@invarn/cibuild 2.7.4 → 2.7.6

package/dist/src/commands/build.js

@@ -135,6 +135,158 @@ export function secretsPropertiesFileFrom(warnings) {
     }
     return "local.properties";
 }
+/**
+ * The product flavor a variant builds, out of the flavors the scanner found —
+ * `ciDynamicDebug` is a build of `ciDynamic`, `prodRelease` of `prod`.
+ *
+ * An Android variant name is the flavor followed by the capitalised build
+ * type, so the character after the flavor has to be an upper-case one. That
+ * check is load-bearing: without it a flavor called `pro` would claim
+ * `prodRelease`. The longest match wins, so `ciDynamic` beats `ci` on a
+ * repository that declares both.
+ */
+export function flavorOfVariant(variant, productFlavors) {
+    const matches = productFlavors
+        .filter((flavor) => {
+        if (flavor.length === 0 || !variant.startsWith(flavor))
+            return false;
+        const head = variant.slice(flavor.length)[0];
+        return head !== undefined && head === head.toUpperCase() && head !== head.toLowerCase();
+    })
+        .sort((a, b) => b.length - a.length);
+    return matches[0] ?? null;
+}
+/** Where a flavor's `google-services.json` belongs inside the app module. */
+export function googleServicesPathFor(flavor, module = "app") {
+    return flavor
+        ? `${module}/src/${flavor}/google-services.json`
+        : `${module}/google-services.json`;
+}
+/**
+ * The per-workflow path and key maps for `SetupOptions`, from the variants the
+ * workflows build and the flavors the scanner found.
+ *
+ * `app/google-services.json` used to be hardcoded here. For a flavored build
+ * that is the plugin's *fallback* location, not the right one, and writing
+ * there is silently wrong rather than loudly wrong: the plugin finds a file,
+ * parses it, and fails on a package name — which reads as a Firebase
+ * misconfiguration rather than as the wrong file having been delivered. That
+ * is what `bld_8e60d90ab4e55f85d2f72459` spent 1292 Gradle tasks proving.
+ */
+export function googleServicesTargets(variants, productFlavors, module = "app") {
+    const paths = {};
+    for (const [workflow, config] of variantByWorkflow(variants)) {
+        const flavor = flavorOfVariant(config.variant, productFlavors);
+        paths[workflow] = googleServicesPathFor(flavor, module);
+    }
+    return paths;
+}
+/** The three workflows every generated pipeline has, in the order they are emitted. */
+export const GENERATED_WORKFLOWS = ["primary", "pull-request", "release"];
+/** The variant each workflow builds, keyed by the workflow's name in the YAML. */
+function variantByWorkflow(variants) {
+    return [
+        ["primary", variants.primary],
+        ["pull-request", variants.pullRequest],
+        ["release", variants.release],
+    ];
+}
+/**
+ * The `workflowFlavors` map for `SetupOptions`, from the variants the
+ * workflows build and the flavors the scanner found.
+ */
+export function variantFlavors(variants, productFlavors) {
+    const flavors = {};
+    for (const [workflow, config] of variantByWorkflow(variants)) {
+        flavors[workflow] = flavorOfVariant(config.variant, productFlavors);
+    }
+    return flavors;
+}
+/**
+ * The `envs` slots one credential needs: one when every workflow that reads it
+ * wants the same bytes, one per workflow when they do not.
+ *
+ * What "the same bytes" means is the credential's own business — a keystore
+ * follows the target path the pipeline declares for it, `google-services.json`
+ * the flavor's source set, `local.properties` the flavor itself — so the
+ * caller passes the discriminator it already computed, one entry per workflow
+ * that reads the credential, and this decides only whether they agree. A
+ * credential only one workflow reads can never disagree, which is why the
+ * genuinely release-only ones keep one slot however flavored the repository
+ * is.
+ *
+ * **The name never changes — the block it sits in does.** An agreed credential
+ * is declared once in `app.envs`; a disagreement is declared under the plain
+ * credential name in **each workflow's own `envs`**, which is where the YAML
+ * already says which workflow something belongs to. `EnvResolver` merges
+ * `app.envs` and then the running workflow's own, so `release`'s declaration is
+ * invisible to `primary` without anything being encoded.
