@invarn/cibuild 2.7.5 → 2.7.7

package/dist/src/commands/build.js

@@ -4,7 +4,6 @@ import prompts from "prompts";
 import { scanAndroidProject, formatScanResult, runnableJavaVersion, javaVersionProblem, } from "./android-scanner.js";
 import { scanIosProject, formatIosScanResult } from "./ios-scanner.js";
 import { SecretsManager } from "../yaml/secrets-manager.js";
-import { encodeSecretName } from "./secrets-upload.js";
 import { collectFileSecret } from "./file-secret-collector.js";
 import { generateGitHubActionsWorkflow } from "./github-workflow.js";
 import { detectDefaultBranch, FALLBACK_DEFAULT_BRANCH } from "../shared/git.js";
@@ -216,27 +215,31 @@ export function variantFlavors(variants, productFlavors) {
  * genuinely release-only ones keep one slot however flavored the repository
  * is.
  *
- * A disagreement is declared under `CIBUILD_SW__<WORKFLOW>__<VAR>`: the name
- * `ci secrets upload` already encodes a workflow-scoped value under, that
- * `SecretsManager` already decodes, and that `EnvResolver` already resolves
- * for the workflow being run. Invarn's secret scopes have no workflow column,
- * but a flat key→value map carries a workflow perfectly well when the workflow
- * is part of the key.
+ * **The name never changes — the block it sits in does.** An agreed credential
+ * is declared once in `app.envs`; a disagreement is declared under the plain
+ * credential name in **each workflow's own `envs`**, which is where the YAML
+ * already says which workflow something belongs to. `EnvResolver` merges
+ * `app.envs` and then the running workflow's own, so `release`'s declaration is
+ * invisible to `primary` without anything being encoded.
  *
- * Every workflow gets a slot, not only the odd one out. The encoded name is
- * per workflow, so a workflow left without one would have neither a value nor
- * the declaration `file@1.0.0` refuses over.
+ * `CIBUILD_SW__<WORKFLOW>__<VAR>` is deliberately *not* used here. That prefix
+ * is the transport encoding `ci secrets upload` carries a workflow-scoped
+ * **value** under — Invarn's secret scopes have no workflow column, so the
+ * workflow travels in the key. A pipeline has structure instead, and spending
+ * the encoding there would be a second way to say what the block already says
+ * (Alex, 2026-09-10).
  *
- * The `file@` step's `var_name` stays unsuffixed either way. The decoding does
- * the mapping; a second naming convention in the step would be a second way to
- * say the same thing.
+ * Every workflow gets a slot, not only the odd one out: a workflow left without
+ * one would have neither a value nor the declaration `file@1.0.0` refuses over.
+ *
+ * The `file@` step's `var_name` is the same plain name either way.
  */
 export function credentialSlots(varName, discriminatorByWorkflow) {
     const distinct = new Set(Object.values(discriminatorByWorkflow));
     if (distinct.size <= 1)
         return [{ slot: varName, workflow: null }];
     return Object.keys(discriminatorByWorkflow).map((workflow) => ({
-        slot: encodeSecretName(varName, workflow),
+        slot: varName,
         workflow,
     }));
 }
@@ -342,40 +345,56 @@ export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: fa
     const buildTypeEnvOverride = (v) => v.buildType !== "Debug" ? `      - BUILD_TYPE: ${v.buildType}\n` : "";
