@invarn/cibuild 2.7.4 → 2.7.6

package/dist/src/commands/file-secret-collector.d.ts

@@ -10,6 +10,19 @@ export interface FileSecretConfig {
     secretName: string;
     /** Returns true if a filename matches (e.g. name === "google-services.json") */
     fileMatch: (name: string) => boolean;
+    /**
+     * Narrows the candidates by their path relative to the project root, once
+     * `fileMatch` has found them by name.
+     *
+     * A credential Android keeps one copy of per product flavor has the same
+     * basename in every source set — four `google-services.json` under
+     * `app/`, `app/src/dev/`, `app/src/prod/` and `app/src/ciDynamic/` — so a
+     * name is not enough to say which one a workflow needs. Without this the
+     * single-candidate auto-apply below never fires on a flavored repository,
+     * and the answer comes from a prompt or from whichever the walk reached
+     * first.
+     */
+    pathMatch?: (relativePath: string) => boolean;
     /** How to read the file into a string value. Defaults to "text". */
     readAs?: "text" | "base64";
     /** Workflow groups to scope the secret to */

package/dist/src/commands/file-secret-collector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-secret-collector.d.ts","sourceRoot":"","sources":["../../../src/commands/file-secret-collector.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3B,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAMrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,EAAE,CAkBxF;AAiDD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,EAC9B,cAAc,UAAQ,GACrB,OAAO,CAAC,eAAe,CAAC,CAuH1B"}
+{"version":3,"file":"file-secret-collector.d.ts","sourceRoot":"","sources":["../../../src/commands/file-secret-collector.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9C,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3B,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAMrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,EAAE,CAkBxF;AAiDD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,EAC9B,cAAc,UAAQ,GACrB,OAAO,CAAC,eAAe,CAAC,CA6I1B"}

package/dist/src/commands/file-secret-collector.js

@@ -1,4 +1,4 @@
-import { resolve, relative } from "node:path";
+import { resolve, relative, sep } from "node:path";
 import { readdirSync, readFileSync } from "node:fs";
 import * as readline from "node:readline";
 import prompts from "prompts";
@@ -77,17 +77,35 @@ async function promptTargetPathInProject(displayName) {
  */
 export async function collectFileSecret(config, cwd, secretsManager, nonInteractive = false) {
     const paths = {};
-    // Only process groups where at least one workflow is missing the secret
-    const pendingGroups = config.workflowGroups.filter((g) => !g.workflows.every((wf) => secretsManager.hasSecret(config.secretName, wf)));
+    const readContent = (p) => config.readAs === "base64"
+        ? readFileSync(p).toString("base64")
+        : readFileSync(p, "utf-8");
+    const relativeToCwd = (p) => relative(cwd, p).split(sep).join("/");
+    const candidates = findProjectFiles(cwd, config.fileMatch).filter((p) => config.pathMatch?.(relativeToCwd(p)) ?? true);
+    // A stored value answers "what are the bytes". It does not answer "where does
+    // each workflow write them", and `.cibuild-secrets.json` cannot: the store
+    // records values and never targets. So a caller that consumes the returned
+    // map has to be asked whichever state the value is in.
+    //
+    // `promptTargetPath` marks that caller — the keystore, the only one whose
+    // return value the generator assigns. Conflating the two questions lost the
+    // keystore split on every repository that had ever run `ci init`: a *global*
+    // entry satisfies `hasSecret` for every workflow, so nothing was pending, an
+    // empty map went back, and the generator's fallback handed all three
+    // workflows one path. A fresh clone asked and split correctly, which is why
+    // no fixture-built test saw it.
+    //
+    // Only when there is something on disk to choose between. With no candidate
+    // the question has no answer worth interrupting for, and the short-circuit is
+    // still the kinder branch.
+    const callerNeedsTargets = config.promptTargetPath === true && candidates.length > 0;
+    const pendingGroups = config.workflowGroups.filter((g) => callerNeedsTargets ||
+        !g.workflows.every((wf) => secretsManager.hasSecret(config.secretName, wf)));
     if (pendingGroups.length === 0) {
         console.log(`   ✅ ${config.secretName} already in .cibuild-secrets.json — will be used at runtime.`);
         return paths;
     }
     const pendingWorkflows = pendingGroups.flatMap((g) => g.workflows);
-    const readContent = (p) => config.readAs === "base64"
-        ? readFileSync(p).toString("base64")
-        : readFileSync(p, "utf-8");
-    const candidates = findProjectFiles(cwd, config.fileMatch);
     if (candidates.length === 1 && config.workflowGroups.length === 1) {
         // Single file, single-group config — auto-apply without prompting
         const content = readContent(candidates[0]);

