@invarn/cibuild 2.7.4 → 2.7.5

package/dist/src/yaml/a-declared-slot-may-name-the-workflow-it-belongs-to.test.js

@@ -0,0 +1,255 @@
+/**
+ * A pipeline may declare a credential slot under the name a *workflow-scoped*
+ * secret carries, and the workflow it names reads it under the plain name.
+ *
+ * Two workflows that build different product flavors cannot share one value.
+ * `local.properties` is the clearest case: every workflow writes the same file
+ * to the same path, and what belongs in it is the flavor's environment — a
+ * different base API URL and twenty other keys the Secrets Gradle Plugin turns
+ * into `BuildConfig`. One slot, one value, and one of the two flavors builds
+ * against the wrong environment.
+ *
+ * The value side of that has always worked. `ci secrets upload` encodes a
+ * workflow-scoped secret as `CIBUILD_SW__<WORKFLOW>__<VAR>`, `SecretsManager`
+ * decodes it back, and `EnvResolver` asks for the workflow being run — proved
+ * end to end on the dispatch path, where a fresh clone has no
+ * `.cibuild-secrets.json` and the value arrives as a bare environment
+ * variable. What did not work is *declaring* it. A pipeline declares its
+ * credentials as empty `envs` slots, and that declaration does two jobs
+ * nothing else does:
+ *
+ *   - `unsetEnvKeys` — what `invarn setup` searches the developer's machine
+ *     by — reads `envs`, never step inputs. An undeclared credential is never
+ *     discovered and never offered for upload.
+ *   - `file@1.0.0` tells "nobody supplied this" from "this workflow does not
+ *     need it" by whether the key is in the env map at all, and only a
+ *     declaration puts an unsupplied key there. Without one, a credential that
+ *     went missing is skipped with a warning and the build fails later inside
+ *     the project's own build tool (issue 03).
+ *
+ * So a per-workflow slot has to be declarable, and a declaration naming one
+ * workflow has to mean nothing in the others — otherwise `release` would
+ * demand `primary`'s value. The decoding belongs here, beside the decoding of
+ * the secret itself, and not in `file@`: the step keeps reading its plain
+ * `var_name` and never learns the convention exists.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { convertYAMLToPipelineDef } from './converter.js';
+import { EnvResolver } from './env-resolver.js';
+import { clearRegistry, registerStep } from './steps/registry.js';
+import { FileStepExecutor } from './steps/file.js';
+const mockConfig = {
+    artifactsDir: '/test/artifacts',
+    maxConcurrentJobs: 1,
+    paths: {
+        buildsDir: '/test/builds',
+        cacheDir: '/test/cache',
+        derivedDataDir: '/test/derived-data',
+    },
+    interpreters: {
+        bash: '/bin/bash',
+        python: 'python3',
+        ruby: 'ruby',
+        node: 'node',
+    },
+};
+const TARGET = 'local.properties';
+/** Two flavors, two environments, and nothing in common but the file name. */
+const CI_DYNAMIC = 'BASE_API_URL=https://ci-dynamic.example.test/api\n';
+const PROD = 'BASE_API_URL=https://prod.example.test/api\n';
+/** Every environment variable a test here may set, cleared around each one. */
+const TOUCHED = [
+    'LOCAL_PROPERTIES',
+    'CIBUILD_S__LOCAL_PROPERTIES',
+    'CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES',
+    'CIBUILD_SW__PULL_REQUEST__LOCAL_PROPERTIES',
+    'CIBUILD_SW__RELEASE__LOCAL_PROPERTIES',
+];
+let workdir;
+let previousCwd;
+function clearTouched() {
+    for (const key of TOUCHED)
+        delete process.env[key];
+}
+beforeEach(() => {
+    clearRegistry();
+    registerStep('file', new FileStepExecutor());
+    previousCwd = process.cwd();
+    workdir = mkdtempSync(join(tmpdir(), 'cibuild-workflow-slot-'));
+    process.chdir(workdir);
+    // `workdir` is the pre-symlink path on macOS; the steps resolve paths from
+    // CIBUILD_SOURCE_DIR, which is cwd, so read files back the same way.
+    workdir = process.cwd();
+    clearTouched();
+});
+afterEach(() => {
+    process.chdir(previousCwd);
+    rmSync(workdir, { recursive: true, force: true });
+    clearRegistry();
+    clearTouched();
+});
+/**
+ * The shape a flavored repository's generated pipeline has: the credential
+ * declared once per workflow under the encoded name, and the same unsuffixed
+ * `var_name` in every workflow's `file@` step.
