@invarn/cibuild 2.8.1 → 2.8.3

package/dist/src/commands/a-properties-stand-in-declares-the-keys-the-build-reads.test.js

@@ -215,4 +215,168 @@ describe("the Secrets-plugin warning path is unchanged", () => {
         expect(result.missingPropertyKeys).toEqual(["MAPS_API_KEY"]);
     });
 });
+/**
+ * The commonest shape of all, and the one the first three sources missed.
+ *
+ * The Secrets plugin's own documentation, and every Google Maps setup guide,
+ * puts the key in the manifest and nowhere else. There is no `BuildConfig`
+ * reference and no `manifestPlaceholders` block — the plugin substitutes the
+ * value during manifest merging. A scan reading only build files and source
+ * returns nothing for such a repository, which is the majority of them.
+ */
+describe("a key referenced only in AndroidManifest.xml", () => {
+    test("names a placeholder the plugin fills", async () => {
+        projectApplyingTheSecretsPlugin();
+        write("app/src/main/AndroidManifest.xml", '<manifest xmlns:android="http://schemas.android.com/apk/res/android">\n' +
+            "  <application>\n" +
+            '    <meta-data android:name="com.google.android.geo.API_KEY"\n' +
+            '               android:value="${MAPS_API_KEY}" />\n' +
+            "  </application>\n</manifest>\n");
+        expect(await keys()).toEqual(["MAPS_API_KEY"]);
+    });
+    // AGP supplies this one from the variant, so it is not a value anybody owes.
+    test("ignores ${applicationId}", async () => {
+        projectApplyingTheSecretsPlugin();
+        write("app/src/main/AndroidManifest.xml", '<manifest>\n  <provider android:authorities="${applicationId}.provider" />\n</manifest>\n');
+        expect(await keys()).toEqual([]);
+    });
+    test("finds them in flavor source sets too", async () => {
+        projectApplyingTheSecretsPlugin();
+        write("app/src/main/AndroidManifest.xml", '<manifest a="${BASE_KEY}" />\n');
+        write("app/src/prod/AndroidManifest.xml", '<manifest a="${PROD_KEY}" />\n');
+        expect(await keys()).toEqual(["BASE_KEY", "PROD_KEY"]);
+    });
+    test("skips a merged manifest under build/", async () => {
+        projectApplyingTheSecretsPlugin();
+        write("app/src/main/AndroidManifest.xml", '<manifest a="${REAL_KEY}" />\n');
+        write("app/build/intermediates/merged_manifest/AndroidManifest.xml", '<manifest a="${STALE}" />\n');
+        expect(await keys()).toEqual(["REAL_KEY"]);
+    });
+});
+/**
+ * A build that loads the properties file itself, with no Secrets plugin
+ * anywhere. The file existing is not the fix for these — only the file
+ * existing *with the key in it* is, because `getProperty` on an absent key
+ * returns null whether or not the file is there.
+ */
+describe("a build that reads the properties file directly", () => {
+    test("names a getProperty key, with no plugin applied", async () => {
+        write("settings.gradle.kts", 'include(":app")\n');
+        write("build.gradle.kts", "// root\n");
+        write("app/build.gradle.kts", 'import com.android.build.gradle.internal.cxx.configure.gradleLocalProperties\n' +
+            'val url: String = gradleLocalProperties(rootDir).getProperty("api.url.release")\n');
+        expect(await keys()).toEqual(["api.url.release"]);
+    });
+    test("keeps dotted keys, which a direct reader may use freely", async () => {
+        write("settings.gradle", "include ':app'\n");
+        write("build.gradle", "// root\n");
+        write("app/build.gradle", "def props = new Properties()\n" +
+            "props.load(rootProject.file('local.properties').newDataInputStream())\n" +
+            "def a = props.getProperty('api.url.debug')\n" +
+            "def b = props.getProperty('tv.isDebug')\n");
+        expect(await keys()).toEqual(["api.url.debug", "tv.isDebug"]);
+    });
+    test("honours a default argument without treating it as a key", async () => {
+        write("settings.gradle.kts", 'include(":app")\n');
+        write("build.gradle.kts", "// root\n");
+        write("app/build.gradle.kts", 'val p = java.util.Properties()\n' +
+            'p.load(rootProject.file("local.properties").reader())\n' +
+            'val u = p.getProperty("api.url.release", "")\n');
+        expect(await keys()).toEqual(["api.url.release"]);
+    });
+    /**
+     * The idiom that hides every key behind a name the repository chose. Without
+     * following it, a repository like this reads as having no keys at all.
