@invarn/cibuild 2.7.4 → 2.7.6

package/dist/src/commands/an-already-stored-value-does-not-answer-the-target-question.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"an-already-stored-value-does-not-answer-the-target-question.test.d.ts","sourceRoot":"","sources":["../../../src/commands/an-already-stored-value-does-not-answer-the-target-question.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG"}

package/dist/src/commands/an-already-stored-value-does-not-answer-the-target-question.test.js

@@ -0,0 +1,160 @@
+/**
+ * A value already in `.cibuild-secrets.json` answers "what are the bytes".
+ * It does not answer "where does each workflow write them", and
+ * `collectFileSecret` used to treat the two as one question.
+ *
+ * `pendingGroups` is empty when every group already has the secret — and a
+ * **global** entry satisfies `hasSecret(name, workflow)` for every workflow, so
+ * one `ci init` in the repository's past is enough. The call then returned an
+ * empty paths map, the caller assigned that to `setupOptions.keystorePaths`,
+ * and the fallback filled every workflow from one source: the `storeFile=`
+ * line of whatever `keystore.properties` was collected, or the first path
+ * Gradle mentioned. One path for three workflows is one discriminator, so
+ * `credentialSlots` declared a single flat `KEYSTORE_BASE64` and the whole
+ * per-workflow split was lost — silently, and on exactly the credential the
+ * split exists for.
+ *
+ * Measured on the real repository, 2026-09-09: the store held
+ * `KEYSTORE_BASE64` globally, the keystore prompt never appeared, and all
+ * three workflows were generated writing to `customer-android.jks` — the
+ * release key's path, over the two debug workflows. A fresh clone of the same
+ * repository prompts and splits correctly, which is why this never showed up
+ * in a test that builds its own fixture from nothing.
+ *
+ * The store records values and never paths, so the path has to be asked for
+ * whichever the value's state is. Only a caller that consumes the returned map
+ * is affected — `promptTargetPath` marks it — so nothing else gains a prompt.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import prompts from 'prompts';
+import { collectFileSecret } from './file-secret-collector.js';
+import { SecretsManager } from '../yaml/secrets-manager.js';
+import { credentialSlots } from './build.js';
+const KEYSTORE_GROUPS = [
+    { label: 'debug builds (primary, pull-request)', workflows: ['primary', 'pull-request'] },
+    { label: 'release', workflows: ['release'] },
+];
+let workdir;
+let secretsManager;
+// `prompts.inject` concatenates, so a sentinel one test leaves queued becomes
+// the next test's answer. The queue itself is the only reset there is.
+const clearInjected = () => {
+    prompts._injected = undefined;
+};
+beforeEach(() => {
+    clearInjected();
+    workdir = resolve(mkdtempSync(join(tmpdir(), 'cibuild-stored-value-target-')));
+    secretsManager = new SecretsManager(join(workdir, '.cibuild-secrets.json'));
+});
+afterEach(() => {
+    clearInjected();
+    rmSync(workdir, { recursive: true, force: true });
+});
+function put(relPath, contents) {
+    const full = join(workdir, relPath);
+    mkdirSync(join(full, '..'), { recursive: true });
+    writeFileSync(full, contents, 'utf-8');
+    return full;
+}
+/** The repository's shape: a committed debug key and an uncommitted release key. */
+function twoKeystores() {
+    return {
+        debug: put('config/debug.keystore', 'debug-key-bytes'),
+        release: put('app/customer-android.jks', 'release-key-bytes'),
+    };
+}
+function collectKeystore() {
+    return collectFileSecret({
+        displayName: 'keystore',
+        secretName: 'KEYSTORE_BASE64',
+        fileMatch: (name) => name.endsWith('.jks') || name.endsWith('.keystore'),
+        readAs: 'base64',
+        workflowGroups: KEYSTORE_GROUPS,
+        promptTargetPath: true,
+    }, workdir, secretsManager);
+}
+describe('a keystore whose value the store already holds', () => {
+    test('is still asked where each workflow writes it', async () => {
+        const { debug, release } = twoKeystores();
+        // One `ci init` in this repository's past, filed globally — which is what
