@invarn/cibuild 2.8.4 → 2.8.6

package/dist/src/yaml/steps/gradle-memory.test.js

@@ -0,0 +1,197 @@
+/**
+ * Gradle's daemon heaps, fitted to the build machine; and a killed daemon,
+ * named as one.
+ *
+ * The fixtures are the `gradle.properties` of IacobIonut01/ReFra
+ * (`-Xmx8G`, inherited by the Kotlin daemon) and vitorpamplona/amethyst
+ * (`-Xmx6g` beside `kotlin.daemon.jvmargs=-Xmx8g`). Both died on a 10 GiB
+ * build machine with nothing in the log but "Gradle build daemon disappeared
+ * unexpectedly".
+ *
+ * The shell under test is the one that ships: it is executed here, not
+ * re-implemented.
+ */
+import { execFileSync, spawnSync } from "node:child_process";
+import { chmodSync, copyFileSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { AndroidBuildForUITestingStepExecutor, AndroidLintStepExecutor, AndroidUnitTestStepExecutor, GradleBuildStepExecutor, } from "./android.js";
+import { GRADLE_MEMORY_FUNCTIONS } from "./gradle-memory.js";
+import { testConfig } from "./test-config.js";
+const FIXTURES = join(dirname(fileURLToPath(import.meta.url)), "../../../test/fixtures/gradle-memory");
+let dir;
+beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "cibuild-gradle-memory-"));
+});
+afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+});
+/** Run the shipped plan in `dir`, the way the step does, with a given memory. */
+function plan(memMib, preferred = "", userHome = join(dir, "no-user-home")) {
+    const script = `${GRADLE_MEMORY_FUNCTIONS}
+cibuild_gradle_memory_plan "$1" gradle.properties "$2/gradle.properties" "$3"
+for a in "\${CIBUILD_GRADLE_MEMORY_ARGS[@]}"; do printf 'ARG %s\\n' "$a"; done
+printf 'LINE %s\\n' "$CIBUILD_GRADLE_MEMORY_LINE"
+printf 'SENTENCE %s\\n' "$CIBUILD_GRADLE_MEMORY_SENTENCE"`;
+    const out = execFileSync("bash", ["-c", script, "plan", memMib, userHome, preferred], {
+        cwd: dir,
+        encoding: "utf-8",
+    });
+    const lines = out.split("\n");
+    return {
+        args: lines.filter((l) => l.startsWith("ARG ")).map((l) => l.slice(4)),
+        line: (lines.find((l) => l.startsWith("LINE ")) ?? "").slice(5),
+        sentence: (lines.find((l) => l.startsWith("SENTENCE ")) ?? "").slice(9),
+    };
+}
+const TEN_GIB = "10240";
+describe("cibuild_gradle_memory_plan", () => {
+    test("ReFra: -Xmx8G, inherited by the Kotlin daemon, is capped on a 10 GiB machine", () => {
+        copyFileSync(join(FIXTURES, "refra.gradle.properties"), join(dir, "gradle.properties"));
+        const p = plan(TEN_GIB);
+        // 75% of 10 GiB, halved because the Kotlin daemon inherits it. Their own
+        // CI runs 4g.
+        expect(p.args).toEqual(["-Dorg.gradle.jvmargs=-Xmx3840m -Dfile.encoding=UTF-8"]);
+        expect(p.line).toContain("org.gradle.jvmargs=-Xmx8G -Dfile.encoding=UTF-8 at gradle.properties:9");
+        expect(p.line).toContain("16.0 GiB");
+        expect(p.line).toContain("-Xmx3840m");
+        expect(p.sentence).toMatch(/^The build machine has 10\.0 GiB; this build's Gradle and Kotlin daemons asked for 16\.0 GiB/);
+    });
+    test("amethyst: both heaps are scaled, and the Kotlin one keeps its other flags", () => {
+        copyFileSync(join(FIXTURES, "amethyst.gradle.properties"), join(dir, "gradle.properties"));
+        const p = plan(TEN_GIB);
+        expect(p.args).toEqual([
+            "-Dorg.gradle.jvmargs=-Xmx3264m -Dfile.encoding=UTF-8",
+            "-Pkotlin.daemon.jvmargs=-Xmx4352m -XX:MaxMetaspaceSize=2g",
+        ]);
+        expect(p.line).toContain("kotlin.daemon.jvmargs=-Xmx8g -XX:MaxMetaspaceSize=2g at gradle.properties:27");
+        expect(p.line).toContain("14.0 GiB");
+    });
+    test("heaps that fit are left alone, and nothing is printed", () => {
+        copyFileSync(join(FIXTURES, "refra.gradle.properties"), join(dir, "gradle.properties"));
+        const p = plan("65536");
+        expect(p.args).toEqual([]);
+        expect(p.line).toBe("");
+        expect(p.sentence).toContain("asked for 16.0 GiB");
+    });
+    test("a project that declares nothing gets Gradle's default and no cap", () => {
+        const p = plan(TEN_GIB);
+        expect(p.args).toEqual([]);
+        expect(p.sentence).toContain("Gradle's default -Xmx512m");
+    });
+    test("in-process Kotlin compilation has no Kotlin daemon to count", () => {
+        writeFileSync(join(dir, "gradle.properties"), "org.gradle.jvmargs=-Xmx4g\nkotlin.compiler.execution.strategy=in-process\n");
+        expect(plan("6144").args).toEqual([]);
+        expect(plan("4096").args).toEqual(["-Dorg.gradle.jvmargs=-Xmx3072m"]);
+    });
+    test("the Gradle user home's value wins over the project's, as in Gradle", () => {
