@invarn/cibuild 2.7.3 → 2.7.5

package/dist/src/yaml/env-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;IACvC;;;OAGG;IACH,OAAO,CAAC,YAAY,CAA0B;gBAG5C,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IAkCvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAqCnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAoBpB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,4BAA4B;IAUpC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}
+{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAkEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;CAgChF;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;IACvC;;;OAGG;IACH,OAAO,CAAC,YAAY,CAA0B;IAC9C,oFAAoF;IACpF,OAAO,CAAC,YAAY,CAAS;IAC7B,oFAAoF;IACpF,OAAO,CAAC,iBAAiB,CAAW;gBAGlC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IAoCvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAqCnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,UAAU;IAiBlB,OAAO,CAAC,YAAY;IAsBpB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,4BAA4B;IAUpC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}

package/dist/src/yaml/env-resolver.js

@@ -8,6 +8,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { execSync } from 'child_process';
 import { SecretsManager } from './secrets-manager.js';
+import { decodeSecretName } from '../commands/secrets-upload.js';
 import { shellAssignedNamesIn } from './shell-assignments.js';
 /**
  * Hints for common variables that require user configuration
@@ -95,6 +96,58 @@ export class ChecksumFileMissingError extends Error {
         this.name = 'ChecksumFileMissingError';
     }
 }
+/**
+ * A credential slot scoped to a workflow the pipeline does not have.
+ *
+ * Thrown at generation time, before any step converts, because every way of
+ * getting the name wrong is otherwise silent. A slot naming a workflow nobody
+ * runs declares the credential for nobody: `file@1.0.0` finds no key in its
+ * map, calls the credential optional and skips it with a warning, and
+ * `ci secrets upload` cheerfully pushes a value under the same wrong name.
+ * Two green halves and a build that dies later inside the project's own build
+ * tool.
+ *
+ * The underscore case gets its own sentence because the workflow is right
+ * there in the pipeline. `encodeSecretName` upper-cases the workflow and turns
+ * dashes into underscores, so decoding turns every underscore back into a
+ * dash: a workflow genuinely called `my_wf` can only ever be addressed as
+ * `my-wf`, and "no such workflow" about a workflow that plainly exists reads
+ * as a defect in us rather than a name that cannot survive the round trip.
+ */
+export class UnknownWorkflowSlotError extends Error {
+    slot;
+    varName;
+    workflow;
+    constructor(slot, varName, workflow, declared) {
+        // A workflow the pipeline has that differs only in its underscores is the
+        // reason the round trip failed, and naming it is the whole fix.
+        const collapsed = declared.find((name) => name.replace(/_/g, '-') === workflow);
+        const because = collapsed
+            ? `This pipeline has a workflow called "${collapsed}". The name a slot ` +
+                `carries cannot hold an underscore: it is upper-cased and its dashes ` +
+                `become underscores, so decoding turns every underscore back into a ` +
+                `dash and "${collapsed}" can only be addressed as "${workflow}".\n` +
+                `\n` +
+                `Rename the workflow to "${workflow}", or give ${varName} one value ` +
+                `for every workflow by declaring it as "${varName}".`
+            : `This pipeline declares: ${declared.join(', ')}.\n` +
+                `\n` +
+                `Fix the workflow name in the slot, or give ${varName} one value for ` +
+                `every workflow by declaring it as "${varName}".`;
+        super(`${slot} is declared for a workflow this pipeline does not have.\n` +
+            `\n` +
+            `The slot asks for ${varName}, for a workflow called "${workflow}". ` +
+            `Nothing runs under that name, so nothing would ever read the value: ` +
+            `the step that writes ${varName} would find no value and skip, and the ` +
+            `build would fail later for a reason that names your project.\n` +
+            `\n` +
+            `${because}`);
+        this.name = 'UnknownWorkflowSlotError';
+        this.slot = slot;
+        this.varName = varName;
+        this.workflow = workflow;
+    }
+}
 /**
  * EnvResolver handles environment variable merging and interpolation
  */
@@ -107,9 +160,15 @@ export class EnvResolver {
      * not it gave one a value. Read by `importDeclaredFromProcessEnv`.
      */
     declaredVars = new Set();
+    /** The workflow being resolved. Decides which scoped slots apply — `slotKeyFor`. */
+    workflowName;
+    /** Every workflow this pipeline declares. A scoped slot has to name one of them. */
+    declaredWorkflows;
     constructor(pipeline, workflow, workflowName, platform, stack, yamlFilePath) {
         this.envVars = new Map();
         this.secretsManager = new SecretsManager();
+        this.workflowName = workflowName;
+        this.declaredWorkflows = Object.keys(pipeline.workflows ?? {});
         // Step 1: Add built-in environment variables (auto-detected defaults)
         this.addBuiltInVars(workflowName, platform, stack, yamlFilePath);
         // Step 2: Load secrets — overrides auto-detected built-ins with user-stored values
@@ -378,9 +437,48 @@ export class EnvResolver {
      * Merges environment variables from YAML array format
      * @param envArray Array of environment variable objects
      */
+    /**
+     * The variable a declared `envs` key stands for, or null when the
+     * declaration belongs to a different workflow.
+     *
+     * A credential two workflows cannot share is declared once per workflow,
+     * under the same name a workflow-scoped secret carries — the pipeline says
+     * `CIBUILD_SW__RELEASE__LOCAL_PROPERTIES: ""` where it used to say
+     * `LOCAL_PROPERTIES: ""`. The build still reads the credential under its
+     * plain name, so the declaration has to mean the plain name: it is what puts
+     * an unsupplied key in the map for `file@1.0.0` to refuse over, and what
+     * lets `importDeclaredFromProcessEnv` accept a value delivered flat.
+     *
+     * A slot naming another workflow is dropped rather than declared. Declaring
+     * it would make this workflow demand a value only that one was ever going to
+     * be given. The decoding lives here, beside the decoding of the secret
+     * itself, so the steps keep reading their plain `var_name` and never learn
+     * the convention exists.
+     *
+     * A slot naming a workflow the pipeline does not have is refused rather than
+     * dropped — see `UnknownWorkflowSlotError`. Dropping it silently is the same
+     * outcome as never declaring the credential, which is the green skip issue 03
+     * exists to end.
+     */
+    slotKeyFor(key) {
+        const decoded = decodeSecretName(key);
+        if (!decoded)
+            return key;
+        if (decoded.workflow) {
+            if (!this.declaredWorkflows.includes(decoded.workflow)) {
+                throw new UnknownWorkflowSlotError(key, decoded.varName, decoded.workflow, this.declaredWorkflows);
+            }
+            if (decoded.workflow !== this.workflowName)
+                return null;
+        }
+        return decoded.varName;
+    }
     mergeEnvVars(envArray) {
         for (const envObj of envArray) {
-            for (const [key, value] of Object.entries(envObj)) {
+            for (const [declaredKey, value] of Object.entries(envObj)) {
+                const key = this.slotKeyFor(declaredKey);
+                if (key === null)
+                    continue;
                 // Naming the key is the declaration, whatever value follows it
                 this.declaredVars.add(key);
                 // First resolve any secret references

