@invarn/cibuild 2.7.4 → 2.7.6

package/dist/src/yaml/a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.js

@@ -0,0 +1,218 @@
+/**
+ * A credential slot scoped to a workflow the pipeline does not have refuses
+ * the build, instead of silently belonging to nobody.
+ *
+ * The declaration `CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: ""` means "this
+ * credential, for the workflow called `primary`". Nothing checked that a
+ * workflow by that name existed, and every way of getting the name wrong fails
+ * quietly:
+ *
+ *   - **A typo.** `CIBUILD_SW__PRIMRAY__X` decodes to workflow `primray`. No
+ *     workflow is called that, so no workflow declares `X`, so `file@1.0.0`
+ *     finds no key in its map, calls the credential optional, and skips it with
+ *     a warning — the green-step failure mode issue 03 exists to end. The
+ *     upload half is equally quiet: `ci secrets upload` encodes a value for
+ *     `primray` and the resolver looks for `primary`.
+ *   - **An underscore in the workflow's own name.** The encoding upper-cases
+ *     the name and turns dashes into underscores, so decoding turns every
+ *     underscore back into a dash. A workflow genuinely called `my_wf` is
+ *     therefore unreachable: its slot decodes to `my-wf`, which the pipeline
+ *     does not have. `ci secrets upload` warns about this at upload time; the
+ *     pipeline is where it can be refused before a build starts.
+ *
+ * Both are one check — does the pipeline have a workflow by the decoded
+ * name? — and both are refused at generation time, from the resolver, before
+ * any step converts. That is the same place issue 03's refusal lands and for
+ * the same reason: a build that cannot possibly deliver a credential should
+ * stop while the message can still name the credential.
+ *
+ * The check only ever fires on a name we generate. No pipeline written before
+ * this declared an encoded slot at all, and a global `CIBUILD_S__X` names no
+ * workflow, so there is nothing in existence for it to refuse.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { convertYAMLToPipelineDef } from './converter.js';
+import { UnknownWorkflowSlotError } from './env-resolver.js';
+import { clearRegistry, registerStep } from './steps/registry.js';
+import { FileStepExecutor } from './steps/file.js';
+const mockConfig = {
+    artifactsDir: '/test/artifacts',
+    maxConcurrentJobs: 1,
+    paths: {
+        buildsDir: '/test/builds',
+        cacheDir: '/test/cache',
+        derivedDataDir: '/test/derived-data',
+    },
+    interpreters: {
+        bash: '/bin/bash',
+        python: 'python3',
+        ruby: 'ruby',
+        node: 'node',
+    },
+};
+const TARGET = 'local.properties';
+const VALUE = 'BASE_API_URL=https://example.test/api\n';
+const TOUCHED = [
+    'LOCAL_PROPERTIES',
+    'CIBUILD_S__LOCAL_PROPERTIES',
+    'CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES',
+    'CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES',
+    'CIBUILD_SW__RELEASE__LOCAL_PROPERTIES',
+    'CIBUILD_SW__MY_WF__LOCAL_PROPERTIES',
+];
+let workdir;
+let previousCwd;
+beforeEach(() => {
+    clearRegistry();
+    registerStep('file', new FileStepExecutor());
+    previousCwd = process.cwd();
+    workdir = mkdtempSync(join(tmpdir(), 'cibuild-unknown-workflow-'));
+    process.chdir(workdir);
+    workdir = process.cwd();
+    for (const key of TOUCHED)
+        delete process.env[key];
+});
+afterEach(() => {
+    process.chdir(previousCwd);
+    rmSync(workdir, { recursive: true, force: true });
+    clearRegistry();
+    for (const key of TOUCHED)
+        delete process.env[key];
+});
+/** A pipeline with the given declared slots and the given workflow names. */
+function probePipeline(declared, workflowNames = ['primary', 'pull-request', 'release']) {
+    const step = {
+        'file@1.0.0': {
+            is_skippable: true,
+            inputs: { target_path: TARGET, var_name: 'LOCAL_PROPERTIES' },
