@invarn/cibuild 2.7.3 → 2.7.5

package/dist/src/commands/each-flavor-is-asked-for-its-own-properties-file.test.js

@@ -0,0 +1,196 @@
+/**
+ * `ci init` asks once per flavor for the properties file the Secrets Gradle
+ * Plugin reads, and stores the answer against that flavor's workflows.
+ *
+ * The generator now declares this credential once per workflow when the
+ * workflows build different flavors, because two flavors are two environments
+ * and one value cannot serve both. Collection had not moved: `collectFileSecret`
+ * was called with a single group labelled *"every workflow"*, so `ci init`
+ * asked once and stored the same bytes against `primary`, `pull-request` and
+ * `release`. The declaration would then say three values are needed and the
+ * store would hold one, three times.
+ *
+ * The machinery for this was already there. `collectFileSecret` takes
+ * `workflowGroups`, prompts per group, and stores per workflow — that is how
+ * the keystore has always collected a debug key and a release key separately.
+ * The properties file was the one credential passing it a single group.
+ *
+ * What matters more than the split is that it is the *same* split: `ci init`
+ * groups by exactly the discriminator `credentialSlots` declares by, so the
+ * question asked and the slot declared cannot drift apart. One group means one
+ * slot and one question; two groups mean one slot per workflow and a question
+ * per group. That invariant is asserted directly rather than left to two
+ * copies of the same rule staying in step.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import prompts from 'prompts';
+import { collectionGroups, credentialSlots, propertiesFileGroups, variantFlavors, } from './build.js';
+import { collectFileSecret } from './file-secret-collector.js';
+import { SecretsManager } from '../yaml/secrets-manager.js';
+function variant(name) {
+    const buildType = name.charAt(0).toUpperCase() + name.slice(1);
+    return { variant: name, buildType, gradleTask: `assemble${buildType}` };
+}
+const FLAVORED = {
+    primary: variant('ciDynamicDebug'),
+    pullRequest: variant('ciDynamicDebug'),
+    release: variant('prodRelease'),
+};
+const UNFLAVORED = {
+    primary: variant('debug'),
+    pullRequest: variant('debug'),
+    release: variant('release'),
+};
+const FLAVORS = ['ciDynamic', 'prod'];
+const CI_DYNAMIC = 'BASE_API_URL=https://ci-dynamic.example.test/api\n';
+const PROD = 'BASE_API_URL=https://prod.example.test/api\n';
+describe('the groups a credential is collected in', () => {
+    test('are one when every workflow wants the same bytes', () => {
+        const groups = collectionGroups({ primary: 'ciDynamic', 'pull-request': 'ciDynamic', release: 'ciDynamic' }, () => 'every workflow');
+        expect(groups).toEqual([
+            { label: 'every workflow', workflows: ['primary', 'pull-request', 'release'], discriminator: 'ciDynamic' },
+        ]);
+    });
+    test('are one per distinct value, keeping the workflows that agree together', () => {
+        const groups = collectionGroups({ primary: 'ciDynamic', 'pull-request': 'ciDynamic', release: 'prod' }, (flavor) => flavor);
+        expect(groups).toEqual([
+            { label: 'ciDynamic', workflows: ['primary', 'pull-request'], discriminator: 'ciDynamic' },
+            { label: 'prod', workflows: ['release'], discriminator: 'prod' },
+        ]);
+    });
+    test('split exactly when the declaration splits', () => {
+        // Two copies of one rule is one copy too many. If these ever disagree,
+        // `ci init` asks a question the pipeline has no slot for, or declares a
+        // slot nothing on the machine was ever collected into.
+        const maps = [
+            { primary: '', 'pull-request': '', release: '' },
+            { primary: 'ciDynamic', 'pull-request': 'ciDynamic', release: 'prod' },
+            { primary: 'a', 'pull-request': 'b', release: 'c' },
+            { release: 'keystore.properties' },
+            { primary: 'app/one.jks', 'pull-request': 'app/one.jks', release: 'app/one.jks' },
+        ];
+        expect(maps.map((map) => ({
+            groups: collectionGroups(map, (d) => d).length === 1,
+            oneFlatSlot: credentialSlots('X', map).length === 1,
+        }))).toEqual([
+            { groups: true, oneFlatSlot: true },
+            { groups: false, oneFlatSlot: false },
+            { groups: false, oneFlatSlot: false },
+            { groups: true, oneFlatSlot: true },
+            { groups: true, oneFlatSlot: true },
+        ]);
+    });
+});
+describe('the groups the properties file is collected in', () => {
+    test('are one per flavor, and say which flavor', () => {
+        const groups = propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS));
+        expect(groups.map((g) => ({ label: g.label, workflows: g.workflows }))).toEqual([
+            { label: 'the ciDynamic flavor (primary, pull-request)', workflows: ['primary', 'pull-request'] },
+            { label: 'the prod flavor (release)', workflows: ['release'] },
+        ]);
+    });
+    test('are one, labelled as they were, on a repository with no flavors', () => {
+        // The label is what the prompt says out loud, and this is the wording
+        // every unflavored repository has always seen.