package/dist/src/yaml/secrets-manager.d.ts

@@ -43,17 +43,27 @@ export declare class SecretsManager {
      * Get a secret value by variable name.
      * Workflow-specific value takes precedence over global.
      * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     *
+     * The stored data is consulted before that fallback, and not only when a
+     * file was loaded. `storeSecret` writes the file but cannot make it one this
+     * instance *loaded*, so a value collected by `ci init` on a repository that
+     * had no store — which is the only kind of run that collects anything — read
+     * back as absent from the instance that had just stored it. `ci init`'s own
+     * `getSecret('KEYSTORE_PROPERTIES', wf)`, which is how a workflow's keystore
+     * target is taken from `storeFile=`, returned undefined on every fresh
+     * repository because of it.
      */
     getSecret(name: string, workflow?: string): string | undefined;
     /**
      * Get all secrets merged: global + workflow-specific (workflow overrides global).
-     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present —
+     * for the keys the store does not hold. See `getSecret`.
      */
     getAll(workflow?: string): Record<string, string>;
     /**
      * Returns the variable name if a secret exists for it, undefined otherwise.
-     * Checks workflow scope first, then global.
-     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     * Checks workflow scope first, then global, then the CIBUILD_-prefixed env
+     * vars when no secrets file is present. See `getSecret`.
      */
     getSecretIdByName(name: string, workflow?: string): string | undefined;
     /**

