@invarn/cibuild 2.7.4 → 2.7.5

package/dist/src/commands/each-flavor-is-asked-for-its-own-properties-file.test.js

@@ -0,0 +1,196 @@
+/**
+ * `ci init` asks once per flavor for the properties file the Secrets Gradle
+ * Plugin reads, and stores the answer against that flavor's workflows.
+ *
+ * The generator now declares this credential once per workflow when the
+ * workflows build different flavors, because two flavors are two environments
+ * and one value cannot serve both. Collection had not moved: `collectFileSecret`
+ * was called with a single group labelled *"every workflow"*, so `ci init`
+ * asked once and stored the same bytes against `primary`, `pull-request` and
+ * `release`. The declaration would then say three values are needed and the
+ * store would hold one, three times.
+ *
+ * The machinery for this was already there. `collectFileSecret` takes
+ * `workflowGroups`, prompts per group, and stores per workflow — that is how
+ * the keystore has always collected a debug key and a release key separately.
+ * The properties file was the one credential passing it a single group.
+ *
+ * What matters more than the split is that it is the *same* split: `ci init`
+ * groups by exactly the discriminator `credentialSlots` declares by, so the
+ * question asked and the slot declared cannot drift apart. One group means one
+ * slot and one question; two groups mean one slot per workflow and a question
+ * per group. That invariant is asserted directly rather than left to two
+ * copies of the same rule staying in step.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import prompts from 'prompts';
+import { collectionGroups, credentialSlots, propertiesFileGroups, variantFlavors, } from './build.js';
+import { collectFileSecret } from './file-secret-collector.js';
+import { SecretsManager } from '../yaml/secrets-manager.js';
+function variant(name) {
+    const buildType = name.charAt(0).toUpperCase() + name.slice(1);
+    return { variant: name, buildType, gradleTask: `assemble${buildType}` };
+}
+const FLAVORED = {
+    primary: variant('ciDynamicDebug'),
+    pullRequest: variant('ciDynamicDebug'),
+    release: variant('prodRelease'),
+};
+const UNFLAVORED = {
+    primary: variant('debug'),
+    pullRequest: variant('debug'),
+    release: variant('release'),
+};
+const FLAVORS = ['ciDynamic', 'prod'];
+const CI_DYNAMIC = 'BASE_API_URL=https://ci-dynamic.example.test/api\n';
+const PROD = 'BASE_API_URL=https://prod.example.test/api\n';
+describe('the groups a credential is collected in', () => {
+    test('are one when every workflow wants the same bytes', () => {
+        const groups = collectionGroups({ primary: 'ciDynamic', 'pull-request': 'ciDynamic', release: 'ciDynamic' }, () => 'every workflow');
+        expect(groups).toEqual([
+            { label: 'every workflow', workflows: ['primary', 'pull-request', 'release'], discriminator: 'ciDynamic' },
+        ]);
+    });
+    test('are one per distinct value, keeping the workflows that agree together', () => {
+        const groups = collectionGroups({ primary: 'ciDynamic', 'pull-request': 'ciDynamic', release: 'prod' }, (flavor) => flavor);
+        expect(groups).toEqual([
+            { label: 'ciDynamic', workflows: ['primary', 'pull-request'], discriminator: 'ciDynamic' },
+            { label: 'prod', workflows: ['release'], discriminator: 'prod' },
+        ]);
+    });
+    test('split exactly when the declaration splits', () => {
+        // Two copies of one rule is one copy too many. If these ever disagree,
+        // `ci init` asks a question the pipeline has no slot for, or declares a
+        // slot nothing on the machine was ever collected into.
+        const maps = [
+            { primary: '', 'pull-request': '', release: '' },
+            { primary: 'ciDynamic', 'pull-request': 'ciDynamic', release: 'prod' },
+            { primary: 'a', 'pull-request': 'b', release: 'c' },
+            { release: 'keystore.properties' },
+            { primary: 'app/one.jks', 'pull-request': 'app/one.jks', release: 'app/one.jks' },
+        ];
+        expect(maps.map((map) => ({
+            groups: collectionGroups(map, (d) => d).length === 1,
+            oneFlatSlot: credentialSlots('X', map).length === 1,
+        }))).toEqual([
+            { groups: true, oneFlatSlot: true },
+            { groups: false, oneFlatSlot: false },
+            { groups: false, oneFlatSlot: false },
+            { groups: true, oneFlatSlot: true },
+            { groups: true, oneFlatSlot: true },
+        ]);
+    });
+});
+describe('the groups the properties file is collected in', () => {
+    test('are one per flavor, and say which flavor', () => {
+        const groups = propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS));
+        expect(groups.map((g) => ({ label: g.label, workflows: g.workflows }))).toEqual([
+            { label: 'the ciDynamic flavor (primary, pull-request)', workflows: ['primary', 'pull-request'] },
+            { label: 'the prod flavor (release)', workflows: ['release'] },
+        ]);
+    });
+    test('are one, labelled as they were, on a repository with no flavors', () => {
+        // The label is what the prompt says out loud, and this is the wording
+        // every unflavored repository has always seen.