+        writeFileSync(join(dir, "gradle.properties"), "org.gradle.jvmargs=-Xmx1g\n");
+        const home = join(dir, "home");
+        mkdirSync(home);
+        writeFileSync(join(home, "gradle.properties"), "org.gradle.jvmargs=-Xmx6g -XX:+UseParallelGC\n");
+        const p = plan(TEN_GIB, "", home);
+        expect(p.args).toEqual(["-Dorg.gradle.jvmargs=-Xmx3840m -XX:+UseParallelGC"]);
+        expect(p.line).toContain(`at ${home}/gradle.properties:1`);
+    });
+    test("JVM arguments the pipeline asks for replace the project's, and are still capped", () => {
+        copyFileSync(join(FIXTURES, "refra.gradle.properties"), join(dir, "gradle.properties"));
+        const fits = plan(TEN_GIB, "-Xmx2g -Dfile.encoding=UTF-8");
+        expect(fits.args).toEqual(["-Dorg.gradle.jvmargs=-Xmx2g -Dfile.encoding=UTF-8"]);
+        expect(fits.line).toContain("as the pipeline asks");
+        const capped = plan("4096", "-Xmx4g -Dfile.encoding=UTF-8");
+        expect(capped.args).toEqual(["-Dorg.gradle.jvmargs=-Xmx1536m -Dfile.encoding=UTF-8"]);
+        expect(capped.line).toContain("at the pipeline");
+    });
+    test("a value continued onto another line is left as it is, and says so", () => {
+        writeFileSync(join(dir, "gradle.properties"), "org.gradle.jvmargs=-Xmx12g \\\n  -Dfile.encoding=UTF-8\n");
+        const p = plan(TEN_GIB);
+        expect(p.args).toEqual([]);
+        expect(p.line).toContain("continues onto another line");
+    });
+    test("an unknown machine size caps nothing", () => {
+        copyFileSync(join(FIXTURES, "refra.gradle.properties"), join(dir, "gradle.properties"));
+        const p = plan("");
+        expect(p.args).toEqual([]);
+        expect(p.sentence).toContain("could not be read");
+    });
+    test("-Xmx in every unit, and a comment is not an assignment", () => {
+        writeFileSync(join(dir, "gradle.properties"), "# org.gradle.jvmargs=-Xmx64g\norg.gradle.jvmargs = -Xms1g -Xmx6144m\nkotlin.daemon.jvmargs:-Xmx4194304k\n");
+        const p = plan("8192");
+        expect(p.args).toEqual([
+            "-Dorg.gradle.jvmargs=-Xms1g -Xmx3648m",
+            "-Pkotlin.daemon.jvmargs=-Xmx2432m",
+        ]);
+    });
+});
+/** A directory standing in for PATH, with a fake `dmesg` that prints `oom`. */
+function fakeBin(oom) {
+    const bin = join(dir, "bin");
+    mkdirSync(bin, { recursive: true });
+    writeFileSync(join(bin, "dmesg"), `#!/bin/bash\nprintf '%s\\n' ${JSON.stringify(oom)}\n`);
+    chmodSync(join(bin, "dmesg"), 0o755);
+    return bin;
+}
+/** A `./gradlew` that records its arguments and fails the way it is told. */
+function fakeGradlew(body) {
+    writeFileSync(join(dir, "gradlew"), `#!/bin/bash\nprintf '%s\\n' "$@" > "$(dirname "$0")/gradlew-args"\n${body}\n`);
+    chmodSync(join(dir, "gradlew"), 0o755);
+}
+function runStep(script, bin) {
+    writeFileSync(join(dir, "step.sh"), script);
+    return spawnSync("bash", [join(dir, "step.sh")], {
+        cwd: dir,
+        encoding: "utf-8",
+        env: { ...process.env, PATH: `${bin}:${process.env.PATH}`, JAVA_HOME: "", CIBUILD_SOURCE_DIR: "" },
+    });
+}
+describe("the Gradle steps", () => {
+    const OOM_LINE = "[  412.9] Out of memory: Killed process 4242 (java) total-vm:14680064kB, anon-rss:9437184kB";
+    test("a killed daemon prints the kernel's out-of-memory lines and the sentence, and still fails", async () => {
+        copyFileSync(join(FIXTURES, "refra.gradle.properties"), join(dir, "gradle.properties"));
+        fakeGradlew('echo "FAILURE: Build failed with an exception."\necho "Gradle build daemon disappeared unexpectedly (it may have been killed or may have crashed)"\nexit 1');
+        const step = await new GradleBuildStepExecutor().execute({ gradle_task: "assembleDebug" }, {}, testConfig);
+        const run = runStep(step.script, fakeBin(OOM_LINE));
+        expect(run.status).toBe(1);
+        expect(run.stdout).toContain("Gradle memory: a Gradle daemon was killed rather than failing the build (exit 1).");
+        expect(run.stdout).toContain(`    ${OOM_LINE}`);
+        expect(run.stdout).toMatch(/The build machine has [0-9.]+ GiB; this build's Gradle and Kotlin daemons asked for 16\.0 GiB/);
+        expect(run.stdout).not.toContain("Gradle build completed successfully");
+    });
+    test("an ordinary failure says nothing about memory", async () => {
+        fakeGradlew('echo "Compilation error"\nexit 1');
+        const step = await new GradleBuildStepExecutor().execute({ gradle_task: "assembleDebug" }, {}, testConfig);
+        const run = runStep(step.script, fakeBin(OOM_LINE));
