@invarn/cibuild 2.7.4 → 2.7.6

package/dist/src/commands/a-credential-target-follows-the-flavor-source-set.test.d.ts

@@ -0,0 +1,38 @@
+/**
+ * A credential's target path and the value chosen for it both have to follow
+ * the product flavor the workflow builds.
+ *
+ * An Android module has one source set per flavor, and each carries its own
+ * copies of whatever the build needs — the manifest, the resources, and
+ * `google-services.json`. The google-services plugin resolves the file by
+ * specificity (variant, then build type, then flavor, then the module root)
+ * and takes the first it finds. So a workflow building `ciDynamicDebug` wants
+ * `app/src/ciDynamic/google-services.json`, and only falls back to the module
+ * root when that is absent.
+ *
+ * The generator assumed one file at the module root. Writing there on a
+ * flavored repository is *silently* wrong rather than loudly wrong: the plugin
+ * finds a file, parses it, and fails on a package name. That is what
+ * `bld_8e60d90ab4e55f85d2f72459` (2026-09-09) spent 1292 Gradle tasks
+ * discovering:
+ *
+ *     Execution failed for task ':app:processCiDynamicDebugGoogleServices'.
+ *     > No matching client found for package name '….ciDynamic'
+ *
+ * The chain worked. The file was the wrong one of four, and the error names
+ * Firebase rather than the credential we delivered.
+ *
+ * Two flavors cannot share one secret, and the key is how a value varies. A
+ * dispatched build's secrets are a flat key→value map — Invarn's scopes are
+ * org, connection and pipeline, with no workflow *column* — but a flat map
+ * carries a workflow perfectly well when the workflow is part of the key,
+ * which is what `ci secrets upload` has encoded as
+ * `CIBUILD_SW__<WORKFLOW>__<VAR>` all along. So the differing keys are
+ * per-workflow ones, not per-flavor ones: the flavor is a property of the
+ * variant the workflow builds, so keying by workflow is one indirection less,
+ * and it is the convention already implemented end to end. A per-flavor
+ * suffix (`GOOGLE_SERVICES_JSON_CIDYNAMIC`) was briefly shipped here as a
+ * second answer to the same question and was reverted (Alex, 2026-09-09).
+ */
+export {};
+//# sourceMappingURL=a-credential-target-follows-the-flavor-source-set.test.d.ts.map

package/dist/src/commands/a-credential-target-follows-the-flavor-source-set.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-credential-target-follows-the-flavor-source-set.test.d.ts","sourceRoot":"","sources":["../../../src/commands/a-credential-target-follows-the-flavor-source-set.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG"}

package/dist/src/commands/a-credential-target-follows-the-flavor-source-set.test.js

@@ -0,0 +1,222 @@
+/**
+ * A credential's target path and the value chosen for it both have to follow
+ * the product flavor the workflow builds.
+ *
+ * An Android module has one source set per flavor, and each carries its own
+ * copies of whatever the build needs — the manifest, the resources, and
+ * `google-services.json`. The google-services plugin resolves the file by
+ * specificity (variant, then build type, then flavor, then the module root)
+ * and takes the first it finds. So a workflow building `ciDynamicDebug` wants
+ * `app/src/ciDynamic/google-services.json`, and only falls back to the module
+ * root when that is absent.
+ *
+ * The generator assumed one file at the module root. Writing there on a
+ * flavored repository is *silently* wrong rather than loudly wrong: the plugin
+ * finds a file, parses it, and fails on a package name. That is what
+ * `bld_8e60d90ab4e55f85d2f72459` (2026-09-09) spent 1292 Gradle tasks
+ * discovering:
+ *
+ *     Execution failed for task ':app:processCiDynamicDebugGoogleServices'.
+ *     > No matching client found for package name '….ciDynamic'
+ *
+ * The chain worked. The file was the wrong one of four, and the error names
+ * Firebase rather than the credential we delivered.
+ *
+ * Two flavors cannot share one secret, and the key is how a value varies. A
+ * dispatched build's secrets are a flat key→value map — Invarn's scopes are
+ * org, connection and pipeline, with no workflow *column* — but a flat map
+ * carries a workflow perfectly well when the workflow is part of the key,
+ * which is what `ci secrets upload` has encoded as
+ * `CIBUILD_SW__<WORKFLOW>__<VAR>` all along. So the differing keys are
+ * per-workflow ones, not per-flavor ones: the flavor is a property of the
+ * variant the workflow builds, so keying by workflow is one indirection less,
+ * and it is the convention already implemented end to end. A per-flavor
+ * suffix (`GOOGLE_SERVICES_JSON_CIDYNAMIC`) was briefly shipped here as a
+ * second answer to the same question and was reverted (Alex, 2026-09-09).