package/dist/src/commands/flavors-a-convention-plugin-creates-are-still-found.test.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Product flavors a convention plugin creates are still the project's flavors.
+ *
+ * `detectBuildVariants` looked for a literal `productFlavors { … }` block in a
+ * Gradle file. Modern Android does not write one: the flavors are an enum in a
+ * convention plugin's Kotlin source and are created programmatically —
+ * `AppFlavor.values().forEach { create(flavor.name) }` — so the block the
+ * scan looks for does not exist anywhere in the repository.
+ *
+ * `android-variant-resolution.test.ts` already records the *runtime* half of
+ * this: nowinandroid declares its flavors the same way, Gradle refused
+ * `:app:lintDebug` as ambiguous, and the step now reads the candidates out of
+ * Gradle's own error. That recovers a task name during a build. It cannot
+ * recover anything decided *before* the build:
+ *
+ *   - `googleServicesTargets` writes every workflow's `google-services.json`
+ *     to the module root instead of its flavor's source set, which is the
+ *     silent wrong-file failure `bld_8e60d90ab4e55f85d2f72459` spent 1292
+ *     Gradle tasks discovering;
+ *   - `variantFlavors` reports no flavor for any workflow, so `credentialSlots`
+ *     sees no disagreement and declares one flat slot where the workflows need
+ *     one value each;
+ *   - the variant prompt offers `debug, release` and nothing else.
+ *
+ * Gradle is not available to the scan — it is a static read, and running a
+ * configuration phase to list flavors would cost minutes. The evidence that
+ * *is* on disk is the one AGP itself relies on: a flavor has a source set.
+ * `app/src/ciDynamic/`, `app/src/prod/` — the same directories
+ * `findGoogleServices` in `invarn setup` has always read the flavor from,
+ * which is why setup resolves this repository correctly while the generator
+ * does not.
+ *
+ * It is a **fallback**, not a merge: a project whose Gradle files declare
+ * flavors literally is decided by those files exactly as before, so this can
+ * only change the answer for a project that currently detects none.
+ */
+export {};
+//# sourceMappingURL=flavors-a-convention-plugin-creates-are-still-found.test.d.ts.map

package/dist/src/commands/flavors-a-convention-plugin-creates-are-still-found.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flavors-a-convention-plugin-creates-are-still-found.test.d.ts","sourceRoot":"","sources":["../../../src/commands/flavors-a-convention-plugin-creates-are-still-found.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG"}

package/dist/src/commands/flavors-a-convention-plugin-creates-are-still-found.test.js

