@invarn/cibuild 2.7.3 → 2.7.5

package/dist/src/yaml/a-cache-path-must-not-swallow-a-credential.test.js

@@ -0,0 +1,223 @@
+/**
+ * A `cache_paths` entry must not contain the file a `file@` step writes.
+ *
+ * Everything else about a credential's life inside a build is bounded, and was
+ * checked on the three boxes after the first build that ever wrote one: the
+ * runner pushes the checkout and the guest root onto `cleanupPaths` and
+ * removes them in a `finally`, the guest gets `rm -rf`, and `tart delete`
+ * reclaims the VM. Nothing was left anywhere.
+ *
+ * The cache store is the one place a file can survive all of that.
+ * `cache-push` archives whatever `cache_paths` names and uploads it to where
+ * the *next* build pulls it from, so a credential swept into that archive
+ * outlives the build it was delivered to — and outlives the sandbox that was
+ * supposed to contain it.
+ *
+ * No pipeline in play trips this. Every one of them caches
+ * `~/.gradle/caches`, `~/.gradle/wrapper` and `.gradle`, and none of those
+ * holds a credential. It is a guard on a mistake that is easy to make and
+ * invisible once made: adding `.` to `cache_paths` is a plausible way to make
+ * a build faster, and it would publish the signing key.
+ *
+ * Refused at generation time, like issue 03's missing credential, because that
+ * is the only place that can see a whole workflow at once — a cache step can
+ * be written before the `file@` step whose target it would swallow — and
+ * because the alternative is a build that goes green while leaking.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { cacheEntryContains, credentialsSwallowedByCache, swallowedCredentialMessage, convertYAMLToPipelineDef, YAMLConversionError, } from './converter.js';
+import { clearRegistry, registerStep } from './steps/registry.js';
+import { FileStepExecutor } from './steps/file.js';
+import { CachePullStepExecutor, CachePushStepExecutor } from './steps/cache.js';
+const KEYSTORE = {
+    targetPath: 'app/customer-android.jks',
+    varName: 'KEYSTORE_BASE64',
+};
+const PROPERTIES = {
+    targetPath: 'local.properties',
+    varName: 'LOCAL_PROPERTIES',
+};
+function cache(...cachePaths) {
+    return [{ stepName: 'cache-push', cachePaths }];
+}
+describe('which cache entries reach a credential', () => {
+    test('the checkout root reaches everything in it', () => {
+        for (const root of ['.', './', './/']) {
+            expect(cacheEntryContains(root, 'app/customer-android.jks')).toBe(true);
+            expect(cacheEntryContains(root, 'local.properties')).toBe(true);
+        }
+    });
+    test('a directory reaches what is under it, and nothing beside it', () => {
+        expect(cacheEntryContains('app', 'app/customer-android.jks')).toBe(true);
+        expect(cacheEntryContains('app/', 'app/customer-android.jks')).toBe(true);
+        expect(cacheEntryContains('./app', 'app/customer-android.jks')).toBe(true);
+        // `application/` is a different directory that merely shares a prefix.
+        expect(cacheEntryContains('app', 'application/customer-android.jks')).toBe(false);
+        expect(cacheEntryContains('.gradle', 'local.properties')).toBe(false);
+    });
+    test('an entry that is the credential itself reaches it', () => {
+        expect(cacheEntryContains('local.properties', 'local.properties')).toBe(true);
+    });
+    test('an absolute or home-rooted entry reaches nothing in the checkout', () => {
+        // `cache.ts` classifies these as absolute and stores them from the
+        // filesystem root, so they are somewhere the checkout is not — which is
+        // why every real pipeline's Gradle caches are safe.