+ *
+ * `CIBUILD_SW__<WORKFLOW>__<VAR>` is deliberately *not* used here. That prefix
+ * is the transport encoding `ci secrets upload` carries a workflow-scoped
+ * **value** under — Invarn's secret scopes have no workflow column, so the
+ * workflow travels in the key. A pipeline has structure instead, and spending
+ * the encoding there would be a second way to say what the block already says
+ * (Alex, 2026-09-10).
+ *
+ * Every workflow gets a slot, not only the odd one out: a workflow left without
+ * one would have neither a value nor the declaration `file@1.0.0` refuses over.
+ *
+ * The `file@` step's `var_name` is the same plain name either way.
+ */
+export function credentialSlots(varName, discriminatorByWorkflow) {
+    const distinct = new Set(Object.values(discriminatorByWorkflow));
+    if (distinct.size <= 1)
+        return [{ slot: varName, workflow: null }];
+    return Object.keys(discriminatorByWorkflow).map((workflow) => ({
+        slot: varName,
+        workflow,
+    }));
+}
+/**
+ * One discriminator per workflow, defaulted the way the step that writes the
+ * credential defaults its own input — so a repository whose scan resolved
+ * nothing does not read as three workflows that disagree.
+ */
+function discriminators(map, fallback) {
+    const out = {};
+    for (const workflow of GENERATED_WORKFLOWS)
+        out[workflow] = map[workflow] ?? fallback;
+    return out;
+}
+/**
+ * The groups `ci init` collects a credential's value in: one per distinct value
+ * of whatever that credential follows, in workflow order.
+ *
+ * The same discriminator `credentialSlots` splits the *declaration* by, and
+ * deliberately the same function computing it, so what `ci init` asks for and
+ * what the pipeline declares cannot drift apart. One group means one slot and
+ * one question; two groups mean one slot per workflow and a question per group.
+ */
+export function collectionGroups(discriminatorByWorkflow, label) {
+    const byDiscriminator = new Map();
+    for (const [workflow, value] of Object.entries(discriminatorByWorkflow)) {
+        byDiscriminator.set(value, [...(byDiscriminator.get(value) ?? []), workflow]);
+    }
+    return [...byDiscriminator].map(([discriminator, workflows]) => ({
+        label: label(discriminator, workflows),
+        workflows,
+        discriminator,
+    }));
+}
+/**
+ * The groups the Secrets Gradle Plugin's properties file is collected in: one
+ * per flavor.
+ *
+ * Unlike `google-services.json`, nothing about this credential's target says
+ * the bytes differ — every workflow writes the same file to the same path.
+ * What differs is the content: the plugin turns the file into `BuildConfig`,
+ * and a flavor is an environment. Asking once and storing one value gives
+ * `prod` the CI backend's base URL, on a green build.
+ */
+export function propertiesFileGroups(workflowFlavors) {
+    return collectionGroups(discriminators(workflowFlavors, ""), (flavor, workflows) => flavor ? `the ${flavor} flavor (${workflows.join(", ")})` : "every workflow");
+}
 export function detectSetupNeeds(warnings) {
     const secretsPropertiesPath = secretsPropertiesFileFrom(warnings);
     return {
@@ -174,7 +326,7 @@ trigger_map:
     workflow: pull-request
 `;
 }
-export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {}, secretsProperties: false, secretsPropertiesPath: 'local.properties' }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
+export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {}, googleServicesPaths: {}, workflowFlavors: {}, secretsProperties: false, secretsPropertiesPath: 'local.properties' }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
     const keystoreStepFor = (wf) => {
         if (!setup.keystore)
             return "";
@@ -191,26 +343,58 @@ export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: fa
     };
     // Add BUILD_TYPE override to workflow envs when it differs from the global default ("Debug")
     const buildTypeEnvOverride = (v) => v.buildType !== "Debug" ? `      - BUILD_TYPE: ${v.buildType}\n` : "";
-    // Optional env var stubs (empty defaults — filled via ci secrets add)
-    const keystoreEnv = setup.keystore
-        ? `    - KEYSTORE_BASE64: ""         # Set via: ci secrets add KEYSTORE_BASE64 -w primary\n`
-        : "";
-    const keystorePropertiesEnv = setup.keystoreProperties
-        ? `    - KEYSTORE_PROPERTIES: ""      # Release signing — set via: ci secrets add KEYSTORE_PROPERTIES -w release\n`
-        : "";
-    const googleServicesEnv = setup.googleServices
-        ? `    - GOOGLE_SERVICES_JSON: ""     # Set via: ci secrets add GOOGLE_SERVICES_JSON\n`
-        : "";
-    const googlePlayEnv = setup.googlePlayDeploy
-        ? `    - GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ""  # Set via: ci secrets add GOOGLE_PLAY_SERVICE_ACCOUNT_JSON -w release\n`
-        : "";
-    // Declared globally and on purpose: `unsetEnvKeys` — what `invarn setup`
-    // searches the developer's machine by — reads `envs`, never step inputs. An
-    // undeclared LOCAL_PROPERTIES is never discovered and never offered for
-    // upload, however many steps name it.