+ */
+import { describe, test, expect } from '@jest/globals';
+import { load } from 'js-yaml';
+import { generateAndroidPipeline, flavorOfVariant, googleServicesPathFor, googleServicesTargets, } from './build.js';
+const BASE = {
+    keystore: false,
+    keystoreProperties: false,
+    googleServices: false,
+    googlePlayDeploy: false,
+    googlePlayPackageName: '',
+    artifactType: 'apk',
+    keystorePaths: {},
+    googleServicesPaths: {},
+    workflowFlavors: {},
+    secretsProperties: false,
+    secretsPropertiesPath: 'local.properties',
+};
+function variant(name) {
+    const buildType = name.charAt(0).toUpperCase() + name.slice(1);
+    return { variant: name, buildType, gradleTask: `assemble${buildType}` };
+}
+/** The real repository's shape: two debug workflows on one flavor, release on another. */
+const FLAVORED = {
+    primary: variant('ciDynamicDebug'),
+    pullRequest: variant('ciDynamicDebug'),
+    release: variant('prodRelease'),
+};
+const UNFLAVORED = {
+    primary: variant('debug'),
+    pullRequest: variant('debug'),
+    release: variant('release'),
+};
+const FLAVORS = ['ciDynamic', 'dev', 'prod', 'gandalf'];
+function parse(yaml) {
+    return load(yaml);
+}
+function envs(parsed) {
+    return Object.assign({}, ...(parsed.app?.envs ?? []));
+}
+/** The `file@` step of `workflow` that writes a google-services.json, if any. */
+function googleServicesStep(parsed, workflow) {
+    return (parsed.workflows?.[workflow]?.steps ?? [])
+        .filter((s) => Object.keys(s)[0] === 'file@1.0.0')
+        .map((s) => s['file@1.0.0'].inputs)
+        .find((inputs) => String(inputs.target_path).endsWith('google-services.json'));
+}
+function generate(variants, flavors) {
+    return parse(generateAndroidPipeline(17, {
+        ...BASE,
+        googleServices: true,
+        googleServicesPaths: googleServicesTargets(variants, flavors),
+    }, variants));
+}
+describe('which flavor a variant builds', () => {
+    test('is the flavor the variant name starts with', () => {
+        expect(flavorOfVariant('ciDynamicDebug', FLAVORS)).toBe('ciDynamic');
+        expect(flavorOfVariant('prodRelease', FLAVORS)).toBe('prod');
+        expect(flavorOfVariant('devDebug', FLAVORS)).toBe('dev');
+    });
+    test('is nothing when the variant is a bare build type', () => {
+        expect(flavorOfVariant('debug', FLAVORS)).toBeNull();
+        expect(flavorOfVariant('release', FLAVORS)).toBeNull();
+        // A repository with no product flavors can never match one.
+        expect(flavorOfVariant('ciDynamicDebug', [])).toBeNull();
+    });
+    test('needs the capital that starts the build type, so a prefix cannot claim it', () => {
+        // Without this check `pro` claims `prodRelease` and the credential lands
+        // in the wrong source set — the same arbitrariness, one layer down.
+        expect(flavorOfVariant('prodRelease', ['pro'])).toBeNull();
+        expect(flavorOfVariant('prodRelease', ['pro', 'prod'])).toBe('prod');
+    });
+    test('gives the longest flavor the win when two both match', () => {
+        expect(flavorOfVariant('ciDynamicDebug', ['ci', 'ciDynamic'])).toBe('ciDynamic');
+    });
+});
+describe('the path a flavor implies', () => {
+    test('is the module root when there is no flavor', () => {
+        expect(googleServicesPathFor(null)).toBe('app/google-services.json');
+    });
+    test('is that flavor\'s source set when there is one', () => {
+        expect(googleServicesPathFor('ciDynamic')).toBe('app/src/ciDynamic/google-services.json');
+        expect(googleServicesPathFor('prod')).toBe('app/src/prod/google-services.json');
+    });
+    test('follows the module when the app is not in `app/`', () => {
+        expect(googleServicesPathFor('ciDynamic', 'androidApp')).toBe('androidApp/src/ciDynamic/google-services.json');
+    });
+});
+describe('the pipeline a flavored repository gets', () => {
+    test('writes each workflow into its own flavor source set', () => {
+        const parsed = generate(FLAVORED, FLAVORS);
+        // One object per workflow so a failure names the workflow that lost it.