+ */
+function probePipeline(declared) {
+    const step = {
+        'file@1.0.0': {
+            title: 'Setup local.properties',
+            is_skippable: true,
+            inputs: { target_path: TARGET, var_name: 'LOCAL_PROPERTIES' },
+        },
+    };
+    return {
+        format_version: '1',
+        app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) },
+        workflows: {
+            primary: { envs: [{ VARIANT: 'ciDynamicDebug' }], steps: [step] },
+            'pull-request': { envs: [{ VARIANT: 'ciDynamicDebug' }], steps: [step] },
+            release: { envs: [{ VARIANT: 'prodRelease' }], steps: [step] },
+        },
+    };
+}
+/**
+ * Converts one workflow and runs the steps it generated the way the runner
+ * does, then reads back whatever landed at `local.properties`.
+ */
+async function land(pipeline, workflow) {
+    const result = await convertYAMLToPipelineDef(pipeline, mockConfig, workflow);
+    const chunks = [...result.warnings];
+    for (const step of result.pipeline.steps) {
+        const scriptPath = join(workdir, `__step_${step.id}.sh`);
+        writeFileSync(scriptPath, step.script, 'utf-8');
+        const proc = spawnSync('bash', [scriptPath], {
+            cwd: workdir,
+            encoding: 'utf-8',
+            env: { ...process.env },
+        });
+        expect(proc.status).toBe(0);
+        chunks.push(proc.stdout ?? '', proc.stderr ?? '');
+    }
+    const landedAt = join(workdir, TARGET);
+    return {
+        output: chunks.join('\n'),
+        contents: existsSync(landedAt) ? readFileSync(landedAt, 'utf-8') : undefined,
+    };
+}
+/** The conversion's outcome, without letting a throw escape the assertion. */
+async function convert(pipeline, workflow) {
+    try {
+        const result = await convertYAMLToPipelineDef(pipeline, mockConfig, workflow);
+        return { steps: result.pipeline.steps };
+    }
+    catch (error) {
+        return { error: error };
+    }
+}
+function resolverFor(pipeline, workflow) {
+    return new EnvResolver(pipeline, pipeline.workflows[workflow], workflow, 'linux');
+}
+/** The three slots a flavored repository's pipeline declares. */
+const PER_WORKFLOW_SLOTS = {
+    CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: '',
+    CIBUILD_SW__PULL_REQUEST__LOCAL_PROPERTIES: '',
+    CIBUILD_SW__RELEASE__LOCAL_PROPERTIES: '',
+};
+describe('a slot naming a workflow', () => {
+    test('delivers that workflow its own bytes, and the other workflow the other bytes', async () => {
+        // Exactly what a dispatch hands the build: bare environment variables
+        // under the encoded names, and no `.cibuild-secrets.json` anywhere.
+        process.env.CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES = CI_DYNAMIC;
+        process.env.CIBUILD_SW__RELEASE__LOCAL_PROPERTIES = PROD;
+        expect(existsSync(join(workdir, '.cibuild-secrets.json'))).toBe(false);
+        const primary = await land(probePipeline(PER_WORKFLOW_SLOTS), 'primary');
+        expect(primary.contents).toBe(CI_DYNAMIC);
+        rmSync(join(workdir, TARGET));
+        const release = await land(probePipeline(PER_WORKFLOW_SLOTS), 'release');
+        expect(release.contents).toBe(PROD);
+    });
+    test('reaches a workflow whose name the encoding had to change', async () => {
+        // `pull-request` cannot be an environment variable name, so the encoding
+        // upper-cases it and turns the dash into an underscore. If the decoding
+        // did not turn it back the slot would belong to a workflow nobody runs.
+        process.env.CIBUILD_SW__PULL_REQUEST__LOCAL_PROPERTIES = CI_DYNAMIC;
+        const { contents } = await land(probePipeline(PER_WORKFLOW_SLOTS), 'pull-request');
+        expect(contents).toBe(CI_DYNAMIC);
+    });
+    test('is not a declaration in any other workflow', async () => {
+        // `release` is asked for nothing here. If `primary`'s slot declared
+        // `LOCAL_PROPERTIES` everywhere, `release` would refuse the build over a
+        // value it was never going to be given.