-    const secretsPropertiesEnv = setup.secretsProperties
-        ? `    - LOCAL_PROPERTIES: ""         # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES\n`
-        : "";
+    // Optional env var stubs (empty defaults — filled via ci secrets add).
+    //
+    // Declared and not merely used by a step: `unsetEnvKeys` — what `invarn
+    // setup` searches the developer's machine by — reads `envs`, never step
+    // inputs. An undeclared credential is never discovered and never offered for
+    // upload, however many steps name it. The same declaration is what
+    // `file@1.0.0` refuses over when nobody supplied the value.
+    //
+    // One slot per credential where every workflow that reads it wants the same
+    // bytes, and one per workflow where they do not — see `credentialSlots`. The
+    // name is the plain credential either way; a per-workflow one is declared in
+    // that workflow's own `envs` rather than under an encoded name.
+    const appEnvDeclarations = [];
+    const workflowEnvDeclarations = {};
+    const declare = (varName, discriminatorByWorkflow, comment) => {
+        for (const { slot, workflow } of credentialSlots(varName, discriminatorByWorkflow)) {
+            if (workflow === null) {
+                appEnvDeclarations.push(`    - ${slot}: ""${comment(null)}\n`);
+                continue;
+            }
+            // Six spaces, not four: a workflow's `envs` sits one level deeper.
+            (workflowEnvDeclarations[workflow] ??= []).push(`      - ${slot}: ""${comment(workflow)}\n`);
+        }
+    };
+    /** Every credential declaration this workflow owns, after its own variables. */
+    const workflowEnvFor = (workflow) => (workflowEnvDeclarations[workflow] ?? []).join("");
+    // Declared in the order they appear in `app.envs`, which the byte-identity
+    // test on an unflavored pipeline pins.
+    if (setup.keystore) {
+        declare("KEYSTORE_BASE64", discriminators(setup.keystorePaths, "keystore.jks"), (wf) => wf
+            ? `  # Set via: ci secrets add KEYSTORE_BASE64 -w ${wf}`
+            : `         # Set via: ci secrets add KEYSTORE_BASE64 -w primary`);
+    }
+    // Release-only, and legitimately so: nothing but `release` signs a release
+    // or talks to Google Play, so there is no second workflow to disagree with.
+    if (setup.keystoreProperties) {
+        appEnvDeclarations.push(`    - KEYSTORE_PROPERTIES: ""      # Release signing — set via: ci secrets add KEYSTORE_PROPERTIES -w release\n`);
+    }
+    if (setup.googleServices) {
+        declare("GOOGLE_SERVICES_JSON", discriminators(setup.googleServicesPaths, "app/google-services.json"), (wf) => wf
+            ? `  # Set via: ci secrets add GOOGLE_SERVICES_JSON -w ${wf}`
+            : `     # Set via: ci secrets add GOOGLE_SERVICES_JSON`);
+    }
+    if (setup.googlePlayDeploy) {
+        appEnvDeclarations.push(`    - GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ""  # Set via: ci secrets add GOOGLE_PLAY_SERVICE_ACCOUNT_JSON -w release\n`);
+    }
+    if (setup.secretsProperties) {
+        declare("LOCAL_PROPERTIES", discriminators(setup.workflowFlavors, ""), (wf) => wf
+            ? `  # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES -w ${wf}`
+            : `         # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES`);
+    }
+    const appEnv = appEnvDeclarations.join("");
     /**
      * The Secrets Gradle Plugin's properties file, written into every workflow
      * that builds. Its evaluation listener runs for every variant, so a debug
@@ -227,15 +411,28 @@ export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: fa
             var_name: LOCAL_PROPERTIES
 `
         : "";
-    const googleServicesStep = setup.googleServices
-        ? `
+    /**
+     * Per workflow, exactly as the keystore is: the flavor a workflow builds
+     * decides where the file is written. A workflow whose variant names no
+     * flavor is unchanged — `app/google-services.json`.