+        expect(run.status).toBe(1);
+        expect(run.stdout).not.toContain("Gradle memory:");
+    });
+    test("the pipeline's jvmargs reach Gradle as one argument, before the task", async () => {
+        fakeGradlew("exit 0");
+        const step = await new GradleBuildStepExecutor().execute({ gradle_task: "assembleDebug", gradle_options: "--stacktrace", jvmargs: "-Xmx256m -Dfile.encoding=UTF-8" }, {}, testConfig);
+        const run = runStep(step.script, fakeBin(""));
+        expect(run.status).toBe(0);
+        const args = execFileSync("cat", [join(dir, "gradlew-args")], { encoding: "utf-8" }).trim().split("\n");
+        expect(args).toEqual(["-Dorg.gradle.jvmargs=-Xmx256m -Dfile.encoding=UTF-8", "assembleDebug", "--stacktrace"]);
+    });
+    test("every Gradle step runs through the plan, and every one is valid bash", async () => {
+        const steps = [
+            await new GradleBuildStepExecutor().execute({}, {}, testConfig),
+            await new AndroidLintStepExecutor().execute({}, {}, testConfig),
+            await new AndroidUnitTestStepExecutor().execute({}, {}, testConfig),
+            await new AndroidBuildForUITestingStepExecutor().execute({}, {}, testConfig),
+        ];
+        for (const step of steps) {
+            const script = step.script;
+            expect(script).toContain("cibuild_gradle_memory_cap ''");
+            execFileSync("bash", ["-n"], { input: script });
+        }
+    });
+    // cibuild's log is parsed for step-progress markers; nothing here may look
+    // like one.
+    test("no line the functions print can be taken for a step-progress marker", () => {
+        for (const line of GRADLE_MEMORY_FUNCTIONS.split("\n")) {
+            expect(line).not.toMatch(/INVARN_(STEP|PHASE)|▸/);
+        }
+    });
+});
+//# sourceMappingURL=gradle-memory.test.js.map

package/dist/src/yaml/steps/ios-deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ios-deps.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/ios-deps.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAc,MAAM,wBAAwB,CAAC;AAMhF,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,gBAAgB;IAChE,yBAAyB,CACvB,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAUpB,OAAO,CACX,MAAM,EAAE,sBAAsB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CA+FpB;AAMD,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;IACxD,yBAAyB,CACvB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAUpB,OAAO,CACX,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CAyDpB"}
+{"version":3,"file":"ios-deps.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/ios-deps.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAc,MAAM,wBAAwB,CAAC;AAMhF,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,gBAAgB;IAChE,yBAAyB,CACvB,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAUpB,OAAO,CACX,MAAM,EAAE,sBAAsB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CAoJpB;AAMD,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6BAA6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,gBAAgB;IACxD,yBAAyB,CACvB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAUpB,OAAO,CACX,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,OAAO,CAAC,OAAO,CAAC;CAyDpB"}

package/dist/src/yaml/steps/ios-deps.js

@@ -65,17 +65,69 @@ export class CocoapodsInstallStepExecutor extends BaseStepExecutor {
         commands.push('# Detect Gemfile with cocoapods gem → use bundle exec');
         commands.push('USE_BUNDLE_EXEC="false"');
         commands.push('if [ -f "Gemfile.lock" ] && grep -q "cocoapods" "Gemfile.lock" 2>/dev/null; then');
-        commands.push('  if command -v bundle &>/dev/null; then');
-        commands.push('    USE_BUNDLE_EXEC="true"');
-        commands.push('    echo "Detected cocoapods in Gemfile.lock — using bundle exec"');
-        commands.push('    bundle install --quiet');
-        commands.push('  fi');
+        commands.push('  USE_BUNDLE_EXEC="true"');
+        commands.push('  echo "Detected cocoapods in Gemfile.lock — using bundle exec"');
         commands.push('elif [ -f "Gemfile" ] && grep -q "cocoapods" "Gemfile" 2>/dev/null; then');
-        commands.push('  if command -v bundle &>/dev/null; then');
-        commands.push('    USE_BUNDLE_EXEC="true"');
-        commands.push('    echo "Detected cocoapods in Gemfile — using bundle exec"');
-        commands.push('    bundle install --quiet');
+        commands.push('  USE_BUNDLE_EXEC="true"');
+        commands.push('  echo "Detected cocoapods in Gemfile — using bundle exec"');
+        commands.push('fi');
+        commands.push('');
+        // Run the bundler the lockfile names, from a Ruby that can install it.