+        },
+    };
+    const workflows = {};
+    for (const name of workflowNames)
+        workflows[name] = { steps: [step] };
+    return {
+        format_version: '1',
+        app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) },
+        workflows,
+    };
+}
+/** The conversion's outcome, without letting a throw escape the assertion. */
+async function convert(pipeline, workflow) {
+    try {
+        const result = await convertYAMLToPipelineDef(pipeline, mockConfig, workflow);
+        return { steps: result.pipeline.steps };
+    }
+    catch (error) {
+        return { error: error };
+    }
+}
+describe('a slot naming a workflow nobody has', () => {
+    test('refuses the build, naming the slot and the workflow it decodes to', async () => {
+        process.env.CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES = VALUE;
+        const { error, steps } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), 'primary');
+        expect(error).toBeInstanceOf(UnknownWorkflowSlotError);
+        expect(error.message).toContain('CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES');
+        expect(error.message).toContain('primray');
+        expect(steps).toBeUndefined();
+    });
+    test('says which workflows the pipeline does have', async () => {
+        const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), 'primary');
+        expect(error.message).toContain('primary');
+        expect(error.message).toContain('pull-request');
+        expect(error.message).toContain('release');
+    });
+    test('names the credential the slot is for, since that is what has to arrive', async () => {
+        const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), 'primary');
+        expect(error.message).toContain('LOCAL_PROPERTIES');
+    });
+    test('refuses from whichever workflow is being run', async () => {
+        // The slot is in `app.envs`, so it is a defect in the pipeline and not in
+        // one workflow of it. A build of `release` must not pass just because the
+        // bad slot happens to name something else.
+        for (const workflow of ['primary', 'pull-request', 'release']) {
+            const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), workflow);
+            expect(error).toBeInstanceOf(UnknownWorkflowSlotError);
+        }
+    });
+    test('refuses a slot declared inside a workflow, not only in app.envs', async () => {
+        const pipeline = {
+            format_version: '1',
+            workflows: {
+                primary: {
+                    envs: [{ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }],
+                    steps: [
+                        {
+                            'file@1.0.0': {
+                                is_skippable: true,
+                                inputs: { target_path: TARGET, var_name: 'LOCAL_PROPERTIES' },
+                            },
+                        },
+                    ],
+                },
+            },
+        };
+        const { error } = await convert(pipeline, 'primary');
+        expect(error).toBeInstanceOf(UnknownWorkflowSlotError);
+    });
+    test('carries no secret value into the message', async () => {
+        process.env.CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES = VALUE;
+        const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), 'primary');
+        expect(error.message).not.toContain(VALUE.trim());
+        expect(error.message).not.toContain('example.test');
+    });
+});
+describe('a workflow whose own name the encoding cannot survive', () => {
+    test('is refused, and the message says the underscore is why', async () => {
+        // The pipeline really does have `my_wf`. Its slot still cannot reach it:
+        // decoding turns every underscore back into a dash, so the slot belongs to
+        // `my-wf`. Saying only "no such workflow" about a workflow that is right
+        // there would read as a bug in us.