+        // the real repository had.
+        secretsManager.storeSecret('KEYSTORE_BASE64', 'already-here');
+        prompts.inject([debug, release]);
+        const paths = await collectKeystore();
+        expect(paths).toEqual({
+            primary: 'config/debug.keystore',
+            'pull-request': 'config/debug.keystore',
+            release: 'app/customer-android.jks',
+        });
+    });
+    test('so the credential still declares one slot per workflow', async () => {
+        const { debug, release } = twoKeystores();
+        secretsManager.storeSecret('KEYSTORE_BASE64', 'already-here');
+        prompts.inject([debug, release]);
+        const paths = await collectKeystore();
+        const discriminatorByWorkflow = Object.fromEntries(Object.entries(paths).map(([workflow, path]) => [workflow, path]));
+        // One declaration per workflow, each under the plain name — what varies is
+        // the `envs` block it is emitted into, not the key.
+        expect(credentialSlots('KEYSTORE_BASE64', discriminatorByWorkflow)).toEqual([
+            { slot: 'KEYSTORE_BASE64', workflow: 'primary' },
+            { slot: 'KEYSTORE_BASE64', workflow: 'pull-request' },
+            { slot: 'KEYSTORE_BASE64', workflow: 'release' },
+        ]);
+    });
+    test('and a workflow-scoped entry hides the question just as well as a global one', async () => {
+        const { debug, release } = twoKeystores();
+        for (const workflow of ['primary', 'pull-request', 'release']) {
+            secretsManager.storeSecret('KEYSTORE_BASE64', 'already-here', workflow);
+        }
+        prompts.inject([debug, release]);
+        expect(await collectKeystore()).toEqual({
+            primary: 'config/debug.keystore',
+            'pull-request': 'config/debug.keystore',
+            release: 'app/customer-android.jks',
+        });
+    });
+    test('and the value the user picks now replaces the one that was there', async () => {
+        const { debug, release } = twoKeystores();
+        secretsManager.storeSecret('KEYSTORE_BASE64', 'already-here');
+        prompts.inject([debug, release]);
+        await collectKeystore();
+        // Re-reading it is the point: a stale global value is what would otherwise
+        // be uploaded for all three workflows.
+        expect(secretsManager.getSecret('KEYSTORE_BASE64', 'primary')).toBe(Buffer.from('debug-key-bytes').toString('base64'));
+        expect(secretsManager.getSecret('KEYSTORE_BASE64', 'release')).toBe(Buffer.from('release-key-bytes').toString('base64'));
+    });
+});
+describe('a credential whose caller does not need a path back', () => {
+    test('still short-circuits on an already-stored value, and asks nothing', async () => {
+        // `google-services.json`, `local.properties` and `keystore.properties` take
+        // their targets from the pipeline's own flavors, not from this call, so the
+        // early return is right for them and must stay. No answer is injected: a
+        // prompt here would hang or take undefined, and either fails the test.
+        put('app/src/prod/google-services.json', '{}');
+        secretsManager.storeSecret('GOOGLE_SERVICES_JSON', 'already-here');
+        const paths = await collectFileSecret({
+            displayName: 'google-services.json',
+            secretName: 'GOOGLE_SERVICES_JSON',
+            fileMatch: (name) => name === 'google-services.json',
+            readAs: 'text',
+            workflowGroups: [{ label: 'release', workflows: ['release'] }],
+        }, workdir, secretsManager);
+        expect(paths).toEqual({});
+        expect(secretsManager.getSecret('GOOGLE_SERVICES_JSON', 'release')).toBe('already-here');
+    });
+});
+describe('a keystore the store has never seen', () => {
+    test('behaves exactly as it did before', async () => {
+        const { debug, release } = twoKeystores();
+        prompts.inject([debug, release]);
+        expect(await collectKeystore()).toEqual({
+            primary: 'config/debug.keystore',
+            'pull-request': 'config/debug.keystore',
+            release: 'app/customer-android.jks',
+        });
+    });
+});
+//# sourceMappingURL=an-already-stored-value-does-not-answer-the-target-question.test.js.map

