@invarn/cibuild 2.9.4 → 2.9.7

package/dist/src/yaml/secrets-manager.js

@@ -1,230 +0,0 @@
-/**
- * Universal secrets management for CI Build
- * Stores sensitive values by exact variable name — no UUIDs, no YAML modification
- * Supports per-workflow scoping with global fallback
- *
- * File format:
- * {
- *   "global": { "VAR_NAME": "value" },
- *   "workflows": {
- *     "staging-java-17": { "VAR_NAME": "value" }
- *   }
- * }
- */
-import * as fs from 'fs';
-import * as path from 'path';
-import { decodeSecretName } from '../commands/secrets-upload.js';
-export class SecretsManager {
-    secretsFilePath;
-    data;
-    fileLoaded = false;
-    constructor(secretsFilePath) {
-        this.secretsFilePath = secretsFilePath || path.join(process.cwd(), '.cibuild-secrets.json');
-        this.data = { global: {}, workflows: {} };
-        this.loadSecrets();
-    }
-    loadSecrets() {
-        try {
-            if (fs.existsSync(this.secretsFilePath)) {
-                const content = fs.readFileSync(this.secretsFilePath, 'utf-8');
-                const parsed = JSON.parse(content);
-                this.fileLoaded = true;
-                // Support both new format and legacy flat format
-                if (parsed.global !== undefined || parsed.workflows !== undefined) {
-                    this.data = {
-                        global: parsed.global || {},
-                        workflows: parsed.workflows || {},
-                    };
-                }
-                else {
-                    // Legacy flat format: treat all keys as global
-                    this.data.global = {};
-                    for (const [key, value] of Object.entries(parsed)) {
-                        if (typeof value === 'string') {
-                            this.data.global[key] = value;
-                        }
-                    }
-                }
-            }
-            else {
-                // No file — try loading from structured env vars (GitHub environment secrets)
-                const envData = this.getStructuredEnvSecrets();
-                if (Object.keys(envData.global).length > 0 ||
-                    Object.keys(envData.workflows).length > 0) {
-                    this.data = envData;
-                    this.fileLoaded = true;
-                }
-            }
-        }
-        catch (error) {
-            console.warn(`Warning: Could not load secrets file: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    }
-    /**
-     * Reads structured env vars (CIBUILD_S__* and CIBUILD_SW__*) and decodes them
-     * back into a SecretsFile structure. Used when running in CI where secrets
-     * were uploaded via `ci secrets upload`.
-     */
-    getStructuredEnvSecrets() {
-        const result = { global: {}, workflows: {} };
-        for (const [key, value] of Object.entries(process.env)) {
-            if (value === undefined)
-                continue;
-            const decoded = decodeSecretName(key);
-            if (!decoded)
-                continue;
-            if (decoded.workflow) {
-                if (!result.workflows[decoded.workflow]) {
-                    result.workflows[decoded.workflow] = {};
-                }
-                result.workflows[decoded.workflow][decoded.varName] = value;
-            }
-            else {
-                result.global[decoded.varName] = value;
-            }
-        }
-        return result;
-    }
-    saveSecrets() {
-        const dir = path.dirname(this.secretsFilePath);
-        if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, { recursive: true });
-        }
-        fs.writeFileSync(this.secretsFilePath, JSON.stringify(this.data, null, 2), {
-            mode: 0o600,
-        });
-    }
-    /**
-     * Store a secret by variable name, optionally scoped to a workflow.
-     * @returns The variable name (used as the key)
-     */
-    storeSecret(name, value, workflow) {
-        if (workflow) {
-            if (!this.data.workflows[workflow]) {
-                this.data.workflows[workflow] = {};
-            }
-            this.data.workflows[workflow][name] = value;
-        }
-        else {
-            this.data.global[name] = value;
-        }
-        this.saveSecrets();
-        return name;
-    }
-    static ENV_PREFIX = 'CIBUILD_';
-    /**
-     * Reads all CIBUILD_-prefixed env vars, stripping the prefix from the keys.
-     * e.g. CIBUILD_SSH_RSA_PRIVATE_KEY → SSH_RSA_PRIVATE_KEY
-     */
-    getEnvSecrets() {
-        const secrets = {};
-        for (const [key, value] of Object.entries(process.env)) {
-            if (key.startsWith(SecretsManager.ENV_PREFIX) && value !== undefined) {
-                secrets[key.slice(SecretsManager.ENV_PREFIX.length)] = value;
-            }
-        }
-        return secrets;
-    }
-    /**
-     * Get a secret value by variable name.
-     * Workflow-specific value takes precedence over global.
-     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
-     *
-     * The stored data is consulted before that fallback, and not only when a
-     * file was loaded. `storeSecret` writes the file but cannot make it one this
-     * instance *loaded*, so a value collected by `ci init` on a repository that
-     * had no store — which is the only kind of run that collects anything — read
-     * back as absent from the instance that had just stored it. `ci init`'s own
-     * `getSecret('KEYSTORE_PROPERTIES', wf)`, which is how a workflow's keystore
-     * target is taken from `storeFile=`, returned undefined on every fresh
-     * repository because of it.
-     */
-    getSecret(name, workflow) {
-        if (workflow && this.data.workflows[workflow]?.[name] !== undefined) {
-            return this.data.workflows[workflow][name];
-        }
-        if (this.data.global[name] !== undefined) {
-            return this.data.global[name];
-        }
-        if (!this.fileLoaded) {
-            return process.env[SecretsManager.ENV_PREFIX + name];
-        }
-        return undefined;
-    }
-    /**
-     * Get all secrets merged: global + workflow-specific (workflow overrides global).
-     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present —
-     * for the keys the store does not hold. See `getSecret`.
-     */
-    getAll(workflow) {
-        const merged = this.fileLoaded ? {} : this.getEnvSecrets();
-        Object.assign(merged, this.data.global);
-        if (workflow && this.data.workflows[workflow]) {
-            Object.assign(merged, this.data.workflows[workflow]);
-        }
-        return merged;
-    }
-    /**
-     * Returns the variable name if a secret exists for it, undefined otherwise.
-     * Checks workflow scope first, then global, then the CIBUILD_-prefixed env
-     * vars when no secrets file is present. See `getSecret`.
-     */
-    getSecretIdByName(name, workflow) {
-        if (workflow && this.data.workflows[workflow]?.[name] !== undefined) {
-            return name;
-        }
-        if (this.data.global[name] !== undefined) {
-            return name;
-        }
-        if (!this.fileLoaded) {
-            return process.env[SecretsManager.ENV_PREFIX + name] !== undefined ? name : undefined;
-        }
-        return undefined;
-    }
-    /**
-     * Returns the name itself (API compatibility).
-     */
-    getSecretName(id) {
-        return this.getSecretIdByName(id) ? id : undefined;
-    }
-    /**
-     * Check if a secret exists by variable name (global or any workflow).
-     */
-    hasSecret(name, workflow) {
-        return this.getSecretIdByName(name, workflow) !== undefined;
-    }
-    /**
-     * Get all stored variable names (global + all workflows, deduplicated).
-     */
-    getAllSecretNames() {
-        const names = new Set(Object.keys(this.data.global));
-        for (const vars of Object.values(this.data.workflows)) {
-            for (const key of Object.keys(vars))
-                names.add(key);
-        }
-        return Array.from(names);
-    }
-    /**
-     * Delete a secret by variable name (from workflow scope or global).
-     */
-    deleteSecret(name, workflow) {
-        let deleted = false;
-        if (workflow && this.data.workflows[workflow]) {
-            if (name in this.data.workflows[workflow]) {
-                delete this.data.workflows[workflow][name];
-                deleted = true;
-            }
-        }
-        else if (name in this.data.global) {
-            delete this.data.global[name];
-            deleted = true;
-        }
-        if (deleted)
-            this.saveSecrets();
-        return deleted;
-    }
-    getSecretsFilePath() {
-        return this.secretsFilePath;
-    }
-}
-//# sourceMappingURL=secrets-manager.js.map