+        expect(propertiesFileGroups(variantFlavors(UNFLAVORED, []))).toEqual([
+            { label: 'every workflow', workflows: ['primary', 'pull-request', 'release'], discriminator: '' },
+        ]);
+    });
+    test('are one when three workflows build three variants of one flavor', () => {
+        const oneFlavor = {
+            primary: variant('ciDynamicDebug'),
+            pullRequest: variant('ciDynamicDebug'),
+            release: variant('ciDynamicRelease'),
+        };
+        expect(propertiesFileGroups(variantFlavors(oneFlavor, FLAVORS))).toHaveLength(1);
+    });
+});
+describe('collecting a value for each group', () => {
+    let workdir;
+    let secretsManager;
+    // `prompts.inject` *concatenates*, so an empty array clears nothing and a
+    // sentinel one test leaves queued becomes the next test's answer. The queue
+    // itself is the only reset there is.
+    const clearInjected = () => {
+        prompts._injected = undefined;
+    };
+    beforeEach(() => {
+        clearInjected();
+        workdir = mkdtempSync(join(tmpdir(), 'cibuild-flavor-properties-'));
+        workdir = resolve(workdir);
+        secretsManager = new SecretsManager(join(workdir, '.cibuild-secrets.json'));
+    });
+    afterEach(() => {
+        clearInjected();
+        rmSync(workdir, { recursive: true, force: true });
+    });
+    function put(relPath, contents) {
+        const full = join(workdir, relPath);
+        mkdirSync(join(full, '..'), { recursive: true });
+        writeFileSync(full, contents, 'utf-8');
+        return full;
+    }
+    async function collect(groups, ni = false) {
+        return collectFileSecret({
+            displayName: 'local.properties',
+            secretName: 'LOCAL_PROPERTIES',
+            fileMatch: (name) => name === 'local.properties',
+            readAs: 'text',
+            workflowGroups: groups,
+        }, workdir, secretsManager, ni);
+    }
+    test('stores a different value against the workflows of each flavor', async () => {
+        const ciDynamicFile = put('local.properties', CI_DYNAMIC);
+        const prodFile = put('envs/prod/local.properties', PROD);
+        prompts.inject([ciDynamicFile, prodFile]);
+        await collect(propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS)));
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'primary')).toBe(CI_DYNAMIC);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'pull-request')).toBe(CI_DYNAMIC);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'release')).toBe(PROD);
+    });
+    test('stores them where `ci secrets upload` will encode them per workflow', async () => {
+        const ciDynamicFile = put('local.properties', CI_DYNAMIC);
+        const prodFile = put('envs/prod/local.properties', PROD);
+        prompts.inject([ciDynamicFile, prodFile]);
+        await collect(propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS)));
+        // Not `global`. A global value would satisfy all three workflows and the
+        // upload would push one flat key, which is the bug this closes.
+        const stored = JSON.parse(readFileSync(join(workdir, '.cibuild-secrets.json'), 'utf-8'));
+        expect(stored.global).toEqual({});
+        expect(Object.keys(stored.workflows).sort()).toEqual(['primary', 'pull-request', 'release']);
+    });
+    test('asks nothing at all when one group meets one file', async () => {
+        // Today's behaviour on every unflavored repository, unchanged: a single
+        // group and a single candidate auto-apply. The injected answer is
+        // unreadable on purpose — if a prompt fired, nothing would be stored.
+        put('local.properties', CI_DYNAMIC);
+        prompts.inject(['/nonexistent/would-be-a-prompt']);
+        await collect(propertiesFileGroups(variantFlavors(UNFLAVORED, [])));
+        for (const workflow of ['primary', 'pull-request', 'release']) {
+            expect(secretsManager.getSecret('LOCAL_PROPERTIES', workflow)).toBe(CI_DYNAMIC);
+        }
+    });
+    test('gives every group the same file when it cannot ask', async () => {
+        // `ci init --create` runs non-interactive. One file is all it can offer,
+        // and a wrong-flavored properties file that the user then corrects beats
+        // no properties file at all, which is a build that cannot configure.
+        put('local.properties', CI_DYNAMIC);
+        await collect(propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS)), true);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'primary')).toBe(CI_DYNAMIC);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'release')).toBe(CI_DYNAMIC);
+    });
+    test('leaves a group alone once its value is already stored', async () => {
+        put('local.properties', CI_DYNAMIC);
+        put('envs/prod/local.properties', PROD);
+        secretsManager.storeSecret('LOCAL_PROPERTIES', PROD, 'release');
+        // One answer, for the one group still pending.
+        prompts.inject([join(workdir, 'local.properties')]);
+        await collect(propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS)));
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'primary')).toBe(CI_DYNAMIC);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'release')).toBe(PROD);
+    });
+});
+//# sourceMappingURL=each-flavor-is-asked-for-its-own-properties-file.test.js.map