package/dist/src/commands/android-scanner.d.ts

@@ -132,8 +132,16 @@ export declare function runnableJavaVersion(detectedJavaVersion: number | undefi
  */
 export declare function javaVersionProblem(detectedJavaVersion: number | undefined, gradleVersion?: string): string | undefined;
 /**
- * Detects build types and product flavors from Gradle files by static parsing.
+ * Detects build types and product flavors from Gradle files by static parsing,
+ * falling back to the module's source sets for the flavors when no Gradle file
+ * declares any (see `flavorsFromSourceSets`).
+ *
  * Always includes "debug" and "release" as defaults.
+ *
+ * The fallback only ever runs when the literal scan found nothing, so a
+ * project whose Gradle files declare flavors is decided by those files exactly
+ * as before. Merging the two would let a leftover directory invent a flavor
+ * the build does not have.
  */
 export declare function detectBuildVariants(gradleFiles: string[]): BuildVariants;
 export declare function scanAndroidProject(projectRoot: string): Promise<ScanResult>;

package/dist/src/commands/android-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/android-scanner.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wFAAwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAwKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAcnE;AAyKD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8CjD;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7E;AAQD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsBvF;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIrF;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,UAAsB,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAuC,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAQR;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAkBpB;AA6FD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAmCxE;AAMD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAoQjF;AAgBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAyD3D"}
+{"version":3,"file":"android-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/android-scanner.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wFAAwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAwKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAcnE;AAyKD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8CjD;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7E;AAQD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsBvF;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIrF;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,UAAsB,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAuC,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAQR;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAkBpB;AAwLD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAsCxE;AAMD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAoQjF;AAgBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAyD3D"}