package/dist/src/yaml/shell-assignments.d.ts

@@ -1,40 +0,0 @@
-/**
- * Which names a shell snippet binds for itself.
- *
- * Two different parts of this codebase scan a step's inputs for `$UPPERCASE`
- * and act on every hit — the pre-execution validator, which demands each one
- * be supplied, and the env resolver, which *substitutes* each one. For a
- * `script` step the inputs are the shell body, so a variable the script
- * computes is indistinguishable from one it needs handed to it. Both were
- * wrong about the same thing, so they share one answer.
- *
- * A generated multiplatform pipeline made it plain. Its prepare step opens
- *
- *     INTEGRATION="$KMM_IOS_INTEGRATION"
- *     IOS_DIR=$(dirname "$IOS_PROJECT_PATH")
- *     for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do …
- *
- * and no build could start: the validator refused for three values nothing was
- * meant to provide, and the resolver would have gone further and *rewritten*
- * the body, replacing `"$IOS_DIR"` with a pipeline value instead of the one
- * `dirname` had just computed. Substituting a shell local is not a missing
- * value at all; it is a corrupted script.
- *
- * **Only the assignment target is collected, never the right-hand side.** That
- * is what keeps this from being a hole: `INTEGRATION="$KMM_IOS_INTEGRATION"`
- * still needs `KMM_IOS_INTEGRATION`, so a script cannot excuse itself from a
- * value it reads by mentioning it.
- *
- * Assignment order is deliberately not modelled. A snippet that reads a
- * variable before setting it is a bug in the snippet, and guessing about it
- * here would trade one wrong answer for another; "does the script set this
- * itself?" is the question worth asking.
- */
-/** The names one snippet of shell assigns to itself. */
-export declare function shellAssignedNamesIn(text: string): Set<string>;
-/**
- * The same question asked of a whole inputs object, walked recursively — what
- * the validator needs, because it reasons about a step rather than a string.
- */
-export declare function shellAssignedNames(obj: unknown): Set<string>;
-//# sourceMappingURL=shell-assignments.d.ts.map