package/dist/src/commands/file-secret-collector.d.ts

@@ -10,6 +10,19 @@ export interface FileSecretConfig {
     secretName: string;
     /** Returns true if a filename matches (e.g. name === "google-services.json") */
     fileMatch: (name: string) => boolean;
+    /**
+     * Narrows the candidates by their path relative to the project root, once
+     * `fileMatch` has found them by name.
+     *
+     * A credential Android keeps one copy of per product flavor has the same
+     * basename in every source set — four `google-services.json` under
+     * `app/`, `app/src/dev/`, `app/src/prod/` and `app/src/ciDynamic/` — so a
+     * name is not enough to say which one a workflow needs. Without this the
+     * single-candidate auto-apply below never fires on a flavored repository,
+     * and the answer comes from a prompt or from whichever the walk reached
+     * first.
+     */
+    pathMatch?: (relativePath: string) => boolean;
     /** How to read the file into a string value. Defaults to "text". */
     readAs?: "text" | "base64";
     /** Workflow groups to scope the secret to */

package/dist/src/commands/file-secret-collector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-secret-collector.d.ts","sourceRoot":"","sources":["../../../src/commands/file-secret-collector.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3B,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAMrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,EAAE,CAkBxF;AAiDD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,EAC9B,cAAc,UAAQ,GACrB,OAAO,CAAC,eAAe,CAAC,CAuH1B"}
+{"version":3,"file":"file-secret-collector.d.ts","sourceRoot":"","sources":["../../../src/commands/file-secret-collector.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9C,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3B,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAMrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,EAAE,CAkBxF;AAiDD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,EAC9B,cAAc,UAAQ,GACrB,OAAO,CAAC,eAAe,CAAC,CA0H1B"}