package/dist/src/yaml/secrets-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-manager.d.ts","sourceRoot":"","sources":["../../../src/yaml/secrets-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACnD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,UAAU,CAAkB;gBAExB,eAAe,CAAC,EAAE,MAAM;IAMpC,OAAO,CAAC,WAAW;IAqCnB;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAkB/B,OAAO,CAAC,WAAW;IAUnB;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAanE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAc;IAEhD;;;OAGG;IACH,OAAO,CAAC,aAAa;IAUrB;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAU9D;;;OAGG;IACH,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAWjD;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAatE;;OAEG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAInD;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAQ7B;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAetD,kBAAkB,IAAI,MAAM;CAG7B"}
+{"version":3,"file":"secrets-manager.d.ts","sourceRoot":"","sources":["../../../src/yaml/secrets-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACnD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,UAAU,CAAkB;gBAExB,eAAe,CAAC,EAAE,MAAM;IAMpC,OAAO,CAAC,WAAW;IAqCnB;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAkB/B,OAAO,CAAC,WAAW;IAUnB;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAanE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAc;IAEhD;;;OAGG;IACH,OAAO,CAAC,aAAa;IAUrB;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAa9D;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IASjD;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAatE;;OAEG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAInD;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAQ7B;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAetD,kBAAkB,IAAI,MAAM;CAG7B"}

package/dist/src/yaml/secrets-manager.js

@@ -129,25 +129,36 @@ export class SecretsManager {
      * Get a secret value by variable name.
      * Workflow-specific value takes precedence over global.
      * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     *
+     * The stored data is consulted before that fallback, and not only when a
+     * file was loaded. `storeSecret` writes the file but cannot make it one this
+     * instance *loaded*, so a value collected by `ci init` on a repository that
+     * had no store — which is the only kind of run that collects anything — read
+     * back as absent from the instance that had just stored it. `ci init`'s own
+     * `getSecret('KEYSTORE_PROPERTIES', wf)`, which is how a workflow's keystore
+     * target is taken from `storeFile=`, returned undefined on every fresh
+     * repository because of it.
      */
     getSecret(name, workflow) {
-        if (!this.fileLoaded) {
-            return process.env[SecretsManager.ENV_PREFIX + name];
-        }
         if (workflow && this.data.workflows[workflow]?.[name] !== undefined) {
             return this.data.workflows[workflow][name];
         }
-        return this.data.global[name];
+        if (this.data.global[name] !== undefined) {
+            return this.data.global[name];
+        }
+        if (!this.fileLoaded) {
+            return process.env[SecretsManager.ENV_PREFIX + name];
+        }
+        return undefined;
     }
     /**
      * Get all secrets merged: global + workflow-specific (workflow overrides global).
-     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present —
+     * for the keys the store does not hold. See `getSecret`.
      */
     getAll(workflow) {
-        if (!this.fileLoaded) {
-            return this.getEnvSecrets();
-        }
-        const merged = { ...this.data.global };
+        const merged = this.fileLoaded ? {} : this.getEnvSecrets();
+        Object.assign(merged, this.data.global);
         if (workflow && this.data.workflows[workflow]) {
             Object.assign(merged, this.data.workflows[workflow]);
         }
@@ -155,19 +166,19 @@ export class SecretsManager {
     }
     /**
      * Returns the variable name if a secret exists for it, undefined otherwise.
-     * Checks workflow scope first, then global.
-     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     * Checks workflow scope first, then global, then the CIBUILD_-prefixed env
+     * vars when no secrets file is present. See `getSecret`.
      */
     getSecretIdByName(name, workflow) {
-        if (!this.fileLoaded) {
-            return process.env[SecretsManager.ENV_PREFIX + name] !== undefined ? name : undefined;
-        }
         if (workflow && this.data.workflows[workflow]?.[name] !== undefined) {
             return name;
         }
         if (this.data.global[name] !== undefined) {
             return name;
         }
+        if (!this.fileLoaded) {
+            return process.env[SecretsManager.ENV_PREFIX + name] !== undefined ? name : undefined;
+        }
         return undefined;
     }
     /**