+        const pipeline = probePipeline({ CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: '' });
+        const { error, steps } = await convert(pipeline, 'release');
+        expect(error).toBeUndefined();
+        expect(steps).toBeDefined();
+        expect(resolverFor(pipeline, 'release').has('LOCAL_PROPERTIES')).toBe(false);
+    });
+    test('still refuses the build in the workflow it does name', async () => {
+        // The tripwire that makes per-workflow slots safe to emit. Replacing one
+        // flat declaration with three scoped ones must not turn issue 03's loud
+        // refusal back into a green skip.
+        const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: '' }), 'primary');
+        expect(error).toBeDefined();
+        expect(error.message).toContain('LOCAL_PROPERTIES');
+        expect(error.message).toContain(TARGET);
+        // Named as the build reads it. The encoding is ours, not the user's, and
+        // `ci secrets add CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES` is not a command.
+        expect(error.message).not.toContain('CIBUILD_SW__');
+    });
+    test('does not put its own spelling into the build environment', () => {
+        process.env.CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES = CI_DYNAMIC;
+        const resolver = resolverFor(probePipeline(PER_WORKFLOW_SLOTS), 'primary');
+        expect(resolver.get('LOCAL_PROPERTIES')).toBe(CI_DYNAMIC);
+        expect(resolver.has('CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES')).toBe(false);
+        expect(Object.keys(resolver.getAll()).filter((k) => k.startsWith('CIBUILD_SW__'))).toEqual([]);
+    });
+    test('carries a value the pipeline itself supplies, under the plain name', () => {
+        const resolver = resolverFor(probePipeline({ CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: CI_DYNAMIC }), 'primary');
+        expect(resolver.get('LOCAL_PROPERTIES')).toBe(CI_DYNAMIC);
+    });
+});
+describe('a value delivered the old way', () => {
+    test('still reaches a per-workflow slot under its plain name', async () => {
+        // A project whose secret was uploaded before any of this existed holds one
+        // flat `LOCAL_PROPERTIES`. Regenerating its pipeline must not strand that
+        // value: the slot declares the plain name, so step 5 imports it.
+        process.env.LOCAL_PROPERTIES = CI_DYNAMIC;
+        const { contents } = await land(probePipeline(PER_WORKFLOW_SLOTS), 'primary');
+        expect(contents).toBe(CI_DYNAMIC);
+    });
+    test('is beaten by the value scoped to the workflow being run', async () => {
+        process.env.LOCAL_PROPERTIES = CI_DYNAMIC;
+        process.env.CIBUILD_SW__RELEASE__LOCAL_PROPERTIES = PROD;
+        const { contents } = await land(probePipeline(PER_WORKFLOW_SLOTS), 'release');
+        expect(contents).toBe(PROD);
+    });
+    test('reaches a globally encoded slot too', () => {
+        // `CIBUILD_S__X` is the other half of the same convention: a secret with
+        // no workflow. A pipeline declaring it means `X`, in every workflow.
+        process.env.CIBUILD_S__LOCAL_PROPERTIES = CI_DYNAMIC;
+        const resolver = resolverFor(probePipeline({ CIBUILD_S__LOCAL_PROPERTIES: '' }), 'release');
+        expect(resolver.get('LOCAL_PROPERTIES')).toBe(CI_DYNAMIC);
+        expect(resolver.has('CIBUILD_S__LOCAL_PROPERTIES')).toBe(false);
+    });
+});
+describe('a pipeline that declares one flat slot', () => {
+    test('is untouched — every workflow reads the one value', async () => {
+        process.env.LOCAL_PROPERTIES = CI_DYNAMIC;
+        for (const workflow of ['primary', 'pull-request', 'release']) {
+            const { contents } = await land(probePipeline({ LOCAL_PROPERTIES: '' }), workflow);
+            expect(contents).toBe(CI_DYNAMIC);
+            rmSync(join(workdir, TARGET));
+        }
+    });
+    test('keeps refusing when nobody supplied it', async () => {
+        const { error } = await convert(probePipeline({ LOCAL_PROPERTIES: '' }), 'primary');
+        expect(error).toBeDefined();
+        expect(error.message).toContain('LOCAL_PROPERTIES');
+    });
+});
+//# sourceMappingURL=a-declared-slot-may-name-the-workflow-it-belongs-to.test.js.map

package/dist/src/yaml/a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.d.ts

@@ -0,0 +1,34 @@
+/**
+ * A credential slot scoped to a workflow the pipeline does not have refuses
+ * the build, instead of silently belonging to nobody.