package/dist/src/commands/file-secret-collector.js

@@ -1,4 +1,4 @@
-import { resolve, relative } from "node:path";
+import { resolve, relative, sep } from "node:path";
 import { readdirSync, readFileSync } from "node:fs";
 import * as readline from "node:readline";
 import prompts from "prompts";
@@ -87,7 +87,8 @@ export async function collectFileSecret(config, cwd, secretsManager, nonInteract
     const readContent = (p) => config.readAs === "base64"
         ? readFileSync(p).toString("base64")
         : readFileSync(p, "utf-8");
-    const candidates = findProjectFiles(cwd, config.fileMatch);
+    const relativeToCwd = (p) => relative(cwd, p).split(sep).join("/");
+    const candidates = findProjectFiles(cwd, config.fileMatch).filter((p) => config.pathMatch?.(relativeToCwd(p)) ?? true);
     if (candidates.length === 1 && config.workflowGroups.length === 1) {
         // Single file, single-group config — auto-apply without prompting
         const content = readContent(candidates[0]);

package/dist/src/commands/local-properties-reaches-every-workflow.test.js

@@ -37,6 +37,8 @@ const BASE = {
     googlePlayPackageName: '',
     artifactType: 'apk',
     keystorePaths: {},
+    googleServicesPaths: {},
+    workflowFlavors: {},
     secretsProperties: false,
     secretsPropertiesPath: 'local.properties',
 };

package/dist/src/yaml/a-cache-path-must-not-swallow-a-credential.test.d.ts

@@ -0,0 +1,28 @@
+/**
+ * A `cache_paths` entry must not contain the file a `file@` step writes.
+ *
+ * Everything else about a credential's life inside a build is bounded, and was
+ * checked on the three boxes after the first build that ever wrote one: the
+ * runner pushes the checkout and the guest root onto `cleanupPaths` and
+ * removes them in a `finally`, the guest gets `rm -rf`, and `tart delete`
+ * reclaims the VM. Nothing was left anywhere.
+ *
+ * The cache store is the one place a file can survive all of that.
+ * `cache-push` archives whatever `cache_paths` names and uploads it to where
+ * the *next* build pulls it from, so a credential swept into that archive
+ * outlives the build it was delivered to — and outlives the sandbox that was
+ * supposed to contain it.
+ *
+ * No pipeline in play trips this. Every one of them caches
+ * `~/.gradle/caches`, `~/.gradle/wrapper` and `.gradle`, and none of those
+ * holds a credential. It is a guard on a mistake that is easy to make and
+ * invisible once made: adding `.` to `cache_paths` is a plausible way to make
+ * a build faster, and it would publish the signing key.
+ *
+ * Refused at generation time, like issue 03's missing credential, because that
+ * is the only place that can see a whole workflow at once — a cache step can
+ * be written before the `file@` step whose target it would swallow — and
+ * because the alternative is a build that goes green while leaking.
+ */
+export {};
+//# sourceMappingURL=a-cache-path-must-not-swallow-a-credential.test.d.ts.map

package/dist/src/yaml/a-cache-path-must-not-swallow-a-credential.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-cache-path-must-not-swallow-a-credential.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-cache-path-must-not-swallow-a-credential.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}