@@ -0,0 +1,300 @@
+/**
+ * Product flavors a convention plugin creates are still the project's flavors.
+ *
+ * `detectBuildVariants` looked for a literal `productFlavors { … }` block in a
+ * Gradle file. Modern Android does not write one: the flavors are an enum in a
+ * convention plugin's Kotlin source and are created programmatically —
+ * `AppFlavor.values().forEach { create(flavor.name) }` — so the block the
+ * scan looks for does not exist anywhere in the repository.
+ *
+ * `android-variant-resolution.test.ts` already records the *runtime* half of
+ * this: nowinandroid declares its flavors the same way, Gradle refused
+ * `:app:lintDebug` as ambiguous, and the step now reads the candidates out of
+ * Gradle's own error. That recovers a task name during a build. It cannot
+ * recover anything decided *before* the build:
+ *
+ *   - `googleServicesTargets` writes every workflow's `google-services.json`
+ *     to the module root instead of its flavor's source set, which is the
+ *     silent wrong-file failure `bld_8e60d90ab4e55f85d2f72459` spent 1292
+ *     Gradle tasks discovering;
+ *   - `variantFlavors` reports no flavor for any workflow, so `credentialSlots`
+ *     sees no disagreement and declares one flat slot where the workflows need
+ *     one value each;
+ *   - the variant prompt offers `debug, release` and nothing else.
+ *
+ * Gradle is not available to the scan — it is a static read, and running a
+ * configuration phase to list flavors would cost minutes. The evidence that
+ * *is* on disk is the one AGP itself relies on: a flavor has a source set.
+ * `app/src/ciDynamic/`, `app/src/prod/` — the same directories
+ * `findGoogleServices` in `invarn setup` has always read the flavor from,
+ * which is why setup resolves this repository correctly while the generator
+ * does not.
+ *
+ * It is a **fallback**, not a merge: a project whose Gradle files declare
+ * flavors literally is decided by those files exactly as before, so this can
+ * only change the answer for a project that currently detects none.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { load } from 'js-yaml';
+import { detectBuildVariants, scanAndroidProject } from './android-scanner.js';
+import { generateAndroidPipeline, googleServicesTargets, variantFlavors, } from './build.js';
+let root;
+beforeEach(() => {
+    root = resolve(mkdtempSync(join(tmpdir(), 'cibuild-convention-flavors-')));
+});
+afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+});
+/** Writes `app/build.gradle.kts` with the given body and returns its path. */
+function appModule(body) {
+    mkdirSync(join(root, 'app'), { recursive: true });
+    const path = join(root, 'app', 'build.gradle.kts');
+    writeFileSync(path, body, 'utf-8');
+    return path;
+}
+/** Creates `app/src/<name>/` holding each of `children`. */
+function sourceSet(name, children = ['res']) {
+    const dir = join(root, 'app', 'src', name);
+    mkdirSync(dir, { recursive: true });
+    for (const child of children) {
+        if (child.includes('.'))
+            writeFileSync(join(dir, child), '{}', 'utf-8');
+        else
+            mkdirSync(join(dir, child), { recursive: true });
+    }
+}
+/** An `android { buildTypes { … } }` block with no `productFlavors` anywhere. */
+const CONVENTION_PLUGIN_MODULE = `
+plugins {
+    id("acme.android.application")
+    id("acme.android.application.flavors")
+}
+
+android {
+    namespace = "com.example.app"
+    buildTypes {
+        debug { isMinifyEnabled = false }
+        release { isMinifyEnabled = true }
+    }
+}
+
+androidComponents {
+    onVariants { variant ->
+        if (variant.buildType == "release" &&
+            variant.productFlavors.any { it.second == "prod" }
+        ) {
+            variant.signingConfig.setConfig(android.signingConfigs.getByName("release"))
+        }
+    }
+}
+`;
+describe('flavors declared by a convention plugin', () => {
+    test('are read from the source sets the flavors have on disk', () => {
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml', 'java', 'res']);
+        sourceSet('ciDynamic', ['google-services.json', 'res']);
+        sourceSet('dev', ['google-services.json', 'res']);
+        sourceSet('prod', ['google-services.json', 'res']);
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['ciDynamic', 'dev', 'prod']);
+    });
+    test('become the variants the prompt offers', () => {
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('ciDynamic');
+        sourceSet('prod');
+        // Every flavor crossed with every build type, which is what the literal
+        // path has always produced.
+        expect(detectBuildVariants([gradle]).variants).toEqual([
+            'ciDynamicDebug',
+            'ciDynamicRelease',
+            'prodDebug',
+            'prodRelease',
+        ]);
+    });
+    test('are found in whichever module has them, not only `app`', () => {
+        const app = appModule(CONVENTION_PLUGIN_MODULE);
+        mkdirSync(join(root, 'core'), { recursive: true });
+        const core = join(root, 'core', 'build.gradle.kts');
+        writeFileSync(core, 'plugins { id("acme.android.library.flavors") }', 'utf-8');
+        mkdirSync(join(root, 'core', 'src', 'staging', 'res'), { recursive: true });
+        mkdirSync(join(root, 'core', 'src', 'main', 'java'), { recursive: true });
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('prod');
+        expect(detectBuildVariants([app, core]).productFlavors).toEqual(['prod', 'staging']);
+    });
+    test('are ordered the same way whatever order the filesystem lists them in', () => {
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('prod');
+        sourceSet('ciDynamic');
+        sourceSet('dev');
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['ciDynamic', 'dev', 'prod']);
+    });
+});
+describe('what a source set directory is not', () => {
+    test('the shared source set, the test source sets, and the build types', () => {
+        const gradle = appModule(`
+android {
+    buildTypes {
+        debug { }
+        release { }
+        staging { }
+    }
+}
+`);
+        sourceSet('main', ['AndroidManifest.xml', 'java']);
+        sourceSet('test', ['java']);
+        sourceSet('androidTest', ['java']);
+        sourceSet('testFixtures', ['java']);
+        sourceSet('debug', ['res']);
+        sourceSet('release', ['res']);
+        sourceSet('staging', ['res']);