package/dist/src/yaml/steps/cocoapods-skip-if-absent.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `cocoapods-install` can be asked to skip a project that has no Podfile.
+ *
+ * The default stays a hard failure, because a pipeline that names this step is
+ * asserting the project uses CocoaPods and a missing Podfile is a real error.
+ *
+ * The iOS template needs the other behaviour: it serves every iOS project and a
+ * large share of them resolve dependencies through Swift Package Manager, where
+ * "Podfile not found" would be a CocoaPods error in a project that does not use
+ * CocoaPods. Until this input existed the template could not use this step at
+ * all, so it ran `pod install` from an inline `script@1.0.0` — which put it out
+ * of reach of the refused-fetch retry this step carries. That is the gap this
+ * closes, and it is why the release order matters: this must ship before the
+ * template is pointed at the step, or every SPM-only iOS repo breaks.
+ */
+export {};
+//# sourceMappingURL=cocoapods-skip-if-absent.test.d.ts.map

package/dist/src/yaml/steps/cocoapods-skip-if-absent.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cocoapods-skip-if-absent.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cocoapods-skip-if-absent.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/src/yaml/steps/cocoapods-skip-if-absent.test.js

@@ -0,0 +1,132 @@
+/**
+ * `cocoapods-install` can be asked to skip a project that has no Podfile.
+ *
+ * The default stays a hard failure, because a pipeline that names this step is
+ * asserting the project uses CocoaPods and a missing Podfile is a real error.
+ *
+ * The iOS template needs the other behaviour: it serves every iOS project and a
+ * large share of them resolve dependencies through Swift Package Manager, where
+ * "Podfile not found" would be a CocoaPods error in a project that does not use
+ * CocoaPods. Until this input existed the template could not use this step at
+ * all, so it ran `pod install` from an inline `script@1.0.0` — which put it out
+ * of reach of the refused-fetch retry this step carries. That is the gap this
+ * closes, and it is why the release order matters: this must ship before the
+ * template is pointed at the step, or every SPM-only iOS repo breaks.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { CocoapodsInstallStepExecutor } from './ios-deps.js';
+import { testConfig } from './test-config.js';
+const build = async (inputs = {}) => {
+    const executor = new CocoapodsInstallStepExecutor();
+    const result = await executor.execute(inputs, {}, testConfig);
+    return result.script;
+};
+/** The body of the `if [ ! -f "Podfile" ]` branch, which is what changes. */
+const absentBranch = (script) => {
+    const lines = script.split('\n');
+    const start = lines.findIndex((l) => l.includes('if [ ! -f "Podfile" ]'));
+    expect(start).toBeGreaterThanOrEqual(0);
+    const end = lines.findIndex((l, i) => i > start && l.trim() === 'fi');
+    return lines.slice(start, end + 1).join('\n');
+};
+describe('by default a missing Podfile is still an error', () => {
+    test('exits non-zero', async () => {
+        expect(absentBranch(await build())).toContain('exit 1');
+    });
+    test('says what was not found', async () => {
+        expect(absentBranch(await build())).toContain('Podfile not found');
+    });
+    test('an explicit false is the same as omitting it', async () => {
+        expect(absentBranch(await build({ skip_if_absent: false }))).toContain('exit 1');
+    });
+});
+describe('skip_if_absent turns it into a clean no-op', () => {
+    test('exits zero instead of one', async () => {
+        const branch = absentBranch(await build({ skip_if_absent: true }));
+        expect(branch).toContain('exit 0');
+        expect(branch).not.toContain('exit 1');
+    });
+    test('says it skipped rather than that something failed', async () => {
+        const branch = absentBranch(await build({ skip_if_absent: true }));
+        expect(branch).toContain('skipping CocoaPods install');
+        expect(branch).not.toContain('Error');
+    });