+        //
+        // A Gemfile.lock ends in `BUNDLED WITH <version>`, and RubyGems refuses to
+        // start any other bundler for it: "Could not find 'bundler' (2.3.21)
+        // required by your Gemfile.lock". The step used to run whatever `bundle`
+        // was on PATH, which on a mac guest is /usr/bin/bundle, system Ruby 2.6 —
+        // and system Ruby cannot `gem install` without sudo, so nothing in the step
+        // could recover.
+        //
+        // Three moves, each conditional, so a machine missing a piece keeps the
+        // old behaviour rather than failing on it:
+        //   - prefer an installed Homebrew Ruby. It is keg-only, so it is not on
+        //     PATH even where it is installed (Homebrew's cocoapods and fastlane
+        //     formulae depend on it), and the system 2.6 wins by default;
+        //   - point GEM_HOME at a writable directory outside the checkout, so both
+        //     `gem install bundler` and `bundle install` can write without sudo,
+        //     and put its bin directory first;
+        //   - install the locked bundler if it is absent and invoke it by version,
+        //     `bundle _<version>_`, which is the form RubyGems accepts.
+        commands.push('BUNDLE_CMD="bundle"');
+        commands.push('if [ "$USE_BUNDLE_EXEC" = "true" ]; then');
+        commands.push('  if command -v brew &>/dev/null; then');
+        commands.push('    BREW_RUBY="$(brew --prefix --installed ruby 2>/dev/null || true)"');
+        commands.push('    if [ -n "$BREW_RUBY" ] && [ -x "$BREW_RUBY/bin/ruby" ]; then');
+        commands.push('      export PATH="$BREW_RUBY/bin:$PATH"');
+        commands.push('    fi');
+        commands.push('  fi');
+        commands.push('  if ! command -v bundle &>/dev/null && ! command -v gem &>/dev/null; then');
+        commands.push('    USE_BUNDLE_EXEC="false"');
+        commands.push('    echo "No bundle or gem on PATH — running pod directly"');
+        commands.push('  fi');
+        commands.push('fi');
+        commands.push('if [ "$USE_BUNDLE_EXEC" = "true" ]; then');
+        commands.push('  export GEM_HOME="${CIBUILD_SCRATCH:-${TMPDIR:-/tmp}}/cibuild-gems"');
+        commands.push('  mkdir -p "$GEM_HOME"');
+        commands.push('  export PATH="$GEM_HOME/bin:$PATH"');
+        commands.push('  RUBY_VERSION_USED="$(ruby -e \'print RUBY_VERSION\' 2>/dev/null || echo unknown)"');
+        commands.push('  echo "Ruby: $(command -v ruby || echo none) ($RUBY_VERSION_USED), GEM_HOME: $GEM_HOME"');
+        commands.push('  LOCKED_BUNDLER=""');
+        commands.push('  if [ -f "Gemfile.lock" ]; then');
+        commands.push('    LOCKED_BUNDLER="$(awk \'/^BUNDLED WITH/ { getline; gsub(/[[:space:]]/, ""); print; exit }\' Gemfile.lock)"');
+        commands.push('  fi');
+        commands.push('  if [ -n "$LOCKED_BUNDLER" ]; then');
+        commands.push('    if ! gem list -i bundler -v "$LOCKED_BUNDLER" &>/dev/null; then');
+        commands.push('      echo "Installing bundler $LOCKED_BUNDLER, which Gemfile.lock names under BUNDLED WITH"');
+        commands.push('      if ! gem install bundler -v "$LOCKED_BUNDLER" --no-document; then');
+        commands.push('        echo "❌ Error: could not install bundler $LOCKED_BUNDLER (Gemfile.lock BUNDLED WITH) under Ruby $RUBY_VERSION_USED"');
+        commands.push('        exit 1');
+        commands.push('      fi');
+        commands.push('    fi');
+        commands.push('    BUNDLE_CMD="bundle _${LOCKED_BUNDLER}_"');
+        commands.push('  elif ! command -v bundle &>/dev/null; then');
+        commands.push('    echo "Installing bundler — none on PATH and Gemfile.lock names no version"');
+        commands.push('    gem install bundler --no-document');
         commands.push('  fi');
+        commands.push('  $BUNDLE_CMD install --quiet');
         commands.push('fi');
         commands.push('');
         // Build pod command
@@ -87,7 +139,7 @@ export class CocoapodsInstallStepExecutor extends BaseStepExecutor {
         // refused anonymous clone there fails the step exactly as it does during a
         // Swift package resolve — same signature, same fix.
         commands.push('if [ "$USE_BUNDLE_EXEC" = "true" ]; then');
-        commands.push('  POD_INVOCATION="bundle exec pod"');
+        commands.push('  POD_INVOCATION="$BUNDLE_CMD exec pod"');
         commands.push('else');
         commands.push('  POD_INVOCATION="pod"');
         commands.push('fi');

package/dist/src/yaml/steps/xcode-derived-data.test.js

@@ -27,10 +27,14 @@
  * left both `Debug` and `Debug-iphonesimulator` under Products.