+        const { error } = await convert(probePipeline({ CIBUILD_SW__MY_WF__LOCAL_PROPERTIES: '' }, ['my_wf']), 'my_wf');
+        expect(error).toBeInstanceOf(UnknownWorkflowSlotError);
+        expect(error.message).toContain('my_wf');
+        expect(error.message).toContain('my-wf');
+        expect(error.message).toMatch(/underscore/i);
+    });
+    test('is not refused when the workflow is named with a dash instead', async () => {
+        process.env.CIBUILD_SW__MY_WF__LOCAL_PROPERTIES = VALUE;
+        const { error, steps } = await convert(probePipeline({ CIBUILD_SW__MY_WF__LOCAL_PROPERTIES: '' }, ['my-wf']), 'my-wf');
+        expect(error).toBeUndefined();
+        expect(steps).toHaveLength(1);
+    });
+});
+describe('what the guard leaves alone', () => {
+    test('a pipeline whose scoped slots all name real workflows', async () => {
+        process.env.CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES = VALUE;
+        process.env.CIBUILD_SW__RELEASE__LOCAL_PROPERTIES = VALUE;
+        const declared = {
+            CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: '',
+            CIBUILD_SW__RELEASE__LOCAL_PROPERTIES: '',
+        };
+        const { error } = await convert(probePipeline(declared, ['primary', 'release']), 'primary');
+        expect(error).toBeUndefined();
+    });
+    test('a global slot, which names no workflow at all', async () => {
+        process.env.CIBUILD_S__LOCAL_PROPERTIES = VALUE;
+        const { error, steps } = await convert(probePipeline({ CIBUILD_S__LOCAL_PROPERTIES: '' }, ['primary']), 'primary');
+        expect(error).toBeUndefined();
+        expect(steps).toHaveLength(1);
+    });
+    test('an ordinary flat slot, which is every pipeline written before this', async () => {
+        process.env.LOCAL_PROPERTIES = VALUE;
+        const { error, steps } = await convert(probePipeline({ LOCAL_PROPERTIES: '' }, ['primary']), 'primary');
+        expect(error).toBeUndefined();
+        expect(steps).toHaveLength(1);
+    });
+    test('a half-encoded name, which is not a scoped slot and never was', async () => {
+        // `decodeSecretName` returns nothing for these, so they are ordinary
+        // variable names. Refusing them would be inventing a rule.
+        for (const key of ['CIBUILD_SW__RELEASE', 'CIBUILD_SW__RELEASE__', 'CIBUILD_S__']) {
+            const { error } = await convert(probePipeline({ [key]: '' }, ['primary']), 'primary');
+            expect(error).toBeUndefined();
+        }
+    });
+});
+//# sourceMappingURL=a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.js.map

package/dist/src/yaml/a-value-this-instance-stored-is-a-value-it-has.test.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A value `SecretsManager` was just told to store is a value it can read back.
+ *
+ * It could not, on exactly the repositories that matter. `loadSecrets` sets
+ * `fileLoaded` when it finds a `.cibuild-secrets.json` or a
+ * `CIBUILD_S*`-shaped environment, and every reader begins
+ * `if (!this.fileLoaded) return process.env[...]` — a compatibility fallback
+ * to bare `CIBUILD_`-prefixed variables from before the store existed.
+ * `storeSecret` writes the file but never clears the flag, so on a repository
+ * that had no store — a first `ci init`, which is the only time `ci init`
+ * collects anything — every value collected in that run read back as absent
+ * from the instance that stored it.
+ *
+ * It is not a hypothetical. `ci init` extracts a workflow's keystore target
+ * from `storeFile=` in the `keystore.properties` it collected a moment
+ * earlier, which is how a project whose signing config names
+ * `app/customer.jks` gets its `file@` step pointed there instead of at
+ * `keystore.jks`. That read returned undefined on every fresh repository, so
+ * the resolution silently fell through to the Gradle-detected path — the half
+ * of issue 07 that shipped and never fired.
+ *
+ * The fix is additive rather than a flag flip: the stored data is consulted
+ * first, and the environment fallback stays exactly where it was for anything
+ * the store does not hold. Nothing that resolved before stops resolving.
+ */
+export {};
+//# sourceMappingURL=a-value-this-instance-stored-is-a-value-it-has.test.d.ts.map

package/dist/src/yaml/a-value-this-instance-stored-is-a-value-it-has.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a-value-this-instance-stored-is-a-value-it-has.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-value-this-instance-stored-is-a-value-it-has.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}

package/dist/src/yaml/a-value-this-instance-stored-is-a-value-it-has.test.js

@@ -0,0 +1,126 @@
+/**
+ * A value `SecretsManager` was just told to store is a value it can read back.
+ *
+ * It could not, on exactly the repositories that matter. `loadSecrets` sets
+ * `fileLoaded` when it finds a `.cibuild-secrets.json` or a
+ * `CIBUILD_S*`-shaped environment, and every reader begins
+ * `if (!this.fileLoaded) return process.env[...]` — a compatibility fallback
+ * to bare `CIBUILD_`-prefixed variables from before the store existed.