+        for (const outside of ['~/.gradle/caches', '~/.gradle/wrapper', '/var/tmp/x']) {
+            expect(cacheEntryContains(outside, 'app/customer-android.jks')).toBe(false);
+            expect(cacheEntryContains(outside, 'local.properties')).toBe(false);
+        }
+    });
+});
+describe('the credentials a workflow would archive', () => {
+    test('are none for the paths every real pipeline caches', () => {
+        expect(credentialsSwallowedByCache([KEYSTORE, PROPERTIES], cache('~/.gradle/caches', '~/.gradle/wrapper', '.gradle'))).toEqual([]);
+    });
+    test('are every one of them when the entry is the checkout root', () => {
+        const found = credentialsSwallowedByCache([KEYSTORE, PROPERTIES], cache('.'));
+        expect(found.map((f) => f.varName)).toEqual(['KEYSTORE_BASE64', 'LOCAL_PROPERTIES']);
+        expect(found[0]).toEqual({
+            stepName: 'cache-push',
+            cachePath: '.',
+            targetPath: 'app/customer-android.jks',
+            varName: 'KEYSTORE_BASE64',
+        });
+    });
+    test('are only the ones the entry actually reaches', () => {
+        const found = credentialsSwallowedByCache([KEYSTORE, PROPERTIES], cache('app'));
+        expect(found.map((f) => f.varName)).toEqual(['KEYSTORE_BASE64']);
+    });
+    test('are found on a pull step as readily as a push step', () => {
+        // `cache-pull` names the same paths, and a pipeline that pulls a directory
+        // it also pushes is the normal shape — so naming the step that declared it
+        // is what makes the message actionable.
+        const found = credentialsSwallowedByCache([PROPERTIES], [
+            { stepName: 'cache-pull', cachePaths: ['.'] },
+        ]);
+        expect(found[0].stepName).toBe('cache-pull');
+    });
+    test('are none when the workflow writes no credential at all', () => {
+        expect(credentialsSwallowedByCache([], cache('.'))).toEqual([]);
+    });
+});
+describe('what the refusal tells the author', () => {
+    test('names the workflow, the entry, the file and the secret', () => {
+        const [swallowed] = credentialsSwallowedByCache([KEYSTORE], cache('.'));
+        const message = swallowedCredentialMessage('primary', swallowed);
+        expect(message).toContain('primary');
+        expect(message).toContain('cache-push');
+        expect(message).toContain('cache_paths');
+        expect(message).toContain('app/customer-android.jks');
+        expect(message).toContain('KEYSTORE_BASE64');
+        // And why it matters, not only that it is refused.
+        expect(message).toContain('outlives the build');
+    });
+});
+// ─── Through the real converter ───────────────────────────────────────────
+const mockConfig = {
+    artifactsDir: '/test/artifacts',
+    maxConcurrentJobs: 1,
+    paths: {
+        buildsDir: '/test/builds',
+        cacheDir: '/test/cache',
+        derivedDataDir: '/test/derived-data',
+    },
+    interpreters: {
+        bash: '/bin/bash',
+        python: 'python3',
+        ruby: 'ruby',
+        node: 'node',
+    },
+};
+let workdir;
+let previousCwd;
+beforeEach(() => {
+    clearRegistry();
+    registerStep('file', new FileStepExecutor());
+    registerStep('cache-pull', new CachePullStepExecutor());
+    registerStep('cache-push', new CachePushStepExecutor());
+    previousCwd = process.cwd();
+    workdir = mkdtempSync(join(tmpdir(), 'cibuild-cache-credential-'));
+    process.chdir(workdir);
+    workdir = process.cwd();
+    process.env.LOCAL_PROPERTIES = 'sdk.dir=/opt/android-sdk\n';
+});
+afterEach(() => {
+    process.chdir(previousCwd);
+    rmSync(workdir, { recursive: true, force: true });
+    clearRegistry();
+    delete process.env.LOCAL_PROPERTIES;
+});
+/** A workflow that writes a credential and then caches `cachePaths`. */
+function pipelineCaching(cachePaths) {
+    return {
+        format_version: '1',
+        app: { envs: [{ LOCAL_PROPERTIES: '' }] },
+        workflows: {
+            primary: {
+                steps: [
+                    {
+                        'file@1.0.0': {
+                            title: 'Setup local.properties',
+                            is_skippable: true,
+                            inputs: { target_path: 'local.properties', var_name: 'LOCAL_PROPERTIES' },
+                        },
+                    },
+                    {
+                        'cache-push@1.0.0': {
+                            inputs: { cache_key: 'gradle-app', cache_paths: cachePaths },
+                        },
+                    },
+                ],
+            },
+        },
+    };
+}
+describe('converting a workflow whose cache would archive a credential', () => {
+    test('refuses, rather than building green and publishing the file', async () => {
+        await expect(convertYAMLToPipelineDef(pipelineCaching(['.']), mockConfig, 'primary')).rejects.toBeInstanceOf(YAMLConversionError);
+        await expect(convertYAMLToPipelineDef(pipelineCaching(['.']), mockConfig, 'primary')).rejects.toThrow(/local\.properties/);
+    });
+    test('refuses when the cache step is written before the file step', async () => {
+        // Order cannot be the test: an author is free to pull a cache first, and
+        // the cache still ends up holding whatever the later step wrote.
