take.
             await collectFileSecret({
-                displayName: "google-services.json",
-                secretName: "GOOGLE_SERVICES_JSON",
-                fileMatch: (name) => name === "google-services.json",
+                displayName: propertiesFile,
+                secretName: "LOCAL_PROPERTIES",
+                fileMatch: (name) => name === propertiesFile.split("/").pop(),
                 readAs: "text",
-                workflowGroups: [
-                    { label: "debug builds (primary, pull-request)", workflows: ["primary", "pull-request"] },
-                    { label: "release", workflows: ["release"] },
-                ],
+                workflowGroups: propertiesFileGroups(setupOptions.workflowFlavors),
             }, cwd, secretsManager, ni);
         }
     }
@@ -1079,8 +1366,16 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
             console.log("     • Setup Keystore (KEYSTORE_BASE64)");
         if (setupOptions.keystoreProperties)
             console.log("     • Setup keystore.properties (KEYSTORE_PROPERTIES) — release only");
-        if (setupOptions.googleServices)
-            console.log("     • Setup google-services.json (GOOGLE_SERVICES_JSON)");
+        if (setupOptions.googleServices) {
+            const seen = new Set();
+            for (const wf of GENERATED_WORKFLOWS) {
+                const path = setupOptions.googleServicesPaths[wf];
+                if (!path || seen.has(path))
+                    continue;
+                seen.add(path);
+                console.log(`     • Setup ${path} (GOOGLE_SERVICES_JSON)`);
+            }
+        }
         if (setupOptions.googlePlayDeploy)
             console.log(`     • Google Play deploy (${setupOptions.googlePlayPackageName}) — release only`);
     }

package/dist/src/commands/each-flavor-is-asked-for-its-own-properties-file.test.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `ci init` asks once per flavor for the properties file the Secrets Gradle
+ * Plugin reads, and stores the answer against that flavor's workflows.
+ *
+ * The generator now declares this credential once per workflow when the
+ * workflows build different flavors, because two flavors are two environments
+ * and one value cannot serve both. Collection had not moved: `collectFileSecret`
+ * was called with a single group labelled *"every workflow"*, so `ci init`
+ * asked once and stored the same bytes against `primary`, `pull-request` and
+ * `release`. The declaration would then say three values are needed and the
+ * store would hold one, three times.
+ *
+ * The machinery for this was already there. `collectFileSecret` takes
+ * `workflowGroups`, prompts per group, and stores per workflow — that is how
+ * the keystore has always collected a debug key and a release key separately.
+ * The properties file was the one credential passing it a single group.
+ *
+ * What matters more than the split is that it is the *same* split: `ci init`
+ * groups by exactly the discriminator `credentialSlots` declares by, so the
+ * question asked and the slot declared cannot drift apart. One group means one
+ * slot and one question; two groups mean one slot per workflow and a question
+ * per group. That invariant is asserted directly rather than left to two
+ * copies of the same rule staying in step.
+ */
+export {};
+//# sourceMappingURL=each-flavor-is-asked-for-its-own-properties-file.test.d.ts.map

package/dist/src/commands/each-flavor-is-asked-for-its-own-properties-file.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"each-flavor-is-asked-for-its-own-properties-file.test.d.ts","sourceRoot":"","sources":["../../../src/commands/each-flavor-is-asked-for-its-own-properties-file.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG"}