@invarn/cibuild 2.7.9 → 2.8.0

package/dist/src/commands/android-java-version.test.js

@@ -63,8 +63,14 @@ describe('runnableJavaVersion', () => {
         expect(runnableJavaVersion(17)).toBe(25);
         expect(runnableJavaVersion(25)).toBe(25);
     });
-    test('takes the newest available JDK when nothing is declared', () => {
-        expect(runnableJavaVersion(undefined)).toBe(25);
+    // Nothing declared and no wrapper to read is nothing to go on. It used to
+    // answer 25 anyway, which is a guess wearing a number; the generator's own
+    // default stands instead, and that is not news worth a warning.
+    test('abstains when there is nothing to go on', () => {
+        expect(runnableJavaVersion(undefined)).toBeUndefined();
+    });
+    test('still answers from the wrapper alone, with nothing declared', () => {
+        expect(runnableJavaVersion(undefined, '8.9')).toBe(21);
     });
     // 8 joined the images on 2026-09-07 and must stay unreachable except where
     // a wrapper ceiling forces it: a project declaring `sourceCompatibility 1.8`
@@ -84,17 +90,58 @@ describe('runnableJavaVersion', () => {
         expect(runnableJavaVersion(11, '5.2.1')).toBe(11);
         expect(runnableJavaVersion(undefined, '6.9')).toBe(11);
     });
+    // No answer is ever a JDK the build machines lack.
     test('never names a JDK no build machine has', () => {
-        expect(AVAILABLE_JAVA_VERSIONS).toContain(runnableJavaVersion(23));
-        expect(AVAILABLE_JAVA_VERSIONS).toContain(runnableJavaVersion(25, '8.9'));
-    });
-    test('lets an old wrapper cap a newer declaration', () => {
-        // Gradle 7.x tops out at 17 even though newer JDKs are installed. There
-        // is no usable JDK at all, so the pipeline names the newest and the
-        // caller warns — `javaVersionProblem` is what says so.
-        expect(runnableJavaVersion(21, '7.6.1')).toBe(25);
+        for (const answer of [runnableJavaVersion(23), runnableJavaVersion(25, '8.9')]) {
+            if (answer !== undefined)
+                expect(AVAILABLE_JAVA_VERSIONS).toContain(answer);
+        }
+    });
+    /**
+     * And no answer is ever above the wrapper's own ceiling.
+     *
+     * This is the defect. Nothing satisfied both the declaration and the
+     * ceiling, so the chooser fell back to the newest installed JDK — which is
+     * *above* the ceiling by construction, because the ceiling is why nothing
+     * fitted. The build then died selecting the JDK, exactly as a too-new JDK
+     * always does, and `javaVersionProblem` had no branch for the shape so
+     * nothing anywhere said a choice had been made.
+     *
+     * The ceiling is hard: Gradle starts before it reads a single
+     * `sourceCompatibility`. The declaration is a floor. So where they conflict
+     * the ceiling wins, and the caller says so.
+     */
+    test('never answers above the wrapper ceiling', () => {
+        // Gradle 7.x tops out at 17. Declaring 21 cannot raise that.
+        expect(runnableJavaVersion(21, '7.6.1')).toBe(17);
         expect(runnableJavaVersion(17, '7.6.1')).toBe(17);
     });
+    // Gradle 6.5 runs on Java 11 at most, and a workflow pins java-version 12.
+    // The old chooser answered 25 and said nothing.
+    test('caps a modern declaration under an old wrapper', () => {
+        expect(runnableJavaVersion(12, '6.5')).toBe(11);
+    });
+    // Every shape the corpus has, held to both properties at once: the answer
+    // is installed, and it is not above the ceiling.
+    test.each([
+        [8, '4.10.2'],
+        [11, '5.2.1'],
+        [12, '6.5'],
+        [17, '7.6.1'],
+        [21, '7.6.1'],
+        [8, '9.0'],
+        [30, '8.9'],
+        [25, '9.1'],
+        [undefined, '6.9'],
+    ])('declared %s on Gradle %s answers within both bounds', (declared, gradle) => {
+        const answer = runnableJavaVersion(declared, gradle);
+        if (answer === undefined)
+            return; // abstention is always allowed
+        expect(AVAILABLE_JAVA_VERSIONS).toContain(answer);
+        const ceiling = gradleJavaCeiling(gradle);
+        if (ceiling !== undefined)
+            expect(answer).toBeLessThanOrEqual(ceiling);
+    });
     test('honours the Gradle 9 floor of 17', () => {
         // The floor rules 11 out; the newest above it is what gets written.
         expect(runnableJavaVersion(8, '9.0')).toBe(21);
@@ -122,5 +169,41 @@ describe('javaVersionProblem', () => {
         // Nor is 4.10.2, since the images carry 8.
         expect(javaVersionProblem(undefined, '4.10.2')).toBeUndefined();
     });
+    /**
+     * The shape that used to fall through every branch, and the reason this
+     * function is resolved from the same place as the answer.