+ *
+ * The declaration `CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: ""` means "this
+ * credential, for the workflow called `primary`". Nothing checked that a
+ * workflow by that name existed, and every way of getting the name wrong fails
+ * quietly:
+ *
+ *   - **A typo.** `CIBUILD_SW__PRIMRAY__X` decodes to workflow `primray`. No
+ *     workflow is called that, so no workflow declares `X`, so `file@1.0.0`
+ *     finds no key in its map, calls the credential optional, and skips it with
+ *     a warning — the green-step failure mode issue 03 exists to end. The
+ *     upload half is equally quiet: `ci secrets upload` encodes a value for
+ *     `primray` and the resolver looks for `primary`.
+ *   - **An underscore in the workflow's own name.** The encoding upper-cases
+ *     the name and turns dashes into underscores, so decoding turns every
+ *     underscore back into a dash. A workflow genuinely called `my_wf` is
+ *     therefore unreachable: its slot decodes to `my-wf`, which the pipeline
+ *     does not have. `ci secrets upload` warns about this at upload time; the
+ *     pipeline is where it can be refused before a build starts.
+ *
+ * Both are one check — does the pipeline have a workflow by the decoded
+ * name? — and both are refused at generation time, from the resolver, before
+ * any step converts. That is the same place issue 03's refusal lands and for
+ * the same reason: a build that cannot possibly deliver a credential should
+ * stop while the message can still name the credential.
+ *
+ * The check only ever fires on a name we generate. No pipeline written before
+ * this declared an encoded slot at all, and a global `CIBUILD_S__X` names no
+ * workflow, so there is nothing in existence for it to refuse.
+ */
+export {};
+//# sourceMappingURL=a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.d.ts.map

package/dist/src/yaml/a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG"}

package/dist/src/yaml/a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.js

@@ -0,0 +1,218 @@
+/**
+ * A credential slot scoped to a workflow the pipeline does not have refuses
+ * the build, instead of silently belonging to nobody.
+ *
+ * The declaration `CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: ""` means "this
+ * credential, for the workflow called `primary`". Nothing checked that a
+ * workflow by that name existed, and every way of getting the name wrong fails
+ * quietly:
+ *
+ *   - **A typo.** `CIBUILD_SW__PRIMRAY__X` decodes to workflow `primray`. No
+ *     workflow is called that, so no workflow declares `X`, so `file@1.0.0`
+ *     finds no key in its map, calls the credential optional, and skips it with
+ *     a warning — the green-step failure mode issue 03 exists to end. The
+ *     upload half is equally quiet: `ci secrets upload` encodes a value for
+ *     `primray` and the resolver looks for `primary`.
+ *   - **An underscore in the workflow's own name.** The encoding upper-cases
+ *     the name and turns dashes into underscores, so decoding turns every
+ *     underscore back into a dash. A workflow genuinely called `my_wf` is
+ *     therefore unreachable: its slot decodes to `my-wf`, which the pipeline
+ *     does not have. `ci secrets upload` warns about this at upload time; the
+ *     pipeline is where it can be refused before a build starts.
+ *
+ * Both are one check — does the pipeline have a workflow by the decoded
+ * name? — and both are refused at generation time, from the resolver, before
+ * any step converts. That is the same place issue 03's refusal lands and for
+ * the same reason: a build that cannot possibly deliver a credential should
+ * stop while the message can still name the credential.