  */
 import { describe, test, expect } from '@jest/globals';
+import { execFileSync } from 'child_process';
+import { mkdtempSync, realpathSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
 import { XcodeBuildStepExecutor, XcodeBuildForTestStepExecutor, XcodeBuildForSimulatorStepExecutor, } from './xcode.js';
 import { APP_PRODUCT_RESOLVER_SOURCE } from './xcode-app-product.js';
 import { testConfig } from './test-config.js';
-const DERIVED = '-derivedDataPath "$OUTPUT_DIR/DerivedData"';
+const DERIVED = '-derivedDataPath "$DERIVED_DATA_PATH"';
 const scriptFor = async (executor, inputs) => {
     const result = await executor.execute({ project_path: 'MyApp.xcodeproj', scheme: 'MyApp', ...inputs }, {}, testConfig);
     return result.script;
@@ -71,7 +75,7 @@ describe('xcode-build-for-simulator finds the .app where it now lands', () => {
     const build = (inputs = {}) => scriptFor(new XcodeBuildForSimulatorStepExecutor(), inputs);
     test('searches under the per-platform Products directory', async () => {
         const script = await build();
-        expect(script).toContain('PRODUCTS_DIR="$OUTPUT_DIR/DerivedData/Build/Products"');
+        expect(script).toContain('PRODUCTS_DIR="$DERIVED_DATA_PATH/Build/Products"');
         expect(script).toContain('find "$PRODUCTS_DIR"');
     });
     test('searches deep enough to reach <config>-<platform>/Foo.app', async () => {
@@ -165,4 +169,68 @@ describe('the output_dir input still steers where everything goes', () => {
         expect(script).toContain(DERIVED);
     });
 });
+/**
+ * Derived data lives outside the source tree.
+ *
+ * With `-derivedDataPath "$OUTPUT_DIR/DerivedData"` and an output_dir of
+ * `build/app`, every resolved SPM checkout sat at
+ * `<repo>/build/app/DerivedData/SourcePackages/checkouts/` — inside the
+ * working tree an app's own SwiftLint build phase lints. vinhnx/Clendar went red
+ * on 145 serious violations, every one of them in a third-party package, none
+ * in the app. A developer's Xcode keeps derived data under ~/Library, so no
+ * repository has a reason to exclude it.
+ */
+describe('derived data is outside the source tree', () => {
+    const definitionOf = (script) => {
+        const line = script.split('\n').find((l) => l.startsWith('DERIVED_DATA_PATH='));
+        expect(line).toBeDefined();
+        return line;
+    };
+    // Runs the step's own definition line, the way the step would.
+    const resolve = (script, env) => execFileSync('bash', ['-c', `${definitionOf(script)}\nprintf '%s' "$DERIVED_DATA_PATH"`], {
+        env: { PATH: process.env.PATH ?? '', ...env },
+    }).toString();
+    test.each(buildingExecutors())('%s never builds into the output dir', async (_name, executor) => {
+        expect(await scriptFor(executor, {})).not.toContain('$OUTPUT_DIR/DerivedData');
+    });
+    test.each(buildingExecutors())('%s puts derived data under the scratch root, not under the checkout', async (_name, executor) => {
+        const scratch = realpathSync(mkdtempSync(join(tmpdir(), 'scratch-')));
+        const repo = join(scratch, 'workspace', 'repo');
+        const path = resolve(await scriptFor(executor, { output_dir: 'build/app' }), {
+            CIBUILD_SCRATCH: scratch,
+            OUTPUT_DIR: join(repo, 'build', 'app'),
+        });
+        expect(path.startsWith(scratch + '/')).toBe(true);
+        expect(path.startsWith(repo + '/')).toBe(false);
+    });
+    test('falls back to TMPDIR outside a sandbox', async () => {
+        const tmp = realpathSync(mkdtempSync(join(tmpdir(), 'tmp-')));
+        const path = resolve(await scriptFor(new XcodeBuildStepExecutor(), {}), {
+            TMPDIR: tmp,
+            OUTPUT_DIR: '/work/repo/build',
+        });
+        expect(path.startsWith(tmp + '/')).toBe(true);
+    });
+    // The iOS template names the same output_dir on Build App and Build for
+    // Testing so the second step reads what the first compiled. That sharing has
+    // to survive the move: same output dir, same derived data.