+     *
+     * A wrapper on Gradle 6.5 under a workflow pinning java-version 12: the
+     * ceiling is not below every installed JDK and the declaration is not above
+     * every installed JDK, so neither old branch fired. The chooser answered 25
+     * — above the ceiling — and nothing said the project had asked for something
+     * else and been overruled.
+     */
+    test('speaks when an old wrapper overrules a newer declaration', () => {
+        const problem = javaVersionProblem(12, '6.5');
+        expect(problem).toContain('Java 12');
+        expect(problem).toContain('Gradle 6.5');
+        expect(problem).toContain('Java 11 at most');
+        expect(problem).toContain('Building on 11');
+    });
+    // An answer that is not what was asked for always speaks, whichever
+    // constraint did the overruling.
+    test.each([
+        [12, '6.5'],
+        [21, '7.6.1'],
+        [30, '8.9'],
+    ])('declared %s on Gradle %s never passes silently', (declared, gradle) => {
+        expect(javaVersionProblem(declared, gradle)).toBeDefined();
+    });
+    // Naming a version with no provenance sends a reader through every Gradle
+    // file looking for a number that is in none of them. The scan knows which
+    // file asked, so the sentence can say.
+    test('names the file that asked, when it is known', () => {
+        const problem = javaVersionProblem(12, '6.5', '.github/workflows/Build.yml');
+        expect(problem).toContain('Java 12 (.github/workflows/Build.yml)');
+    });
+    test('reads correctly without a source', () => {
+        expect(javaVersionProblem(12, '6.5')).not.toContain('(');
+    });
 });
 //# sourceMappingURL=android-java-version.test.js.map

package/dist/src/commands/android-scanner.d.ts

@@ -11,6 +11,16 @@ export interface ScanResult {
     warnings: BuildWarning[];
     /** Highest Java version requirement detected in Gradle files (e.g. 17, 21). */
     detectedJavaVersion?: number;
+    /**
+     * The file that asked for it, when the level came from outside Gradle —
+     * `.github/workflows/Build.yml`, `.java-version`, `.tool-versions`.
+     *
+     * The scan computed this and dropped it, so a warning could name a version
+     * with no provenance and send a reader looking through every Gradle file for
+     * a number that is not in any of them. Undefined when the level came from a
+     * Gradle file, or when a Gradle file asked for at least as much.
+     */
+    detectedJavaVersionSource?: string;
     /** Gradle version the wrapper pins, e.g. "8.9". Undefined when there is no wrapper. */
     detectedGradleVersion?: string;
     /** Build types, product flavors, and all variant combinations detected in Gradle files. */
@@ -102,12 +112,71 @@ export declare function gradleJavaFloor(gradleVersion: string | undefined): numb
  */
 export declare const AVAILABLE_JAVA_VERSIONS: number[];
 /**
- * The newest JDK a build machine carries. Named because it is what a
- * generated pipeline falls back to when no JDK can satisfy the constraints —
- * a pipeline has to write something, and `javaVersionProblem` says what was
- * given up.
+ * The newest JDK a build machine carries.
+ *
+ * It is no longer what the chooser falls back to. It used to be: with no JDK
+ * satisfying both the sources and the wrapper, `runnableJavaVersion` returned
+ * this — which on a project pinning a modern Java level under an old Gradle
+ * wrapper is a JDK **above** that wrapper's ceiling, and the build dies at
+ * `:app:processDebugMainManifest` with "module java.base does not opens
+ * java.io to unnamed module". A number above the ceiling is not a fallback;
+ * it is the failure, chosen deliberately and reported as success.
  */
 export declare const NEWEST_AVAILABLE_JAVA_VERSION: number;
+/** Why the chooser answered as it did. See {@link chooseJavaVersion}. */
+export type JavaVersionKind = "unknown" | "satisfies" | "capped-by-wrapper" | "above-runners" | "wrapper-below-runners";
+/** The JDK choice and the reason for it, resolved together. */
+export interface JavaVersionChoice {
+    /** The JDK to write, or undefined where no answer exists. */
+    version: number | undefined;
+    kind: JavaVersionKind;
+    /** The highest level the project asked for, or 0 if it asked for none. */
+    declared: number;
+    /** The newest JDK the wrapper can start on, or undefined if unreadable. */
+    ceiling: number | undefined;
+    installed: number[];
+}
+/**
+ * The JDK to build on, with the reason attached — one place where the
+ * constraints are resolved, so the answer and the explanation cannot disagree.