+ * `storeSecret` writes the file but never clears the flag, so on a repository
+ * that had no store — a first `ci init`, which is the only time `ci init`
+ * collects anything — every value collected in that run read back as absent
+ * from the instance that stored it.
+ *
+ * It is not a hypothetical. `ci init` extracts a workflow's keystore target
+ * from `storeFile=` in the `keystore.properties` it collected a moment
+ * earlier, which is how a project whose signing config names
+ * `app/customer.jks` gets its `file@` step pointed there instead of at
+ * `keystore.jks`. That read returned undefined on every fresh repository, so
+ * the resolution silently fell through to the Gradle-detected path — the half
+ * of issue 07 that shipped and never fired.
+ *
+ * The fix is additive rather than a flag flip: the stored data is consulted
+ * first, and the environment fallback stays exactly where it was for anything
+ * the store does not hold. Nothing that resolved before stops resolving.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { SecretsManager } from './secrets-manager.js';
+const KEYSTORE_PROPERTIES = 'storeFile=app/customer.jks\nstorePassword=x\n';
+let dir;
+let storePath;
+beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'cibuild-store-readback-'));
+    storePath = join(dir, '.cibuild-secrets.json');
+    delete process.env.CIBUILD_KEYSTORE_PROPERTIES;
+    delete process.env.CIBUILD_FROM_THE_ENVIRONMENT;
+});
+afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+    delete process.env.CIBUILD_KEYSTORE_PROPERTIES;
+    delete process.env.CIBUILD_FROM_THE_ENVIRONMENT;
+});
+describe('a repository that had no store yet', () => {
+    test('reads back a workflow-scoped value it just stored', () => {
+        const sm = new SecretsManager(storePath);
+        sm.storeSecret('KEYSTORE_PROPERTIES', KEYSTORE_PROPERTIES, 'release');
+        expect(sm.getSecret('KEYSTORE_PROPERTIES', 'release')).toBe(KEYSTORE_PROPERTIES);
+        expect(sm.hasSecret('KEYSTORE_PROPERTIES', 'release')).toBe(true);
+        expect(sm.getSecretIdByName('KEYSTORE_PROPERTIES', 'release')).toBe('KEYSTORE_PROPERTIES');
+    });
+    test('is why `ci init` can point a keystore step at the declared target', () => {
+        // The read that silently returned undefined: `ci init` takes the keystore
+        // target out of the properties file it collected in the same run.
+        const sm = new SecretsManager(storePath);
+        sm.storeSecret('KEYSTORE_PROPERTIES', KEYSTORE_PROPERTIES, 'release');
+        const storeFile = sm
+            .getSecret('KEYSTORE_PROPERTIES', 'release')
+            ?.split('\n')
+            .find((line) => line.trim().startsWith('storeFile='));
+        expect(storeFile).toBe('storeFile=app/customer.jks');
+    });
+    test('reads back a global value it just stored', () => {
+        const sm = new SecretsManager(storePath);
+        sm.storeSecret('LOCAL_PROPERTIES', 'BASE_API_URL=x\n');
+        expect(sm.getSecret('LOCAL_PROPERTIES')).toBe('BASE_API_URL=x\n');
+        expect(sm.getAll()).toHaveProperty('LOCAL_PROPERTIES', 'BASE_API_URL=x\n');
+        expect(sm.getAllSecretNames()).toContain('LOCAL_PROPERTIES');
+    });
+    test('keeps a value scoped to the workflow it was stored for', () => {
+        const sm = new SecretsManager(storePath);
+        sm.storeSecret('LOCAL_PROPERTIES', 'ci-dynamic', 'primary');
+        sm.storeSecret('LOCAL_PROPERTIES', 'prod', 'release');
+        expect(sm.getSecret('LOCAL_PROPERTIES', 'primary')).toBe('ci-dynamic');
+        expect(sm.getSecret('LOCAL_PROPERTIES', 'release')).toBe('prod');
+        // No global value was stored, so a workflow nobody stored for has none.