+        expect(propertiesFileGroups(variantFlavors(UNFLAVORED, []))).toEqual([
+            { label: 'every workflow', workflows: ['primary', 'pull-request', 'release'], discriminator: '' },
+        ]);
+    });
+    test('are one when three workflows build three variants of one flavor', () => {
+        const oneFlavor = {
+            primary: variant('ciDynamicDebug'),
+            pullRequest: variant('ciDynamicDebug'),
+            release: variant('ciDynamicRelease'),
+        };
+        expect(propertiesFileGroups(variantFlavors(oneFlavor, FLAVORS))).toHaveLength(1);
+    });
+});
+describe('collecting a value for each group', () => {
+    let workdir;
+    let secretsManager;
+    // `prompts.inject` *concatenates*, so an empty array clears nothing and a
+    // sentinel one test leaves queued becomes the next test's answer. The queue
+    // itself is the only reset there is.
+    const clearInjected = () => {
+        prompts._injected = undefined;
+    };
+    beforeEach(() => {
+        clearInjected();
+        workdir = mkdtempSync(join(tmpdir(), 'cibuild-flavor-properties-'));
+        workdir = resolve(workdir);
+        secretsManager = new SecretsManager(join(workdir, '.cibuild-secrets.json'));
+    });
+    afterEach(() => {
+        clearInjected();
+        rmSync(workdir, { recursive: true, force: true });
+    });
+    function put(relPath, contents) {
+        const full = join(workdir, relPath);
+        mkdirSync(join(full, '..'), { recursive: true });
+        writeFileSync(full, contents, 'utf-8');
+        return full;
+    }
+    async function collect(groups, ni = false) {
+        return collectFileSecret({
+            displayName: 'local.properties',
+            secretName: 'LOCAL_PROPERTIES',
+            fileMatch: (name) => name === 'local.properties',
+            readAs: 'text',
+            workflowGroups: groups,
+        }, workdir, secretsManager, ni);
+    }
+    test('stores a different value against the workflows of each flavor', async () => {
+        const ciDynamicFile = put('local.properties', CI_DYNAMIC);
+        const prodFile = put('envs/prod/local.properties', PROD);
+        prompts.inject([ciDynamicFile, prodFile]);
+        await collect(propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS)));
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'primary')).toBe(CI_DYNAMIC);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'pull-request')).toBe(CI_DYNAMIC);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'release')).toBe(PROD);
+    });
+    test('stores them where `ci secrets upload` will encode them per workflow', async () => {
+        const ciDynamicFile = put('local.properties', CI_DYNAMIC);
+        const prodFile = put('envs/prod/local.properties', PROD);
+        prompts.inject([ciDynamicFile, prodFile]);
+        await collect(propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS)));
+        // Not `global`. A global value would satisfy all three workflows and the
+        // upload would push one flat key, which is the bug this closes.
+        const stored = JSON.parse(readFileSync(join(workdir, '.cibuild-secrets.json'), 'utf-8'));
+        expect(stored.global).toEqual({});
+        expect(Object.keys(stored.workflows).sort()).toEqual(['primary', 'pull-request', 'release']);
+    });
+    test('asks nothing at all when one group meets one file', async () => {
+        // Today's behaviour on every unflavored repository, unchanged: a single
+        // group and a single candidate auto-apply. The injected answer is
+        // unreadable on purpose — if a prompt fired, nothing would be stored.
+        put('local.properties', CI_DYNAMIC);
+        prompts.inject(['/nonexistent/would-be-a-prompt']);
+        await collect(propertiesFileGroups(variantFlavors(UNFLAVORED, [])));
+        for (const workflow of ['primary', 'pull-request', 'release']) {
+            expect(secretsManager.getSecret('LOCAL_PROPERTIES', workflow)).toBe(CI_DYNAMIC);
+        }
+    });
+    test('gives every group the same file when it cannot ask', async () => {
+        // `ci init --create` runs non-interactive. One file is all it can offer,
+        // and a wrong-flavored properties file that the user then corrects beats
+        // no properties file at all, which is a build that cannot configure.
+        put('local.properties', CI_DYNAMIC);
+        await collect(propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS)), true);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'primary')).toBe(CI_DYNAMIC);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'release')).toBe(CI_DYNAMIC);
+    });
+    test('leaves a group alone once its value is already stored', async () => {
+        put('local.properties', CI_DYNAMIC);
+        put('envs/prod/local.properties', PROD);
+        secretsManager.storeSecret('LOCAL_PROPERTIES', PROD, 'release');
+        // One answer, for the one group still pending.
+        prompts.inject([join(workdir, 'local.properties')]);
+        await collect(propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS)));
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'primary')).toBe(CI_DYNAMIC);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'release')).toBe(PROD);
+    });
+});
+//# sourceMappingURL=each-flavor-is-asked-for-its-own-properties-file.test.js.map