+    test('two steps naming the same output_dir share derived data', async () => {
+        const env = { CIBUILD_SCRATCH: '/scratch', OUTPUT_DIR: '/work/repo/build/app' };
+        const app = resolve(await scriptFor(new XcodeBuildForSimulatorStepExecutor(), { output_dir: 'build/app' }), env);
+        const tests = resolve(await scriptFor(new XcodeBuildForTestStepExecutor(), { output_dir: 'build/app' }), env);
+        expect(tests).toBe(app);
+    });
+    test('two different output dirs stay apart', async () => {
+        const script = await scriptFor(new XcodeBuildStepExecutor(), {});
+        const a = resolve(script, { CIBUILD_SCRATCH: '/scratch', OUTPUT_DIR: '/work/repo/build/app' });
+        const b = resolve(script, { CIBUILD_SCRATCH: '/scratch', OUTPUT_DIR: '/work/repo/build' });
+        expect(a).not.toBe(b);
+    });
+    test('the product listing and the xctestrun search follow it', async () => {
+        const build = await scriptFor(new XcodeBuildStepExecutor(), {});
+        expect(build).toContain('ls -lhR "$DERIVED_DATA_PATH/Build/Products"');
+        const forTest = await scriptFor(new XcodeBuildForTestStepExecutor(), {});
+        expect(forTest).toContain('find "$DERIVED_DATA_PATH/Build/Products" -name "*.xctestrun"');
+    });
+});
 //# sourceMappingURL=xcode-derived-data.test.js.map

package/dist/src/yaml/steps/xcode-new.test.js

@@ -52,7 +52,7 @@ describe('XcodeBuildForTestStepExecutor', () => {
         const executor = new XcodeBuildForTestStepExecutor();
         const result = await executor.execute({ project_path: 'MyApp.xcodeproj', scheme: 'MyApp' }, {}, testConfig);
         expect(result.script).toContain('-derivedDataPath');
-        expect(result.script).toContain('DerivedData');
+        expect(result.script).toContain('-derivedDataPath "$DERIVED_DATA_PATH"');
     });
     test('should locate .xctestrun file', async () => {
         const executor = new XcodeBuildForTestStepExecutor();

package/dist/src/yaml/steps/xcode-resolve-retry.test.js

@@ -29,7 +29,7 @@ describe('xcode-build-for-test resolves before it builds', () => {
         const resolveLine = script
             .split('\n')
             .find((l) => l.includes('-resolvePackageDependencies'));
-        expect(resolveLine).toContain('-derivedDataPath "$OUTPUT_DIR/DerivedData"');
+        expect(resolveLine).toContain('-derivedDataPath "$DERIVED_DATA_PATH"');
     });
     test('passes the same project type and scheme as the build', async () => {
         const resolveLine = (await build())
@@ -131,7 +131,7 @@ describe('cocoapods-install retries a refused pod source fetch', () => {
     });
     test('still chooses between bundle exec and bare pod', async () => {
         const script = await build();
-        expect(script).toContain('bundle exec pod');
+        expect(script).toContain('$BUNDLE_CMD exec pod');
         expect(script).toContain('USE_BUNDLE_EXEC');
     });
     test('runs the pod command exactly once in the script', async () => {

package/dist/src/yaml/steps/xcode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xcode.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/xcode.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAI7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,yBAAyB,CACvB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmDpB,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA0IzG;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACzD,yBAAyB,CACvB,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmDpB,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAuExG;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kCAAkC;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;iEAC6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;qDAGiD;IACjD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,gBAAgB;IAC5D,yBAAyB,CACvB,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IA6B1B,UAAU,IAAI,UAAU,EAAE;IASpB,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAwU3G;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,yBAAyB,CACvB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IA4BpB,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyEzG;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;sDACkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,yBAAyB,CACvB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAS1B,UAAU;;;;;IAUJ,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAuH3G;AAMD,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,gBAAgB;IACjE,yBAAyB,CACvB,MAAM,EAAE,uBAAuB,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAsB1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA6GlH;AAMD,MAAM,WAAW,8BAA8B;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,qBAAa,oCAAqC,SAAQ,gBAAgB;IACxE,yBAAyB,CACvB,MAAM,EAAE,8BAA8B,EACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAgB1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAkFzH;AAMD,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,kCAAmC,SAAQ,gBAAgB;IACtE,yBAAyB,CACvB,MAAM,EAAE,4BAA4B,EACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAsB1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAqMvH;AAMD,MAAM,WAAW,qBAAqB;IACpC,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yCAAyC;IACzC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,yBAAyB,CACvB,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAkHhH"}
+{"version":3,"file":"xcode.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/xcode.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAI7C,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AA6BhF;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,yBAAyB,CACvB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmDpB,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA2IzG;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,gBAAgB;IACzD,yBAAyB,CACvB,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAmDpB,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAuExG;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kCAAkC;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6CAA6C;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC;iEAC6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;qDAGiD;IACjD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,gBAAgB;IAC5D,yBAAyB,CACvB,MAAM,EAAE,kBAAkB,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IA6B1B,UAAU,IAAI,UAAU,EAAE;IASpB,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAwU3G;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,yBAAyB,CACvB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IA4BpB,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAyEzG;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;sDACkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,yBAAyB,CACvB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAS1B,UAAU;;;;;IAUJ,OAAO,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAuH3G;AAMD,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,gBAAgB;IACjE,yBAAyB,CACvB,MAAM,EAAE,uBAAuB,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAsB1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA8GlH;AAMD,MAAM,WAAW,8BAA8B;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,qBAAa,oCAAqC,SAAQ,gBAAgB;IACxE,yBAAyB,CACvB,MAAM,EAAE,8BAA8B,EACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAgB1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAkFzH;AAMD,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBAAa,kCAAmC,SAAQ,gBAAgB;IACtE,yBAAyB,CACvB,MAAM,EAAE,4BAA4B,EACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAsB1B,UAAU,IAAI,UAAU,EAAE;IAMpB,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAsMvH;AAMD,MAAM,WAAW,qBAAqB;IACpC,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yCAAyC;IACzC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,gBAAgB;IAC/D,yBAAyB,CACvB,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,QAAQ,GAChB,qBAAqB,EAAE;IAM1B,UAAU,IAAI,UAAU,EAAE;IAOpB,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CAkHhH"}

package/dist/src/yaml/steps/xcode.js

@@ -6,6 +6,32 @@ import { BaseStepExecutor } from './base.js';
 import { resolveDestinationInput } from './xcode-destination.js';
 import { APP_PRODUCT_RESOLVER_SOURCE } from './xcode-app-product.js';
 import { refusedFetchHelpers, retryOnRefusedFetch } from './git-fetch-retry.js';
+/**
+ * Where derived data goes: outside the source tree, keyed by the output dir.