package/dist/src/yaml/shell-assignments.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"shell-assignments.d.ts","sourceRoot":"","sources":["../../../src/yaml/shell-assignments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAaH,wDAAwD;AACxD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAa9D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAa5D"}

package/dist/src/yaml/shell-assignments.js

@@ -1,77 +0,0 @@
-/**
- * Which names a shell snippet binds for itself.
- *
- * Two different parts of this codebase scan a step's inputs for `$UPPERCASE`
- * and act on every hit — the pre-execution validator, which demands each one
- * be supplied, and the env resolver, which *substitutes* each one. For a
- * `script` step the inputs are the shell body, so a variable the script
- * computes is indistinguishable from one it needs handed to it. Both were
- * wrong about the same thing, so they share one answer.
- *
- * A generated multiplatform pipeline made it plain. Its prepare step opens
- *
- *     INTEGRATION="$KMM_IOS_INTEGRATION"
- *     IOS_DIR=$(dirname "$IOS_PROJECT_PATH")
- *     for WORKSPACE in "$IOS_DIR"/*.xcworkspace; do …
- *
- * and no build could start: the validator refused for three values nothing was
- * meant to provide, and the resolver would have gone further and *rewritten*
- * the body, replacing `"$IOS_DIR"` with a pipeline value instead of the one
- * `dirname` had just computed. Substituting a shell local is not a missing
- * value at all; it is a corrupted script.
- *
- * **Only the assignment target is collected, never the right-hand side.** That
- * is what keeps this from being a hole: `INTEGRATION="$KMM_IOS_INTEGRATION"`
- * still needs `KMM_IOS_INTEGRATION`, so a script cannot excuse itself from a
- * value it reads by mentioning it.
- *
- * Assignment order is deliberately not modelled. A snippet that reads a
- * variable before setting it is a bug in the snippet, and guessing about it
- * here would trade one wrong answer for another; "does the script set this
- * itself?" is the question worth asking.
- */
-/** `NAME=…`, `export NAME=…`, `local/readonly/declare/typeset NAME=…`, `NAME+=…` */
-const ASSIGNMENT = /(?:^|[\n;&|(]|\|\||&&)[ \t]*(?:(?:export|readonly|local|declare|typeset)[ \t]+)?([A-Z_][A-Z_0-9]*)\+?=/g;
-/** `for NAME in …`, `select NAME in …` */
-const LOOP = /(?:^|[\n;&|(])[ \t]*(?:for|select)[ \t]+([A-Z_][A-Z_0-9]*)[ \t]+in\b/g;
-/** `read NAME`, `read -r NAME OTHER`, `while read -r NAME` */
-const READ = /(?:^|[\n;&|(]|\|\||&&)[ \t]*(?:while[ \t]+)?read[ \t]+((?:-\S+[ \t]+)*)([A-Z_][A-Z_0-9]*(?:[ \t]+[A-Z_][A-Z_0-9]*)*)/g;
-/** The names one snippet of shell assigns to itself. */
-export function shellAssignedNamesIn(text) {
-    const names = new Set();
-    for (const re of [ASSIGNMENT, LOOP]) {
-        re.lastIndex = 0;
-        let m;
-        while ((m = re.exec(text)) !== null)
-            names.add(m[1]);
-    }
-    READ.lastIndex = 0;
-    let m;
-    while ((m = READ.exec(text)) !== null) {
-        for (const n of m[2].trim().split(/[ \t]+/))
-            names.add(n);
-    }
-    return names;
-}
-/**
- * The same question asked of a whole inputs object, walked recursively — what
- * the validator needs, because it reasons about a step rather than a string.
- */
-export function shellAssignedNames(obj) {
-    const names = new Set();
-    const walk = (value) => {
-        if (typeof value === 'string') {
-            for (const n of shellAssignedNamesIn(value))
-                names.add(n);
-        }
-        else if (Array.isArray(value)) {
-            value.forEach(walk);
-        }
-        else if (value && typeof value === 'object') {
-            Object.values(value).forEach(walk);
-        }
-    };
-    walk(obj);
-    return names;
-}
-//# sourceMappingURL=shell-assignments.js.map