+        expect(sm.getSecret('LOCAL_PROPERTIES', 'pull-request')).toBeUndefined();
+    });
+});
+describe('the environment fallback', () => {
+    test('still answers for a key the store does not hold', () => {
+        process.env.CIBUILD_FROM_THE_ENVIRONMENT = 'inherited';
+        const sm = new SecretsManager(storePath);
+        sm.storeSecret('LOCAL_PROPERTIES', 'stored');
+        expect(sm.getSecret('FROM_THE_ENVIRONMENT')).toBe('inherited');
+        expect(sm.hasSecret('FROM_THE_ENVIRONMENT')).toBe(true);
+        expect(sm.getAll()).toMatchObject({
+            FROM_THE_ENVIRONMENT: 'inherited',
+            LOCAL_PROPERTIES: 'stored',
+        });
+    });
+    test('answers for everything when nothing has been stored', () => {
+        process.env.CIBUILD_FROM_THE_ENVIRONMENT = 'inherited';
+        const sm = new SecretsManager(storePath);
+        expect(sm.getSecret('FROM_THE_ENVIRONMENT')).toBe('inherited');
+        expect(sm.getAll()).toEqual({ FROM_THE_ENVIRONMENT: 'inherited' });
+    });
+    test('loses to a value that was actually stored', () => {
+        process.env.CIBUILD_KEYSTORE_PROPERTIES = 'from-the-environment';
+        const sm = new SecretsManager(storePath);
+        sm.storeSecret('KEYSTORE_PROPERTIES', KEYSTORE_PROPERTIES, 'release');
+        expect(sm.getSecret('KEYSTORE_PROPERTIES', 'release')).toBe(KEYSTORE_PROPERTIES);
+    });
+});
+describe('a repository that already had a store', () => {
+    test('is unchanged — the file is the answer and the environment is not consulted', () => {
+        process.env.CIBUILD_FROM_THE_ENVIRONMENT = 'inherited';
+        writeFileSync(storePath, JSON.stringify({ global: { A: 'from-the-file' }, workflows: {} }), { mode: 0o600 });
+        const sm = new SecretsManager(storePath);
+        expect(sm.getSecret('A')).toBe('from-the-file');
+        expect(sm.getSecret('FROM_THE_ENVIRONMENT')).toBeUndefined();
+        expect(sm.getAll()).toEqual({ A: 'from-the-file' });
+    });
+    test('still lets a workflow value beat the global one', () => {
+        writeFileSync(storePath, JSON.stringify({
+            global: { A: 'global' },
+            workflows: { release: { A: 'release' } },
+        }), { mode: 0o600 });
+        const sm = new SecretsManager(storePath);
+        expect(sm.getSecret('A', 'release')).toBe('release');
+        expect(sm.getSecret('A', 'primary')).toBe('global');
+        expect(sm.getAll('release')).toEqual({ A: 'release' });
+    });
+});
+//# sourceMappingURL=a-value-this-instance-stored-is-a-value-it-has.test.js.map

package/dist/src/yaml/converter.d.ts

@@ -15,6 +15,54 @@ export interface ConversionResult {
     warnings: string[];
     skippedSteps: number;
 }
+/**
+ * A credential a `file@` step writes, and where it goes.
+ */
+export interface CredentialTarget {
+    targetPath: string;
+    varName: string;
+}
+/** A cache step's declared paths, and which step declared them. */
+export interface CachePathDeclaration {
+    stepName: string;
+    cachePaths: string[];
+}
+export interface SwallowedCredential {
+    stepName: string;
+    cachePath: string;
+    targetPath: string;
+    varName: string;
+}
+/**
+ * True when caching `cachePath` would sweep up the file at `targetPath`.
+ *
+ * Only a project-relative entry can: `cache.ts` classifies a `~`- or
+ * `/`-rooted entry as absolute and stores it from the filesystem root, so it
+ * is somewhere the checkout is not. An entry naming the checkout itself (`.`,
+ * `./`) contains everything.
+ */
+export declare function cacheEntryContains(cachePath: string, targetPath: string): boolean;
+/**
+ * Every credential a workflow's cache steps would archive.