+     *
+     * The `var_name` is the same in every workflow on purpose. Scoping a value
+     * to a workflow is the *secret's* job, not the step's: `CIBUILD_SW__<WF>__X`
+     * is decoded by `SecretsManager` and resolved by `EnvResolver` for the
+     * workflow being run, so one name here reads a different value there.
+     */
+    const googleServicesStepFor = (wf) => {
+        if (!setup.googleServices)
+            return "";
+        const path = setup.googleServicesPaths[wf] ?? "app/google-services.json";
+        return `
       - file@1.0.0:
           is_skippable: true
           inputs:
-            target_path: app/google-services.json
+            target_path: ${path}
             var_name: GOOGLE_SERVICES_JSON
-`
-        : "";
+`;
+    };
     const googlePlayStep = setup.googlePlayDeploy
         ? `
       - file@1.0.0:
@@ -290,14 +487,14 @@ app:
     - MODULE: app
     - BUILD_TYPE: Debug
     - GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.parallel=true
-${keystoreEnv}${keystorePropertiesEnv}${googleServicesEnv}${googlePlayEnv}${secretsPropertiesEnv}
+${appEnv}
 workflows:
   primary:
     envs:
       - VARIANT: ${pv.variant}
-${buildTypeEnvOverride(pv)}
+${buildTypeEnvOverride(pv)}${workflowEnvFor("primary")}
     steps:
-${keystoreStepFor("primary")}${googleServicesStep}${secretsPropertiesStep}
+${keystoreStepFor("primary")}${googleServicesStepFor("primary")}${secretsPropertiesStep}
       - set-java-version@1.0.0:
           inputs:
             java_version: '${javaVersion}'
@@ -335,9 +532,9 @@ ${keystoreStepFor("primary")}${googleServicesStep}${secretsPropertiesStep}
   pull-request:
     envs:
       - VARIANT: ${prv.variant}
-${buildTypeEnvOverride(prv)}
+${buildTypeEnvOverride(prv)}${workflowEnvFor("pull-request")}
     steps:
-${keystoreStepFor("pull-request")}${googleServicesStep}${secretsPropertiesStep}
+${keystoreStepFor("pull-request")}${googleServicesStepFor("pull-request")}${secretsPropertiesStep}
       - set-java-version@1.0.0:
           inputs:
             java_version: '${javaVersion}'
@@ -374,9 +571,9 @@ ${keystoreStepFor("pull-request")}${googleServicesStep}${secretsPropertiesStep}
   release:
     envs:
       - VARIANT: ${rv.variant}
-${buildTypeEnvOverride(rv)}
+${buildTypeEnvOverride(rv)}${workflowEnvFor("release")}
     steps:
-${keystoreStepFor("release")}${keystorePropertiesStep}${googleServicesStep}${secretsPropertiesStep}
+${keystoreStepFor("release")}${keystorePropertiesStep}${googleServicesStepFor("release")}${secretsPropertiesStep}
       - set-java-version@1.0.0:
           inputs:
             java_version: '${javaVersion}'
@@ -943,7 +1140,13 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
     }
     // 4. Prompt to generate setup steps for detected file issues
     const setupNeeds = detectSetupNeeds(scanResult.warnings);
-    const setupOptions = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {}, secretsProperties: false, secretsPropertiesPath: setupNeeds.secretsPropertiesPath };
+    // Which flavor each workflow builds decides where its google-services.json
+    // is written, and — with no path to give it away — whether the properties
+    // file can be one value or has to be one per workflow. Both maps are
+    // derived from the variants chosen just above.