+ *
+ * They used to. The chooser fell back to the newest installed JDK whenever
+ * nothing satisfied both constraints, and the sentence beside it had two
+ * branches — a ceiling below every installed JDK, and a declaration above
+ * every installed JDK — so the commonest shape of all fell through both and
+ * said nothing at all. A project pinning Java 12 against a Gradle wrapper that
+ * runs on 11 at most got Java 25 and silence.
+ *
+ * Three facts decide it:
+ *
+ *  - **What the build machine has.** Only `AVAILABLE_JAVA_VERSIONS` exist, so
+ *    a project declaring 30 cannot simply be given 30.
+ *  - **What Gradle can run on.** The wrapper sets a ceiling that source
+ *    compatibility cannot raise: Gradle starts before it reads a single
+ *    `sourceCompatibility`.
+ *  - **What the sources ask for.** A declaration is a floor, not an exact
+ *    request — a project declaring 11 compiles fine on 21.
+ *
+ * `kind` distinguishes the five outcomes:
+ *
+ *  - `unknown` — nothing declared and no readable wrapper. Nothing to go on
+ *    and nothing to say.
+ *  - `satisfies` — an installed JDK meets both the floor and the ceiling.
+ *  - `capped-by-wrapper` — nothing meets both, and the wrapper is why. The
+ *    ceiling is hard and the declaration is a preference, so the newest JDK
+ *    the wrapper *can* run is the answer, and the caller says so.
+ *  - `above-runners` — the declaration is above every installed JDK, and that
+ *    rather than the wrapper is what binds. **No answer**: asking for it would
+ *    fail when the JDK is selected, and quietly picking a lower one would be
+ *    the guess this exists to avoid.
+ *  - `wrapper-below-runners` — the ceiling is below every installed JDK. No
+ *    answer exists.
+ *
+ * `above-runners` is checked before `capped-by-wrapper` so a project declaring
+ * 99 against a modern wrapper is told about the machines rather than about its
+ * wrapper: both bind, and the one it can act on is the one worth naming.
+ */
+export declare function chooseJavaVersion(detectedJavaVersion: number | undefined, gradleVersion?: string): JavaVersionChoice;
 /**
  * The Java version to write into a generated pipeline: the **newest**
  * available JDK that satisfies both what the sources declare and what the
@@ -125,12 +194,22 @@ export declare const NEWEST_AVAILABLE_JAVA_VERSION: number;
  * caps the JDK no matter what the sources say — which is why the ceiling
  * above had to learn minor versions before this could ship.
  */
-export declare function runnableJavaVersion(detectedJavaVersion: number | undefined, gradleVersion?: string): number;
+export declare function runnableJavaVersion(detectedJavaVersion: number | undefined, gradleVersion?: string): number | undefined;
 /**
- * What `runnableJavaVersion` could not honour, as a sentence, or undefined
- * when it honoured everything.
+ * What the choice could not honour, as a sentence, or undefined when it
+ * honoured everything.
+ *
+ * Silence is the failure this exists to prevent: a pipeline that quietly
+ * overruled what a project asked for reads as the project's own problem, and
+ * the commonest shape of all — an old wrapper under a modern declaration — was
+ * the one that used to fall through every branch.
+ *
+ * `source` names the file that asked, when the caller knows it. The scan now
+ * returns it, so "asks for Java 12" can become "asks for Java 12
+ * (.github/workflows/Build.yml)" — a version with no provenance sends a reader
+ * looking through every Gradle file for a number that is not in any of them.
  */
-export declare function javaVersionProblem(detectedJavaVersion: number | undefined, gradleVersion?: string): string | undefined;
+export declare function javaVersionProblem(detectedJavaVersion: number | undefined, gradleVersion?: string, source?: string): string | undefined;
 /**
  * Detects build types and product flavors from Gradle files by static parsing,
  * falling back to the module's source sets for the flavors when no Gradle file

package/dist/src/commands/android-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/android-scanner.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wFAAwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAwKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAcnE;AAyKD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8CjD;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7E;AAQD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsBvF;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIrF;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,UAAsB,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAuC,CAAC;AAElF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAQR;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAkBpB;AAwLD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAsCxE;AAMD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAoQjF;AAgBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAyD3D"}
+{"version":3,"file":"android-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/android-scanner.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wFAAwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAwKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAcnE;AAyKD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8CjD;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7E;AAQD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsBvF;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIrF;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,UAAsB,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAuC,CAAC;AAElF,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,mBAAmB,GACnB,eAAe,GACf,uBAAuB,CAAC;AAE5B,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,IAAI,EAAE,eAAe,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,iBAAiB,CAC/B,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,iBAAiB,CAkCnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAwBpB;AAwLD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAsCxE;AAMD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAiRjF;AAgBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAqE3D"}

package/dist/src/commands/android-scanner.js

@@ -518,12 +518,87 @@ export function gradleJavaFloor(gradleVersion) {
  */
 export const AVAILABLE_JAVA_VERSIONS = [8, 11, 17, 21, 25];
 /**
- * The newest JDK a build machine carries. Named because it is what a
- * generated pipeline falls back to when no JDK can satisfy the constraints —
- * a pipeline has to write something, and `javaVersionProblem` says what was
- * given up.