+    test('still runs pod install when a Podfile IS present', async () => {
+        // The skip is a branch, not a mode — the rest of the step is untouched.
+        const script = await build({ skip_if_absent: true });
+        expect(script).toContain('POD_INVOCATION');
+        expect(script).toContain('$POD_INVOCATION $POD_CMD');
+    });
+    test('still wraps the pod fetch in the refused-fetch retry', async () => {
+        // This is the entire point of letting the template use the step.
+        const script = await build({ skip_if_absent: true });
+        expect(script).toContain('cibuild_fetch_was_refused');
+        expect(script).toContain('CIBUILD_FETCH_MAX_ATTEMPTS');
+    });
+    test('still chooses between bundle exec and bare pod', async () => {
+        const script = await build({ skip_if_absent: true });
+        expect(script).toContain('USE_BUNDLE_EXEC');
+        expect(script).toContain('bundle exec pod');
+    });
+});
+/**
+ * The inline script the template used did two things, not one: it skipped a
+ * project with no Podfile, AND it looked for that Podfile beside the Xcode
+ * project rather than at the repository root. Both have to exist as inputs or
+ * the template cannot be switched — about a quarter of iOS repositories keep
+ * the app one directory down, and template inputs interpolate variables, not
+ * `$(dirname …)`.
+ */
+describe('project_path finds the Podfile beside the project', () => {
+    test('changes into the project directory, not the repo root', async () => {
+        const script = await build({ project_path: 'ios/MyApp.xcworkspace' });
+        expect(script).toContain(`WORK_DIR="$(dirname 'ios/MyApp.xcworkspace')"`);
+        expect(script).toContain('cd "$WORK_DIR"');
+    });
+    test('does not fall back to CIBUILD_SOURCE_DIR when it is given', async () => {
+        const script = await build({ project_path: 'ios/MyApp.xcworkspace' });
+        expect(script).not.toContain('cd "$CIBUILD_SOURCE_DIR"');
+    });
+    test('still falls back to CIBUILD_SOURCE_DIR when nothing is given', async () => {
+        expect(await build()).toContain('cd "$CIBUILD_SOURCE_DIR"');
+    });
+    test('an explicit source_root_path still wins over project_path', async () => {
+        const script = await build({
+            project_path: 'ios/MyApp.xcworkspace',
+            source_root_path: 'somewhere/else',
+        });
+        expect(script).toContain(`cd 'somewhere/else'`);
+        expect(script).not.toContain('dirname');
+    });
+    test('composes with skip_if_absent, which is how the template uses it', async () => {
+        const script = await build({ project_path: 'ios/MyApp.xcworkspace', skip_if_absent: true });
+        expect(script).toContain(`WORK_DIR="$(dirname 'ios/MyApp.xcworkspace')"`);
+        expect(absentBranch(script)).toContain('exit 0');
+        expect(script).toContain('cibuild_fetch_was_refused');
+    });
+});
+/**
+ * The exact input combination the iOS template sends. Pinned here because the
+ * template lives in another repository and deploys on a different cadence, so
+ * nothing else would notice this step drifting away from what it sends.
+ */
+describe('the iOS template combination', () => {
+    const templateInputs = {
+        project_path: 'MyApp.xcworkspace',
+        skip_if_absent: true,
+        command: 'install --repo-update',
+    };
+    test('produces pod install --repo-update, flags intact', async () => {
+        const script = await build(templateInputs);
+        expect(script).toContain('POD_CMD="install --repo-update"');
+    });
+    test('runs that under the refused-fetch retry, exactly once', async () => {
+        const script = await build(templateInputs);
+        expect(script).toContain('$POD_INVOCATION $POD_CMD');
+        expect(script.split('CIBUILD_FETCH_MAX_ATTEMPTS=').length - 1).toBe(1);
+    });
+    test('skips instead of failing when the repo has no Podfile', async () => {
+        expect(absentBranch(await build(templateInputs))).toContain('exit 0');
+    });
+});
+//# sourceMappingURL=cocoapods-skip-if-absent.test.js.map