+    const googleServicesPaths = googleServicesTargets(variants, productFlavors);
+    const workflowFlavors = variantFlavors(variants, productFlavors);
+    const setupOptions = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {}, googleServicesPaths, workflowFlavors, secretsProperties: false, secretsPropertiesPath: setupNeeds.secretsPropertiesPath };
     const secretsManager = new SecretsManager();
     const keystoreWorkflowGroups = [
         { label: "debug builds (primary, pull-request)", workflows: ["primary", "pull-request"] },
@@ -1035,16 +1238,38 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
             setupOptions.googleServices = !!create;
         }
         if (setupOptions.googleServices) {
-            await collectFileSecret({
-                displayName: "google-services.json",
-                secretName: "GOOGLE_SERVICES_JSON",
-                fileMatch: (name) => name === "google-services.json",
-                readAs: "text",
-                workflowGroups: [
-                    { label: "debug builds (primary, pull-request)", workflows: ["primary", "pull-request"] },
-                    { label: "release", workflows: ["release"] },
-                ],
-            }, cwd, secretsManager, ni);
+            // One collection per distinct target path. Workflows building the same
+            // flavor write to the same place and are collected together; workflows
+            // building different flavors need different files, so each is asked
+            // separately and pinned to its own source set — which is what lets a
+            // flavored repository auto-select rather than guess.
+            //
+            // The secret name is the same every time, and the *value* is stored per
+            // workflow. That is what `SecretsManager` has always done, what
+            // `ci secrets upload` encodes as `CIBUILD_SW__<WF>__<VAR>`, and what
+            // `EnvResolver` resolves for the workflow being run.
+            const byTarget = collectionGroups(discriminators(setupOptions.googleServicesPaths, "app/google-services.json"), (_path, workflows) => workflows.join(", "));
+            for (const group of byTarget) {
+                const flavorDir = /\/src\/([^/]+)\//.exec(group.discriminator)?.[1] ?? null;
+                await collectFileSecret({
+                    displayName: flavorDir
+                        ? `google-services.json for the ${flavorDir} flavor`
+                        : "google-services.json",
+                    secretName: "GOOGLE_SERVICES_JSON",
+                    fileMatch: (name) => name === "google-services.json",
+                    // A flavored target takes the copy from that flavor's source set. An
+                    // unflavored one takes anything that is *not* a flavor's copy, so
+                    // the module root wins rather than an arbitrary source set.
+                    pathMatch: flavorDir
+                        ? (rel) => rel.includes(`/src/${flavorDir}/`) || rel.startsWith(`src/${flavorDir}/`)
+                        : (rel) => !/(?:^|\/)src\/[^/]+\//.test(rel),
+                    readAs: "text",
+                    // One group per call, not all of them: each group narrows the search
+                    // to its own flavor's source set, which is what lets a flavored
+                    // repository auto-select rather than ask.
+                    workflowGroups: [group],
+                }, cwd, secretsManager, ni);
+            }
         }
     }
     if (setupNeeds.secretsProperties) {
@@ -1064,14 +1289,18 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
         if (setupOptions.secretsProperties) {
             // Every workflow, not just release: the plugin's evaluation listener
             // runs for every variant, so a debug build cannot configure without it.
+            //
+            // And one group per flavor, because the plugin turns this file into
+            // BuildConfig and a flavor is an environment. Every group in one call,
+            // unlike google-services.json above: there is no per-flavor path
+            // convention for a properties file to narrow the search by, so the
+            // groups differ only in which answer they take.