package/dist/src/yaml/step-validator-check-failure.test.d.ts

@@ -1,24 +0,0 @@
-/**
- * Unit tests for what happens when a pre-execution check cannot run.
- *
- * A check that *ran* and found nothing, and a check that *threw* before it
- * tested anything, are different events. Until 2026-09-01 they were reported
- * identically: the throw was wrapped in a `Check failed:` message and carried
- * the requirement's own declared severity. For the Java JDK requirement that
- * severity is `info` — chosen because the check looks in several places and a
- * miss is not fatal — so a check that never looked anywhere at all was
- * reported as information and read as noise.
- *
- * It was not noise. The released macOS binary is built with `pkg`, which
- * cannot evaluate a dynamic `import()` of a module it did not bundle; the JDK
- * check opened with two of them and threw `Invalid host defined options` on
- * every macOS build. It went unseen for as long as the fleet has existed.
- *
- * Two rules are pinned here:
- *   1. a throw is reported at `warning`, whatever the requirement declares;
- *   2. no check may reach for a Node builtin through a dynamic import, because
- *      nothing else in the test suite can see that failure — under plain
- *      `node`, and in the npm bundle, the code works.
- */
-export {};
-//# sourceMappingURL=step-validator-check-failure.test.d.ts.map

package/dist/src/yaml/step-validator-check-failure.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"step-validator-check-failure.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator-check-failure.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG"}