package/dist/src/yaml/a-cache-path-must-not-swallow-a-credential.test.js

@@ -0,0 +1,223 @@
+/**
+ * A `cache_paths` entry must not contain the file a `file@` step writes.
+ *
+ * Everything else about a credential's life inside a build is bounded, and was
+ * checked on the three boxes after the first build that ever wrote one: the
+ * runner pushes the checkout and the guest root onto `cleanupPaths` and
+ * removes them in a `finally`, the guest gets `rm -rf`, and `tart delete`
+ * reclaims the VM. Nothing was left anywhere.
+ *
+ * The cache store is the one place a file can survive all of that.
+ * `cache-push` archives whatever `cache_paths` names and uploads it to where
+ * the *next* build pulls it from, so a credential swept into that archive
+ * outlives the build it was delivered to — and outlives the sandbox that was
+ * supposed to contain it.
+ *
+ * No pipeline in play trips this. Every one of them caches
+ * `~/.gradle/caches`, `~/.gradle/wrapper` and `.gradle`, and none of those
+ * holds a credential. It is a guard on a mistake that is easy to make and
+ * invisible once made: adding `.` to `cache_paths` is a plausible way to make
+ * a build faster, and it would publish the signing key.
+ *
+ * Refused at generation time, like issue 03's missing credential, because that
+ * is the only place that can see a whole workflow at once — a cache step can
+ * be written before the `file@` step whose target it would swallow — and
+ * because the alternative is a build that goes green while leaking.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { cacheEntryContains, credentialsSwallowedByCache, swallowedCredentialMessage, convertYAMLToPipelineDef, YAMLConversionError, } from './converter.js';
+import { clearRegistry, registerStep } from './steps/registry.js';
+import { FileStepExecutor } from './steps/file.js';
+import { CachePullStepExecutor, CachePushStepExecutor } from './steps/cache.js';
+const KEYSTORE = {
+    targetPath: 'app/customer-android.jks',
+    varName: 'KEYSTORE_BASE64',
+};
+const PROPERTIES = {
+    targetPath: 'local.properties',
+    varName: 'LOCAL_PROPERTIES',
+};
+function cache(...cachePaths) {
+    return [{ stepName: 'cache-push', cachePaths }];
+}
+describe('which cache entries reach a credential', () => {
+    test('the checkout root reaches everything in it', () => {
+        for (const root of ['.', './', './/']) {
+            expect(cacheEntryContains(root, 'app/customer-android.jks')).toBe(true);
+            expect(cacheEntryContains(root, 'local.properties')).toBe(true);
+        }
+    });
+    test('a directory reaches what is under it, and nothing beside it', () => {
+        expect(cacheEntryContains('app', 'app/customer-android.jks')).toBe(true);
+        expect(cacheEntryContains('app/', 'app/customer-android.jks')).toBe(true);
+        expect(cacheEntryContains('./app', 'app/customer-android.jks')).toBe(true);
+        // `application/` is a different directory that merely shares a prefix.
+        expect(cacheEntryContains('app', 'application/customer-android.jks')).toBe(false);
+        expect(cacheEntryContains('.gradle', 'local.properties')).toBe(false);
+    });
+    test('an entry that is the credential itself reaches it', () => {
+        expect(cacheEntryContains('local.properties', 'local.properties')).toBe(true);
+    });
+    test('an absolute or home-rooted entry reaches nothing in the checkout', () => {
+        // `cache.ts` classifies these as absolute and stores them from the
+        // filesystem root, so they are somewhere the checkout is not — which is
+        // why every real pipeline's Gradle caches are safe.
+        for (const outside of ['~/.gradle/caches', '~/.gradle/wrapper', '/var/tmp/x']) {
+            expect(cacheEntryContains(outside, 'app/customer-android.jks')).toBe(false);
+            expect(cacheEntryContains(outside, 'local.properties')).toBe(false);
+        }
+    });
+});
+describe('the credentials a workflow would archive', () => {
+    test('are none for the paths every real pipeline caches', () => {
+        expect(credentialsSwallowedByCache([KEYSTORE, PROPERTIES], cache('~/.gradle/caches', '~/.gradle/wrapper', '.gradle'))).toEqual([]);
+    });
+    test('are every one of them when the entry is the checkout root', () => {
+        const found = credentialsSwallowedByCache([KEYSTORE, PROPERTIES], cache('.'));
+        expect(found.map((f) => f.varName)).toEqual(['KEYSTORE_BASE64', 'LOCAL_PROPERTIES']);
+        expect(found[0]).toEqual({
+            stepName: 'cache-push',
+            cachePath: '.',
+            targetPath: 'app/customer-android.jks',
+            varName: 'KEYSTORE_BASE64',
+        });
+    });
+    test('are only the ones the entry actually reaches', () => {
+        const found = credentialsSwallowedByCache([KEYSTORE, PROPERTIES], cache('app'));
+        expect(found.map((f) => f.varName)).toEqual(['KEYSTORE_BASE64']);
+    });
+    test('are found on a pull step as readily as a push step', () => {
+        // `cache-pull` names the same paths, and a pipeline that pulls a directory
+        // it also pushes is the normal shape — so naming the step that declared it
+        // is what makes the message actionable.
+        const found = credentialsSwallowedByCache([PROPERTIES], [
+            { stepName: 'cache-pull', cachePaths: ['.'] },