package/dist/src/commands/android-scanner.js

@@ -1,4 +1,4 @@
-import { resolve, relative } from "node:path";
+import { resolve, join, relative, dirname } from "node:path";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { parseSettingsModules } from "../shared/gradle-settings.js";
 // ---------------------------------------------------------------------------
@@ -655,9 +655,107 @@ function extractDirectChildNames(block) {
     }
     return [...new Set(names)];
 }
+/** Source-set directories AGP defines itself, which never name a flavor. */
+const SHARED_SOURCE_SETS = new Set(["main", "test", "androidTest", "testFixtures"]);
+/** `testProd` and `androidTestProd` are `prod`'s test source sets, not flavors. */
+const TEST_SOURCE_SET_PREFIXES = ["test", "androidTest"];
 /**
- * Detects build types and product flavors from Gradle files by static parsing.
+ * What a source set holds. A directory under `src/` carrying none of these is
+ * something a human left there, not a source set AGP would read.
+ */
+const SOURCE_SET_CONTENTS = new Set([
+    "java",
+    "kotlin",
+    "res",
+    "resources",
+    "assets",
+    "aidl",
+    "jni",
+    "jniLibs",
+    "rs",
+    "renderscript",
+    "shaders",
+    "ml",
+    "baselineProfiles",
+    "AndroidManifest.xml",
+    "google-services.json",
+]);
+function safeReaddir(dir) {
+    try {
+        return readdirSync(dir, { withFileTypes: true }).map((e) => ({
+            name: e.name,
+            isDirectory: e.isDirectory(),
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+/** `testProd` starts with the segment `test`; a flavor called `testing` does not. */
+function startsWithSegment(name, segment) {
+    if (!name.startsWith(segment) || name.length === segment.length)
+        return false;
+    const next = name[segment.length];
+    return next === next.toUpperCase() && next !== next.toLowerCase();
+}
+/** `ciDynamicDebug` ends with the segment `debug`; `staging` does not. */
+function endsWithSegment(name, segment) {
+    const capitalized = segment.charAt(0).toUpperCase() + segment.slice(1);
+    return name.length > capitalized.length && name.endsWith(capitalized);
+}
+/**
+ * Product flavors read from the source sets a module has on disk.
+ *
+ * Modern Android declares its flavors in a convention plugin — an enum in
+ * Kotlin source, applied through `create(flavor.name)` — so there is no
+ * literal `productFlavors { … }` block anywhere to parse. The scan is static
+ * by design (running a Gradle configuration phase to list flavors would cost
+ * minutes on every `ci build`), so the evidence has to be something already on
+ * disk. A flavor has a source set, which is the same evidence `invarn setup`
+ * has always resolved `google-services.json` by.
+ *
+ * A directory under `<module>/src/` names a flavor when it is none of the
+ * things AGP creates for its own reasons: the shared and test source sets, a
+ * build type, a test source set for one flavor, or a variant — a flavor and a
+ * build type already joined, which taking for a flavor would cross with the
+ * build types a second time and offer `ciDynamicDebugDebug`.
+ */
+function flavorsFromSourceSets(gradleFiles, buildTypes) {
+    const found = new Set();
+    for (const filePath of gradleFiles) {
+        const srcDir = join(dirname(filePath), "src");
+        for (const entry of safeReaddir(srcDir)) {
+            if (!entry.isDirectory)
+                continue;
+            const name = entry.name;
+            if (SHARED_SOURCE_SETS.has(name))
+                continue;
+            if (buildTypes.includes(name))
+                continue;
+            if (TEST_SOURCE_SET_PREFIXES.some((p) => startsWithSegment(name, p)))
+                continue;
+            if (buildTypes.some((bt) => endsWithSegment(name, bt)))
+                continue;
+            const holds = safeReaddir(join(srcDir, name));
+            if (!holds.some((child) => SOURCE_SET_CONTENTS.has(child.name)))
+                continue;
+            found.add(name);
+        }
+    }
+    // The filesystem's order is not a declaration order, so give it one.
+    return Array.from(found).sort();
+}
+/**
+ * Detects build types and product flavors from Gradle files by static parsing,
+ * falling back to the module's source sets for the flavors when no Gradle file
+ * declares any (see `flavorsFromSourceSets`).
+ *
  * Always includes "debug" and "release" as defaults.
+ *
+ * The fallback only ever runs when the literal scan found nothing, so a
+ * project whose Gradle files declare flavors is decided by those files exactly
+ * as before. Merging the two would let a leftover directory invent a flavor
+ * the build does not have.
  */
 export function detectBuildVariants(gradleFiles) {
     const buildTypeSet = new Set(["debug", "release"]);
@@ -678,7 +776,9 @@ export function detectBuildVariants(gradleFiles) {
         }
     }
     const buildTypes = Array.from(buildTypeSet);
-    const productFlavors = Array.from(productFlavorSet);
+    const productFlavors = productFlavorSet.size > 0
+        ? Array.from(productFlavorSet)
+        : flavorsFromSourceSets(gradleFiles, buildTypes);
     const variants = productFlavors.length === 0
         ? buildTypes
         : productFlavors.flatMap((flavor) => buildTypes.map((bt) => `${flavor}${bt.charAt(0).toUpperCase()}${bt.slice(1)}`));