+ *
+ * It used to be "$DERIVED_DATA_PATH", and OUTPUT_DIR is inside the
+ * checkout — so every resolved SPM package sat in the working tree, where an
+ * app's own lint or format build phase walks it. vinhnx/Clendar's SwiftLint
+ * phase failed the build on 145 serious violations, all of them in
+ * third-party packages under build/app/DerivedData/SourcePackages/checkouts.
+ * A developer's Xcode keeps derived data under ~/Library, so no repository has
+ * a reason to exclude that directory, and it should not have to.
+ *
+ * CIBUILD_SCRATCH is the runner's per-build local root, which holds the
+ * checkout rather than sitting inside it; outside a sandbox it falls back to
+ * TMPDIR. The key is a checksum of the absolute output dir, so two steps that
+ * name the same output_dir still share derived data (the iOS template relies
+ * on that to avoid compiling the app twice) and two that name different ones
+ * stay apart, as they did before.
+ */
+function derivedDataPathLines() {
+    return [
+        '# Derived data outside the source tree, keyed by the output dir',
+        'DERIVED_DATA_PATH="${CIBUILD_SCRATCH:-${TMPDIR:-/tmp}}/cibuild-derived-data/$(printf \'%s\' "$OUTPUT_DIR" | cksum | cut -d\' \' -f1)"',
+        'mkdir -p "$DERIVED_DATA_PATH"',
+        'echo "Derived data: $DERIVED_DATA_PATH"',
+    ];
+}
 /**
  * Xcodebuild step executor
  * Builds iOS/macOS projects using xcodebuild
@@ -64,6 +90,7 @@ export class XcodeBuildStepExecutor extends BaseStepExecutor {
         commands.push('# Create output directory and resolve to absolute path');
         commands.push(`mkdir -p '${this.escapeBash(outputDir)}'`);
         commands.push(`OUTPUT_DIR="$(cd '${this.escapeBash(outputDir)}' && pwd)"`);
+        commands.push(...derivedDataPathLines());
         // Create xcconfig file if content provided
         if (xcconfigContent && xcconfigContent.trim() !== '') {
             commands.push('');
@@ -97,7 +124,7 @@ export class XcodeBuildStepExecutor extends BaseStepExecutor {
             command: 'xcodebuild -resolvePackageDependencies' +
                 ` "$PROJECT_TYPE" '${escapedPath}'` +
                 ` -scheme '${this.escapeBash(scheme)}'` +
-                ' -derivedDataPath "$OUTPUT_DIR/DerivedData"',
+                ' -derivedDataPath "$DERIVED_DATA_PATH"',
         }));
         // Build xcodebuild command
         commands.push('');
@@ -112,14 +139,14 @@ export class XcodeBuildStepExecutor extends BaseStepExecutor {
         xcodebuildCmd += ` -scheme '${this.escapeBash(scheme)}'`;
         xcodebuildCmd += ` -configuration '${this.escapeBash(configuration)}'`;
         xcodebuildCmd += ` -destination '${this.escapeBash(destination)}'`;
-        // Derived data under the output dir, rather than CONFIGURATION_BUILD_DIR.
+        // A derived data path (see derivedDataPathLines), rather than CONFIGURATION_BUILD_DIR.
         // Same reasoning as XcodeBuildForSimulatorStepExecutor below, where the
         // full mechanism and the control are written up: the flat directory
         // collapses xcodebuild's per-configuration/per-platform product separation
         // and any graph with two tasks producing the same output name is refused
         // with "Multiple commands produce". It also desynchronises CocoaPods, whose
         // PODS_CONFIGURATION_BUILD_DIR follows BUILD_DIR and not this setting.
-        xcodebuildCmd += ` -derivedDataPath "$OUTPUT_DIR/DerivedData"`;
+        xcodebuildCmd += ` -derivedDataPath "$DERIVED_DATA_PATH"`;
         // Add xcconfig if provided
         if (xcconfigContent && xcconfigContent.trim() !== '') {
             xcodebuildCmd += ' -xcconfig "$XCCONFIG_FILE"';
@@ -132,8 +159,8 @@ export class XcodeBuildStepExecutor extends BaseStepExecutor {
         // Products live under the per-platform Products directory now, not flat in
         // $OUTPUT_DIR, so point the listing at where they actually are — otherwise
         // the log says "artifacts in build/" above an empty directory.