+        ]);
+        expect(found[0].stepName).toBe('cache-pull');
+    });
+    test('are none when the workflow writes no credential at all', () => {
+        expect(credentialsSwallowedByCache([], cache('.'))).toEqual([]);
+    });
+});
+describe('what the refusal tells the author', () => {
+    test('names the workflow, the entry, the file and the secret', () => {
+        const [swallowed] = credentialsSwallowedByCache([KEYSTORE], cache('.'));
+        const message = swallowedCredentialMessage('primary', swallowed);
+        expect(message).toContain('primary');
+        expect(message).toContain('cache-push');
+        expect(message).toContain('cache_paths');
+        expect(message).toContain('app/customer-android.jks');
+        expect(message).toContain('KEYSTORE_BASE64');
+        // And why it matters, not only that it is refused.
+        expect(message).toContain('outlives the build');
+    });
+});
+// ─── Through the real converter ───────────────────────────────────────────
+const mockConfig = {
+    artifactsDir: '/test/artifacts',
+    maxConcurrentJobs: 1,
+    paths: {
+        buildsDir: '/test/builds',
+        cacheDir: '/test/cache',
+        derivedDataDir: '/test/derived-data',
+    },
+    interpreters: {
+        bash: '/bin/bash',
+        python: 'python3',
+        ruby: 'ruby',
+        node: 'node',
+    },
+};
+let workdir;
+let previousCwd;
+beforeEach(() => {
+    clearRegistry();
+    registerStep('file', new FileStepExecutor());
+    registerStep('cache-pull', new CachePullStepExecutor());
+    registerStep('cache-push', new CachePushStepExecutor());
+    previousCwd = process.cwd();
+    workdir = mkdtempSync(join(tmpdir(), 'cibuild-cache-credential-'));
+    process.chdir(workdir);
+    workdir = process.cwd();
+    process.env.LOCAL_PROPERTIES = 'sdk.dir=/opt/android-sdk\n';
+});
+afterEach(() => {
+    process.chdir(previousCwd);
+    rmSync(workdir, { recursive: true, force: true });
+    clearRegistry();
+    delete process.env.LOCAL_PROPERTIES;
+});
+/** A workflow that writes a credential and then caches `cachePaths`. */
+function pipelineCaching(cachePaths) {
+    return {
+        format_version: '1',
+        app: { envs: [{ LOCAL_PROPERTIES: '' }] },
+        workflows: {
+            primary: {
+                steps: [
+                    {
+                        'file@1.0.0': {
+                            title: 'Setup local.properties',
+                            is_skippable: true,
+                            inputs: { target_path: 'local.properties', var_name: 'LOCAL_PROPERTIES' },
+                        },
+                    },
+                    {
+                        'cache-push@1.0.0': {
+                            inputs: { cache_key: 'gradle-app', cache_paths: cachePaths },
+                        },
+                    },
+                ],
+            },
+        },
+    };
+}
+describe('converting a workflow whose cache would archive a credential', () => {
+    test('refuses, rather than building green and publishing the file', async () => {
+        await expect(convertYAMLToPipelineDef(pipelineCaching(['.']), mockConfig, 'primary')).rejects.toBeInstanceOf(YAMLConversionError);
+        await expect(convertYAMLToPipelineDef(pipelineCaching(['.']), mockConfig, 'primary')).rejects.toThrow(/local\.properties/);
+    });
+    test('refuses when the cache step is written before the file step', async () => {
+        // Order cannot be the test: an author is free to pull a cache first, and
+        // the cache still ends up holding whatever the later step wrote.
+        const reordered = {
+            format_version: '1',
+            app: { envs: [{ LOCAL_PROPERTIES: '' }] },
+            workflows: {
+                primary: {
+                    steps: [
+                        { 'cache-pull@1.0.0': { inputs: { cache_key: 'k', cache_paths: ['.'] } } },
+                        {
+                            'file@1.0.0': {
+                                is_skippable: true,
+                                inputs: { target_path: 'local.properties', var_name: 'LOCAL_PROPERTIES' },
+                            },
+                        },
+                    ],
+                },
+            },
+        };
+        await expect(convertYAMLToPipelineDef(reordered, mockConfig, 'primary')).rejects.toThrow(/LOCAL_PROPERTIES/);
+    });
+    test('converts the paths every real pipeline caches, untouched', async () => {
+        const result = await convertYAMLToPipelineDef(pipelineCaching(['~/.gradle/caches', '~/.gradle/wrapper', '.gradle']), mockConfig, 'primary');
+        expect(result.pipeline.steps).toHaveLength(2);
+        expect(result.warnings).toEqual([]);
+    });
+    test('leaves a workflow with no credential alone, whatever it caches', async () => {
+        const noCredential = {
+            format_version: '1',
+            workflows: {
+                primary: {
+                    steps: [{ 'cache-push@1.0.0': { inputs: { cache_key: 'k', cache_paths: ['.'] } } }],
+                },
+            },
+        };
+        const result = await convertYAMLToPipelineDef(noCredential, mockConfig, 'primary');
+        expect(result.pipeline.steps).toHaveLength(1);
+    });
+});
+//# sourceMappingURL=a-cache-path-must-not-swallow-a-credential.test.js.map