             await collectFileSecret({
                 displayName: propertiesFile,
                 secretName: "LOCAL_PROPERTIES",
                 fileMatch: (name) => name === propertiesFile.split("/").pop(),
                 readAs: "text",
-                workflowGroups: [
-                    { label: "every workflow", workflows: ["primary", "pull-request", "release"] },
-                ],
+                workflowGroups: propertiesFileGroups(setupOptions.workflowFlavors),
             }, cwd, secretsManager, ni);
         }
     }
@@ -1156,8 +1385,16 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
             console.log("     • Setup Keystore (KEYSTORE_BASE64)");
         if (setupOptions.keystoreProperties)
             console.log("     • Setup keystore.properties (KEYSTORE_PROPERTIES) — release only");
-        if (setupOptions.googleServices)
-            console.log("     • Setup google-services.json (GOOGLE_SERVICES_JSON)");
+        if (setupOptions.googleServices) {
+            const seen = new Set();
+            for (const wf of GENERATED_WORKFLOWS) {
+                const path = setupOptions.googleServicesPaths[wf];
+                if (!path || seen.has(path))
+                    continue;
+                seen.add(path);
+                console.log(`     • Setup ${path} (GOOGLE_SERVICES_JSON)`);
+            }
+        }
         if (setupOptions.googlePlayDeploy)
             console.log(`     • Google Play deploy (${setupOptions.googlePlayPackageName}) — release only`);
     }

package/dist/src/commands/each-flavor-is-asked-for-its-own-properties-file.test.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `ci init` asks once per flavor for the properties file the Secrets Gradle
+ * Plugin reads, and stores the answer against that flavor's workflows.
+ *
+ * The generator now declares this credential once per workflow when the
+ * workflows build different flavors, because two flavors are two environments
+ * and one value cannot serve both. Collection had not moved: `collectFileSecret`
+ * was called with a single group labelled *"every workflow"*, so `ci init`
+ * asked once and stored the same bytes against `primary`, `pull-request` and
+ * `release`. The declaration would then say three values are needed and the
+ * store would hold one, three times.
+ *
+ * The machinery for this was already there. `collectFileSecret` takes
+ * `workflowGroups`, prompts per group, and stores per workflow — that is how
+ * the keystore has always collected a debug key and a release key separately.
+ * The properties file was the one credential passing it a single group.
+ *
+ * What matters more than the split is that it is the *same* split: `ci init`
+ * groups by exactly the discriminator `credentialSlots` declares by, so the
+ * question asked and the slot declared cannot drift apart. One group means one
+ * slot and one question; two groups mean one slot per workflow and a question
+ * per group. That invariant is asserted directly rather than left to two
+ * copies of the same rule staying in step.
+ */
+export {};
+//# sourceMappingURL=each-flavor-is-asked-for-its-own-properties-file.test.d.ts.map

package/dist/src/commands/each-flavor-is-asked-for-its-own-properties-file.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"each-flavor-is-asked-for-its-own-properties-file.test.d.ts","sourceRoot":"","sources":["../../../src/commands/each-flavor-is-asked-for-its-own-properties-file.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG"}

package/dist/src/commands/each-flavor-is-asked-for-its-own-properties-file.test.js

@@ -0,0 +1,196 @@
+/**
+ * `ci init` asks once per flavor for the properties file the Secrets Gradle
+ * Plugin reads, and stores the answer against that flavor's workflows.
+ *
+ * The generator now declares this credential once per workflow when the
+ * workflows build different flavors, because two flavors are two environments
+ * and one value cannot serve both. Collection had not moved: `collectFileSecret`
+ * was called with a single group labelled *"every workflow"*, so `ci init`
+ * asked once and stored the same bytes against `primary`, `pull-request` and
+ * `release`. The declaration would then say three values are needed and the
+ * store would hold one, three times.
+ *
+ * The machinery for this was already there. `collectFileSecret` takes
+ * `workflowGroups`, prompts per group, and stores per workflow — that is how
+ * the keystore has always collected a debug key and a release key separately.
+ * The properties file was the one credential passing it a single group.