     // Optional env var stubs (empty defaults — filled via ci secrets add).
     //
-    // Declared globally and on purpose: `unsetEnvKeys` — what `invarn setup`
-    // searches the developer's machine by — reads `envs`, never step inputs. An
-    // undeclared credential is never discovered and never offered for upload,
-    // however many steps name it.
+    // Declared and not merely used by a step: `unsetEnvKeys` — what `invarn
+    // setup` searches the developer's machine by — reads `envs`, never step
+    // inputs. An undeclared credential is never discovered and never offered for
+    // upload, however many steps name it. The same declaration is what
+    // `file@1.0.0` refuses over when nobody supplied the value.
     //
     // One slot per credential where every workflow that reads it wants the same
-    // bytes, and one per workflow where they do not — see `credentialSlots`.
-    // The `var_name` in the step below stays unsuffixed either way.
-    const declare = (varName, discriminatorByWorkflow, comment) => credentialSlots(varName, discriminatorByWorkflow)
-        .map(({ slot, workflow }) => `    - ${slot}: ""${comment(workflow)}\n`)
-        .join("");
-    const keystoreEnv = setup.keystore
-        ? declare("KEYSTORE_BASE64", discriminators(setup.keystorePaths, "keystore.jks"), (wf) => wf
+    // bytes, and one per workflow where they do not — see `credentialSlots`. The
+    // name is the plain credential either way; a per-workflow one is declared in
+    // that workflow's own `envs` rather than under an encoded name.
+    const appEnvDeclarations = [];
+    const workflowEnvDeclarations = {};
+    const declare = (varName, discriminatorByWorkflow, comment) => {
+        for (const { slot, workflow } of credentialSlots(varName, discriminatorByWorkflow)) {
+            if (workflow === null) {
+                appEnvDeclarations.push(`    - ${slot}: ""${comment(null)}\n`);
+                continue;
+            }
+            // Six spaces, not four: a workflow's `envs` sits one level deeper.
+            (workflowEnvDeclarations[workflow] ??= []).push(`      - ${slot}: ""${comment(workflow)}\n`);
+        }
+    };
+    /** Every credential declaration this workflow owns, after its own variables. */
+    const workflowEnvFor = (workflow) => (workflowEnvDeclarations[workflow] ?? []).join("");
+    // Declared in the order they appear in `app.envs`, which the byte-identity
+    // test on an unflavored pipeline pins.
+    if (setup.keystore) {
+        declare("KEYSTORE_BASE64", discriminators(setup.keystorePaths, "keystore.jks"), (wf) => wf
             ? `  # Set via: ci secrets add KEYSTORE_BASE64 -w ${wf}`
-            : `         # Set via: ci secrets add KEYSTORE_BASE64 -w primary`)
-        : "";
+            : `         # Set via: ci secrets add KEYSTORE_BASE64 -w primary`);
+    }
     // Release-only, and legitimately so: nothing but `release` signs a release
     // or talks to Google Play, so there is no second workflow to disagree with.
-    const keystorePropertiesEnv = setup.keystoreProperties
-        ? `    - KEYSTORE_PROPERTIES: ""      # Release signing — set via: ci secrets add KEYSTORE_PROPERTIES -w release\n`
-        : "";