package/dist/src/commands/build.d.ts

@@ -1,4 +1,5 @@
 import type { BuildWarning } from "./android-scanner.js";
+import type { WorkflowGroup } from "./file-secret-collector.js";
 export interface SetupOptions {
     keystore: boolean;
     keystoreProperties: boolean;
@@ -9,6 +10,35 @@ export interface SetupOptions {
     artifactType: 'apk' | 'aab';
     /** Resolved keystore file paths per workflow (relative to project root), if found on disk. */
     keystorePaths: Record<string, string>;
+    /**
+     * Where each workflow's `google-services.json` is written. It follows the
+     * **flavor** the workflow builds: Android gives every product flavor its own
+     * source set, each with its own copy of the file, and the plugin resolves by
+     * specificity — variant, build type, flavor, module root. A workflow
+     * building `ciDynamicDebug` therefore wants
+     * `app/src/ciDynamic/google-services.json`, and a workflow building
+     * `prodRelease` wants a different file at a different path.
+     *
+     * The *value* varies per workflow too, and that needs no second map: a
+     * secret is scoped to a workflow by its name — `CIBUILD_SW__PRIMARY__X`
+     * beside `CIBUILD_SW__RELEASE__X` — which `SecretsManager` decodes and
+     * `EnvResolver` resolves for the workflow being run. One `var_name` in the
+     * step, one declared slot, and the workflow picks the value.
+     */
+    googleServicesPaths: Record<string, string>;
+    /**
+     * The product flavor each workflow's variant builds, or null where the
+     * variant names none.
+     *
+     * `LOCAL_PROPERTIES` follows this rather than a target path, and it is the
+     * only credential that has to: every workflow writes the same
+     * `local.properties` to the same place, so nothing about the path says the
+     * bytes differ. What belongs *in* the file is the flavor's environment — a
+     * different base API URL plus twenty other keys the Secrets Gradle Plugin
+     * turns into `BuildConfig` — so two workflows on different flavors cannot
+     * share one value, and `credentialSlots` splits the slot when they disagree.
+     */
+    workflowFlavors: Record<string, string | null>;
     /**
      * Whether a build file applies the Google Secrets Gradle Plugin and reads a
      * properties file the repository does not carry. The plugin's evaluation
@@ -58,7 +88,104 @@ export interface IosSetupOptions {
  * that applies the plugin* and names the properties file only in its message.
  */
 export declare function secretsPropertiesFileFrom(warnings: BuildWarning[]): string | null;
-export declare function detectSetupNeeds(warnings: BuildWarning[]): Omit<SetupOptions, "keystorePaths">;
+/**
+ * The product flavor a variant builds, out of the flavors the scanner found —
+ * `ciDynamicDebug` is a build of `ciDynamic`, `prodRelease` of `prod`.
+ *
+ * An Android variant name is the flavor followed by the capitalised build
+ * type, so the character after the flavor has to be an upper-case one. That
+ * check is load-bearing: without it a flavor called `pro` would claim
+ * `prodRelease`. The longest match wins, so `ciDynamic` beats `ci` on a
+ * repository that declares both.
+ */
+export declare function flavorOfVariant(variant: string, productFlavors: string[]): string | null;
+/** Where a flavor's `google-services.json` belongs inside the app module. */
+export declare function googleServicesPathFor(flavor: string | null, module?: string): string;
+/**
+ * The per-workflow path and key maps for `SetupOptions`, from the variants the
+ * workflows build and the flavors the scanner found.
+ *
+ * `app/google-services.json` used to be hardcoded here. For a flavored build
+ * that is the plugin's *fallback* location, not the right one, and writing
+ * there is silently wrong rather than loudly wrong: the plugin finds a file,
+ * parses it, and fails on a package name — which reads as a Firebase
+ * misconfiguration rather than as the wrong file having been delivered. That
+ * is what `bld_8e60d90ab4e55f85d2f72459` spent 1292 Gradle tasks proving.
+ */
+export declare function googleServicesTargets(variants: WorkflowVariants, productFlavors: string[], module?: string): Record<string, string>;
+/** The three workflows every generated pipeline has, in the order they are emitted. */
+export declare const GENERATED_WORKFLOWS: readonly ["primary", "pull-request", "release"];
+/**
+ * The `workflowFlavors` map for `SetupOptions`, from the variants the
+ * workflows build and the flavors the scanner found.
+ */
+export declare function variantFlavors(variants: WorkflowVariants, productFlavors: string[]): Record<string, string | null>;
+/** One `envs` slot to declare, and the workflow it belongs to. */
+export interface CredentialSlot {
+    slot: string;
+    /** null when one slot serves every workflow that reads the credential. */
+    workflow: string | null;
+}
+/**
+ * The `envs` slots one credential needs: one when every workflow that reads it
+ * wants the same bytes, one per workflow when they do not.
+ *
+ * What "the same bytes" means is the credential's own business — a keystore