+        expect(['primary', 'pull-request', 'release'].map((workflow) => ({
+            workflow,
+            target_path: googleServicesStep(parsed, workflow)?.target_path,
+        }))).toEqual([
+            { workflow: 'primary', target_path: 'app/src/ciDynamic/google-services.json' },
+            { workflow: 'pull-request', target_path: 'app/src/ciDynamic/google-services.json' },
+            { workflow: 'release', target_path: 'app/src/prod/google-services.json' },
+        ]);
+    });
+    test('names one secret in every workflow, whatever the flavor', () => {
+        // The value differs per workflow; the *name* does not. Scoping a value to
+        // a workflow is the secret's job — `ci secrets add GOOGLE_SERVICES_JSON
+        // <pipeline> -w primary` stores it per workflow, `ci secrets upload`
+        // encodes it as `CIBUILD_SW__PRIMARY__GOOGLE_SERVICES_JSON`, and
+        // `EnvResolver` resolves it for the workflow being run. A second naming
+        // convention in the step would be a second way to say the same thing.
+        const parsed = generate(FLAVORED, FLAVORS);
+        expect(['primary', 'pull-request', 'release'].map((workflow) => googleServicesStep(parsed, workflow)?.var_name)).toEqual(['GOOGLE_SERVICES_JSON', 'GOOGLE_SERVICES_JSON', 'GOOGLE_SERVICES_JSON']);
+    });
+    test('declares that one secret under no invented per-flavor name', () => {
+        // Declared, and declared empty: `unsetEnvKeys` — what `invarn setup`
+        // searches the developer's machine by — reads `envs`, never step inputs.
+        // A key no `envs` entry names is never discovered and never uploaded.
+        //
+        // *How many* slots it takes is a later ruling and lives in
+        // `a-credential-two-workflows-cannot-share-is-declared-per-workflow`: two
+        // flavors need two values, and `invarn setup` fills one slot with one
+        // value, so a flavored repository declares one slot per workflow under the
+        // `CIBUILD_SW__` name the upload already encodes. What this test still
+        // holds is the naming: whatever the flavor, the credential is
+        // `GOOGLE_SERVICES_JSON` and never `GOOGLE_SERVICES_JSON_CIDYNAMIC`.
+        const yaml = generateAndroidPipeline(17, {
+            ...BASE,
+            googleServices: true,
+            googleServicesPaths: googleServicesTargets(FLAVORED, FLAVORS),
+        }, FLAVORED);
+        // One declaration per workflow, in that workflow's own `envs`, under the
+        // plain credential name — the block says which workflow, so nothing is
+        // encoded into the key.
+        const parsed = parse(yaml);
+        const declaringWorkflows = Object.keys(parsed.workflows ?? {}).filter((workflow) => 'GOOGLE_SERVICES_JSON' in
+            Object.assign({}, ...(parsed.workflows?.[workflow]?.envs ?? [])));
+        expect(declaringWorkflows).toEqual(['primary', 'pull-request', 'release']);
+        expect(envs(parsed)).not.toHaveProperty('GOOGLE_SERVICES_JSON');
+        expect(yaml).not.toMatch(/GOOGLE_SERVICES_JSON_[A-Z]/);
+        expect(yaml).not.toContain('CIBUILD_SW__');
+    });
+});
+describe('a repository with no product flavors', () => {
+    test('is exactly what it was: one key, one path, in every workflow', () => {
+        const parsed = generate(UNFLAVORED, []);
+        expect(envs(parsed).GOOGLE_SERVICES_JSON).toBe('');
+        for (const workflow of ['primary', 'pull-request', 'release']) {
+            expect(googleServicesStep(parsed, workflow)).toMatchObject({
+                target_path: 'app/google-services.json',
+                var_name: 'GOOGLE_SERVICES_JSON',
+            });
+        }
+    });
+    test('is unchanged even when the pipeline is generated with no options at all', () => {
+        // The defaulted `SetupOptions` has empty maps; the step must still fall
+        // back to the module root rather than emitting `undefined`.