package/dist/src/yaml/steps/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4CH;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CA07C7C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA4CH;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAq8C7C"}

package/dist/src/yaml/steps/index.js

@@ -451,11 +451,20 @@ export function initializeStepRegistry() {
                 description: 'Explicit path to Podfile',
                 required: false,
             },
+            project_path: {
+                description: 'A .xcodeproj/.xcworkspace whose directory holds the Podfile. For repositories that keep the app one directory down from the root.',
+                required: false,
+            },
             verbose: {
                 description: 'Enable verbose CocoaPods logging',
                 required: false,
                 default: false,
             },
+            skip_if_absent: {
+                description: 'Succeed and do nothing when there is no Podfile, instead of failing. For pipelines that serve every iOS project, where plenty use Swift Package Manager and have no Podfile.',
+                required: false,
+                default: false,
+            },
         },
     });
     registerStep('carthage', new CarthageStepExecutor(), {

package/dist/src/yaml/steps/ios-deps.d.ts

@@ -11,8 +11,43 @@ export interface CocoapodsInstallInputs {
     source_root_path?: string;
     /** Explicit path to Podfile (overrides source_root_path) */
     podfile_path?: string;
+    /**
+     * A .xcodeproj/.xcworkspace whose DIRECTORY holds the Podfile.
+     *
+     * About a quarter of iOS repositories keep the app one directory down from
+     * the repository root, and the Podfile is down there with it — so "run pod
+     * install at the root" is wrong for them. A caller that already knows where
+     * the project is should not have to compute its directory separately, and a
+     * pipeline template cannot: template inputs interpolate variables, not
+     * `$(dirname …)`, so `source_root_path` alone could not express it and the
+     * iOS template had to run `pod install` from an inline script to get at
+     * `dirname`. That inline script is what put it out of reach of the
+     * refused-fetch retry.
+     *
+     * Only the directory is used; the file itself need not exist.
+     *
+     * Precedence, most specific first: podfile_path, source_root_path,
+     * project_path, then $CIBUILD_SOURCE_DIR.
+     */
+    project_path?: string;
     /** Enable verbose CocoaPods logging */
     verbose?: boolean;
+    /**
+     * Succeed and do nothing when there is no Podfile, instead of failing.
+     *
+     * Defaults to false, which keeps the contract every existing caller was
+     * written against: a pipeline that names this step is asserting the project
+     * uses CocoaPods, and a missing Podfile is a real error worth stopping for.
+     *
+     * The iOS template is the caller that needs the other behaviour. It serves
+     * every iOS project, and a large share of them resolve dependencies through
+     * Swift Package Manager and have no Podfile at all — for those, "Podfile not
+     * found" is a CocoaPods error in a project that does not use CocoaPods.
+     * Until this existed the template could not use this step, and so ran
+     * `pod install` from an inline script instead, out of reach of the
+     * refused-fetch retry that this step carries.
+     */
+    skip_if_absent?: boolean;
 }
 /**
  * Runs `pod install` or `pod update`.

package/dist/src/yaml/steps/ios-deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ios-deps.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/ios-deps.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAc,MAAM,wBAAwB,CAAC;AAMhF,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,gBAAgB;IAChE,yBAAyB,CACvB,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAUpB,OAAO,CACX,MAAM,EAAE,sBAAsB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CAkFpB;AAMD,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;IACxD,yBAAyB,CACvB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAUpB,OAAO,CACX,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CAyDpB"}
+{"version":3,"file":"ios-deps.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/ios-deps.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAc,MAAM,wBAAwB,CAAC;AAMhF,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,gBAAgB;IAChE,yBAAyB,CACvB,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAUpB,OAAO,CACX,MAAM,EAAE,sBAAsB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CA+FpB;AAMD,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;IACxD,yBAAyB,CACvB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAUpB,OAAO,CACX,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CAyDpB"}