+ *
+ * What matters more than the split is that it is the *same* split: `ci init`
+ * groups by exactly the discriminator `credentialSlots` declares by, so the
+ * question asked and the slot declared cannot drift apart. One group means one
+ * slot and one question; two groups mean one slot per workflow and a question
+ * per group. That invariant is asserted directly rather than left to two
+ * copies of the same rule staying in step.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import prompts from 'prompts';
+import { collectionGroups, credentialSlots, propertiesFileGroups, variantFlavors, } from './build.js';
+import { collectFileSecret } from './file-secret-collector.js';
+import { SecretsManager } from '../yaml/secrets-manager.js';
+function variant(name) {
+    const buildType = name.charAt(0).toUpperCase() + name.slice(1);
+    return { variant: name, buildType, gradleTask: `assemble${buildType}` };
+}
+const FLAVORED = {
+    primary: variant('ciDynamicDebug'),
+    pullRequest: variant('ciDynamicDebug'),
+    release: variant('prodRelease'),
+};
+const UNFLAVORED = {
+    primary: variant('debug'),
+    pullRequest: variant('debug'),
+    release: variant('release'),
+};
+const FLAVORS = ['ciDynamic', 'prod'];
+const CI_DYNAMIC = 'BASE_API_URL=https://ci-dynamic.example.test/api\n';
+const PROD = 'BASE_API_URL=https://prod.example.test/api\n';
+describe('the groups a credential is collected in', () => {
+    test('are one when every workflow wants the same bytes', () => {
+        const groups = collectionGroups({ primary: 'ciDynamic', 'pull-request': 'ciDynamic', release: 'ciDynamic' }, () => 'every workflow');
+        expect(groups).toEqual([
+            { label: 'every workflow', workflows: ['primary', 'pull-request', 'release'], discriminator: 'ciDynamic' },
+        ]);
+    });
+    test('are one per distinct value, keeping the workflows that agree together', () => {
+        const groups = collectionGroups({ primary: 'ciDynamic', 'pull-request': 'ciDynamic', release: 'prod' }, (flavor) => flavor);
+        expect(groups).toEqual([
+            { label: 'ciDynamic', workflows: ['primary', 'pull-request'], discriminator: 'ciDynamic' },
+            { label: 'prod', workflows: ['release'], discriminator: 'prod' },
+        ]);
+    });
+    test('split exactly when the declaration splits', () => {
+        // Two copies of one rule is one copy too many. If these ever disagree,
+        // `ci init` asks a question the pipeline has no slot for, or declares a
+        // slot nothing on the machine was ever collected into.
+        const maps = [
+            { primary: '', 'pull-request': '', release: '' },
+            { primary: 'ciDynamic', 'pull-request': 'ciDynamic', release: 'prod' },
+            { primary: 'a', 'pull-request': 'b', release: 'c' },
+            { release: 'keystore.properties' },
+            { primary: 'app/one.jks', 'pull-request': 'app/one.jks', release: 'app/one.jks' },
+        ];
+        expect(maps.map((map) => ({
+            groups: collectionGroups(map, (d) => d).length === 1,
+            oneFlatSlot: credentialSlots('X', map).length === 1,
+        }))).toEqual([
+            { groups: true, oneFlatSlot: true },
+            { groups: false, oneFlatSlot: false },
+            { groups: false, oneFlatSlot: false },
+            { groups: true, oneFlatSlot: true },
+            { groups: true, oneFlatSlot: true },
+        ]);
+    });
+});
+describe('the groups the properties file is collected in', () => {
+    test('are one per flavor, and say which flavor', () => {
+        const groups = propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS));
+        expect(groups.map((g) => ({ label: g.label, workflows: g.workflows }))).toEqual([
+            { label: 'the ciDynamic flavor (primary, pull-request)', workflows: ['primary', 'pull-request'] },
+            { label: 'the prod flavor (release)', workflows: ['release'] },
+        ]);
+    });
+    test('are one, labelled as they were, on a repository with no flavors', () => {
+        // The label is what the prompt says out loud, and this is the wording
+        // every unflavored repository has always seen.
+        expect(propertiesFileGroups(variantFlavors(UNFLAVORED, []))).toEqual([
+            { label: 'every workflow', workflows: ['primary', 'pull-request', 'release'], discriminator: '' },
+        ]);
+    });
+    test('are one when three workflows build three variants of one flavor', () => {
+        const oneFlavor = {
+            primary: variant('ciDynamicDebug'),
+            pullRequest: variant('ciDynamicDebug'),
+            release: variant('ciDynamicRelease'),
+        };
+        expect(propertiesFileGroups(variantFlavors(oneFlavor, FLAVORS))).toHaveLength(1);
+    });
+});
+describe('collecting a value for each group', () => {
+    let workdir;
+    let secretsManager;
+    // `prompts.inject` *concatenates*, so an empty array clears nothing and a
+    // sentinel one test leaves queued becomes the next test's answer. The queue
+    // itself is the only reset there is.