+        const parsed = parse(generateAndroidPipeline(17, { ...BASE, googleServices: true }, UNFLAVORED));
+        expect(googleServicesStep(parsed, 'primary')).toMatchObject({
+            target_path: 'app/google-services.json',
+            var_name: 'GOOGLE_SERVICES_JSON',
+        });
+    });
+    test('emits nothing at all when the scan found no google-services.json', () => {
+        const parsed = parse(generateAndroidPipeline(17, BASE, UNFLAVORED));
+        expect(envs(parsed)).not.toHaveProperty('GOOGLE_SERVICES_JSON');
+        for (const workflow of ['primary', 'pull-request', 'release']) {
+            expect(googleServicesStep(parsed, workflow)).toBeUndefined();
+        }
+    });
+});
+describe('a repository whose workflows all build one flavor', () => {
+    test('gets a single flavored key, written to that flavor everywhere', () => {
+        const allCiDynamic = {
+            primary: variant('ciDynamicDebug'),
+            pullRequest: variant('ciDynamicDebug'),
+            release: variant('ciDynamicRelease'),
+        };
+        const parsed = generate(allCiDynamic, FLAVORS);
+        expect(Object.keys(envs(parsed)).filter((k) => k.startsWith('GOOGLE_SERVICES_JSON'))).toEqual([
+            'GOOGLE_SERVICES_JSON',
+        ]);
+        for (const workflow of ['primary', 'pull-request', 'release']) {
+            expect(googleServicesStep(parsed, workflow)).toMatchObject({
+                target_path: 'app/src/ciDynamic/google-services.json',
+                var_name: 'GOOGLE_SERVICES_JSON',
+            });
+        }
+    });
+});
+//# sourceMappingURL=a-credential-target-follows-the-flavor-source-set.test.js.map

package/dist/src/commands/a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.d.ts

@@ -0,0 +1,41 @@
+/**
+ * A credential two workflows cannot share is declared once per workflow, not
+ * once for the pipeline.
+ *
+ * The generator declares each credential it finds as one empty `app.envs`
+ * slot — `- LOCAL_PROPERTIES: ""` — and emits the same unsuffixed `var_name`
+ * in every workflow's `file@` step. On a repository with one flavor that is
+ * exactly right. On a flavored one it is one value where the build needs two,
+ * and the pipeline says so nowhere: `invarn setup` finds one slot, uploads one
+ * value, and all three workflows read it.
+ *
+ * `LOCAL_PROPERTIES` is the case that matters most and the one with no target
+ * path to give it away. Every workflow writes the same `local.properties` to
+ * the same place; what belongs *in* it is the flavor's environment — a
+ * different base API URL plus twenty other keys the Secrets Gradle Plugin
+ * turns into `BuildConfig`. `ciDynamic` and `prod` are different environments,
+ * so `prodRelease` built against `ciDynamic`'s properties is a release
+ * pointing at the CI backend. Two credentials give themselves away by path
+ * instead, and both were measured: `google-services.json` per flavor source
+ * set (`bld_8e60d90ab4e55f85d2f72459`) and the keystore per declared target
+ * (`bld_f3cc37d81…`).
+ *
+ * The name is the whole mechanism. Invarn's secret scopes are org, connection
+ * and pipeline, with no workflow column for a value to vary along — but a flat
+ * key→value map carries a workflow perfectly well when the workflow is part of
+ * the key, which is what `ci secrets upload` has always encoded and
+ * `SecretsManager` has always decoded. So the slot names the workflow and the
+ * step does not: `var_name` stays unsuffixed in every workflow, the decoding
+ * does the mapping, and a second naming convention in the step would be a
+ * second way to say the same thing (`GOOGLE_SERVICES_JSON_CIDYNAMIC` was that
+ * second way, and it was reverted).
+ *
+ * What decides is whether the workflows disagree about the thing the
+ * credential follows, and each credential follows something different: a
+ * keystore its declared target path, `google-services.json` the flavor's
+ * source set, `local.properties` the flavor itself. A credential only one
+ * workflow reads can never disagree, which is why the two genuinely
+ * release-only credentials keep one slot however flavored the repository is.
+ */
+export {};
+//# sourceMappingURL=a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.d.ts.map

package/dist/src/commands/a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.d.ts","sourceRoot":"","sources":["../../../src/commands/a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG"}

package/dist/src/commands/a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.js

@@ -0,0 +1,324 @@
+/**
+ * A credential two workflows cannot share is declared once per workflow, not
+ * once for the pipeline.
+ *
+ * The generator declares each credential it finds as one empty `app.envs`
+ * slot — `- LOCAL_PROPERTIES: ""` — and emits the same unsuffixed `var_name`
+ * in every workflow's `file@` step. On a repository with one flavor that is
+ * exactly right. On a flavored one it is one value where the build needs two,
+ * and the pipeline says so nowhere: `invarn setup` finds one slot, uploads one
+ * value, and all three workflows read it.