+        const reordered = {
+            format_version: '1',
+            app: { envs: [{ LOCAL_PROPERTIES: '' }] },
+            workflows: {
+                primary: {
+                    steps: [
+                        { 'cache-pull@1.0.0': { inputs: { cache_key: 'k', cache_paths: ['.'] } } },
+                        {
+                            'file@1.0.0': {
+                                is_skippable: true,
+                                inputs: { target_path: 'local.properties', var_name: 'LOCAL_PROPERTIES' },
+                            },
+                        },
+                    ],
+                },
+            },
+        };
+        await expect(convertYAMLToPipelineDef(reordered, mockConfig, 'primary')).rejects.toThrow(/LOCAL_PROPERTIES/);
+    });
+    test('converts the paths every real pipeline caches, untouched', async () => {
+        const result = await convertYAMLToPipelineDef(pipelineCaching(['~/.gradle/caches', '~/.gradle/wrapper', '.gradle']), mockConfig, 'primary');
+        expect(result.pipeline.steps).toHaveLength(2);
+        expect(result.warnings).toEqual([]);
+    });
+    test('leaves a workflow with no credential alone, whatever it caches', async () => {
+        const noCredential = {
+            format_version: '1',
+            workflows: {
+                primary: {
+                    steps: [{ 'cache-push@1.0.0': { inputs: { cache_key: 'k', cache_paths: ['.'] } } }],
+                },
+            },
+        };
+        const result = await convertYAMLToPipelineDef(noCredential, mockConfig, 'primary');
+        expect(result.pipeline.steps).toHaveLength(1);
+    });
+});
+//# sourceMappingURL=a-cache-path-must-not-swallow-a-credential.test.js.map

package/dist/src/yaml/a-declared-slot-may-name-the-workflow-it-belongs-to.test.d.ts

@@ -0,0 +1,37 @@
+/**
+ * A pipeline may declare a credential slot under the name a *workflow-scoped*
+ * secret carries, and the workflow it names reads it under the plain name.
+ *
+ * Two workflows that build different product flavors cannot share one value.
+ * `local.properties` is the clearest case: every workflow writes the same file
+ * to the same path, and what belongs in it is the flavor's environment — a
+ * different base API URL and twenty other keys the Secrets Gradle Plugin turns
+ * into `BuildConfig`. One slot, one value, and one of the two flavors builds
+ * against the wrong environment.
+ *
+ * The value side of that has always worked. `ci secrets upload` encodes a
+ * workflow-scoped secret as `CIBUILD_SW__<WORKFLOW>__<VAR>`, `SecretsManager`
+ * decodes it back, and `EnvResolver` asks for the workflow being run — proved
+ * end to end on the dispatch path, where a fresh clone has no
+ * `.cibuild-secrets.json` and the value arrives as a bare environment
+ * variable. What did not work is *declaring* it. A pipeline declares its
+ * credentials as empty `envs` slots, and that declaration does two jobs
+ * nothing else does:
+ *
+ *   - `unsetEnvKeys` — what `invarn setup` searches the developer's machine
+ *     by — reads `envs`, never step inputs. An undeclared credential is never
+ *     discovered and never offered for upload.