-    const googleServicesEnv = setup.googleServices
-        ? declare("GOOGLE_SERVICES_JSON", discriminators(setup.googleServicesPaths, "app/google-services.json"), (wf) => wf
+    if (setup.keystoreProperties) {
+        appEnvDeclarations.push(`    - KEYSTORE_PROPERTIES: ""      # Release signing — set via: ci secrets add KEYSTORE_PROPERTIES -w release\n`);
+    }
+    if (setup.googleServices) {
+        declare("GOOGLE_SERVICES_JSON", discriminators(setup.googleServicesPaths, "app/google-services.json"), (wf) => wf
             ? `  # Set via: ci secrets add GOOGLE_SERVICES_JSON -w ${wf}`
-            : `     # Set via: ci secrets add GOOGLE_SERVICES_JSON`)
-        : "";
-    const googlePlayEnv = setup.googlePlayDeploy
-        ? `    - GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ""  # Set via: ci secrets add GOOGLE_PLAY_SERVICE_ACCOUNT_JSON -w release\n`
-        : "";
-    const secretsPropertiesEnv = setup.secretsProperties
-        ? declare("LOCAL_PROPERTIES", discriminators(setup.workflowFlavors, ""), (wf) => wf
+            : `     # Set via: ci secrets add GOOGLE_SERVICES_JSON`);
+    }
+    if (setup.googlePlayDeploy) {
+        appEnvDeclarations.push(`    - GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ""  # Set via: ci secrets add GOOGLE_PLAY_SERVICE_ACCOUNT_JSON -w release\n`);
+    }
+    if (setup.secretsProperties) {
+        declare("LOCAL_PROPERTIES", discriminators(setup.workflowFlavors, ""), (wf) => wf
             ? `  # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES -w ${wf}`
-            : `         # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES`)
-        : "";
+            : `         # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES`);
+    }
+    const appEnv = appEnvDeclarations.join("");
     /**
      * The Secrets Gradle Plugin's properties file, written into every workflow
      * that builds. Its evaluation listener runs for every variant, so a debug
@@ -468,12 +487,12 @@ app:
     - MODULE: app
     - BUILD_TYPE: Debug
     - GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.parallel=true
-${keystoreEnv}${keystorePropertiesEnv}${googleServicesEnv}${googlePlayEnv}${secretsPropertiesEnv}
+${appEnv}
 workflows:
   primary:
     envs:
       - VARIANT: ${pv.variant}
-${buildTypeEnvOverride(pv)}
+${buildTypeEnvOverride(pv)}${workflowEnvFor("primary")}
     steps:
 ${keystoreStepFor("primary")}${googleServicesStepFor("primary")}${secretsPropertiesStep}
       - set-java-version@1.0.0:
@@ -513,7 +532,7 @@ ${keystoreStepFor("primary")}${googleServicesStepFor("primary")}${secretsPropert
   pull-request:
     envs:
       - VARIANT: ${prv.variant}
-${buildTypeEnvOverride(prv)}
+${buildTypeEnvOverride(prv)}${workflowEnvFor("pull-request")}
     steps:
 ${keystoreStepFor("pull-request")}${googleServicesStepFor("pull-request")}${secretsPropertiesStep}
       - set-java-version@1.0.0:
@@ -552,7 +571,7 @@ ${keystoreStepFor("pull-request")}${googleServicesStepFor("pull-request")}${secr
   release:
     envs:
       - VARIANT: ${rv.variant}
-${buildTypeEnvOverride(rv)}
+${buildTypeEnvOverride(rv)}${workflowEnvFor("release")}
     steps:
 ${keystoreStepFor("release")}${keystorePropertiesStep}${googleServicesStepFor("release")}${secretsPropertiesStep}
       - set-java-version@1.0.0:

package/dist/src/commands/file-secret-collector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-secret-collector.d.ts","sourceRoot":"","sources":["../../../src/commands/file-secret-collector.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9C,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3B,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAMrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,EAAE,CAkBxF;AAiDD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,EAC9B,cAAc,UAAQ,GACrB,OAAO,CAAC,eAAe,CAAC,CA0H1B"}
+{"version":3,"file":"file-secret-collector.d.ts","sourceRoot":"","sources":["../../../src/commands/file-secret-collector.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9C,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3B,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAMrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,EAAE,CAkBxF;AAiDD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,EAC9B,cAAc,UAAQ,GACrB,OAAO,CAAC,eAAe,CAAC,CA6I1B"}

package/dist/src/commands/file-secret-collector.js

@@ -77,18 +77,35 @@ async function promptTargetPathInProject(displayName) {
  */
 export async function collectFileSecret(config, cwd, secretsManager, nonInteractive = false) {
     const paths = {};
-    // Only process groups where at least one workflow is missing the secret
-    const pendingGroups = config.workflowGroups.filter((g) => !g.workflows.every((wf) => secretsManager.hasSecret(config.secretName, wf)));
-    if (pendingGroups.length === 0) {
-        console.log(`   ✅ ${config.secretName} already in .cibuild-secrets.json — will be used at runtime.`);
-        return paths;
-    }
-    const pendingWorkflows = pendingGroups.flatMap((g) => g.workflows);
     const readContent = (p) => config.readAs === "base64"
         ? readFileSync(p).toString("base64")
         : readFileSync(p, "utf-8");
     const relativeToCwd = (p) => relative(cwd, p).split(sep).join("/");
     const candidates = findProjectFiles(cwd, config.fileMatch).filter((p) => config.pathMatch?.(relativeToCwd(p)) ?? true);
+    // A stored value answers "what are the bytes". It does not answer "where does
+    // each workflow write them", and `.cibuild-secrets.json` cannot: the store
+    // records values and never targets. So a caller that consumes the returned
+    // map has to be asked whichever state the value is in.
+    //
+    // `promptTargetPath` marks that caller — the keystore, the only one whose
+    // return value the generator assigns. Conflating the two questions lost the
+    // keystore split on every repository that had ever run `ci init`: a *global*
+    // entry satisfies `hasSecret` for every workflow, so nothing was pending, an
+    // empty map went back, and the generator's fallback handed all three
+    // workflows one path. A fresh clone asked and split correctly, which is why
+    // no fixture-built test saw it.
+    //
+    // Only when there is something on disk to choose between. With no candidate
+    // the question has no answer worth interrupting for, and the short-circuit is
+    // still the kinder branch.
+    const callerNeedsTargets = config.promptTargetPath === true && candidates.length > 0;
+    const pendingGroups = config.workflowGroups.filter((g) => callerNeedsTargets ||
+        !g.workflows.every((wf) => secretsManager.hasSecret(config.secretName, wf)));
+    if (pendingGroups.length === 0) {
+        console.log(`   ✅ ${config.secretName} already in .cibuild-secrets.json — will be used at runtime.`);
+        return paths;
+    }
+    const pendingWorkflows = pendingGroups.flatMap((g) => g.workflows);
     if (candidates.length === 1 && config.workflowGroups.length === 1) {
         // Single file, single-group config — auto-apply without prompting
         const content = readContent(candidates[0]);

package/dist/src/commands/flavors-a-convention-plugin-creates-are-still-found.test.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Product flavors a convention plugin creates are still the project's flavors.
+ *
+ * `detectBuildVariants` looked for a literal `productFlavors { … }` block in a
+ * Gradle file. Modern Android does not write one: the flavors are an enum in a
+ * convention plugin's Kotlin source and are created programmatically —
+ * `AppFlavor.values().forEach { create(flavor.name) }` — so the block the
+ * scan looks for does not exist anywhere in the repository.
+ *
+ * `android-variant-resolution.test.ts` already records the *runtime* half of
+ * this: nowinandroid declares its flavors the same way, Gradle refused
+ * `:app:lintDebug` as ambiguous, and the step now reads the candidates out of
+ * Gradle's own error. That recovers a task name during a build. It cannot
+ * recover anything decided *before* the build:
+ *
+ *   - `googleServicesTargets` writes every workflow's `google-services.json`
+ *     to the module root instead of its flavor's source set, which is the
+ *     silent wrong-file failure `bld_8e60d90ab4e55f85d2f72459` spent 1292
+ *     Gradle tasks discovering;
+ *   - `variantFlavors` reports no flavor for any workflow, so `credentialSlots`
+ *     sees no disagreement and declares one flat slot where the workflows need
+ *     one value each;
+ *   - the variant prompt offers `debug, release` and nothing else.
+ *
+ * Gradle is not available to the scan — it is a static read, and running a
+ * configuration phase to list flavors would cost minutes. The evidence that
+ * *is* on disk is the one AGP itself relies on: a flavor has a source set.
+ * `app/src/ciDynamic/`, `app/src/prod/` — the same directories
+ * `findGoogleServices` in `invarn setup` has always read the flavor from,
+ * which is why setup resolves this repository correctly while the generator
+ * does not.
+ *
+ * It is a **fallback**, not a merge: a project whose Gradle files declare
+ * flavors literally is decided by those files exactly as before, so this can
+ * only change the answer for a project that currently detects none.
+ */
+export {};
+//# sourceMappingURL=flavors-a-convention-plugin-creates-are-still-found.test.d.ts.map

package/dist/src/commands/flavors-a-convention-plugin-creates-are-still-found.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flavors-a-convention-plugin-creates-are-still-found.test.d.ts","sourceRoot":"","sources":["../../../src/commands/flavors-a-convention-plugin-creates-are-still-found.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG"}

package/dist/src/commands/flavors-a-convention-plugin-creates-are-still-found.test.js