+ *
+ * The check only ever fires on a name we generate. No pipeline written before
+ * this declared an encoded slot at all, and a global `CIBUILD_S__X` names no
+ * workflow, so there is nothing in existence for it to refuse.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { convertYAMLToPipelineDef } from './converter.js';
+import { UnknownWorkflowSlotError } from './env-resolver.js';
+import { clearRegistry, registerStep } from './steps/registry.js';
+import { FileStepExecutor } from './steps/file.js';
+const mockConfig = {
+    artifactsDir: '/test/artifacts',
+    maxConcurrentJobs: 1,
+    paths: {
+        buildsDir: '/test/builds',
+        cacheDir: '/test/cache',
+        derivedDataDir: '/test/derived-data',
+    },
+    interpreters: {
+        bash: '/bin/bash',
+        python: 'python3',
+        ruby: 'ruby',
+        node: 'node',
+    },
+};
+const TARGET = 'local.properties';
+const VALUE = 'BASE_API_URL=https://example.test/api\n';
+const TOUCHED = [
+    'LOCAL_PROPERTIES',
+    'CIBUILD_S__LOCAL_PROPERTIES',
+    'CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES',
+    'CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES',
+    'CIBUILD_SW__RELEASE__LOCAL_PROPERTIES',
+    'CIBUILD_SW__MY_WF__LOCAL_PROPERTIES',
+];
+let workdir;
+let previousCwd;
+beforeEach(() => {
+    clearRegistry();
+    registerStep('file', new FileStepExecutor());
+    previousCwd = process.cwd();
+    workdir = mkdtempSync(join(tmpdir(), 'cibuild-unknown-workflow-'));
+    process.chdir(workdir);
+    workdir = process.cwd();
+    for (const key of TOUCHED)
+        delete process.env[key];
+});
+afterEach(() => {
+    process.chdir(previousCwd);
+    rmSync(workdir, { recursive: true, force: true });
+    clearRegistry();
+    for (const key of TOUCHED)
+        delete process.env[key];
+});
+/** A pipeline with the given declared slots and the given workflow names. */
+function probePipeline(declared, workflowNames = ['primary', 'pull-request', 'release']) {
+    const step = {
+        'file@1.0.0': {
+            is_skippable: true,
+            inputs: { target_path: TARGET, var_name: 'LOCAL_PROPERTIES' },
+        },
+    };
+    const workflows = {};
+    for (const name of workflowNames)
+        workflows[name] = { steps: [step] };
+    return {
+        format_version: '1',
+        app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) },
+        workflows,
+    };
+}
+/** The conversion's outcome, without letting a throw escape the assertion. */
+async function convert(pipeline, workflow) {
+    try {
+        const result = await convertYAMLToPipelineDef(pipeline, mockConfig, workflow);
+        return { steps: result.pipeline.steps };
+    }
+    catch (error) {
+        return { error: error };
+    }
+}
+describe('a slot naming a workflow nobody has', () => {
+    test('refuses the build, naming the slot and the workflow it decodes to', async () => {
+        process.env.CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES = VALUE;
+        const { error, steps } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), 'primary');
+        expect(error).toBeInstanceOf(UnknownWorkflowSlotError);
+        expect(error.message).toContain('CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES');
+        expect(error.message).toContain('primray');
+        expect(steps).toBeUndefined();
+    });
+    test('says which workflows the pipeline does have', async () => {
+        const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), 'primary');
+        expect(error.message).toContain('primary');
+        expect(error.message).toContain('pull-request');
+        expect(error.message).toContain('release');
+    });
+    test('names the credential the slot is for, since that is what has to arrive', async () => {
+        const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), 'primary');
+        expect(error.message).toContain('LOCAL_PROPERTIES');
+    });
+    test('refuses from whichever workflow is being run', async () => {
+        // The slot is in `app.envs`, so it is a defect in the pipeline and not in
+        // one workflow of it. A build of `release` must not pass just because the
+        // bad slot happens to name something else.
+        for (const workflow of ['primary', 'pull-request', 'release']) {
+            const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), workflow);
+            expect(error).toBeInstanceOf(UnknownWorkflowSlotError);
+        }
+    });
+    test('refuses a slot declared inside a workflow, not only in app.envs', async () => {
+        const pipeline = {
+            format_version: '1',
+            workflows: {
+                primary: {
+                    envs: [{ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }],
+                    steps: [
+                        {
+                            'file@1.0.0': {
+                                is_skippable: true,
+                                inputs: { target_path: TARGET, var_name: 'LOCAL_PROPERTIES' },
+                            },
+                        },
+                    ],
+                },
+            },
+        };
+        const { error } = await convert(pipeline, 'primary');
+        expect(error).toBeInstanceOf(UnknownWorkflowSlotError);
+    });
+    test('carries no secret value into the message', async () => {
+        process.env.CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES = VALUE;
+        const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), 'primary');
+        expect(error.message).not.toContain(VALUE.trim());
+        expect(error.message).not.toContain('example.test');
+    });
+});
+describe('a workflow whose own name the encoding cannot survive', () => {
+    test('is refused, and the message says the underscore is why', async () => {
+        // The pipeline really does have `my_wf`. Its slot still cannot reach it:
+        // decoding turns every underscore back into a dash, so the slot belongs to
+        // `my-wf`. Saying only "no such workflow" about a workflow that is right
+        // there would read as a bug in us.