package/dist/src/yaml/a-declared-slot-may-name-the-workflow-it-belongs-to.test.d.ts

@@ -0,0 +1,37 @@
+/**
+ * A pipeline may declare a credential slot under the name a *workflow-scoped*
+ * secret carries, and the workflow it names reads it under the plain name.
+ *
+ * Two workflows that build different product flavors cannot share one value.
+ * `local.properties` is the clearest case: every workflow writes the same file
+ * to the same path, and what belongs in it is the flavor's environment — a
+ * different base API URL and twenty other keys the Secrets Gradle Plugin turns
+ * into `BuildConfig`. One slot, one value, and one of the two flavors builds
+ * against the wrong environment.
+ *
+ * The value side of that has always worked. `ci secrets upload` encodes a
+ * workflow-scoped secret as `CIBUILD_SW__<WORKFLOW>__<VAR>`, `SecretsManager`
+ * decodes it back, and `EnvResolver` asks for the workflow being run — proved
+ * end to end on the dispatch path, where a fresh clone has no
+ * `.cibuild-secrets.json` and the value arrives as a bare environment
+ * variable. What did not work is *declaring* it. A pipeline declares its
+ * credentials as empty `envs` slots, and that declaration does two jobs
+ * nothing else does:
+ *
+ *   - `unsetEnvKeys` — what `invarn setup` searches the developer's machine
+ *     by — reads `envs`, never step inputs. An undeclared credential is never
+ *     discovered and never offered for upload.
+ *   - `file@1.0.0` tells "nobody supplied this" from "this workflow does not
+ *     need it" by whether the key is in the env map at all, and only a
+ *     declaration puts an unsupplied key there. Without one, a credential that
+ *     went missing is skipped with a warning and the build fails later inside
+ *     the project's own build tool (issue 03).
+ *
+ * So a per-workflow slot has to be declarable, and a declaration naming one
+ * workflow has to mean nothing in the others — otherwise `release` would
+ * demand `primary`'s value. The decoding belongs here, beside the decoding of
+ * the secret itself, and not in `file@`: the step keeps reading its plain
+ * `var_name` and never learns the convention exists.
+ */
+export {};
+//# sourceMappingURL=a-declared-slot-may-name-the-workflow-it-belongs-to.test.d.ts.map

package/dist/src/yaml/a-declared-slot-may-name-the-workflow-it-belongs-to.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-declared-slot-may-name-the-workflow-it-belongs-to.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-declared-slot-may-name-the-workflow-it-belongs-to.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG"}