-        commands.push('echo "Build artifacts in: $OUTPUT_DIR/DerivedData/Build/Products"');
-        commands.push('ls -lhR "$OUTPUT_DIR/DerivedData/Build/Products" 2>/dev/null || true');
+        commands.push('echo "Build artifacts in: $DERIVED_DATA_PATH/Build/Products"');
+        commands.push('ls -lhR "$DERIVED_DATA_PATH/Build/Products" 2>/dev/null || true');
         const script = this.createBashScriptFromCommands(commands, stepName);
         return this.createScriptStep(script, stepName);
     }
@@ -806,6 +833,7 @@ export class XcodeBuildForTestStepExecutor extends BaseStepExecutor {
         // Output directory
         commands.push(`mkdir -p '${this.escapeBash(outputDir)}'`);
         commands.push(`OUTPUT_DIR="$(cd '${this.escapeBash(outputDir)}' && pwd)"`);
+        commands.push(...derivedDataPathLines());
         commands.push('');
         // xcconfig
         if (xcconfigContent.trim()) {
@@ -833,7 +861,7 @@ export class XcodeBuildForTestStepExecutor extends BaseStepExecutor {
             command: 'xcodebuild -resolvePackageDependencies' +
                 ` "$PROJECT_TYPE" '${escapedPath}'` +
                 ` -scheme '${escapedScheme}'` +
-                ' -derivedDataPath "$OUTPUT_DIR/DerivedData"',
+                ' -derivedDataPath "$DERIVED_DATA_PATH"',
         }));
         // Build command
         let cmd = 'xcodebuild build-for-testing';
@@ -841,7 +869,7 @@ export class XcodeBuildForTestStepExecutor extends BaseStepExecutor {
         cmd += ` -scheme '${escapedScheme}'`;
         cmd += ` -configuration '${this.escapeBash(configuration)}'`;
         cmd += ` -destination '${this.escapeBash(destination)}'`;
-        cmd += ` -derivedDataPath "$OUTPUT_DIR/DerivedData"`;
+        cmd += ` -derivedDataPath "$DERIVED_DATA_PATH"`;
         if (testPlan) {
             cmd += ` -testPlan '${this.escapeBash(testPlan)}'`;
         }
@@ -855,7 +883,7 @@ export class XcodeBuildForTestStepExecutor extends BaseStepExecutor {
         commands.push('');
         // Locate .xctestrun file
         commands.push('# Locate generated .xctestrun file');
-        commands.push('XCTESTRUN_PATH=$(find "$OUTPUT_DIR/DerivedData/Build/Products" -name "*.xctestrun" | head -1)');
+        commands.push('XCTESTRUN_PATH=$(find "$DERIVED_DATA_PATH/Build/Products" -name "*.xctestrun" | head -1)');
         commands.push('if [ -z "$XCTESTRUN_PATH" ]; then');
         commands.push('  echo "❌ Error: .xctestrun file not found"');
         commands.push('  exit 1');
@@ -1007,6 +1035,7 @@ export class XcodeBuildForSimulatorStepExecutor extends BaseStepExecutor {
         // Output dir
         commands.push(`mkdir -p '${this.escapeBash(outputDir)}'`);
         commands.push(`OUTPUT_DIR="$(cd '${this.escapeBash(outputDir)}' && pwd)"`);
+        commands.push(...derivedDataPathLines());
         commands.push('');
         // xcconfig
         commands.push('XCCONFIG_FILE="$(mktemp -t cibuild-xcconfig).xcconfig"');
@@ -1040,7 +1069,7 @@ export class XcodeBuildForSimulatorStepExecutor extends BaseStepExecutor {
             command: 'xcodebuild -resolvePackageDependencies' +
                 ` "$PROJECT_TYPE" '${escapedPath}'` +
                 ` -scheme '${escapedScheme}'` +
-                ' -derivedDataPath "$OUTPUT_DIR/DerivedData"',
+                ' -derivedDataPath "$DERIVED_DATA_PATH"',
         }));
         // Build command
         let cmd = 'xcodebuild';
@@ -1087,7 +1116,7 @@ export class XcodeBuildForSimulatorStepExecutor extends BaseStepExecutor {
         // with no .app; -derivedDataPath reached BUILD SUCCEEDED in 2m06s and left
         // both Debug and Debug-iphonesimulator under Products — the separation the
         // flat directory destroys.
-        cmd += ` -derivedDataPath "$OUTPUT_DIR/DerivedData"`;
+        cmd += ` -derivedDataPath "$DERIVED_DATA_PATH"`;
         cmd += ' -xcconfig "$XCCONFIG_FILE"';
         if (xcodebuildOptions) {
             cmd += ` ${xcodebuildOptions}`;
@@ -1106,7 +1135,7 @@ export class XcodeBuildForSimulatorStepExecutor extends BaseStepExecutor {
         // answer — a project with no shared scheme is ordinary and builds fine, so
         // this resolves the same bundle it always did there.
         commands.push('# Locate generated .app — the one this scheme builds');
-        commands.push('PRODUCTS_DIR="$OUTPUT_DIR/DerivedData/Build/Products"');
+        commands.push('PRODUCTS_DIR="$DERIVED_DATA_PATH/Build/Products"');
         commands.push('APP_RESOLVER="$(mktemp -t cibuild-app-product).cjs"');
         commands.push(`cat > "$APP_RESOLVER" << 'CIBUILD_APP_PRODUCT_EOF'`);
         commands.push(APP_PRODUCT_RESOLVER_SOURCE.trim());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.8.4",
+  "version": "2.8.6",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",