+    const clearInjected = () => {
+        prompts._injected = undefined;
+    };
+    beforeEach(() => {
+        clearInjected();
+        workdir = mkdtempSync(join(tmpdir(), 'cibuild-flavor-properties-'));
+        workdir = resolve(workdir);
+        secretsManager = new SecretsManager(join(workdir, '.cibuild-secrets.json'));
+    });
+    afterEach(() => {
+        clearInjected();
+        rmSync(workdir, { recursive: true, force: true });
+    });
+    function put(relPath, contents) {
+        const full = join(workdir, relPath);
+        mkdirSync(join(full, '..'), { recursive: true });
+        writeFileSync(full, contents, 'utf-8');
+        return full;
+    }
+    async function collect(groups, ni = false) {
+        return collectFileSecret({
+            displayName: 'local.properties',
+            secretName: 'LOCAL_PROPERTIES',
+            fileMatch: (name) => name === 'local.properties',
+            readAs: 'text',
+            workflowGroups: groups,
+        }, workdir, secretsManager, ni);
+    }
+    test('stores a different value against the workflows of each flavor', async () => {
+        const ciDynamicFile = put('local.properties', CI_DYNAMIC);
+        const prodFile = put('envs/prod/local.properties', PROD);
+        prompts.inject([ciDynamicFile, prodFile]);
+        await collect(propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS)));
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'primary')).toBe(CI_DYNAMIC);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'pull-request')).toBe(CI_DYNAMIC);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'release')).toBe(PROD);
+    });
+    test('stores them where `ci secrets upload` will encode them per workflow', async () => {
+        const ciDynamicFile = put('local.properties', CI_DYNAMIC);
+        const prodFile = put('envs/prod/local.properties', PROD);
+        prompts.inject([ciDynamicFile, prodFile]);
+        await collect(propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS)));
+        // Not `global`. A global value would satisfy all three workflows and the
+        // upload would push one flat key, which is the bug this closes.
+        const stored = JSON.parse(readFileSync(join(workdir, '.cibuild-secrets.json'), 'utf-8'));
+        expect(stored.global).toEqual({});
+        expect(Object.keys(stored.workflows).sort()).toEqual(['primary', 'pull-request', 'release']);
+    });
+    test('asks nothing at all when one group meets one file', async () => {
+        // Today's behaviour on every unflavored repository, unchanged: a single
+        // group and a single candidate auto-apply. The injected answer is
+        // unreadable on purpose — if a prompt fired, nothing would be stored.
+        put('local.properties', CI_DYNAMIC);
+        prompts.inject(['/nonexistent/would-be-a-prompt']);
+        await collect(propertiesFileGroups(variantFlavors(UNFLAVORED, [])));
+        for (const workflow of ['primary', 'pull-request', 'release']) {
+            expect(secretsManager.getSecret('LOCAL_PROPERTIES', workflow)).toBe(CI_DYNAMIC);
+        }
+    });
+    test('gives every group the same file when it cannot ask', async () => {
+        // `ci init --create` runs non-interactive. One file is all it can offer,
+        // and a wrong-flavored properties file that the user then corrects beats
+        // no properties file at all, which is a build that cannot configure.
+        put('local.properties', CI_DYNAMIC);
+        await collect(propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS)), true);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'primary')).toBe(CI_DYNAMIC);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'release')).toBe(CI_DYNAMIC);
+    });
+    test('leaves a group alone once its value is already stored', async () => {
+        put('local.properties', CI_DYNAMIC);
+        put('envs/prod/local.properties', PROD);
+        secretsManager.storeSecret('LOCAL_PROPERTIES', PROD, 'release');
+        // One answer, for the one group still pending.
+        prompts.inject([join(workdir, 'local.properties')]);
+        await collect(propertiesFileGroups(variantFlavors(FLAVORED, FLAVORS)));
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'primary')).toBe(CI_DYNAMIC);
+        expect(secretsManager.getSecret('LOCAL_PROPERTIES', 'release')).toBe(PROD);
+    });
+});
+//# sourceMappingURL=each-flavor-is-asked-for-its-own-properties-file.test.js.map