+ * The newest JDK a build machine carries.
+ *
+ * It is no longer what the chooser falls back to. It used to be: with no JDK
+ * satisfying both the sources and the wrapper, `runnableJavaVersion` returned
+ * this — which on a project pinning a modern Java level under an old Gradle
+ * wrapper is a JDK **above** that wrapper's ceiling, and the build dies at
+ * `:app:processDebugMainManifest` with "module java.base does not opens
+ * java.io to unnamed module". A number above the ceiling is not a fallback;
+ * it is the failure, chosen deliberately and reported as success.
  */
 export const NEWEST_AVAILABLE_JAVA_VERSION = Math.max(...AVAILABLE_JAVA_VERSIONS);
+/**
+ * The JDK to build on, with the reason attached — one place where the
+ * constraints are resolved, so the answer and the explanation cannot disagree.
+ *
+ * They used to. The chooser fell back to the newest installed JDK whenever
+ * nothing satisfied both constraints, and the sentence beside it had two
+ * branches — a ceiling below every installed JDK, and a declaration above
+ * every installed JDK — so the commonest shape of all fell through both and
+ * said nothing at all. A project pinning Java 12 against a Gradle wrapper that
+ * runs on 11 at most got Java 25 and silence.
+ *
+ * Three facts decide it:
+ *
+ *  - **What the build machine has.** Only `AVAILABLE_JAVA_VERSIONS` exist, so
+ *    a project declaring 30 cannot simply be given 30.
+ *  - **What Gradle can run on.** The wrapper sets a ceiling that source
+ *    compatibility cannot raise: Gradle starts before it reads a single
+ *    `sourceCompatibility`.
+ *  - **What the sources ask for.** A declaration is a floor, not an exact
+ *    request — a project declaring 11 compiles fine on 21.
+ *
+ * `kind` distinguishes the five outcomes:
+ *
+ *  - `unknown` — nothing declared and no readable wrapper. Nothing to go on
+ *    and nothing to say.
+ *  - `satisfies` — an installed JDK meets both the floor and the ceiling.
+ *  - `capped-by-wrapper` — nothing meets both, and the wrapper is why. The
+ *    ceiling is hard and the declaration is a preference, so the newest JDK
+ *    the wrapper *can* run is the answer, and the caller says so.
+ *  - `above-runners` — the declaration is above every installed JDK, and that
+ *    rather than the wrapper is what binds. **No answer**: asking for it would
+ *    fail when the JDK is selected, and quietly picking a lower one would be
+ *    the guess this exists to avoid.
+ *  - `wrapper-below-runners` — the ceiling is below every installed JDK. No
+ *    answer exists.
+ *
+ * `above-runners` is checked before `capped-by-wrapper` so a project declaring
+ * 99 against a modern wrapper is told about the machines rather than about its
+ * wrapper: both bind, and the one it can act on is the one worth naming.
+ */
+export function chooseJavaVersion(detectedJavaVersion, gradleVersion) {
+    const declared = Number(detectedJavaVersion) || 0;
+    const ceiling = gradleJavaCeiling(gradleVersion);
+    const floor = gradleJavaFloor(gradleVersion);
+    const installed = [...AVAILABLE_JAVA_VERSIONS].sort((a, b) => a - b);
+    const base = { declared, ceiling, installed };
+    if (!declared && floor === undefined) {
+        return { ...base, version: undefined, kind: "unknown" };
+    }
+    const wanted = Math.max(declared, floor ?? 0);
+    const usable = installed.filter((v) => v >= wanted && v <= (ceiling ?? Infinity));
+    // The newest that fits. Nothing reaches the oldest installed JDK unless a
+    // ceiling leaves nothing else, which is the only reason 8 and 11 are on the
+    // images at all.