+ *
+ * `LOCAL_PROPERTIES` is the case that matters most and the one with no target
+ * path to give it away. Every workflow writes the same `local.properties` to
+ * the same place; what belongs *in* it is the flavor's environment — a
+ * different base API URL plus twenty other keys the Secrets Gradle Plugin
+ * turns into `BuildConfig`. `ciDynamic` and `prod` are different environments,
+ * so `prodRelease` built against `ciDynamic`'s properties is a release
+ * pointing at the CI backend. Two credentials give themselves away by path
+ * instead, and both were measured: `google-services.json` per flavor source
+ * set (`bld_8e60d90ab4e55f85d2f72459`) and the keystore per declared target
+ * (`bld_f3cc37d81…`).
+ *
+ * The name is the whole mechanism. Invarn's secret scopes are org, connection
+ * and pipeline, with no workflow column for a value to vary along — but a flat
+ * key→value map carries a workflow perfectly well when the workflow is part of
+ * the key, which is what `ci secrets upload` has always encoded and
+ * `SecretsManager` has always decoded. So the slot names the workflow and the
+ * step does not: `var_name` stays unsuffixed in every workflow, the decoding
+ * does the mapping, and a second naming convention in the step would be a
+ * second way to say the same thing (`GOOGLE_SERVICES_JSON_CIDYNAMIC` was that
+ * second way, and it was reverted).
+ *
+ * What decides is whether the workflows disagree about the thing the
+ * credential follows, and each credential follows something different: a
+ * keystore its declared target path, `google-services.json` the flavor's
+ * source set, `local.properties` the flavor itself. A credential only one
+ * workflow reads can never disagree, which is why the two genuinely
+ * release-only credentials keep one slot however flavored the repository is.
+ */
+import { describe, test, expect } from '@jest/globals';
+import { load } from 'js-yaml';
+import { generateAndroidPipeline, googleServicesTargets, variantFlavors, credentialSlots, GENERATED_WORKFLOWS, } from './build.js';
+function variant(name) {
+    const buildType = name.charAt(0).toUpperCase() + name.slice(1);
+    return { variant: name, buildType, gradleTask: `assemble${buildType}` };
+}
+/** The real repository's shape: two debug workflows on one flavor, release on another. */
+const FLAVORED = {
+    primary: variant('ciDynamicDebug'),
+    pullRequest: variant('ciDynamicDebug'),
+    release: variant('prodRelease'),
+};
+const UNFLAVORED = {
+    primary: variant('debug'),
+    pullRequest: variant('debug'),
+    release: variant('release'),
+};
+const FLAVORS = ['ciDynamic', 'dev', 'prod'];
+/** The keystore targets the real repository resolves: debug key, release key. */
+const SPLIT_KEYSTORES = {
+    primary: 'config/debug.keystore',
+    'pull-request': 'config/debug.keystore',
+    release: 'app/release.jks',
+};
+const BASE = {
+    keystore: false,
+    keystoreProperties: false,
+    googleServices: false,
+    googlePlayDeploy: false,
+    googlePlayPackageName: '',
+    artifactType: 'apk',
+    keystorePaths: {},
+    googleServicesPaths: {},
+    workflowFlavors: {},
+    secretsProperties: false,
+    secretsPropertiesPath: 'local.properties',
+};
+/** Every credential the Android generator knows how to declare, all switched on. */
+const ALL_CREDENTIALS = {
+    keystore: true,
+    keystoreProperties: true,
+    googleServices: true,
+    googlePlayDeploy: true,
+    googlePlayPackageName: 'com.example.app',
+    artifactType: 'aab',
+    secretsProperties: true,
+};
+function parse(yaml) {
+    return load(yaml);
+}
+function envs(parsed) {
+    return Object.assign({}, ...(parsed.app?.envs ?? []));
+}
+/** What one workflow's own `envs` block declares. */
+function workflowEnvs(parsed, workflow) {
+    return Object.assign({}, ...(parsed.workflows?.[workflow]?.envs ?? []));
+}
+/**
+ * The workflows whose own `envs` declare `varName`, in pipeline order.
+ *
+ * The name is the plain credential now, so *where* the declaration sits is the
+ * whole answer to which workflow it belongs to.