+     */
+    test("follows a hand-rolled accessor to its call sites", async () => {
+        write("settings.gradle", "include ':app'\n");
+        write("build.gradle", "// root\n");
+        write("app/build.gradle", "def getProps(String propName) {\n" +
+            "    def propsFile = rootProject.file('local.properties')\n" +
+            "    if (propsFile.exists()) {\n" +
+            "        def props = new Properties()\n" +
+            "        props.load(new FileInputStream(propsFile))\n" +
+            "        return props[propName]\n" +
+            "    } else {\n" +
+            "        return \"\";\n" +
+            "    }\n" +
+            "}\n" +
+            "\n" +
+            "String signFilePath = getProps(\"sign.file\")\n" +
+            "Boolean noObfuscate = getProps(\"app.dontobfuscate\")?.toBoolean() ?: false\n");
+        expect(await keys()).toEqual(["app.dontobfuscate", "sign.file"]);
+    });
+    test("does not follow a function that reads something else", async () => {
+        write("settings.gradle", "include ':app'\n");
+        write("build.gradle", "// root\n");
+        write("app/build.gradle", "def getProps(String n) {\n" +
+            "    def p = new Properties()\n" +
+            "    p.load(rootProject.file('local.properties').newDataInputStream())\n" +
+            "    return p[n]\n" +
+            "}\n" +
+            "def version(String n) {\n" +
+            "    def p = new Properties()\n" +
+            "    p.load(rootProject.file('version.properties').newDataInputStream())\n" +
+            "    return p[n]\n" +
+            "}\n" +
+            "def a = getProps('wanted')\n" +
+            "def b = version('unwanted')\n");
+        expect(await keys()).toEqual(["wanted"]);
+    });
+    /**
+     * `properties["x"]` is the Gradle *project* property channel —
+     * `gradle.properties` and `-P` — which the scan already reports separately.
+     * Declaring those in a properties file would be the wrong file entirely.
+     */
+    test("does not confuse Gradle project properties for properties-file keys", async () => {
+        write("settings.gradle.kts", 'include(":app")\n');
+        write("build.gradle.kts", "// root\n");
+        write("app/build.gradle.kts", 'val p = java.util.Properties()\n' +
+            'p.load(rootProject.file("local.properties").reader())\n' +
+            'val a = p.getProperty("wanted")\n' +
+            'val b = properties["projectScoped"]\n' +
+            'val c = findProperty("alsoProjectScoped")\n');
+        expect(await keys()).toEqual(["wanted"]);
+    });
+    /** A developer's own SDK path is not a value anybody owes the build. */
+    test("never names a machine-local key", async () => {
+        write("settings.gradle.kts", 'include(":app")\n');
+        write("build.gradle.kts", "// root\n");
+        write("app/build.gradle.kts", 'val p = java.util.Properties()\n' +
+            'p.load(rootProject.file("local.properties").reader())\n' +
+            'val sdk = p.getProperty("sdk.dir")\n' +
+            'val ndk = p.getProperty("ndk.dir")\n' +
+            'val cmake = p.getProperty("cmake.dir")\n' +
+            'val real = p.getProperty("api.key")\n');
+        expect(await keys()).toEqual(["api.key"]);
+    });
+});
+/**
+ * A scan that answers well on a small repository and thins out on a large one
+ * is the worse of the two failures, because the large one is the one someone
+ * is paid to build.
+ *
+ * Manifests and source shared a file budget at first, and source was walked
+ * first. Measured on a real application — 1743 source files, 47 manifests —
+ * the source walk spent the whole budget and the manifests were never opened,
+ * so every key referenced only as `${KEY}` in a manifest came back missing.
+ * Nine of that application's twenty declared keys were lost that way, and the
+ * scan reported the other eleven with no sign anything was wrong.
+ *
+ * This is the only test here that builds a tree big enough to exhaust a
+ * budget, because that is the only way to express the defect. It costs about
+ * half a second.