+ *
+ * `cache-push` uploads whatever `cache_paths` names, and that archive is
+ * stored where the *next* build pulls it from — so a credential swept into it
+ * outlives the build that received it. Everything else about a credential's
+ * life is bounded: the runner pushes the checkout and the guest root onto
+ * `cleanupPaths` and removes them in a `finally`, the guest gets
+ * `rm -rf`, and `tart delete` reclaims the VM. The cache store is the one
+ * place a file can survive all of that, which makes this the single hole in
+ * "nothing survives a build".
+ *
+ * No pipeline in play trips it — every one of them caches `~/.gradle/caches`,
+ * `~/.gradle/wrapper` and `.gradle`, and none of those contains a credential —
+ * so this is a guard on a mistake that is easy to make and impossible to see:
+ * adding `.` to `cache_paths` is a plausible way to speed up a build, and it
+ * would publish the keystore.
+ */
+export declare function credentialsSwallowedByCache(credentials: readonly CredentialTarget[], caches: readonly CachePathDeclaration[]): SwallowedCredential[];
+/** The refusal text for one swallowed credential. */
+export declare function swallowedCredentialMessage(workflowName: string, swallowed: SwallowedCredential): string;
 /**
  * Converts a YAML pipeline workflow to PipelineDef format
  * @param pipeline Parsed YAML pipeline

package/dist/src/yaml/converter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converter.d.ts","sourceRoot":"","sources":["../../../src/yaml/converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAW,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AAMzE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AA6CD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM,EACrB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAgK3B;AAwGD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,EAAE,CAEtE"}
+{"version":3,"file":"converter.d.ts","sourceRoot":"","sources":["../../../src/yaml/converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAW,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AAMzE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAaD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAaD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CASjF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,SAAS,gBAAgB,EAAE,EACxC,MAAM,EAAE,SAAS,oBAAoB,EAAE,GACtC,mBAAmB,EAAE,CAgBvB;AAED,qDAAqD;AACrD,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,mBAAmB,GAC7B,MAAM,CAaR;AAkCD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM,EACrB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAyM3B;AAwGD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,EAAE,CAEtE"}

package/dist/src/yaml/converter.js

@@ -21,6 +21,87 @@ const CACHE_STEPS = new Set(['cache-pull', 'cache-push']);
 function isCacheStep(stepName) {
     return CACHE_STEPS.has(stepName);
 }
+/**
+ * Trailing slashes and a leading `./` off, backslashes forward. `.` and the
+ * empty string both mean "the whole checkout".
+ */
+function normalizeCheckoutPath(path) {
+    const forward = path.trim().replace(/\\/g, '/');
+    const withoutLead = forward.replace(/^\.\//, '');
+    const withoutTrail = withoutLead.replace(/\/+$/, '');
+    return withoutTrail === '.' ? '' : withoutTrail;
+}
+/**
+ * True when caching `cachePath` would sweep up the file at `targetPath`.
+ *
+ * Only a project-relative entry can: `cache.ts` classifies a `~`- or
+ * `/`-rooted entry as absolute and stores it from the filesystem root, so it
+ * is somewhere the checkout is not. An entry naming the checkout itself (`.`,
+ * `./`) contains everything.
+ */
+export function cacheEntryContains(cachePath, targetPath) {
+    const raw = cachePath.trim();
+    if (raw.startsWith('~') || raw.startsWith('/'))
+        return false;
+    const cache = normalizeCheckoutPath(raw);
+    const target = normalizeCheckoutPath(targetPath);
+    if (target === '')
+        return false;
+    if (cache === '')
+        return true;
+    return target === cache || target.startsWith(`${cache}/`);
+}
+/**
+ * Every credential a workflow's cache steps would archive.
+ *
+ * `cache-push` uploads whatever `cache_paths` names, and that archive is
+ * stored where the *next* build pulls it from — so a credential swept into it
+ * outlives the build that received it. Everything else about a credential's
+ * life is bounded: the runner pushes the checkout and the guest root onto
+ * `cleanupPaths` and removes them in a `finally`, the guest gets
+ * `rm -rf`, and `tart delete` reclaims the VM. The cache store is the one
+ * place a file can survive all of that, which makes this the single hole in
+ * "nothing survives a build".