+ */
+function declaringWorkflows(parsed, varName) {
+    return Object.keys(parsed.workflows ?? {}).filter((workflow) => varName in workflowEnvs(parsed, workflow));
+}
+/** The `var_name` of every `file@` step in `workflow`, in order. */
+function fileVarNames(parsed, workflow) {
+    return (parsed.workflows?.[workflow]?.steps ?? [])
+        .filter((s) => Object.keys(s)[0] === 'file@1.0.0')
+        .map((s) => s['file@1.0.0'].inputs.var_name);
+}
+/** The declared slots that carry `varName`, however they are named. */
+function slotsFor(parsed, varName) {
+    return Object.keys(envs(parsed)).filter((key) => key === varName || key.endsWith(`__${varName}`));
+}
+function flavoredPipeline(over = {}) {
+    return parse(generateAndroidPipeline(17, {
+        ...BASE,
+        ...ALL_CREDENTIALS,
+        keystorePaths: SPLIT_KEYSTORES,
+        googleServicesPaths: googleServicesTargets(FLAVORED, FLAVORS),
+        workflowFlavors: variantFlavors(FLAVORED, FLAVORS),
+        ...over,
+    }, FLAVORED));
+}
+describe('what a credential follows', () => {
+    test('is the flavor each workflow builds, for the properties file', () => {
+        expect(variantFlavors(FLAVORED, FLAVORS)).toEqual({
+            primary: 'ciDynamic',
+            'pull-request': 'ciDynamic',
+            release: 'prod',
+        });
+    });
+    test('is nothing at all on a repository with no product flavors', () => {
+        expect(variantFlavors(UNFLAVORED, [])).toEqual({
+            primary: null,
+            'pull-request': null,
+            release: null,
+        });
+    });
+});
+describe('the slots one credential gets', () => {
+    test('are one, unsuffixed, when every workflow wants the same bytes', () => {
+        expect(credentialSlots('LOCAL_PROPERTIES', {
+            primary: 'ciDynamic',
+            'pull-request': 'ciDynamic',
+            release: 'ciDynamic',
+        })).toEqual([{ slot: 'LOCAL_PROPERTIES', workflow: null }]);
+    });
+    test('are one per workflow, under the plain name, when they do not', () => {
+        // The name never changes; the block it is declared in does.
+        // `CIBUILD_SW__<WF>__<VAR>` is the encoding `ci secrets upload` carries a
+        // workflow-scoped *value* under, and a pipeline has structure instead.
+        expect(credentialSlots('LOCAL_PROPERTIES', {
+            primary: 'ciDynamic',
+            'pull-request': 'ciDynamic',
+            release: 'prod',
+        })).toEqual([
+            { slot: 'LOCAL_PROPERTIES', workflow: 'primary' },
+            { slot: 'LOCAL_PROPERTIES', workflow: 'pull-request' },
+            { slot: 'LOCAL_PROPERTIES', workflow: 'release' },
+        ]);
+    });
+    test('include the workflows that agree, not only the odd one out', () => {
+        // `pull-request` wants the same bytes as `primary`. It still needs a slot
+        // of its own: the encoded name is per workflow, and a workflow with no
+        // slot has no value and no tripwire.
+        const workflows = credentialSlots('KEYSTORE_BASE64', SPLIT_KEYSTORES).map((s) => s.workflow);
+        expect(workflows).toEqual(['primary', 'pull-request', 'release']);
+    });
+    test('are one when only one workflow reads the credential', () => {
+        expect(credentialSlots('KEYSTORE_PROPERTIES', { release: 'keystore.properties' })).toEqual([
+            { slot: 'KEYSTORE_PROPERTIES', workflow: null },
+        ]);
+    });
+});
+describe('a flavored repository', () => {
+    test('declares the properties file in each workflow, and not globally', () => {
+        const parsed = flavoredPipeline();
+        expect(declaringWorkflows(parsed, 'LOCAL_PROPERTIES')).toEqual([
+            'primary',
+            'pull-request',
+            'release',
+        ]);
+        // Globally would be one value for three workflows, which is the bug.
+        expect(envs(parsed)).not.toHaveProperty('LOCAL_PROPERTIES');
+    });
+    test('declares google-services.json and the keystore per workflow too', () => {
+        const parsed = flavoredPipeline();
+        for (const varName of ['GOOGLE_SERVICES_JSON', 'KEYSTORE_BASE64']) {
+            expect(declaringWorkflows(parsed, varName)).toEqual([
+                'primary',
+                'pull-request',
+                'release',
+            ]);
+            expect(envs(parsed)).not.toHaveProperty(varName);
+        }
+    });
+    test('keeps one slot for the credentials only `release` reads', () => {
+        // Genuinely release-only, and legitimately so: nothing else signs a
+        // release or talks to Google Play. A second slot for a workflow that never
+        // reads the value is a value the user is asked for and nothing consumes.