@@ -0,0 +1,300 @@
+/**
+ * Product flavors a convention plugin creates are still the project's flavors.
+ *
+ * `detectBuildVariants` looked for a literal `productFlavors { … }` block in a
+ * Gradle file. Modern Android does not write one: the flavors are an enum in a
+ * convention plugin's Kotlin source and are created programmatically —
+ * `AppFlavor.values().forEach { create(flavor.name) }` — so the block the
+ * scan looks for does not exist anywhere in the repository.
+ *
+ * `android-variant-resolution.test.ts` already records the *runtime* half of
+ * this: nowinandroid declares its flavors the same way, Gradle refused
+ * `:app:lintDebug` as ambiguous, and the step now reads the candidates out of
+ * Gradle's own error. That recovers a task name during a build. It cannot
+ * recover anything decided *before* the build:
+ *
+ *   - `googleServicesTargets` writes every workflow's `google-services.json`
+ *     to the module root instead of its flavor's source set, which is the
+ *     silent wrong-file failure `bld_8e60d90ab4e55f85d2f72459` spent 1292
+ *     Gradle tasks discovering;
+ *   - `variantFlavors` reports no flavor for any workflow, so `credentialSlots`
+ *     sees no disagreement and declares one flat slot where the workflows need
+ *     one value each;
+ *   - the variant prompt offers `debug, release` and nothing else.
+ *
+ * Gradle is not available to the scan — it is a static read, and running a
+ * configuration phase to list flavors would cost minutes. The evidence that
+ * *is* on disk is the one AGP itself relies on: a flavor has a source set.
+ * `app/src/ciDynamic/`, `app/src/prod/` — the same directories
+ * `findGoogleServices` in `invarn setup` has always read the flavor from,
+ * which is why setup resolves this repository correctly while the generator
+ * does not.
+ *
+ * It is a **fallback**, not a merge: a project whose Gradle files declare
+ * flavors literally is decided by those files exactly as before, so this can
+ * only change the answer for a project that currently detects none.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { load } from 'js-yaml';
+import { detectBuildVariants, scanAndroidProject } from './android-scanner.js';
+import { generateAndroidPipeline, googleServicesTargets, variantFlavors, } from './build.js';
+let root;
+beforeEach(() => {
+    root = resolve(mkdtempSync(join(tmpdir(), 'cibuild-convention-flavors-')));
+});
+afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+});
+/** Writes `app/build.gradle.kts` with the given body and returns its path. */
+function appModule(body) {
+    mkdirSync(join(root, 'app'), { recursive: true });
+    const path = join(root, 'app', 'build.gradle.kts');
+    writeFileSync(path, body, 'utf-8');
+    return path;
+}
+/** Creates `app/src/<name>/` holding each of `children`. */
+function sourceSet(name, children = ['res']) {
+    const dir = join(root, 'app', 'src', name);
+    mkdirSync(dir, { recursive: true });
+    for (const child of children) {
+        if (child.includes('.'))
+            writeFileSync(join(dir, child), '{}', 'utf-8');
+        else
+            mkdirSync(join(dir, child), { recursive: true });
+    }
+}
+/** An `android { buildTypes { … } }` block with no `productFlavors` anywhere. */
+const CONVENTION_PLUGIN_MODULE = `
+plugins {
+    id("acme.android.application")
+    id("acme.android.application.flavors")
+}
+
+android {
+    namespace = "com.example.app"
+    buildTypes {
+        debug { isMinifyEnabled = false }
+        release { isMinifyEnabled = true }
+    }
+}
+
+androidComponents {
+    onVariants { variant ->
+        if (variant.buildType == "release" &&
+            variant.productFlavors.any { it.second == "prod" }
+        ) {
+            variant.signingConfig.setConfig(android.signingConfigs.getByName("release"))
+        }
+    }
+}
+`;
+describe('flavors declared by a convention plugin', () => {
+    test('are read from the source sets the flavors have on disk', () => {
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml', 'java', 'res']);
+        sourceSet('ciDynamic', ['google-services.json', 'res']);
+        sourceSet('dev', ['google-services.json', 'res']);
+        sourceSet('prod', ['google-services.json', 'res']);