+ *   - `file@1.0.0` tells "nobody supplied this" from "this workflow does not
+ *     need it" by whether the key is in the env map at all, and only a
+ *     declaration puts an unsupplied key there. Without one, a credential that
+ *     went missing is skipped with a warning and the build fails later inside
+ *     the project's own build tool (issue 03).
+ *
+ * So a per-workflow slot has to be declarable, and a declaration naming one
+ * workflow has to mean nothing in the others — otherwise `release` would
+ * demand `primary`'s value. The decoding belongs here, beside the decoding of
+ * the secret itself, and not in `file@`: the step keeps reading its plain
+ * `var_name` and never learns the convention exists.
+ */
+export {};
+//# sourceMappingURL=a-declared-slot-may-name-the-workflow-it-belongs-to.test.d.ts.map

package/dist/src/yaml/a-declared-slot-may-name-the-workflow-it-belongs-to.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-declared-slot-may-name-the-workflow-it-belongs-to.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-declared-slot-may-name-the-workflow-it-belongs-to.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG"}

package/dist/src/yaml/a-declared-slot-may-name-the-workflow-it-belongs-to.test.js

@@ -0,0 +1,255 @@
+/**
+ * A pipeline may declare a credential slot under the name a *workflow-scoped*
+ * secret carries, and the workflow it names reads it under the plain name.
+ *
+ * Two workflows that build different product flavors cannot share one value.
+ * `local.properties` is the clearest case: every workflow writes the same file
+ * to the same path, and what belongs in it is the flavor's environment — a
+ * different base API URL and twenty other keys the Secrets Gradle Plugin turns
+ * into `BuildConfig`. One slot, one value, and one of the two flavors builds
+ * against the wrong environment.
+ *
+ * The value side of that has always worked. `ci secrets upload` encodes a
+ * workflow-scoped secret as `CIBUILD_SW__<WORKFLOW>__<VAR>`, `SecretsManager`
+ * decodes it back, and `EnvResolver` asks for the workflow being run — proved
+ * end to end on the dispatch path, where a fresh clone has no
+ * `.cibuild-secrets.json` and the value arrives as a bare environment
+ * variable. What did not work is *declaring* it. A pipeline declares its
+ * credentials as empty `envs` slots, and that declaration does two jobs
+ * nothing else does:
+ *
+ *   - `unsetEnvKeys` — what `invarn setup` searches the developer's machine
+ *     by — reads `envs`, never step inputs. An undeclared credential is never
+ *     discovered and never offered for upload.
+ *   - `file@1.0.0` tells "nobody supplied this" from "this workflow does not
+ *     need it" by whether the key is in the env map at all, and only a
+ *     declaration puts an unsupplied key there. Without one, a credential that
+ *     went missing is skipped with a warning and the build fails later inside
+ *     the project's own build tool (issue 03).