package/dist/src/yaml/step-validator-check-failure.test.js

@@ -1,130 +0,0 @@
-/**
- * Unit tests for what happens when a pre-execution check cannot run.
- *
- * A check that *ran* and found nothing, and a check that *threw* before it
- * tested anything, are different events. Until 2026-09-01 they were reported
- * identically: the throw was wrapped in a `Check failed:` message and carried
- * the requirement's own declared severity. For the Java JDK requirement that
- * severity is `info` — chosen because the check looks in several places and a
- * miss is not fatal — so a check that never looked anywhere at all was
- * reported as information and read as noise.
- *
- * It was not noise. The released macOS binary is built with `pkg`, which
- * cannot evaluate a dynamic `import()` of a module it did not bundle; the JDK
- * check opened with two of them and threw `Invalid host defined options` on
- * every macOS build. It went unseen for as long as the fleet has existed.
- *
- * Two rules are pinned here:
- *   1. a throw is reported at `warning`, whatever the requirement declares;
- *   2. no check may reach for a Node builtin through a dynamic import, because
- *      nothing else in the test suite can see that failure — under plain
- *      `node`, and in the npm bundle, the code works.
- */
-import { describe, test, expect } from '@jest/globals';
-import { readFileSync, readdirSync, statSync } from 'node:fs';
-import { join } from 'node:path';
-import { registerStep } from './steps/registry.js';
-import { BaseStepExecutor } from './steps/base.js';
-import { StepValidator } from './step-validator.js';
-import { loadConfig } from '../config.js';
-const config = loadConfig();
-/** A step whose single requirement behaves however the test needs it to. */
-function stepWhoseCheck(severity, check) {
-    const name = `probe-${Math.random().toString(36).slice(2)}`;
-    class ProbeStep extends BaseStepExecutor {
-        async execute() {
-            return this.createScriptStep('echo probe', name);
-        }
-        getValidationRequirements() {
-            return [
-                {
-                    category: 'command',
-                    name: 'probe-tool',
-                    description: 'A tool the probe step needs',
-                    timing: 'pre-execution',
-                    severity,
-                    check,
-                },
-            ];
-        }
-    }
-    registerStep(name, new ProbeStep());
-    return name;
-}
-async function validate(stepName) {
-    const validator = new StepValidator({
-        format_version: '1',
-        meta: { invarn: { stack: 'macos-xcode-26.4' } },
-        workflows: { primary: { steps: [{ [`${stepName}@1.0.0`]: { inputs: {} } }] } },
-    }, 'primary', config);
-    return validator.validateWorkflow();
-}
-describe('a check that could not run', () => {
-    test('is reported as a warning even though the requirement declares info', async () => {
-        const name = stepWhoseCheck('info', async () => {
-            throw new Error('Invalid host defined options');
-        });
-        const result = await validate(name);
-        expect(result.counts).toMatchObject({ errors: 0, warnings: 1, info: 0 });
-        expect(result.issues[0].requirement.severity).toBe('warning');
-        expect(result.issues[0].result.message).toBe('Check failed: Invalid host defined options');
-    });
-    test('does not turn a hard requirement into a soft one', async () => {
-        const name = stepWhoseCheck('error', async () => {
-            throw new Error('boom');
-        });
-        const result = await validate(name);
-        // An `error` requirement whose check throws must not be downgraded — that
-        // would let a pipeline proceed past a requirement nothing verified.
-        expect(result.counts).toMatchObject({ errors: 1, warnings: 0, info: 0 });
-        expect(result.valid).toBe(false);
-    });
-    test('leaves a check that ran and failed at its declared severity', async () => {
-        const name = stepWhoseCheck('info', async () => ({
-            passed: false,
-            message: 'Java 17 not found',
-        }));
-        const result = await validate(name);
-        // The whole point of the distinction: this check *worked*. `info` is the
-        // right severity for it and must survive.
-        expect(result.counts).toMatchObject({ errors: 0, warnings: 0, info: 1 });
-        expect(result.issues[0].result.message).toBe('Java 17 not found');
-    });
-});
-/**
- * The structural half.
- *
- * esbuild leaves a dynamic `import()` of a Node builtin in the bundle — the
- * builtins are external — and `pkg` then cannot evaluate it. Relative
- * specifiers are inlined by the bundler and are unaffected, which is why
- * `envman` and `fidelity-trim` work while the JDK check did not.
- *
- * There is no runtime test that can catch this: it reproduces only in a
- * `pkg`-built binary, and `./test.sh` runs under plain `node`. So the rule is
- * enforced on the source.
- */
-describe('no source file reaches for a Node builtin through a dynamic import', () => {
-    const BUILTIN = /await import\(\s*['"](?:node:)?(fs|path|os|child_process|readline|crypto|util|url|http|https|net|stream|zlib|tty|events)(?:\/[\w-]+)?['"]\s*\)/;
-    function sourceFiles(dir) {
-        return readdirSync(dir).flatMap((entry) => {
-            const full = join(dir, entry);
-            if (statSync(full).isDirectory())
-                return sourceFiles(full);
-            if (!full.endsWith('.ts') || full.endsWith('.test.ts'))
-                return [];
-            return [full];
-        });
-    }
-    test('src is clean', () => {
-        // Jest runs from the package root; `src` is the whole surface that gets
-        // bundled into the released binary.
-        const offenders = sourceFiles(join(process.cwd(), 'src'))
-            .flatMap((file) => readFileSync(file, 'utf8')
-            .split('\n')
-            .map((line, i) => ({ file, line: line.trim(), n: i + 1 }))
-            .filter(({ line }) => BUILTIN.test(line)))
-            .map(({ file, n, line }) => `${file.replace(/.*\/src\//, 'src/')}:${n}  ${line}`);
-        expect(offenders).toEqual([]);
-    });
-});
-//# sourceMappingURL=step-validator-check-failure.test.js.map

package/dist/src/yaml/step-validator-self-assigned.test.d.ts

@@ -1,23 +0,0 @@
-/**
- * A step does not owe itself the variables its own shell sets.
- *
- * Pre-execution validation auto-discovers every `$UPPERCASE` in a step's
- * inputs and treats it as a value the pipeline must supply. For a `script`
- * step the inputs *are* the shell body, so a variable the script computes was
- * indistinguishable from one it needed handed to it — and because the check
- * cannot prompt in a sandbox, the pipeline was refused before step 1 for
- * values nothing was ever meant to provide.
- *
- * A generated multiplatform pipeline hit exactly that. Its prepare step opens
- * with `INTEGRATION="$KMM_IOS_INTEGRATION"`, `IOS_DIR=$(dirname
- * "$IOS_PROJECT_PATH")` and `for WORKSPACE in "$IOS_DIR"/*.xcworkspace`, and
- * the run died on "3 required value(s) missing — INTEGRATION, IOS_DIR,
- * WORKSPACE" while the two variables it genuinely reads were both declared and
- * present. The iOS templates do the same thing with `IOS_DIR` alone.
- *
- * The load-bearing half of these tests is the second half: only the assignment
- * *target* is excused, never the right-hand side, so a script cannot exempt
- * itself from a value it reads by mentioning it.
- */
-import '../yaml/steps/index.js';
-//# sourceMappingURL=step-validator-self-assigned.test.d.ts.map

package/dist/src/yaml/step-validator-self-assigned.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"step-validator-self-assigned.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/step-validator-self-assigned.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,wBAAwB,CAAC"}