package/dist/src/yaml/steps/ios-deps.js

@@ -19,7 +19,9 @@ export class CocoapodsInstallStepExecutor extends BaseStepExecutor {
         const command = this.getInput(inputs, 'command', 'install');
         const sourceRootPath = this.getInput(inputs, 'source_root_path', '');
         const podfilePath = this.getInput(inputs, 'podfile_path', '');
+        const projectPath = this.getInput(inputs, 'project_path', '');
         const verbose = this.getInput(inputs, 'verbose', false);
+        const skipIfAbsent = this.getInput(inputs, 'skip_if_absent', false);
         const commands = [];
         commands.push('# cocoapods-install');
         commands.push('echo "🔧 Running CocoaPods..."');
@@ -33,6 +35,11 @@ export class CocoapodsInstallStepExecutor extends BaseStepExecutor {
         else if (sourceRootPath) {
             commands.push(`cd '${this.escapeBash(sourceRootPath)}'`);
         }
+        else if (projectPath) {
+            commands.push('# Podfile sits beside the Xcode project, not at the repo root');
+            commands.push(`WORK_DIR="$(dirname '${this.escapeBash(projectPath)}')"`);
+            commands.push('cd "$WORK_DIR"');
+        }
         else {
             commands.push('# Use CIBUILD_SOURCE_DIR if set, otherwise current directory');
             commands.push('if [ -n "$CIBUILD_SOURCE_DIR" ]; then');
@@ -40,10 +47,18 @@ export class CocoapodsInstallStepExecutor extends BaseStepExecutor {
             commands.push('fi');
         }
         commands.push('');
-        // Check for Podfile
+        // Check for Podfile. Absent is either a hard error or a clean no-op,
+        // depending on whether the caller is asserting "this project uses
+        // CocoaPods" or asking "use CocoaPods if this project does".
         commands.push('if [ ! -f "Podfile" ]; then');
-        commands.push('  echo "❌ Error: Podfile not found in $(pwd)"');
-        commands.push('  exit 1');
+        if (skipIfAbsent) {
+            commands.push('  echo "No Podfile in $(pwd) — skipping CocoaPods install."');
+            commands.push('  exit 0');
+        }
+        else {
+            commands.push('  echo "❌ Error: Podfile not found in $(pwd)"');
+            commands.push('  exit 1');
+        }
         commands.push('fi');
         commands.push('');
         // Determine whether to use bundle exec

package/dist/src/yaml/steps/xcode-derived-data.test.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Products go under a derived data path, never into one flat directory.
+ *
+ * `CONFIGURATION_BUILD_DIR` overrides the per-configuration/per-platform
+ * product separation xcodebuild provides under
+ * `DerivedData/Build/Products/<config>-<platform>/`, flattening every target in
+ * the graph into a single directory. Two build tasks for the same target then
+ * declare the same absolute output path and xcodebuild refuses the entire build
+ * with "Multiple commands produce". The notes it prints name the SAME target
+ * twice, which is the tell: one target built twice into one directory, not two
+ * packages colliding on a name.
+ *
+ * Measured 2026-09-09 on the iOS corpus rows, all on the template's must-pass
+ * "Build App" step: 16 collisions on jellyfin/Swiftfin, 266 on
+ * Automattic/pocket-casts-ios, 425 on home-assistant/iOS.
+ *
+ * A fourth row failed differently for the same reason. CocoaPods derives
+ * `PODS_CONFIGURATION_BUILD_DIR` from `BUILD_DIR`, which `CONFIGURATION_BUILD_DIR`
+ * does NOT override — so pod products land in the flat directory while every
+ * generated copy-resources script and linker search path still points into
+ * DerivedData. shenruisi/Stay reported "Resource SDWebImage.bundle not found.
+ * Run pod install" for a bundle that had been built two directories away.
+ *
+ * Proved by control on a runner guest, same repo and image and flags with only
+ * this setting differing: `CONFIGURATION_BUILD_DIR` reproduced the collision and
+ * exit 65 with no .app, `-derivedDataPath` reached BUILD SUCCEEDED in 2m06s and
+ * left both `Debug` and `Debug-iphonesimulator` under Products.
+ */
+export {};
+//# sourceMappingURL=xcode-derived-data.test.d.ts.map

package/dist/src/yaml/steps/xcode-derived-data.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xcode-derived-data.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/xcode-derived-data.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG"}