+ */
+describe("a repository larger than the source budget", () => {
+    test("still reads its manifests", async () => {
+        projectApplyingTheSecretsPlugin();
+        write("app/src/main/AndroidManifest.xml", '<manifest android:value="${MANIFEST_ONLY_KEY}" />\n');
+        // Past SOURCE_FILE_CAP, spread over directories so no single readdir is
+        // unrepresentative.
+        for (let i = 0; i < 8100; i++) {
+            write(`app/src/main/java/p${i % 40}/F${i}.kt`, `val x${i} = 1\n`);
+        }
+        expect(await keys()).toContain("MANIFEST_ONLY_KEY");
+    }, 60_000);
+});
 //# sourceMappingURL=a-properties-stand-in-declares-the-keys-the-build-reads.test.js.map

package/dist/src/commands/android-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"android-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/android-scanner.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wFAAwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAkaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAcnE;AAyKD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8CjD;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7E;AAQD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsBvF;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIrF;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,UAAsB,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAuC,CAAC;AAElF,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,mBAAmB,GACnB,eAAe,GACf,uBAAuB,CAAC;AAE5B,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,IAAI,EAAE,eAAe,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,iBAAiB,CAC/B,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,iBAAiB,CAkCnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAwBpB;AAwLD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAsCxE;AAMD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA8RjF;AAgBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAqE3D"}
+{"version":3,"file":"android-scanner.d.ts","sourceRoot":"","sources":["../../../src/commands/android-scanner.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,SAAS,GACT,iBAAiB,GACjB,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,uFAAuF;IACvF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,gGAAgG;IAChG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,wFAAwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAolBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAcnE;AAyKD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GACX;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CA8CjD;AA2BD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7E;AAQD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsBvF;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIrF;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB,UAAsB,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAuC,CAAC;AAElF,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,WAAW,GACX,mBAAmB,GACnB,eAAe,GACf,uBAAuB,CAAC;AAE5B,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,IAAI,EAAE,eAAe,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,iBAAiB,CAC/B,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,iBAAiB,CAkCnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAwBpB;AAwLD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,aAAa,CAsCxE;AAMD,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA8RjF;AAgBD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAqE3D"}

package/dist/src/commands/android-scanner.js

@@ -316,12 +316,140 @@ function extractManifestPlaceholderKeys(content) {
     }
     return names;
 }
+/**
+ * Placeholder names referenced in an `AndroidManifest.xml`, other than the ones
+ * the Android Gradle Plugin injects itself.
+ *
+ * **This is what the Secrets plugin is mostly for.** Its own documentation, and
+ * every Google Maps setup guide, puts the key in the manifest and nowhere else:
+ *
+ *     <meta-data android:name="com.google.android.geo.API_KEY"
+ *                android:value="${MAPS_API_KEY}" />
+ *
+ * There is no `BuildConfig` reference and no `manifestPlaceholders` block —
+ * the plugin reads `MAPS_API_KEY` from the properties file and substitutes it
+ * during manifest merging. A scan that reads only build files and source sees
+ * nothing at all in such a repository.
+ *
+ * `applicationId` is excluded because AGP supplies it from the variant. A name
+ * a build file *declares* in `manifestPlaceholders` is not excluded: the build
+ * supplies that one, so naming it costs the usual unused line, and telling the
+ * two apart would mean resolving which module's manifest merges with which
+ * module's build file.
+ */
+const AGP_INJECTED_PLACEHOLDERS = new Set(["applicationId"]);
+function extractManifestXmlPlaceholders(content) {
+    const names = [];
+    const re = /\$\{([A-Za-z_][A-Za-z0-9_.]*)\}/g;
+    let m;
+    while ((m = re.exec(content)) !== null) {
+        if (!AGP_INJECTED_PLACEHOLDERS.has(m[1]))
+            names.push(m[1]);
+    }
+    return names;
+}
+/**
+ * True when this build file loads the properties file itself, rather than
+ * leaving it to the Secrets plugin.
+ *
+ * Every spelling seen in the wild reduces to naming the file or calling a
+ * helper that names it: `rootProject.file("local.properties")`, AGP's own
+ * `gradleLocalProperties(rootDir)`, and Compose's `localPropertiesFile`.