+    if (usable.length > 0) {
+        return { ...base, version: usable[usable.length - 1], kind: "satisfies" };
+    }
+    if (declared > installed[installed.length - 1]) {
+        return { ...base, version: undefined, kind: "above-runners" };
+    }
+    const underCeiling = installed.filter((v) => v <= (ceiling ?? Infinity));
+    if (underCeiling.length > 0) {
+        return {
+            ...base,
+            version: underCeiling[underCeiling.length - 1],
+            kind: "capped-by-wrapper",
+        };
+    }
+    return { ...base, version: undefined, kind: "wrapper-below-runners" };
+}
 /**
  * The Java version to write into a generated pipeline: the **newest**
  * available JDK that satisfies both what the sources declare and what the
@@ -542,34 +617,44 @@ export const NEWEST_AVAILABLE_JAVA_VERSION = Math.max(...AVAILABLE_JAVA_VERSIONS
  * above had to learn minor versions before this could ship.
  */
 export function runnableJavaVersion(detectedJavaVersion, gradleVersion) {
-    const ceiling = gradleJavaCeiling(gradleVersion) ?? Infinity;
-    const floor = Math.max(detectedJavaVersion ?? 0, gradleJavaFloor(gradleVersion) ?? 0);
-    const usable = AVAILABLE_JAVA_VERSIONS.filter((v) => v >= floor && v <= ceiling).sort((a, b) => a - b);
-    if (usable.length === 0)
-        return NEWEST_AVAILABLE_JAVA_VERSION;
-    return usable[usable.length - 1];
+    return chooseJavaVersion(detectedJavaVersion, gradleVersion).version;
 }
 /**
- * What `runnableJavaVersion` could not honour, as a sentence, or undefined
- * when it honoured everything.
+ * What the choice could not honour, as a sentence, or undefined when it
+ * honoured everything.
+ *
+ * Silence is the failure this exists to prevent: a pipeline that quietly
+ * overruled what a project asked for reads as the project's own problem, and
+ * the commonest shape of all — an old wrapper under a modern declaration — was
+ * the one that used to fall through every branch.
+ *
+ * `source` names the file that asked, when the caller knows it. The scan now
+ * returns it, so "asks for Java 12" can become "asks for Java 12
+ * (.github/workflows/Build.yml)" — a version with no provenance sends a reader
+ * looking through every Gradle file for a number that is not in any of them.
  */
-export function javaVersionProblem(detectedJavaVersion, gradleVersion) {
+export function javaVersionProblem(detectedJavaVersion, gradleVersion, source) {
+    const choice = chooseJavaVersion(detectedJavaVersion, gradleVersion);
+    if (choice.kind === "satisfies" || choice.kind === "unknown")
+        return undefined;
+    const { declared, ceiling, installed } = choice;
     // "11, 17 and 21", not "11 and 17 and 21" — a human reads this next to a
     // build that will not start.
-    const sorted = [...AVAILABLE_JAVA_VERSIONS].sort((a, b) => a - b);
-    const installed = sorted.length > 1
-        ? `${sorted.slice(0, -1).join(", ")} and ${sorted[sorted.length - 1]}`
-        : String(sorted[0]);
-    const ceiling = gradleJavaCeiling(gradleVersion);
-    const lowest = Math.min(...AVAILABLE_JAVA_VERSIONS);
-    if (ceiling !== undefined && ceiling < lowest) {
-        return `Gradle ${gradleVersion} runs on Java ${ceiling} at most, and build machines carry only ${installed}. This pipeline will very likely fail before it compiles anything — upgrade the Gradle wrapper.`;
+    const list = installed.length > 1
+        ? `${installed.slice(0, -1).join(", ")} and ${installed[installed.length - 1]}`
+        : String(installed[0]);
+    const asked = source ? `Java ${declared} (${source})` : `Java ${declared}`;
+    if (choice.kind === "wrapper-below-runners") {
+        return `Gradle ${gradleVersion} runs on Java ${ceiling} at most, and build machines carry only ${list}. This pipeline will very likely fail before it compiles anything — upgrade the Gradle wrapper.`;
     }
-    const highest = Math.max(...AVAILABLE_JAVA_VERSIONS);
-    if ((detectedJavaVersion ?? 0) > highest) {
-        return `This project declares Java ${detectedJavaVersion}, and build machines carry only ${installed}. Writing Java ${runnableJavaVersion(detectedJavaVersion, gradleVersion)} instead — asking for ${detectedJavaVersion} would fail at "Set the Java version".`;
+    if (choice.kind === "above-runners") {
+        return `This project declares Java ${declared}, and build machines carry only ${list}. Leaving JAVA_VERSION at the pipeline default — asking for ${declared} would fail at "Set the Java version", and quietly choosing a lower one would be a guess.`;
     }
-    return undefined;
+    // capped-by-wrapper
+    const preamble = declared
+        ? `This project asks for ${asked}, and Gradle ${gradleVersion} runs on Java ${ceiling} at most.`
+        : `Gradle ${gradleVersion} runs on Java ${ceiling} at most.`;
+    return `${preamble} Building on ${choice.version} — the newest the wrapper allows.`;
 }
 // ---------------------------------------------------------------------------
 // Gitignore helper
@@ -817,6 +902,12 @@ export async function scanAndroidProject(projectRoot) {
     const detectedJavaVersion = declaredJavaVersion === undefined && pinnedJava === undefined
         ? undefined
         : Math.max(declaredJavaVersion ?? 0, pinnedJava?.version ?? 0);
+    // Only when the pin is what set the level. A Gradle file asking for as much
+    // or more is the thing a reader would find by looking, so naming the
+    // workflow there would point away from the answer.