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['ciDynamic', 'dev', 'prod']);
+    });
+    test('become the variants the prompt offers', () => {
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('ciDynamic');
+        sourceSet('prod');
+        // Every flavor crossed with every build type, which is what the literal
+        // path has always produced.
+        expect(detectBuildVariants([gradle]).variants).toEqual([
+            'ciDynamicDebug',
+            'ciDynamicRelease',
+            'prodDebug',
+            'prodRelease',
+        ]);
+    });
+    test('are found in whichever module has them, not only `app`', () => {
+        const app = appModule(CONVENTION_PLUGIN_MODULE);
+        mkdirSync(join(root, 'core'), { recursive: true });
+        const core = join(root, 'core', 'build.gradle.kts');
+        writeFileSync(core, 'plugins { id("acme.android.library.flavors") }', 'utf-8');
+        mkdirSync(join(root, 'core', 'src', 'staging', 'res'), { recursive: true });
+        mkdirSync(join(root, 'core', 'src', 'main', 'java'), { recursive: true });
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('prod');
+        expect(detectBuildVariants([app, core]).productFlavors).toEqual(['prod', 'staging']);
+    });
+    test('are ordered the same way whatever order the filesystem lists them in', () => {
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('prod');
+        sourceSet('ciDynamic');
+        sourceSet('dev');
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['ciDynamic', 'dev', 'prod']);
+    });
+});
+describe('what a source set directory is not', () => {
+    test('the shared source set, the test source sets, and the build types', () => {
+        const gradle = appModule(`
+android {
+    buildTypes {
+        debug { }
+        release { }
+        staging { }
+    }
+}
+`);
+        sourceSet('main', ['AndroidManifest.xml', 'java']);
+        sourceSet('test', ['java']);
+        sourceSet('androidTest', ['java']);
+        sourceSet('testFixtures', ['java']);
+        sourceSet('debug', ['res']);
+        sourceSet('release', ['res']);
+        sourceSet('staging', ['res']);
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual([]);
+    });
+    test('a variant directory, which is a flavor and a build type already joined', () => {
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('ciDynamic');
+        sourceSet('ciDynamicDebug', ['res']);
+        sourceSet('prodRelease', ['res']);
+        // Taking `ciDynamicDebug` for a flavor would cross it with the build types
+        // again and offer `ciDynamicDebugDebug`.
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['ciDynamic']);
+    });
+    test('a test source set for one flavor', () => {
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('prod');
+        sourceSet('testProd', ['java']);
+        sourceSet('androidTestProd', ['java']);
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['prod']);
+    });
+    test('a flavor whose name merely starts with `test`', () => {
+        // `testing` is a legitimate flavor name; `testProd` is AGP's test source
+        // set for `prod`. The capital is the whole difference.
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('testing');
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['testing']);
+    });
+    test('a directory under `src/` that holds nothing a source set holds', () => {
+        const gradle = appModule(CONVENTION_PLUGIN_MODULE);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('prod');
+        mkdirSync(join(root, 'app', 'src', 'notes'), { recursive: true });
+        writeFileSync(join(root, 'app', 'src', 'notes', 'README.md'), '# scratch', 'utf-8');
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['prod']);
+    });
+});
+describe('a project the literal scan already reads', () => {
+    test('is decided by its Gradle files, and the source sets change nothing', () => {
+        // The block declares two; the disk carries a third. A merge would invent a
+        // flavor the build does not have, so the literal answer wins outright.
+        const gradle = appModule(`
+android {
+    flavorDimensions += "contentType"
+    productFlavors {
+        create("demo") { dimension = "contentType" }
+        create("prod") { dimension = "contentType" }
+    }
+}
+`);