package/dist/src/commands/file-secret-collector.d.ts

@@ -10,6 +10,19 @@ export interface FileSecretConfig {
     secretName: string;
     /** Returns true if a filename matches (e.g. name === "google-services.json") */
     fileMatch: (name: string) => boolean;
+    /**
+     * Narrows the candidates by their path relative to the project root, once
+     * `fileMatch` has found them by name.
+     *
+     * A credential Android keeps one copy of per product flavor has the same
+     * basename in every source set — four `google-services.json` under
+     * `app/`, `app/src/dev/`, `app/src/prod/` and `app/src/ciDynamic/` — so a
+     * name is not enough to say which one a workflow needs. Without this the
+     * single-candidate auto-apply below never fires on a flavored repository,
+     * and the answer comes from a prompt or from whichever the walk reached
+     * first.
+     */
+    pathMatch?: (relativePath: string) => boolean;
     /** How to read the file into a string value. Defaults to "text". */
     readAs?: "text" | "base64";
     /** Workflow groups to scope the secret to */

package/dist/src/commands/file-secret-collector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-secret-collector.d.ts","sourceRoot":"","sources":["../../../src/commands/file-secret-collector.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3B,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAMrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,EAAE,CAkBxF;AAiDD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,EAC9B,cAAc,UAAQ,GACrB,OAAO,CAAC,eAAe,CAAC,CAuH1B"}
+{"version":3,"file":"file-secret-collector.d.ts","sourceRoot":"","sources":["../../../src/commands/file-secret-collector.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9C,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3B,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAMrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,EAAE,CAkBxF;AAiDD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,EAC9B,cAAc,UAAQ,GACrB,OAAO,CAAC,eAAe,CAAC,CA0H1B"}