+    const detectedJavaVersionSource = pinnedJava !== undefined && pinnedJava.version > (declaredJavaVersion ?? 0)
+        ? pinnedJava.source
+        : undefined;
     const detectedGradleVersion = detectGradleWrapperVersion(projectRoot);
     const buildVariants = detectBuildVariants(gradleFiles);
     // ------------------------------------------------------------------
@@ -1024,7 +1115,13 @@ export async function scanAndroidProject(projectRoot) {
             });
         }
     }
-    return { warnings, detectedJavaVersion, detectedGradleVersion, buildVariants };
+    return {
+        warnings,
+        detectedJavaVersion,
+        detectedJavaVersionSource,
+        detectedGradleVersion,
+        buildVariants,
+    };
 }
 // ---------------------------------------------------------------------------
 // Formatter
@@ -1045,9 +1142,18 @@ export function formatScanResult(result) {
     // actually name — they differ whenever the declaration is below the oldest
     // installed JDK or above the newest, and saying only the first made the
     // second look like it had been honoured.
+    //
+    // And when they differ, say why in the same breath. An answer that is not
+    // what was asked for, printed with no reason, reads as a fact about the
+    // project rather than as a decision made on its behalf.
     if (result.detectedJavaVersion !== undefined) {
         const willUse = runnableJavaVersion(result.detectedJavaVersion, result.detectedGradleVersion);
-        lines.push(`ℹ  Detected Java ${result.detectedJavaVersion} requirement — pipeline will use Java ${willUse}`);
+        lines.push(willUse === undefined
+            ? `ℹ  Detected Java ${result.detectedJavaVersion} requirement — no installed JDK can satisfy it`
+            : `ℹ  Detected Java ${result.detectedJavaVersion} requirement — pipeline will use Java ${willUse}`);
+        const problem = javaVersionProblem(result.detectedJavaVersion, result.detectedGradleVersion, result.detectedJavaVersionSource);
+        if (problem)
+            lines.push(`   ${problem}`);
         lines.push("");
     }
     if (result.warnings.length === 0) {

package/dist/src/commands/build.d.ts

@@ -197,6 +197,14 @@ export declare function detectSetupNeeds(warnings: BuildWarning[]): Omit<SetupOp
  * and a webhook must never reach it.
  */
 export declare function triggerMapBlock(defaultBranch?: string): string;
+/**
+ * The JDK a generated pipeline names when the project's own constraints have
+ * no answer — nothing declared and no readable wrapper, or a declaration no
+ * installed JDK can meet. A generated pipeline has to write something; what it
+ * must not do is write a number the wrapper cannot start on and call that a
+ * choice.