+ */
+function readsPropertiesFileDirectly(content) {
+    return (/\blocal\.properties\b/.test(content) ||
+        /\bgradleLocalProperties\s*\(/.test(content) ||
+        /\blocalPropertiesFile\b/.test(content));
+}
+/**
+ * Keys a build file reads out of a properties file it loaded itself.
+ *
+ * `getProperty("x")` is the direct form, with or without a default. The rest is
+ * for the idiom that hides it: a repository defines its own one-line accessor —
+ *
+ *     def getProps(String name) {
+ *       def f = rootProject.file('local.properties')
+ *       if (f.exists()) { def p = new Properties(); p.load(...); return p[name] }
+ *       return ""
+ *     }
+ *
+ * — and every key then arrives as `getProps("sign.file")`, under a name chosen
+ * by that repository. So a function whose *body* reads the properties file is
+ * treated as an accessor for it, and the string literals at its call sites are
+ * keys. Without that, a repository like this reads as having none.
+ *
+ * `properties["x"]` is deliberately not matched: that is the Gradle *project*
+ * property channel — `gradle.properties` and `-P` — which `extractPropertyRefs`
+ * already reports, and which is not this file.
+ */
+function extractDirectPropertyReads(content) {
+    const names = [];
+    const direct = /\.\s*getProperty\s*\(\s*["']([^"']+)["']/g;
+    let m;
+    while ((m = direct.exec(content)) !== null)
+        names.push(m[1]);
+    for (const accessor of propertiesAccessorNames(content)) {
+        const call = new RegExp(`\\b${escapeForRegExp(accessor)}\\s*\\(\\s*["']([^"']+)["']`, "g");
+        let c;
+        while ((c = call.exec(content)) !== null)
+            names.push(c[1]);
+    }
+    return names;
+}
+function escapeForRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Functions declared in this file whose body reads the properties file. */
+function propertiesAccessorNames(content) {
+    const names = [];
+    // Groovy `def name(...) {` and Kotlin `fun name(...) {`, which is how a
+    // build script declares one.
+    const decl = /\b(?:def|fun)\s+([A-Za-z_]\w*)\s*\([^)]*\)\s*(?::[^{]*)?\{/g;
+    let m;
+    while ((m = decl.exec(content)) !== null) {
+        // `matchingBrace` counts from inside the block, so hand it the index after
+        // the opening brace the declaration regex ended on.
+        const body = m.index + m[0].length;
+        const close = matchingBrace(content, body);
+        if (close === -1)
+            continue;
+        if (readsPropertiesFileDirectly(content.slice(body, close)))
+            names.push(m[1]);
+    }
+    return names;
+}
+/**
+ * Keys that name a location on the machine running the build, not a value the
+ * build needs supplied.
+ *
+ * Writing one into a generated file puts a developer's own SDK path onto a
+ * runner, where it is wrong — and Gradle finds the SDK from `ANDROID_HOME`
+ * when the key is absent, which is how every build on a runner resolves it.
+ * The Secrets plugin ignores `sdk.dir` for the same reason.
+ */
+const MACHINE_LOCAL_KEYS = new Set(["sdk.dir", "ndk.dir", "cmake.dir"]);
 // Bounds on the source walk, the way `findGradleFiles` bounds itself to the
 // files a build actually declares. A repository is an unbounded tree and this
 // runs on every scan of one.
 const SOURCE_EXTENSIONS = [".kt", ".kts", ".java"];
 const SOURCE_SKIP_DIRS = new Set(["build", "node_modules"]);
-const SOURCE_FILE_CAP = 1500;
+/**
+ * **Manifests get their own budget, and a source walk cannot spend it.**
+ *
+ * They shared one at first, with source walked first, and on a real application
+ * that meant the manifests were never reached at all: 1743 source files against
+ * a 1500-file cap left nothing, and the keys referenced only as `${KEY}` in a
+ * manifest — which is most of them — came back missing. A scan that answers
+ * well on a small repository and silently thins out on a large one is the worse
+ * of the two failures, because the large one is the one someone is paid to
+ * build.
+ *
+ * There are few manifests and many source files — 47 against 1743 in that same
+ * application — so the two are not competing for a scarce resource, they were
+ * just sharing the wrong one.