package/dist/src/commands/file-secret-collector.js

@@ -1,4 +1,4 @@
-import { resolve, relative } from "node:path";
+import { resolve, relative, sep } from "node:path";
 import { readdirSync, readFileSync } from "node:fs";
 import * as readline from "node:readline";
 import prompts from "prompts";
@@ -87,7 +87,8 @@ export async function collectFileSecret(config, cwd, secretsManager, nonInteract
     const readContent = (p) => config.readAs === "base64"
         ? readFileSync(p).toString("base64")
         : readFileSync(p, "utf-8");
-    const candidates = findProjectFiles(cwd, config.fileMatch);
+    const relativeToCwd = (p) => relative(cwd, p).split(sep).join("/");
+    const candidates = findProjectFiles(cwd, config.fileMatch).filter((p) => config.pathMatch?.(relativeToCwd(p)) ?? true);
     if (candidates.length === 1 && config.workflowGroups.length === 1) {
         // Single file, single-group config — auto-apply without prompting
         const content = readContent(candidates[0]);

package/dist/src/commands/local-properties-reaches-every-workflow.test.d.ts

@@ -0,0 +1,30 @@
+/**
+ * A properties file the Secrets Gradle Plugin reads is a credential like any
+ * other, and it has to reach every workflow that builds — not just `release`.
+ *
+ * The scanner has always found this one: it emits a `secrets-plugin` warning
+ * whenever a build file applies the plugin and the properties file it reads is
+ * gitignored, and `ci init` prints *"The file is gitignored — inject it as a
+ * file step before building"* along with the exact step to write. Then it
+ * generates a pipeline without that step. The advice was correct and nobody
+ * acted on it, so the pipeline it wrote could not configure Gradle at all.
+ *
+ * Measured, not supposed: the first build in the record to consume an uploaded
+ * credential (`bld_f5167b731b95974e61350390`, 2026-09-09) got past
+ * google-services and died four steps later on
+ *
+ *     A problem occurred configuring project ':analytics'.
+ *        > The file '<repo>/local.properties' could not be found
+ *
+ * on a repository whose `release` workflow had a `file@` step for it and whose
+ * `primary` and `pull-request` did not. The plugin's evaluation listener runs
+ * for every variant, so a debug build needs the file exactly as much as a
+ * release one does.
+ *
+ * Declaring the slot matters as much as the step. `unsetEnvKeys` — what
+ * `invarn setup` searches by — reads `envs`, not step inputs, so an undeclared
+ * `LOCAL_PROPERTIES` is never discovered on the developer's machine and never
+ * offered for upload, however many steps name it.
+ */
+export {};
+//# sourceMappingURL=local-properties-reaches-every-workflow.test.d.ts.map

package/dist/src/commands/local-properties-reaches-every-workflow.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-properties-reaches-every-workflow.test.d.ts","sourceRoot":"","sources":["../../../src/commands/local-properties-reaches-every-workflow.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG"}