+        sourceSet('main', ['AndroidManifest.xml']);
+        sourceSet('demo');
+        sourceSet('prod');
+        sourceSet('leftover', ['res']);
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual(['demo', 'prod']);
+    });
+});
+describe('a project with no flavors at all', () => {
+    test('is exactly what it was', () => {
+        const gradle = appModule(`
+android {
+    buildTypes {
+        debug { }
+        release { }
+    }
+}
+`);
+        sourceSet('main', ['AndroidManifest.xml', 'java', 'res']);
+        sourceSet('debug', ['res']);
+        const detected = detectBuildVariants([gradle]);
+        expect(detected.productFlavors).toEqual([]);
+        expect(detected.variants).toEqual(['debug', 'release']);
+    });
+    test('is unchanged when the module has no `src/` directory at all', () => {
+        const gradle = appModule('android { }');
+        expect(detectBuildVariants([gradle]).productFlavors).toEqual([]);
+    });
+});
+const BASE_SETUP = {
+    keystore: false,
+    keystoreProperties: false,
+    googleServices: false,
+    googlePlayDeploy: false,
+    googlePlayPackageName: '',
+    artifactType: 'apk',
+    keystorePaths: {},
+    googleServicesPaths: {},
+    workflowFlavors: {},
+    secretsProperties: false,
+    secretsPropertiesPath: 'local.properties',
+};
+describe('what finding them buys the generator', () => {
+    /** The real repository's shape, as a project on disk. */
+    function conventionPluginRepository() {
+        appModule(CONVENTION_PLUGIN_MODULE);
+        writeFileSync(join(root, 'settings.gradle.kts'), 'include(":app")\n', 'utf-8');
+        sourceSet('main', ['AndroidManifest.xml', 'java', 'res']);
+        sourceSet('ciDynamic', ['google-services.json', 'res']);
+        sourceSet('dev', ['google-services.json', 'res']);
+        sourceSet('prod', ['google-services.json', 'res']);
+    }
+    const variant = (name) => ({
+        variant: name,
+        buildType: name.charAt(0).toUpperCase() + name.slice(1),
+        gradleTask: `assemble${name.charAt(0).toUpperCase()}${name.slice(1)}`,
+    });
+    const VARIANTS = {
+        primary: variant('ciDynamicDebug'),
+        pullRequest: variant('ciDynamicDebug'),
+        release: variant('prodRelease'),
+    };
+    test('each workflow writes google-services.json into its own source set', async () => {
+        conventionPluginRepository();
+        const { productFlavors } = (await scanAndroidProject(root)).buildVariants;
+        expect(googleServicesTargets(VARIANTS, productFlavors)).toEqual({
+            primary: 'app/src/ciDynamic/google-services.json',
+            'pull-request': 'app/src/ciDynamic/google-services.json',
+            release: 'app/src/prod/google-services.json',
+        });
+    });
+    test('the credential the two flavors cannot share is declared per workflow', async () => {
+        conventionPluginRepository();
+        const { productFlavors } = (await scanAndroidProject(root)).buildVariants;
+        const yaml = generateAndroidPipeline(17, {
+            ...BASE_SETUP,
+            googleServices: true,
+            googleServicesPaths: googleServicesTargets(VARIANTS, productFlavors),
+        }, VARIANTS);
+        const parsed = load(yaml);
+        const declaringWorkflows = Object.keys(parsed.workflows ?? {}).filter((workflow) => 'GOOGLE_SERVICES_JSON' in Object.assign({}, ...(parsed.workflows?.[workflow]?.envs ?? [])));
+        // One declaration per workflow, in that workflow's own `envs`, under the
+        // plain name — the split the flavors bought, without the transport prefix.
+        expect(declaringWorkflows).toEqual(['primary', 'pull-request', 'release']);
+        expect(Object.assign({}, ...(parsed.app?.envs ?? []))).not.toHaveProperty('GOOGLE_SERVICES_JSON');
+    });
+    test('local.properties is split by the flavor each workflow builds', async () => {
+        conventionPluginRepository();
+        const { productFlavors } = (await scanAndroidProject(root)).buildVariants;
+        expect(variantFlavors(VARIANTS, productFlavors)).toEqual({
+            primary: 'ciDynamic',
+            'pull-request': 'ciDynamic',
+            release: 'prod',
+        });
+    });
+});
+//# sourceMappingURL=flavors-a-convention-plugin-creates-are-still-found.test.js.map