+        const { error } = await convert(probePipeline({ CIBUILD_SW__MY_WF__LOCAL_PROPERTIES: '' }, ['my_wf']), 'my_wf');
+        expect(error).toBeInstanceOf(UnknownWorkflowSlotError);
+        expect(error.message).toContain('my_wf');
+        expect(error.message).toContain('my-wf');
+        expect(error.message).toMatch(/underscore/i);
+    });
+    test('is not refused when the workflow is named with a dash instead', async () => {
+        process.env.CIBUILD_SW__MY_WF__LOCAL_PROPERTIES = VALUE;
+        const { error, steps } = await convert(probePipeline({ CIBUILD_SW__MY_WF__LOCAL_PROPERTIES: '' }, ['my-wf']), 'my-wf');
+        expect(error).toBeUndefined();
+        expect(steps).toHaveLength(1);
+    });
+});
+describe('what the guard leaves alone', () => {
+    test('a pipeline whose scoped slots all name real workflows', async () => {
+        process.env.CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES = VALUE;
+        process.env.CIBUILD_SW__RELEASE__LOCAL_PROPERTIES = VALUE;
+        const declared = {
+            CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: '',
+            CIBUILD_SW__RELEASE__LOCAL_PROPERTIES: '',
+        };
+        const { error } = await convert(probePipeline(declared, ['primary', 'release']), 'primary');
+        expect(error).toBeUndefined();
+    });
+    test('a global slot, which names no workflow at all', async () => {
+        process.env.CIBUILD_S__LOCAL_PROPERTIES = VALUE;
+        const { error, steps } = await convert(probePipeline({ CIBUILD_S__LOCAL_PROPERTIES: '' }, ['primary']), 'primary');
+        expect(error).toBeUndefined();
+        expect(steps).toHaveLength(1);
+    });
+    test('an ordinary flat slot, which is every pipeline written before this', async () => {
+        process.env.LOCAL_PROPERTIES = VALUE;
+        const { error, steps } = await convert(probePipeline({ LOCAL_PROPERTIES: '' }, ['primary']), 'primary');
+        expect(error).toBeUndefined();
+        expect(steps).toHaveLength(1);
+    });
+    test('a half-encoded name, which is not a scoped slot and never was', async () => {
+        // `decodeSecretName` returns nothing for these, so they are ordinary
+        // variable names. Refusing them would be inventing a rule.
+        for (const key of ['CIBUILD_SW__RELEASE', 'CIBUILD_SW__RELEASE__', 'CIBUILD_S__']) {
+            const { error } = await convert(probePipeline({ [key]: '' }, ['primary']), 'primary');
+            expect(error).toBeUndefined();
+        }
+    });
+});
+//# sourceMappingURL=a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.js.map

package/dist/src/yaml/a-value-this-instance-stored-is-a-value-it-has.test.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A value `SecretsManager` was just told to store is a value it can read back.
+ *
+ * It could not, on exactly the repositories that matter. `loadSecrets` sets
+ * `fileLoaded` when it finds a `.cibuild-secrets.json` or a
+ * `CIBUILD_S*`-shaped environment, and every reader begins
+ * `if (!this.fileLoaded) return process.env[...]` — a compatibility fallback
+ * to bare `CIBUILD_`-prefixed variables from before the store existed.
+ * `storeSecret` writes the file but never clears the flag, so on a repository
+ * that had no store — a first `ci init`, which is the only time `ci init`
+ * collects anything — every value collected in that run read back as absent
+ * from the instance that stored it.
+ *
+ * It is not a hypothetical. `ci init` extracts a workflow's keystore target
+ * from `storeFile=` in the `keystore.properties` it collected a moment
+ * earlier, which is how a project whose signing config names
+ * `app/customer.jks` gets its `file@` step pointed there instead of at
+ * `keystore.jks`. That read returned undefined on every fresh repository, so
+ * the resolution silently fell through to the Gradle-detected path — the half
+ * of issue 07 that shipped and never fired.
+ *
+ * The fix is additive rather than a flag flip: the stored data is consulted
+ * first, and the environment fallback stays exactly where it was for anything
+ * the store does not hold. Nothing that resolved before stops resolving.
+ */
+export {};
+//# sourceMappingURL=a-value-this-instance-stored-is-a-value-it-has.test.d.ts.map

package/dist/src/yaml/a-value-this-instance-stored-is-a-value-it-has.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-value-this-instance-stored-is-a-value-it-has.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-value-this-instance-stored-is-a-value-it-has.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}