+ */
+const SOURCE_FILE_CAP = 8000;
+const MANIFEST_FILE_CAP = 500;
 const SOURCE_DEPTH_CAP = 12;
 /** Source files under `dir`, up to the shared file budget. */
 function findSourceFiles(dir, budget, depth = 0) {
@@ -360,12 +488,49 @@ function findSourceFiles(dir, budget, depth = 0) {
 function outermost(dirs) {
     return dirs.filter((dir) => !dirs.some((other) => other !== dir && dir.startsWith(other + "/")));
 }
+/** Manifests under `dir`, up to the shared file budget. */
+function findManifests(dir, budget, depth = 0) {
+    if (depth > SOURCE_DEPTH_CAP || budget.left <= 0)
+        return [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const found = [];
+    for (const entry of entries) {
+        if (entry.name.startsWith("."))
+            continue;
+        if (entry.isDirectory()) {
+            if (!SOURCE_SKIP_DIRS.has(entry.name)) {
+                found.push(...findManifests(join(dir, entry.name), budget, depth + 1));
+            }
+        }
+        else if (entry.name === "AndroidManifest.xml") {
+            if (budget.left <= 0)
+                break;
+            budget.left--;
+            found.push(join(dir, entry.name));
+        }
+    }
+    return found;
+}
 /**
- * The property names the build reads out of the Secrets plugin's properties
- * file — see `ScanResult.missingPropertyKeys`.
+ * The property names the build reads out of the properties file — see
+ * `ScanResult.missingPropertyKeys`. Four sources, because a repository may use
+ * any of them and most use exactly one:
+ *
+ *  - `${KEY}` in an `AndroidManifest.xml`, which the Secrets plugin fills. The
+ *    commonest of the four by a distance, and the one its documentation shows.
+ *  - `manifestPlaceholders` declared in a build file.
+ *  - `BuildConfig.<FIELD>` in source, for a key read as a generated constant.
+ *  - `getProperty("key")` in a build file that loads the properties file
+ *    itself, for a build that does not use the plugin at all.
  *
- * Bounded to the modules that apply the plugin, because that is where its
- * generated fields are visible and where the references to them live.
+ * Bounded to the modules that either apply the plugin or read the file
+ * directly. A module that does neither cannot be reading a key out of it.
  */
 function collectPropertyKeys(gradleFiles) {
     // A module with both a `build.gradle` and a `build.gradle.kts` yields its
@@ -374,21 +539,35 @@ function collectPropertyKeys(gradleFiles) {
     const keys = new Set();
     for (const filePath of gradleFiles) {
         const content = safeRead(filePath);
-        if (!appliesSecretsPlugin(content))
+        const plugin = appliesSecretsPlugin(content);
+        const direct = readsPropertiesFileDirectly(content);
+        if (!plugin && !direct)
             continue;
         moduleDirs.add(dirname(filePath));
         for (const key of extractManifestPlaceholderKeys(content))
             keys.add(key);
+        if (direct)
+            for (const key of extractDirectPropertyReads(content))
+                keys.add(key);
     }
     if (moduleDirs.size === 0)
         return [];
-    const budget = { left: SOURCE_FILE_CAP };
+    const sourceBudget = { left: SOURCE_FILE_CAP };
+    const manifestBudget = { left: MANIFEST_FILE_CAP };
     for (const dir of outermost([...moduleDirs])) {
-        for (const file of findSourceFiles(dir, budget)) {
+        // Manifests first. They are the likeliest place for a key and the cheapest
+        // to read, so if anything is ever going to run short it must not be these.
+        for (const manifest of findManifests(dir, manifestBudget)) {
+            for (const name of extractManifestXmlPlaceholders(safeRead(manifest)))
+                keys.add(name);
+        }
+        for (const file of findSourceFiles(dir, sourceBudget)) {
             for (const name of extractBuildConfigFieldRefs(safeRead(file)))
                 keys.add(name);
         }
     }
+    for (const key of MACHINE_LOCAL_KEYS)
+        keys.delete(key);
     return [...keys].sort();
 }
 /** Parse property keys from a standard .properties file, skipping comments and blank lines. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.8.1",
+  "version": "2.8.3",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",