+ */
+export declare const DEFAULT_PIPELINE_JAVA_VERSION = 17;
 export declare function generateAndroidPipeline(javaVersion?: number, setup?: SetupOptions, variants?: WorkflowVariants, cacheTechnology?: "gradle" | "kmm", metaNamespace?: 'invarn' | 'cibuild.io', defaultBranch?: string): string;
 export declare function generateIosPipeline(projectPath: string, setup: IosSetupOptions, variants: IosWorkflowVariants, metaNamespace?: 'invarn' | 'cibuild.io', defaultBranch?: string): string;
 export declare function handleBuildCommand(detectMobileProjectRoot: (dir: string) => "android" | "ios" | "kmm" | null, options?: {

package/dist/src/commands/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,sBAAsB,CAAC;AAMrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAIhE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;;;;;;;;OAWG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAiID;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAYjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CASxF;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,SAAQ,GAAG,MAAM,CAInF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,MAAM,EAAE,EACxB,MAAM,SAAQ,GACb,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,iDAAkD,CAAC;AAWnF;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAM/B;AAED,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GACjE,cAAc,EAAE,CAOlB;AAgBD,yFAAyF;AACzF,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,sFAAsF;IACtF,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/C,KAAK,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,MAAM,GAC5D,eAAe,EAAE,CAUnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAC7C,eAAe,EAAE,CAInB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,YAAY,EAAE,GACvB,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,CAAC,CAoBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAW,EACxB,KAAK,GAAE,YAAmS,EAC1S,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CAyTR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/build.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,sBAAsB,CAAC;AAMrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAIhE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;;;;;;;;OAWG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C;;;;;OAKG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,WAAW,EAAE,qBAAqB,CAAC;IACnC,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAiBD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,uBAAuB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAiID;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,IAAI,CAYjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CASxF;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,SAAQ,GAAG,MAAM,CAInF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,MAAM,EAAE,EACxB,MAAM,SAAQ,GACb,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,iDAAkD,CAAC;AAWnF;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,gBAAgB,EAC1B,cAAc,EAAE,MAAM,EAAE,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAM/B;AAED,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GACjE,cAAc,EAAE,CAOlB;AAgBD,yFAAyF;AACzF,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,sFAAsF;IACtF,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/C,KAAK,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,MAAM,GAC5D,eAAe,EAAE,CAUnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAC7C,eAAe,EAAE,CAInB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,YAAY,EAAE,GACvB,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,qBAAqB,GAAG,iBAAiB,CAAC,CAoBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,aAAa,GAAE,MAAgC,GAAG,MAAM,CAcvF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD,wBAAgB,uBAAuB,CACrC,WAAW,GAAE,MAAsC,EACnD,KAAK,GAAE,YAAmS,EAC1S,QAAQ,GAAE,gBAAmC,EAC7C,eAAe,GAAE,QAAQ,GAAG,KAAgB,EAC5C,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CAyTR;AAED,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,mBAAmB,EAC7B,aAAa,GAAE,QAAQ,GAAG,YAA2B,EACrD,aAAa,GAAE,MAAgC,GAC9C,MAAM,CA4LR;AAiVD,wBAAsB,kBAAkB,CACtC,uBAAuB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,EAC1E,OAAO,GAAE;IACP,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CACpC,GACL,OAAO,CAAC,IAAI,CAAC,CA4Bf"}

package/dist/src/commands/build.js

@@ -326,7 +326,15 @@ trigger_map:
     workflow: pull-request
 `;
 }
-export function generateAndroidPipeline(javaVersion = 17, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {}, googleServicesPaths: {}, workflowFlavors: {}, secretsProperties: false, secretsPropertiesPath: 'local.properties' }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
+/**
+ * The JDK a generated pipeline names when the project's own constraints have
+ * no answer — nothing declared and no readable wrapper, or a declaration no
+ * installed JDK can meet. A generated pipeline has to write something; what it
+ * must not do is write a number the wrapper cannot start on and call that a
+ * choice.
+ */
+export const DEFAULT_PIPELINE_JAVA_VERSION = 17;
+export function generateAndroidPipeline(javaVersion = DEFAULT_PIPELINE_JAVA_VERSION, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {}, googleServicesPaths: {}, workflowFlavors: {}, secretsProperties: false, secretsPropertiesPath: 'local.properties' }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
     const keystoreStepFor = (wf) => {
         if (!setup.keystore)
             return "";
@@ -1370,11 +1378,17 @@ async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
         }
     }
     // 7. Generate and write the pipeline
+    //
+    // The chooser abstains rather than falling back, so `undefined` here means
+    // "no installed JDK meets this project's constraints" — not "17 is fine".
+    // The default is what gets written in that case, and the warning below is
+    // what says so; it is never silent when the answer is not what was asked
+    // for, which is the whole reason the two are resolved together.
     const javaVersion = runnableJavaVersion(scanResult.detectedJavaVersion, scanResult.detectedGradleVersion);
-    const javaProblem = javaVersionProblem(scanResult.detectedJavaVersion, scanResult.detectedGradleVersion);
+    const javaProblem = javaVersionProblem(scanResult.detectedJavaVersion, scanResult.detectedGradleVersion, scanResult.detectedJavaVersionSource);
     if (javaProblem)
         console.log(`\n⚠️  ${javaProblem}`);
-    const yaml = generateAndroidPipeline(javaVersion, setupOptions, variants, cacheTechnology, options.metaNamespace, detectDefaultBranch());
+    const yaml = generateAndroidPipeline(javaVersion ?? DEFAULT_PIPELINE_JAVA_VERSION, setupOptions, variants, cacheTechnology, options.metaNamespace, detectDefaultBranch());
     writeFileSync(outputPath, yaml, "utf-8");
     console.log("\n✅ Generated .ci/pipelines/cibuild.yml");
     console.log(`   Platform: ${platformLabel}`);

package/dist/src/yaml/steps/xcode-app-product.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Which built `.app` belongs to the scheme that was built.