+ *
+ * So a per-workflow slot has to be declarable, and a declaration naming one
+ * workflow has to mean nothing in the others — otherwise `release` would
+ * demand `primary`'s value. The decoding belongs here, beside the decoding of
+ * the secret itself, and not in `file@`: the step keeps reading its plain
+ * `var_name` and never learns the convention exists.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { convertYAMLToPipelineDef } from './converter.js';
+import { EnvResolver } from './env-resolver.js';
+import { clearRegistry, registerStep } from './steps/registry.js';
+import { FileStepExecutor } from './steps/file.js';
+const mockConfig = {
+    artifactsDir: '/test/artifacts',
+    maxConcurrentJobs: 1,
+    paths: {
+        buildsDir: '/test/builds',
+        cacheDir: '/test/cache',
+        derivedDataDir: '/test/derived-data',
+    },
+    interpreters: {
+        bash: '/bin/bash',
+        python: 'python3',
+        ruby: 'ruby',
+        node: 'node',
+    },
+};
+const TARGET = 'local.properties';
+/** Two flavors, two environments, and nothing in common but the file name. */
+const CI_DYNAMIC = 'BASE_API_URL=https://ci-dynamic.example.test/api\n';
+const PROD = 'BASE_API_URL=https://prod.example.test/api\n';
+/** Every environment variable a test here may set, cleared around each one. */
+const TOUCHED = [
+    'LOCAL_PROPERTIES',
+    'CIBUILD_S__LOCAL_PROPERTIES',
+    'CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES',
+    'CIBUILD_SW__PULL_REQUEST__LOCAL_PROPERTIES',
+    'CIBUILD_SW__RELEASE__LOCAL_PROPERTIES',
+];
+let workdir;
+let previousCwd;
+function clearTouched() {
+    for (const key of TOUCHED)
+        delete process.env[key];
+}
+beforeEach(() => {
+    clearRegistry();
+    registerStep('file', new FileStepExecutor());
+    previousCwd = process.cwd();
+    workdir = mkdtempSync(join(tmpdir(), 'cibuild-workflow-slot-'));
+    process.chdir(workdir);
+    // `workdir` is the pre-symlink path on macOS; the steps resolve paths from
+    // CIBUILD_SOURCE_DIR, which is cwd, so read files back the same way.
+    workdir = process.cwd();
+    clearTouched();
+});
+afterEach(() => {
+    process.chdir(previousCwd);
+    rmSync(workdir, { recursive: true, force: true });
+    clearRegistry();
+    clearTouched();
+});
+/**
+ * The shape a flavored repository's generated pipeline has: the credential
+ * declared once per workflow under the encoded name, and the same unsuffixed
+ * `var_name` in every workflow's `file@` step.
+ */
+function probePipeline(declared) {
+    const step = {
+        'file@1.0.0': {
+            title: 'Setup local.properties',
+            is_skippable: true,
+            inputs: { target_path: TARGET, var_name: 'LOCAL_PROPERTIES' },
+        },
+    };
+    return {
+        format_version: '1',
+        app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) },
+        workflows: {
+            primary: { envs: [{ VARIANT: 'ciDynamicDebug' }], steps: [step] },
+            'pull-request': { envs: [{ VARIANT: 'ciDynamicDebug' }], steps: [step] },
+            release: { envs: [{ VARIANT: 'prodRelease' }], steps: [step] },
+        },
+    };
+}
+/**
+ * Converts one workflow and runs the steps it generated the way the runner
+ * does, then reads back whatever landed at `local.properties`.
+ */
+async function land(pipeline, workflow) {
+    const result = await convertYAMLToPipelineDef(pipeline, mockConfig, workflow);
+    const chunks = [...result.warnings];
+    for (const step of result.pipeline.steps) {
+        const scriptPath = join(workdir, `__step_${step.id}.sh`);
+        writeFileSync(scriptPath, step.script, 'utf-8');
+        const proc = spawnSync('bash', [scriptPath], {
+            cwd: workdir,
+            encoding: 'utf-8',
+            env: { ...process.env },
+        });
+        expect(proc.status).toBe(0);
+        chunks.push(proc.stdout ?? '', proc.stderr ?? '');
+    }
+    const landedAt = join(workdir, TARGET);
+    return {
+        output: chunks.join('\n'),
+        contents: existsSync(landedAt) ? readFileSync(landedAt, 'utf-8') : undefined,
+    };
+}
+/** The conversion's outcome, without letting a throw escape the assertion. */
+async function convert(pipeline, workflow) {
+    try {
+        const result = await convertYAMLToPipelineDef(pipeline, mockConfig, workflow);
+        return { steps: result.pipeline.steps };
+    }
+    catch (error) {
+        return { error: error };
+    }
+}
+function resolverFor(pipeline, workflow) {
+    return new EnvResolver(pipeline, pipeline.workflows[workflow], workflow, 'linux');
+}
+/** The three slots a flavored repository's pipeline declares. */
+const PER_WORKFLOW_SLOTS = {
+    CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: '',
+    CIBUILD_SW__PULL_REQUEST__LOCAL_PROPERTIES: '',
+    CIBUILD_SW__RELEASE__LOCAL_PROPERTIES: '',
+};
+describe('a slot naming a workflow', () => {
+    test('delivers that workflow its own bytes, and the other workflow the other bytes', async () => {
+        // Exactly what a dispatch hands the build: bare environment variables
+        // under the encoded names, and no `.cibuild-secrets.json` anywhere.