+        const parsed = flavoredPipeline();
+        expect(slotsFor(parsed, 'KEYSTORE_PROPERTIES')).toEqual(['KEYSTORE_PROPERTIES']);
+        expect(slotsFor(parsed, 'GOOGLE_PLAY_SERVICE_ACCOUNT_JSON')).toEqual([
+            'GOOGLE_PLAY_SERVICE_ACCOUNT_JSON',
+        ]);
+    });
+    test('leaves the step naming the credential, not the slot', () => {
+        // The `file@` step never learns the convention exists. `EnvResolver`
+        // resolves the plain name for the workflow being run, so one name in the
+        // step reads a different value in each workflow.
+        const parsed = flavoredPipeline();
+        for (const workflow of GENERATED_WORKFLOWS) {
+            const names = fileVarNames(parsed, workflow);
+            expect(names.length).toBeGreaterThan(0);
+            expect(names.filter((n) => n.startsWith('CIBUILD_'))).toEqual([]);
+        }
+    });
+    test('declares every slot empty, which is what `invarn setup` searches by', () => {
+        // `unsetEnvKeys` collects `envs` keys whose declared value is the empty
+        // string — from `app.envs` and from each workflow's own. A slot with
+        // anything else in it is never discovered on the developer's machine and
+        // never offered for upload.
+        const parsed = flavoredPipeline();
+        const isCredential = (k) => /^(KEYSTORE|GOOGLE|LOCAL)_/.test(k);
+        const declared = [
+            ...Object.entries(envs(parsed)),
+            ...Object.keys(parsed.workflows ?? {}).flatMap((w) => Object.entries(workflowEnvs(parsed, w))),
+        ].filter(([key]) => isCredential(key));
+        // Three per-workflow slots each for the properties file,
+        // google-services.json and the keystore; one flat slot each for the two
+        // release-only ones.
+        expect(declared.length).toBe(11);
+        for (const [, value] of declared)
+            expect(value).toBe('');
+    });
+    test('spends no encoding on what the block already says', () => {
+        // The workflow a declaration belongs to is the block it sits in. The
+        // `CIBUILD_SW__` prefix stays what it has always been: how `ci secrets
+        // upload` transports a workflow-scoped value into a flat key→value store
+        // that has no workflow column (Alex, 2026-09-10).
+        const yaml = generateAndroidPipeline(17, {
+            ...BASE,
+            ...ALL_CREDENTIALS,
+            keystorePaths: SPLIT_KEYSTORES,
+            googleServicesPaths: googleServicesTargets(FLAVORED, FLAVORS),
+            workflowFlavors: variantFlavors(FLAVORED, FLAVORS),
+        }, FLAVORED);
+        expect(yaml).not.toContain('CIBUILD_SW__');
+        expect(yaml).not.toContain('CIBUILD_S__');
+    });
+    test('puts a per-workflow declaration in a workflow the pipeline has', () => {
+        // Structural now, and that is the point: a declaration cannot name a
+        // workflow that does not exist, because it lives inside one.
+        const parsed = flavoredPipeline();
+        const present = Object.keys(parsed.workflows ?? {});
+        const perWorkflow = ['KEYSTORE_BASE64', 'GOOGLE_SERVICES_JSON', 'LOCAL_PROPERTIES'].flatMap((varName) => declaringWorkflows(parsed, varName));
+        expect(perWorkflow.length).toBe(9);
+        expect(perWorkflow.every((w) => present.includes(w))).toBe(true);
+    });
+});
+describe('a repository whose workflows all want the same bytes', () => {
+    test('is byte-identical to what the generator emitted before any of this', () => {
+        // The whole `app.envs` block, as it stood at cibuild d8263a1 with every
+        // credential switched on and no flavors anywhere. Item 02 must be inert
+        // here: this is what every already-onboarded project regenerates to.
+        const yaml = generateAndroidPipeline(17, { ...BASE, ...ALL_CREDENTIALS });
+        const block = yaml.slice(yaml.indexOf('app:\n'), yaml.indexOf('\nworkflows:'));
+        expect(block).toBe('app:\n' +
+            '  envs:\n' +
+            '    - PROJECT_LOCATION: .\n' +
+            '    - MODULE: app\n' +
+            '    - BUILD_TYPE: Debug\n' +
+            '    - GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.parallel=true\n' +
+            '    - KEYSTORE_BASE64: ""         # Set via: ci secrets add KEYSTORE_BASE64 -w primary\n' +
+            '    - KEYSTORE_PROPERTIES: ""      # Release signing — set via: ci secrets add KEYSTORE_PROPERTIES -w release\n' +
+            '    - GOOGLE_SERVICES_JSON: ""     # Set via: ci secrets add GOOGLE_SERVICES_JSON\n' +
+            '    - GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ""  # Set via: ci secrets add GOOGLE_PLAY_SERVICE_ACCOUNT_JSON -w release\n' +
+            '    - LOCAL_PROPERTIES: ""         # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES\n');
+        expect(yaml).not.toContain('CIBUILD_SW__');
+    });
+    test('is flat on one flavor as much as on none', () => {
+        // Three workflows, one flavor, three different build types. The build type
+        // is not what any of these credentials follows, so nothing splits.