+ *
+ * A simulator build leaves every application bundle its graph produced under
+ * `DerivedData/Build/Products/<configuration>-<platform>/`, and a scheme that
+ * builds a watchOS or tvOS companion alongside the app produces two. Taking
+ * whichever one a directory scan reaches first is a coin toss, and it lands the
+ * wrong way often enough to matter: a project whose scheme builds both an iOS
+ * app and a watch companion exported the 588 KB watch bundle as the app under
+ * test. The build was green, the artifact manifest was non-empty, and the
+ * thing a user downloaded could not be installed on the device they built for.
+ * That is worse than delivering nothing, because nothing is visibly wrong and
+ * a plausible wrong answer is not.
+ *
+ * The scheme already knows. A shared `.xcscheme` lists its build entries with a
+ * `BuildableName` whose extension IS the product type, and `buildForRunning`
+ * separates what the scheme builds from what it merely references — a scheme
+ * may list several `.app` entries it does not build, so "mentions an app" is
+ * not the question and a check that asked it would pick just as badly.
+ *
+ * Where the scheme gives no answer this falls back rather than failing. A
+ * project with no shared scheme at all is ordinary — plenty of them never
+ * commit one — and those builds work. Absence of evidence is not evidence, so
+ * the destination's own platform directory decides, and failing to resolve an
+ * app is left to the caller's existing guard.
+ *
+ * The whole resolver runs on the machine that did the build, against the
+ * products that build actually produced, so it needs nothing from the step
+ * generator but the scheme name and the destination.
+ */
+/** A built application bundle, as found under `Build/Products`. */
+export interface BuiltApp {
+    /** The `<configuration>-<platform>` directory, or `''` directly under Products. */
+    platform: string;
+    /** The bundle's own name, e.g. `MyApp.app`. */
+    name: string;
+    /** Absolute path to the bundle. */
+    path: string;
+}
+/**
+ * The SDK suffix the Products directory carries for a given destination.
+ *
+ * `-destination 'generic/platform=iOS Simulator'` builds into
+ * `Debug-iphonesimulator`; the watchOS and tvOS spellings are the ones that
+ * matter here, because a companion target is exactly what produces the second
+ * bundle this resolver exists to skip past.
+ */
+export declare function platformSuffixForDestination(destination: string): string;
+/**
+ * The application bundles a scheme's build action actually builds.
+ *
+ * `buildForRunning="NO"` entries are listed and not built. A scheme can carry
+ * three `.app` entries that are API-compatibility testers in other containers
+ * beside the one framework it really produces, so the attribute is the whole
+ * filter rather than a refinement of one.
+ *
+ * Returns an empty list for a file that cannot be read or carries no build
+ * action — no evidence, which the caller must not read as "builds no app".
+ */
+export declare function runnableAppProducts(schemeXml: string | null): string[];
+/**
+ * The bundle to export, given everything that was built and what the scheme
+ * says it builds.
+ *
+ * In order: the scheme's own product on the destination's platform, the
+ * scheme's own product anywhere, anything on the destination's platform,
+ * anything at all. The last two are the no-shared-scheme path, and they are
+ * what keeps a project that never committed a scheme building exactly as it
+ * did before.
+ */
+export declare function chooseAppProduct(apps: BuiltApp[], schemeProducts: string[], destination: string): BuiltApp | null;
+/**
+ * The resolver as it runs on the build machine: dependency-free CommonJS,
+ * written to a temp file and invoked with
+ * `node <file> <productsDir> <projectPath> <scheme> <destination>`.
+ *
+ * It prints the chosen bundle's path and nothing else, and exits non-zero with
+ * no output when it cannot choose — which is the signal for the caller's
+ * existing scan to take over, so a machine without a usable node is no worse
+ * off than before this existed.
+ *
+ * Kept as source text rather than bundled because the step ships a shell
+ * script, not a module graph. The three functions above are the same rules in
+ * testable form, and `xcode-app-product.test.ts` holds them to each other.
+ *
+ * Must contain no backtick and no dollar-brace: it is emitted into a bash
+ * heredoc, and it is a TypeScript template literal on the way there.
+ */
+export declare const APP_PRODUCT_RESOLVER_SOURCE: string;
+//# sourceMappingURL=xcode-app-product.d.ts.map

package/dist/src/yaml/steps/xcode-app-product.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xcode-app-product.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/xcode-app-product.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,mEAAmE;AACnE,MAAM,WAAW,QAAQ;IACvB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAMxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAatE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,QAAQ,EAAE,EAChB,cAAc,EAAE,MAAM,EAAE,EACxB,WAAW,EAAE,MAAM,GAClB,QAAQ,GAAG,IAAI,CAOjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAqIzC,CAAC"}