+ *
+ * No pipeline in play trips it — every one of them caches `~/.gradle/caches`,
+ * `~/.gradle/wrapper` and `.gradle`, and none of those contains a credential —
+ * so this is a guard on a mistake that is easy to make and impossible to see:
+ * adding `.` to `cache_paths` is a plausible way to speed up a build, and it
+ * would publish the keystore.
+ */
+export function credentialsSwallowedByCache(credentials, caches) {
+    const found = [];
+    for (const cache of caches) {
+        for (const cachePath of cache.cachePaths) {
+            for (const credential of credentials) {
+                if (!cacheEntryContains(cachePath, credential.targetPath))
+                    continue;
+                found.push({
+                    stepName: cache.stepName,
+                    cachePath: cachePath.trim(),
+                    targetPath: credential.targetPath,
+                    varName: credential.varName,
+                });
+            }
+        }
+    }
+    return found;
+}
+/** The refusal text for one swallowed credential. */
+export function swallowedCredentialMessage(workflowName, swallowed) {
+    return [
+        `Workflow "${workflowName}" would cache a credential.`,
+        ``,
+        `  The ${swallowed.stepName} step lists "${swallowed.cachePath}" in cache_paths, and that`,
+        `  contains "${swallowed.targetPath}" — the file written from the ${swallowed.varName} secret.`,
+        ``,
+        `  A cached credential outlives the build. The archive is stored where the next`,
+        `  build pulls it from, and nothing removes it when the sandbox is destroyed.`,
+        ``,
+        `  Narrow the cache_paths entry to the directories the build needs cached, or`,
+        `  write the credential somewhere outside them.`,
+    ].join('\n');
+}
 /**
  * Mapping of common unsupported steps to CI Build alternatives
  */
@@ -98,6 +179,11 @@ export async function convertYAMLToPipelineDef(pipeline, config, workflowName, y
     const steps = [];
     const stepsOrder = [];
     let stepCounter = 0;
+    // Collected as the steps are converted, checked once at the end: a cache
+    // step can be declared before the `file@` step whose target it would
+    // swallow, so neither one alone can answer the question.
+    const credentialTargets = [];
+    const cacheDeclarations = [];
     for (const yamlStep of workflowSteps) {
         // Parse step (sub-task 3.8)
         const parsedStep = parseStep(yamlStep, stepCounter);
@@ -154,6 +240,27 @@ export async function convertYAMLToPipelineDef(pipeline, config, workflowName, y
             }
             throw error;
         }
+        // Both halves of the cache-swallows-a-credential question, read off the
+        // interpolated inputs so `$PROJECT_LOCATION` and friends are already the
+        // paths they will be at runtime.
+        if (resolvedStepName === 'file') {
+            const targetPath = interpolatedInputs?.target_path;
+            const varName = interpolatedInputs?.var_name;
+            if (typeof targetPath === 'string' && typeof varName === 'string') {
+                credentialTargets.push({ targetPath, varName });
+            }
+        }
+        if (isCacheStep(resolvedStepName)) {
+            const declared = interpolatedInputs?.cache_paths;
+            const cachePaths = Array.isArray(declared)
+                ? declared.filter((p) => typeof p === 'string')
+                : typeof declared === 'string'
+                    ? [declared]
+                    : [];
+            if (cachePaths.length > 0) {
+                cacheDeclarations.push({ stepName: resolvedStepName, cachePaths });
+            }
+        }
         // Execute step to get script
         const stepDef = await stepExecutor.execute(interpolatedInputs, envResolver.getAll(), config);
         // Generate unique step ID
@@ -174,6 +281,16 @@ export async function convertYAMLToPipelineDef(pipeline, config, workflowName, y
             }
         }
     }
+    // Step 4b: refuse a pipeline that would archive a credential.
+    //
+    // Thrown at generation time for the same reason issue 03's missing-credential
+    // refusal is: it is the only place that can see the whole workflow, and the
+    // alternative is a build that succeeds while publishing a key. A pipeline
+    // configuration error, and the author is the one who can fix it.