+        process.env.CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES = CI_DYNAMIC;
+        process.env.CIBUILD_SW__RELEASE__LOCAL_PROPERTIES = PROD;
+        expect(existsSync(join(workdir, '.cibuild-secrets.json'))).toBe(false);
+        const primary = await land(probePipeline(PER_WORKFLOW_SLOTS), 'primary');
+        expect(primary.contents).toBe(CI_DYNAMIC);
+        rmSync(join(workdir, TARGET));
+        const release = await land(probePipeline(PER_WORKFLOW_SLOTS), 'release');
+        expect(release.contents).toBe(PROD);
+    });
+    test('reaches a workflow whose name the encoding had to change', async () => {
+        // `pull-request` cannot be an environment variable name, so the encoding
+        // upper-cases it and turns the dash into an underscore. If the decoding
+        // did not turn it back the slot would belong to a workflow nobody runs.
+        process.env.CIBUILD_SW__PULL_REQUEST__LOCAL_PROPERTIES = CI_DYNAMIC;
+        const { contents } = await land(probePipeline(PER_WORKFLOW_SLOTS), 'pull-request');
+        expect(contents).toBe(CI_DYNAMIC);
+    });
+    test('is not a declaration in any other workflow', async () => {
+        // `release` is asked for nothing here. If `primary`'s slot declared
+        // `LOCAL_PROPERTIES` everywhere, `release` would refuse the build over a
+        // value it was never going to be given.
+        const pipeline = probePipeline({ CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: '' });
+        const { error, steps } = await convert(pipeline, 'release');
+        expect(error).toBeUndefined();
+        expect(steps).toBeDefined();
+        expect(resolverFor(pipeline, 'release').has('LOCAL_PROPERTIES')).toBe(false);
+    });
+    test('still refuses the build in the workflow it does name', async () => {
+        // The tripwire that makes per-workflow slots safe to emit. Replacing one
+        // flat declaration with three scoped ones must not turn issue 03's loud
+        // refusal back into a green skip.
+        const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: '' }), 'primary');
+        expect(error).toBeDefined();
+        expect(error.message).toContain('LOCAL_PROPERTIES');
+        expect(error.message).toContain(TARGET);
+        // Named as the build reads it. The encoding is ours, not the user's, and
+        // `ci secrets add CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES` is not a command.
+        expect(error.message).not.toContain('CIBUILD_SW__');
+    });
+    test('does not put its own spelling into the build environment', () => {
+        process.env.CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES = CI_DYNAMIC;
+        const resolver = resolverFor(probePipeline(PER_WORKFLOW_SLOTS), 'primary');
+        expect(resolver.get('LOCAL_PROPERTIES')).toBe(CI_DYNAMIC);
+        expect(resolver.has('CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES')).toBe(false);
+        expect(Object.keys(resolver.getAll()).filter((k) => k.startsWith('CIBUILD_SW__'))).toEqual([]);
+    });
+    test('carries a value the pipeline itself supplies, under the plain name', () => {
+        const resolver = resolverFor(probePipeline({ CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: CI_DYNAMIC }), 'primary');
+        expect(resolver.get('LOCAL_PROPERTIES')).toBe(CI_DYNAMIC);
+    });
+});
+describe('a value delivered the old way', () => {
+    test('still reaches a per-workflow slot under its plain name', async () => {
+        // A project whose secret was uploaded before any of this existed holds one
+        // flat `LOCAL_PROPERTIES`. Regenerating its pipeline must not strand that
+        // value: the slot declares the plain name, so step 5 imports it.