+        const allCiDynamic = {
+            primary: variant('ciDynamicDebug'),
+            pullRequest: variant('ciDynamicDebug'),
+            release: variant('ciDynamicRelease'),
+        };
+        const yaml = generateAndroidPipeline(17, {
+            ...BASE,
+            ...ALL_CREDENTIALS,
+            googleServicesPaths: googleServicesTargets(allCiDynamic, FLAVORS),
+            workflowFlavors: variantFlavors(allCiDynamic, FLAVORS),
+        }, allCiDynamic);
+        expect(yaml).not.toContain('CIBUILD_SW__');
+        expect(slotsFor(parse(yaml), 'LOCAL_PROPERTIES')).toEqual(['LOCAL_PROPERTIES']);
+    });
+    test('is flat when one keystore serves every workflow', () => {
+        const yaml = generateAndroidPipeline(17, {
+            ...BASE,
+            keystore: true,
+            keystorePaths: { primary: 'app/one.jks', 'pull-request': 'app/one.jks', release: 'app/one.jks' },
+        });
+        expect(slotsFor(parse(yaml), 'KEYSTORE_BASE64')).toEqual(['KEYSTORE_BASE64']);
+    });
+    test('is flat when the scan resolved no keystore path at all', () => {
+        // Empty maps default the way the step defaults them, so a repository the
+        // scan could not resolve does not read as three disagreeing workflows.
+        const yaml = generateAndroidPipeline(17, { ...BASE, keystore: true });
+        expect(slotsFor(parse(yaml), 'KEYSTORE_BASE64')).toEqual(['KEYSTORE_BASE64']);
+    });
+    test('is flat when only some workflows resolved a path, and it is the default', () => {
+        const yaml = generateAndroidPipeline(17, {
+            ...BASE,
+            keystore: true,
+            keystorePaths: { release: 'keystore.jks' },
+        });
+        expect(slotsFor(parse(yaml), 'KEYSTORE_BASE64')).toEqual(['KEYSTORE_BASE64']);
+    });
+});
+//# sourceMappingURL=a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.js.map

package/dist/src/commands/an-already-stored-value-does-not-answer-the-target-question.test.d.ts

@@ -0,0 +1,29 @@
+/**
+ * A value already in `.cibuild-secrets.json` answers "what are the bytes".
+ * It does not answer "where does each workflow write them", and
+ * `collectFileSecret` used to treat the two as one question.
+ *
+ * `pendingGroups` is empty when every group already has the secret — and a
+ * **global** entry satisfies `hasSecret(name, workflow)` for every workflow, so
+ * one `ci init` in the repository's past is enough. The call then returned an
+ * empty paths map, the caller assigned that to `setupOptions.keystorePaths`,
+ * and the fallback filled every workflow from one source: the `storeFile=`
+ * line of whatever `keystore.properties` was collected, or the first path
+ * Gradle mentioned. One path for three workflows is one discriminator, so
+ * `credentialSlots` declared a single flat `KEYSTORE_BASE64` and the whole
+ * per-workflow split was lost — silently, and on exactly the credential the
+ * split exists for.
+ *
+ * Measured on the real repository, 2026-09-09: the store held
+ * `KEYSTORE_BASE64` globally, the keystore prompt never appeared, and all
+ * three workflows were generated writing to `customer-android.jks` — the
+ * release key's path, over the two debug workflows. A fresh clone of the same
+ * repository prompts and splits correctly, which is why this never showed up
+ * in a test that builds its own fixture from nothing.
+ *
+ * The store records values and never paths, so the path has to be asked for
+ * whichever the value's state is. Only a caller that consumes the returned map
+ * is affected — `promptTargetPath` marks it — so nothing else gains a prompt.
+ */
+export {};
+//# sourceMappingURL=an-already-stored-value-does-not-answer-the-target-question.test.d.ts.map