+    const swallowed = credentialsSwallowedByCache(credentialTargets, cacheDeclarations);
+    if (swallowed.length > 0) {
+        throw new YAMLConversionError(swallowed.map((s) => swallowedCredentialMessage(selectedWorkflowName, s)).join('\n\n'));
+    }
     // Step 5: Create PipelineDef
     const pipelineDef = {
         name: `${selectedWorkflowName} (YAML)`,

package/dist/src/yaml/env-resolver.d.ts

@@ -23,6 +23,30 @@ export declare class ChecksumFileMissingError extends Error {
     readonly stepName?: string | undefined;
     constructor(filePath: string, stepName?: string | undefined);
 }
+/**
+ * A credential slot scoped to a workflow the pipeline does not have.
+ *
+ * Thrown at generation time, before any step converts, because every way of
+ * getting the name wrong is otherwise silent. A slot naming a workflow nobody
+ * runs declares the credential for nobody: `file@1.0.0` finds no key in its
+ * map, calls the credential optional and skips it with a warning, and
+ * `ci secrets upload` cheerfully pushes a value under the same wrong name.
+ * Two green halves and a build that dies later inside the project's own build
+ * tool.
+ *
+ * The underscore case gets its own sentence because the workflow is right
+ * there in the pipeline. `encodeSecretName` upper-cases the workflow and turns
+ * dashes into underscores, so decoding turns every underscore back into a
+ * dash: a workflow genuinely called `my_wf` can only ever be addressed as
+ * `my-wf`, and "no such workflow" about a workflow that plainly exists reads
+ * as a defect in us rather than a name that cannot survive the round trip.
+ */
+export declare class UnknownWorkflowSlotError extends Error {
+    readonly slot: string;
+    readonly varName: string;
+    readonly workflow: string;
+    constructor(slot: string, varName: string, workflow: string, declared: string[]);
+}
 /**
  * EnvResolver handles environment variable merging and interpolation
  */
@@ -35,6 +59,10 @@ export declare class EnvResolver {
      * not it gave one a value. Read by `importDeclaredFromProcessEnv`.
      */
     private declaredVars;
+    /** The workflow being resolved. Decides which scoped slots apply — `slotKeyFor`. */
+    private workflowName;
+    /** Every workflow this pipeline declares. A scoped slot has to name one of them. */
+    private declaredWorkflows;
     constructor(pipeline: YAMLPipeline, workflow: YAMLWorkflow, workflowName: string, platform: Platform, stack?: string, yamlFilePath?: string);
     /**
      * Gets the value of an environment variable
@@ -111,6 +139,30 @@ export declare class EnvResolver {
      * Merges environment variables from YAML array format
      * @param envArray Array of environment variable objects
      */
+    /**
+     * The variable a declared `envs` key stands for, or null when the
+     * declaration belongs to a different workflow.
+     *
+     * A credential two workflows cannot share is declared once per workflow,
+     * under the same name a workflow-scoped secret carries — the pipeline says
+     * `CIBUILD_SW__RELEASE__LOCAL_PROPERTIES: ""` where it used to say
+     * `LOCAL_PROPERTIES: ""`. The build still reads the credential under its
+     * plain name, so the declaration has to mean the plain name: it is what puts
+     * an unsupplied key in the map for `file@1.0.0` to refuse over, and what
+     * lets `importDeclaredFromProcessEnv` accept a value delivered flat.
+     *
+     * A slot naming another workflow is dropped rather than declared. Declaring
+     * it would make this workflow demand a value only that one was ever going to
+     * be given. The decoding lives here, beside the decoding of the secret
+     * itself, so the steps keep reading their plain `var_name` and never learn
+     * the convention exists.
+     *
+     * A slot naming a workflow the pipeline does not have is refused rather than
+     * dropped — see `UnknownWorkflowSlotError`. Dropping it silently is the same
+     * outcome as never declaring the credential, which is the green skip issue 03
+     * exists to end.
+     */
+    private slotKeyFor;
     private mergeEnvVars;
     /**
      * Fills a declared-but-still-empty variable from the process environment.