package/dist/src/commands/local-properties-reaches-every-workflow.test.js

@@ -0,0 +1,146 @@
+/**
+ * A properties file the Secrets Gradle Plugin reads is a credential like any
+ * other, and it has to reach every workflow that builds — not just `release`.
+ *
+ * The scanner has always found this one: it emits a `secrets-plugin` warning
+ * whenever a build file applies the plugin and the properties file it reads is
+ * gitignored, and `ci init` prints *"The file is gitignored — inject it as a
+ * file step before building"* along with the exact step to write. Then it
+ * generates a pipeline without that step. The advice was correct and nobody
+ * acted on it, so the pipeline it wrote could not configure Gradle at all.
+ *
+ * Measured, not supposed: the first build in the record to consume an uploaded
+ * credential (`bld_f5167b731b95974e61350390`, 2026-09-09) got past
+ * google-services and died four steps later on
+ *
+ *     A problem occurred configuring project ':analytics'.
+ *        > The file '<repo>/local.properties' could not be found
+ *
+ * on a repository whose `release` workflow had a `file@` step for it and whose
+ * `primary` and `pull-request` did not. The plugin's evaluation listener runs
+ * for every variant, so a debug build needs the file exactly as much as a
+ * release one does.
+ *
+ * Declaring the slot matters as much as the step. `unsetEnvKeys` — what
+ * `invarn setup` searches by — reads `envs`, not step inputs, so an undeclared
+ * `LOCAL_PROPERTIES` is never discovered on the developer's machine and never
+ * offered for upload, however many steps name it.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { load } from 'js-yaml';
+import { generateAndroidPipeline, detectSetupNeeds } from './build.js';
+const BASE = {
+    keystore: false,
+    keystoreProperties: false,
+    googleServices: false,
+    googlePlayDeploy: false,
+    googlePlayPackageName: '',
+    artifactType: 'apk',
+    keystorePaths: {},
+    googleServicesPaths: {},
+    workflowFlavors: {},
+    secretsProperties: false,
+    secretsPropertiesPath: 'local.properties',
+};
+function parse(yaml) {
+    return load(yaml);
+}
+function envs(parsed) {
+    return Object.assign({}, ...(parsed.app?.envs ?? []));
+}
+function stepNames(parsed, workflow) {
+    return (parsed.workflows?.[workflow]?.steps ?? []).map((s) => Object.keys(s)[0]);
+}
+function fileStepsOf(parsed, workflow) {
+    return (parsed.workflows?.[workflow]?.steps ?? [])
+        .filter((s) => Object.keys(s)[0] === 'file@1.0.0')
+        .map((s) => s['file@1.0.0']);
+}
+describe('a properties file the build reads at configuration time', () => {
+    test('is declared once and written in every workflow that builds', () => {
+        const parsed = parse(generateAndroidPipeline(17, { ...BASE, secretsProperties: true }));
+        expect(envs(parsed).LOCAL_PROPERTIES).toBe('');
+        // One object per workflow so a failure names the workflow that lost it.
+        const written = ['primary', 'pull-request', 'release'].map((workflow) => {
+            const step = fileStepsOf(parsed, workflow).find((s) => s.inputs.var_name === 'LOCAL_PROPERTIES');
+            return {
+                workflow,
+                target: step?.inputs.target_path,
+                // Text, not binary: re-encoding a properties file as base64 would
+                // write base64 to disk and the plugin would read gibberish.
+                base64: step?.inputs.base64_encoded,
+            };
+        });
+        expect(written).toEqual([
+            { workflow: 'primary', target: 'local.properties', base64: undefined },
+            { workflow: 'pull-request', target: 'local.properties', base64: undefined },
+            { workflow: 'release', target: 'local.properties', base64: undefined },
+        ]);
+    });
+    test('is written before anything that could read it', () => {
+        const parsed = parse(generateAndroidPipeline(17, { ...BASE, secretsProperties: true }));
+        const order = ['primary', 'pull-request', 'release'].map((workflow) => {
+            const names = stepNames(parsed, workflow);
+            const wrote = names.indexOf('file@1.0.0');
+            const firstBuildTool = names.findIndex((n) => /^(gradle-build|android-lint|android-unit-test)@/.test(n));
+            return { workflow, writesBeforeBuilding: wrote >= 0 && firstBuildTool > wrote };
+        });
+        expect(order).toEqual([
+            { workflow: 'primary', writesBeforeBuilding: true },
+            { workflow: 'pull-request', writesBeforeBuilding: true },
+            { workflow: 'release', writesBeforeBuilding: true },
+        ]);
+    });
+    test('follows the plugin to a properties file that is not local.properties', () => {
+        const parsed = parse(generateAndroidPipeline(17, {
+            ...BASE,
+            secretsProperties: true,
+            secretsPropertiesPath: 'config/secrets.properties',
+        }));
+        const written = fileStepsOf(parsed, 'primary').find((s) => s.inputs.var_name === 'LOCAL_PROPERTIES');
+        expect(written.inputs.target_path).toBe('config/secrets.properties');
+    });
+    test('appears nowhere in a repository that does not use the plugin', () => {
+        // The whole point of scanning: a pipeline must not declare a slot the
+        // build never reads. After issue 03 a declared-and-empty slot fails the
+        // build, so an unnecessary one turns a working repository red.
+        const yaml = generateAndroidPipeline(17, BASE);
+        expect(yaml).not.toContain('LOCAL_PROPERTIES');
+        expect(fileStepsOf(parse(yaml), 'primary')).toEqual([]);
+    });
+});
+describe('the scan that decides it', () => {
+    const warning = (over) => ({
+        category: 'secrets-plugin',
+        severity: 'warning',
+        message: 'Secrets plugin key: MAPS_API_KEY',
+        location: 'local.properties',
+        ...over,
+    });
+    test('takes the properties file from the per-key warning', () => {
+        const needs = detectSetupNeeds([warning({})]);
+        expect(needs.secretsProperties).toBe(true);
+        expect(needs.secretsPropertiesPath).toBe('local.properties');
+    });
+    test('takes it from the message when the warning has no defaults file', () => {
+        // The two `secrets-plugin` warnings disagree about `location`: the
+        // per-key one carries the properties file, the fallback one carries the
+        // *build file* that applies the plugin. Reading the wrong one would point
+        // the step at `app/build.gradle.kts`.
+        const needs = detectSetupNeeds([
+            warning({
+                message: "Google Secrets Gradle Plugin reads 'config/secrets.properties' which is absent in CI",
+                location: 'app/build.gradle.kts',
+            }),
+        ]);
+        expect(needs.secretsProperties).toBe(true);
+        expect(needs.secretsPropertiesPath).toBe('config/secrets.properties');
+    });
+    test('is off when nothing reports the plugin', () => {
+        const needs = detectSetupNeeds([
+            { category: 'missing-file', severity: 'warning', message: 'keystore.properties not found' },
+        ]);
+        expect(needs.secretsProperties).toBe(false);
+    });
+});
+//# sourceMappingURL=local-properties-reaches-every-workflow.test.js.map