+        process.env.LOCAL_PROPERTIES = CI_DYNAMIC;
+        const { contents } = await land(probePipeline(PER_WORKFLOW_SLOTS), 'primary');
+        expect(contents).toBe(CI_DYNAMIC);
+    });
+    test('is beaten by the value scoped to the workflow being run', async () => {
+        process.env.LOCAL_PROPERTIES = CI_DYNAMIC;
+        process.env.CIBUILD_SW__RELEASE__LOCAL_PROPERTIES = PROD;
+        const { contents } = await land(probePipeline(PER_WORKFLOW_SLOTS), 'release');
+        expect(contents).toBe(PROD);
+    });
+    test('reaches a globally encoded slot too', () => {
+        // `CIBUILD_S__X` is the other half of the same convention: a secret with
+        // no workflow. A pipeline declaring it means `X`, in every workflow.
+        process.env.CIBUILD_S__LOCAL_PROPERTIES = CI_DYNAMIC;
+        const resolver = resolverFor(probePipeline({ CIBUILD_S__LOCAL_PROPERTIES: '' }), 'release');
+        expect(resolver.get('LOCAL_PROPERTIES')).toBe(CI_DYNAMIC);
+        expect(resolver.has('CIBUILD_S__LOCAL_PROPERTIES')).toBe(false);
+    });
+});
+describe('a pipeline that declares one flat slot', () => {
+    test('is untouched — every workflow reads the one value', async () => {
+        process.env.LOCAL_PROPERTIES = CI_DYNAMIC;
+        for (const workflow of ['primary', 'pull-request', 'release']) {
+            const { contents } = await land(probePipeline({ LOCAL_PROPERTIES: '' }), workflow);
+            expect(contents).toBe(CI_DYNAMIC);
+            rmSync(join(workdir, TARGET));
+        }
+    });
+    test('keeps refusing when nobody supplied it', async () => {
+        const { error } = await convert(probePipeline({ LOCAL_PROPERTIES: '' }), 'primary');
+        expect(error).toBeDefined();
+        expect(error.message).toContain('LOCAL_PROPERTIES');
+    });
+});
+//# sourceMappingURL=a-declared-slot-may-name-the-workflow-it-belongs-to.test.js.map

package/dist/src/yaml/a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.d.ts

@@ -0,0 +1,34 @@
+/**
+ * A credential slot scoped to a workflow the pipeline does not have refuses
+ * the build, instead of silently belonging to nobody.
+ *
+ * The declaration `CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: ""` means "this
+ * credential, for the workflow called `primary`". Nothing checked that a
+ * workflow by that name existed, and every way of getting the name wrong fails
+ * quietly:
+ *
+ *   - **A typo.** `CIBUILD_SW__PRIMRAY__X` decodes to workflow `primray`. No
+ *     workflow is called that, so no workflow declares `X`, so `file@1.0.0`
+ *     finds no key in its map, calls the credential optional, and skips it with
+ *     a warning — the green-step failure mode issue 03 exists to end. The
+ *     upload half is equally quiet: `ci secrets upload` encodes a value for
+ *     `primray` and the resolver looks for `primary`.
+ *   - **An underscore in the workflow's own name.** The encoding upper-cases
+ *     the name and turns dashes into underscores, so decoding turns every
+ *     underscore back into a dash. A workflow genuinely called `my_wf` is
+ *     therefore unreachable: its slot decodes to `my-wf`, which the pipeline
+ *     does not have. `ci secrets upload` warns about this at upload time; the
+ *     pipeline is where it can be refused before a build starts.
+ *
+ * Both are one check — does the pipeline have a workflow by the decoded
+ * name? — and both are refused at generation time, from the resolver, before
+ * any step converts. That is the same place issue 03's refusal lands and for
+ * the same reason: a build that cannot possibly deliver a credential should
+ * stop while the message can still name the credential.
+ *
+ * The check only ever fires on a name we generate. No pipeline written before
+ * this declared an encoded slot at all, and a global `CIBUILD_S__X` names no
+ * workflow, so there is nothing in existence for it to refuse.
+ */
+export {};
+//# sourceMappingURL=a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.d.ts.map

package/dist/src/yaml/a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG"}