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual([]);
+    });
+    test('a variant directory, which is a flavor and a build type already joined', () => {
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('ciDynamic');
+        sourceSet('ciDynamicDebug', ['res']);
+        sourceSet('prodRelease', ['res']);
+        // Taking `ciDynamicDebug` for a flavor would cross it with the build types
+        // again and offer `ciDynamicDebugDebug`.
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['ciDynamic']);
+    });
+    test('a test source set for one flavor', () => {
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('prod');
+        sourceSet('testProd', ['java']);
+        sourceSet('androidTestProd', ['java']);
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['prod']);
+    });
+    test('a flavor whose name merely starts with `test`', () => {
+        // `testing` is a legitimate flavor name; `testProd` is AGP's test source
+        // set for `prod`. The capital is the whole difference.
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('testing');
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['testing']);
+    });
+    test('a directory under `src/` that holds nothing a source set holds', () => {
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('prod');
+        mkdirSync(join(root, 'app', 'src', 'notes'), { recursive: true });
+        writeFileSync(join(root, 'app', 'src', 'notes', 'README.md'), '# scratch', 'utf-8');
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['prod']);
+    });
+});
+describe('a project the literal scan already reads', () => {
+    test('is decided by its Gradle files, and the source sets change nothing', () => {
+        // The block declares two; the disk carries a third. A merge would invent a
+        // flavor the build does not have, so the literal answer wins outright.
+        const gradle = appModule(`
+android {
+    flavorDimensions += "contentType"
+    productFlavors {
+        create("demo") { dimension = "contentType" }
+        create("prod") { dimension = "contentType" }
+    }
+}
+`);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('demo');
+        sourceSet('prod');
+        sourceSet('leftover', ['res']);
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['demo', 'prod']);
+    });
+});
+describe('a project with no flavors at all', () => {
+    test('is exactly what it was', () => {
+        const gradle = appModule(`
+android {
+    buildTypes {
+        debug { }
+        release { }
+    }
+}
+`);
+        sourceSet('main', ['AndroidManifest.xml', 'java', 'res']);
+        sourceSet('debug', ['res']);
+        const detected = detectBuildVariants([gradle]);
+        expect(detected.productFlavors).toEqual([]);
+        expect(detected.variants).toEqual(['debug', 'release']);
+    });
+    test('is unchanged when the module has no `src/` directory at all', () => {
+        const gradle = appModule('android { }');
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual([]);
+    });
+});
+const BASE_SETUP = {
+    keystore: false,
+    keystoreProperties: false,
+    googleServices: false,
+    googlePlayDeploy: false,
+    googlePlayPackageName: '',
+    artifactType: 'apk',
+    keystorePaths: {},
+    googleServicesPaths: {},
+    workflowFlavors: {},
+    secretsProperties: false,
+    secretsPropertiesPath: 'local.properties',
+};
+describe('what finding them buys the generator', () => {
+    /** The real repository's shape, as a project on disk. */
+    function conventionPluginRepository() {
+        appModule(CONVENTION_PLUGIN_MODULE);
+        writeFileSync(join(root, 'settings.gradle.kts'), 'include(":app")\n', 'utf-8');
+        sourceSet('main', ['AndroidManifest.xml', 'java', 'res']);
+        sourceSet('ciDynamic', ['google-services.json', 'res']);
+        sourceSet('dev', ['google-services.json', 'res']);
+        sourceSet('prod', ['google-services.json', 'res']);
+    }
+    const variant = (name) => ({
+        variant: name,
+        buildType: name.charAt(0).toUpperCase() + name.slice(1),
+        gradleTask: `assemble${name.charAt(0).toUpperCase()}${name.slice(1)}`,
+    });
+    const VARIANTS = {
+        primary: variant('ciDynamicDebug'),
+        pullRequest: variant('ciDynamicDebug'),
+        release: variant('prodRelease'),
+    };
+    test('each workflow writes google-services.json into its own source set', async () => {
+        conventionPluginRepository();
+        const { productFlavors } = (await scanAndroidProject(root)).buildVariants;
+        expect(googleServicesTargets(VARIANTS, productFlavors)).toEqual({
+            primary: 'app/src/ciDynamic/google-services.json',
+            'pull-request': 'app/src/ciDynamic/google-services.json',
+            release: 'app/src/prod/google-services.json',
+        });
+    });
+    test('the credential the two flavors cannot share is declared per workflow', async () => {
+        conventionPluginRepository();
+        const { productFlavors } = (await scanAndroidProject(root)).buildVariants;
+        const yaml = generateAndroidPipeline(17, {
+            ...BASE_SETUP,
+            googleServices: true,
+            googleServicesPaths: googleServicesTargets(VARIANTS, productFlavors),
+        }, VARIANTS);
+        const parsed = load(yaml);
+        const declaringWorkflows = Object.keys(parsed.workflows ?? {}).filter((workflow) => 'GOOGLE_SERVICES_JSON' in Object.assign({}, ...(parsed.workflows?.[workflow]?.envs ?? [])));
+        // One declaration per workflow, in that workflow's own `envs`, under the
+        // plain name — the split the flavors bought, without the transport prefix.
+        expect(declaringWorkflows).toEqual(['primary', 'pull-request', 'release']);
+        expect(Object.assign({}, ...(parsed.app?.envs ?? []))).not.toHaveProperty('GOOGLE_SERVICES_JSON');
+    });
+    test('local.properties is split by the flavor each workflow builds', async () => {
+        conventionPluginRepository();
+        const { productFlavors } = (await scanAndroidProject(root)).buildVariants;
+        expect(variantFlavors(VARIANTS, productFlavors)).toEqual({
+            primary: 'ciDynamic',
+            'pull-request': 'ciDynamic',
+            release: 'prod',
+        });
+    });
+});
+//# sourceMappingURL=flavors-a-convention-plugin-creates-are-still-found.test.js.map