package/dist/src/yaml/a-cache-path-must-not-swallow-a-credential.test.d.ts

@@ -0,0 +1,28 @@
+/**
+ * A `cache_paths` entry must not contain the file a `file@` step writes.
+ *
+ * Everything else about a credential's life inside a build is bounded, and was
+ * checked on the three boxes after the first build that ever wrote one: the
+ * runner pushes the checkout and the guest root onto `cleanupPaths` and
+ * removes them in a `finally`, the guest gets `rm -rf`, and `tart delete`
+ * reclaims the VM. Nothing was left anywhere.
+ *
+ * The cache store is the one place a file can survive all of that.
+ * `cache-push` archives whatever `cache_paths` names and uploads it to where
+ * the *next* build pulls it from, so a credential swept into that archive
+ * outlives the build it was delivered to — and outlives the sandbox that was
+ * supposed to contain it.
+ *
+ * No pipeline in play trips this. Every one of them caches
+ * `~/.gradle/caches`, `~/.gradle/wrapper` and `.gradle`, and none of those
+ * holds a credential. It is a guard on a mistake that is easy to make and
+ * invisible once made: adding `.` to `cache_paths` is a plausible way to make
+ * a build faster, and it would publish the signing key.
+ *
+ * Refused at generation time, like issue 03's missing credential, because that
+ * is the only place that can see a whole workflow at once — a cache step can
+ * be written before the `file@` step whose target it would swallow — and
+ * because the alternative is a build that goes green while leaking.
+ */
+export {};
+//# sourceMappingURL=a-cache-path-must-not-swallow-a-credential.test.d.ts.map

package/dist/src/yaml/a-cache-path-must-not-swallow-a-credential.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-cache-path-must-not-swallow-a-credential.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-cache-path-must-not-swallow-a-credential.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}