+ * follows the target path the pipeline declares for it, `google-services.json`
+ * the flavor's source set, `local.properties` the flavor itself — so the
+ * caller passes the discriminator it already computed, one entry per workflow
+ * that reads the credential, and this decides only whether they agree. A
+ * credential only one workflow reads can never disagree, which is why the
+ * genuinely release-only ones keep one slot however flavored the repository
+ * is.
+ *
+ * **The name never changes — the block it sits in does.** An agreed credential
+ * is declared once in `app.envs`; a disagreement is declared under the plain
+ * credential name in **each workflow's own `envs`**, which is where the YAML
+ * already says which workflow something belongs to. `EnvResolver` merges
+ * `app.envs` and then the running workflow's own, so `release`'s declaration is
+ * invisible to `primary` without anything being encoded.
+ *
+ * `CIBUILD_SW__<WORKFLOW>__<VAR>` is deliberately *not* used here. That prefix
+ * is the transport encoding `ci secrets upload` carries a workflow-scoped
+ * **value** under — Invarn's secret scopes have no workflow column, so the
+ * workflow travels in the key. A pipeline has structure instead, and spending
+ * the encoding there would be a second way to say what the block already says
+ * (Alex, 2026-09-10).
+ *
+ * Every workflow gets a slot, not only the odd one out: a workflow left without
+ * one would have neither a value nor the declaration `file@1.0.0` refuses over.
+ *
+ * The `file@` step's `var_name` is the same plain name either way.
+ */
+export declare function credentialSlots(varName: string, discriminatorByWorkflow: Record<string, string | null | undefined>): CredentialSlot[];
+/** One group of workflows a credential's value is collected for, and what they share. */
+export interface CollectionGroup extends WorkflowGroup {
+    /** The value of whatever the credential follows, shared by this group's workflows. */
+    discriminator: string;
+}
+/**
+ * The groups `ci init` collects a credential's value in: one per distinct value
+ * of whatever that credential follows, in workflow order.
+ *
+ * The same discriminator `credentialSlots` splits the *declaration* by, and
+ * deliberately the same function computing it, so what `ci init` asks for and
+ * what the pipeline declares cannot drift apart. One group means one slot and
+ * one question; two groups mean one slot per workflow and a question per group.
+ */
+export declare function collectionGroups(discriminatorByWorkflow: Record<string, string>, label: (discriminator: string, workflows: string[]) => string): CollectionGroup[];
+/**
+ * The groups the Secrets Gradle Plugin's properties file is collected in: one
+ * per flavor.
+ *
+ * Unlike `google-services.json`, nothing about this credential's target says
+ * the bytes differ — every workflow writes the same file to the same path.
+ * What differs is the content: the plugin turns the file into `BuildConfig`,
+ * and a flavor is an environment. Asking once and storing one value gives
+ * `prod` the CI backend's base URL, on a green build.
+ */
+export declare function propertiesFileGroups(workflowFlavors: Record<string, string | null>): CollectionGroup[];
+export declare function detectSetupNeeds(warnings: BuildWarning[]): Omit<SetupOptions, "keystorePaths" | "googleServicesPaths" | "workflowFlavors">;
 /**
  * The `trigger_map` block appended to every generated pipeline.
  *

package/dist/src/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,sBAAsB,CAAC;AAQrE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAiID;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAYjF;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAoB9F;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAqP,EAC5P,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CAmPR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,sBAAsB,CAAC;AAMrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAIhE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;;;;;;;;OAWG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAiID;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAYjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CASxF;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,SAAQ,GAAG,MAAM,CAInF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,MAAM,EAAE,EACxB,MAAM,SAAQ,GACb,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,iDAAkD,CAAC;AAWnF;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAM/B;AAED,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GACjE,cAAc,EAAE,CAOlB;AAgBD,yFAAyF;AACzF,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,sFAAsF;IACtF,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/C,KAAK,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,MAAM,GAC5D,eAAe,EAAE,CAUnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAC7C,eAAe,EAAE,CAInB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,YAAY,EAAE,GACvB,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,CAAC,CAoBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAmS,EAC1S,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CAyTR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}