package/dist/src/commands/local-properties-reaches-every-workflow.test.js

@@ -37,6 +37,8 @@ const BASE = {
     googlePlayPackageName: '',
     artifactType: 'apk',
     keystorePaths: {},
+    googleServicesPaths: {},
+    workflowFlavors: {},
     secretsProperties: false,
     secretsPropertiesPath: 'local.properties',
 };

package/dist/src/yaml/a-cache-path-must-not-swallow-a-credential.test.d.ts

@@ -0,0 +1,28 @@
+/**
+ * A `cache_paths` entry must not contain the file a `file@` step writes.
+ *
+ * Everything else about a credential's life inside a build is bounded, and was
+ * checked on the three boxes after the first build that ever wrote one: the
+ * runner pushes the checkout and the guest root onto `cleanupPaths` and
+ * removes them in a `finally`, the guest gets `rm -rf`, and `tart delete`
+ * reclaims the VM. Nothing was left anywhere.
+ *
+ * The cache store is the one place a file can survive all of that.
+ * `cache-push` archives whatever `cache_paths` names and uploads it to where
+ * the *next* build pulls it from, so a credential swept into that archive
+ * outlives the build it was delivered to — and outlives the sandbox that was
+ * supposed to contain it.
+ *
+ * No pipeline in play trips this. Every one of them caches
+ * `~/.gradle/caches`, `~/.gradle/wrapper` and `.gradle`, and none of those
+ * holds a credential. It is a guard on a mistake that is easy to make and
+ * invisible once made: adding `.` to `cache_paths` is a plausible way to make
+ * a build faster, and it would publish the signing key.
+ *
+ * Refused at generation time, like issue 03's missing credential, because that
+ * is the only place that can see a whole workflow at once — a cache step can
+ * be written before the `file@` step whose target it would swallow — and
+ * because the alternative is a build that goes green while leaking.
+ */
+export {};
+//# sourceMappingURL=a-cache-path-must-not-swallow-a-credential.test.d.ts.map

package/dist/src/yaml/a-cache-path-must-not-swallow-a-credential.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-cache-path-must-not-swallow-a-credential.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-cache-path-must-not-swallow-a-credential.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}