package/dist/src/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/run.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAiJ3E"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/run.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,UAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAkJ3E"}

package/dist/src/commands/run.js

@@ -106,7 +106,7 @@ export async function handleRunCommand(opts = {}) {
                 interactive: isInteractiveTTY(),
             });
             pipeline = conversionResult.pipeline;
-            await runner.runPipeline(pipeline, conversionResult.warnings, conversionResult.skippedSteps);
+            await runner.runPipeline(pipeline, conversionResult.warnings, conversionResult.skippedSteps, conversionResult.checkout);
         }
         else if (isJavaScriptModule) {
             // The one dynamic import that has to stay dynamic: the specifier is a

package/dist/src/runner.d.ts

@@ -1,4 +1,5 @@
 import type { StepDef, PipelineDef, CIConfig } from "./types.js";
+import type { CheckoutWitness } from "./yaml/converter.js";
 export declare class StepExecutionError extends Error {
     stepId: string;
     stepName: string;
@@ -12,6 +13,19 @@ export declare class PipelineRunner {
     private formatDuration;
     validatePipeline(pipeline: PipelineDef): void;
     displayWarnings(warnings: string[], skippedSteps: number): void;
-    runPipeline(pipeline: PipelineDef, warnings?: string[], skippedSteps?: number): Promise<void>;
+    /**
+     * The commit this build compiled, printed under the banner.
+     *
+     * Every build carries it, whatever steps it declares. The dashboard's sha is
+     * the one that was *dispatched*; this one was read off the disk the compiler
+     * is about to read, and it is what a later argument about which code shipped
+     * has to be settled against. It used to live only in `git-clone`'s echo,
+     * which is optional and no longer in the curated templates.
+     *
+     * Labels match that echo's on purpose — where both appear they are the same
+     * three facts, and they have to agree.
+     */
+    displayCheckout(checkout: CheckoutWitness): void;
+    runPipeline(pipeline: PipelineDef, warnings?: string[], skippedSteps?: number, checkout?: CheckoutWitness): Promise<void>;
 }
 //# sourceMappingURL=runner.d.ts.map

package/dist/src/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/runner.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAOjE,qBAAa,kBAAmB,SAAQ,KAAK;IAElC,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,MAAM;gBAFhB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;CAK1B;AAED,qBAAa,cAAc;IACb,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,QAAQ;IAE9B,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiHhE,OAAO,CAAC,cAAc;IAYtB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,IAAI;IAwB7C,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAczD,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CA2CpG"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/runner.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAO3D,qBAAa,kBAAmB,SAAQ,KAAK;IAElC,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,MAAM;gBAFhB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;CAK1B;AAED,qBAAa,cAAc;IACb,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,QAAQ;IAE9B,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiHhE,OAAO,CAAC,cAAc;IAYtB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,GAAG,IAAI;IAwB7C,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAc/D;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAO1C,WAAW,CACf,QAAQ,EAAE,WAAW,EACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,EACnB,YAAY,CAAC,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,eAAe,GACzB,OAAO,CAAC,IAAI,CAAC;CA+CjB"}