@invarn/cibuild 2.9.4 → 2.9.7

package/package.json

@@ -1,20 +1,18 @@
 {
   "name": "@invarn/cibuild",
-  "version": "2.9.4",
+  "version": "2.9.7",
   "description": "CI Build CLI — local pipeline orchestration and validation",
   "type": "module",
   "main": "dist/cli.cjs",
   "exports": {
     ".": "./dist/cli.cjs",
     "./lib": {
-      "types": "./dist/src/lib.d.ts",
-      "import": "./dist/src/lib.js",
-      "require": "./dist/src/lib.js"
+      "import": "./dist/lib.mjs",
+      "default": "./dist/lib.mjs"
     },
     "./commands": {
-      "types": "./dist/src/commands/index.d.ts",
-      "import": "./dist/src/commands/index.js",
-      "require": "./dist/src/commands/index.js"
+      "import": "./dist/commands.mjs",
+      "default": "./dist/commands.mjs"
     }
   },
   "bin": {
@@ -23,9 +21,7 @@
   },
   "files": [
     "dist/cli.cjs",
-    "dist/src/**/*.js",
-    "dist/src/**/*.d.ts",
-    "dist/src/**/*.d.ts.map"
+    "dist/*.mjs"
   ],
   "scripts": {
     "build": "./build.sh",

package/dist/src/cli.d.ts

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import "./yaml/steps/index.js";
-//# sourceMappingURL=cli.d.ts.map

package/dist/src/cli.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AASA,OAAO,uBAAuB,CAAC"}

package/dist/src/cli.js

@@ -1,399 +0,0 @@
-#!/usr/bin/env node
-import { resolve, extname } from "node:path";
-import { existsSync, readdirSync, readFileSync } from "node:fs";
-// Static — see the note in `yaml/steps/android.ts`. `pkg` cannot evaluate a
-// dynamic `import()` of a builtin.
-import { createInterface } from "node:readline";
-import prompts from "prompts";
-import { SecretsManager } from "./yaml/secrets-manager.js";
-import "./yaml/steps/index.js"; // Initialize step registry
-import { handleBuildCommand } from "./commands/build.js";
-import { handleEditCommand } from "./commands/edit.js";
-import { handleSecretsUploadCommand } from "./commands/secrets-upload.js";
-import { handleSecretsSyncWorkflowCommand } from "./commands/secrets-sync-workflow.js";
-import { handleResetCommand } from "./commands/reset.js";
-import { handleInitCommand } from "./commands/init.js";
-import { handleValidateCommand } from "./commands/validate.js";
-import { handleRunCommand } from "./commands/run.js";
-import { handleDetectProjectCommand } from "./commands/detect-project.js";
-import { handleDetectPlatformCommand } from "./commands/detect-platform.js";
-import { detectMobileProjectRoot } from "./shared/detect-project.js";
-async function main() {
-    const args = process.argv.slice(2);
-    if (args[0] === "--version" || args[0] === "-v") {
-        console.log(CIBUILD_VERSION);
-        process.exit(0);
-    }
-    if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
-        console.log(`
-CI Build - Lightweight CI/CD Pipeline Runner
-
-Usage:
-  ci init                                         Check dependencies + set up pipeline (interactive)
-  ci init --create                                 Check dependencies + create pipeline (non-interactive)
-  ci init --import <path>                          Check dependencies + import YAML pipeline (non-interactive)
-  ci build                                        Generate a standard pipeline for the current project
-  ci run <path> [-w <name>]                       Run locally (development mode)
-  ci run <path> [-w <name>] --production          Run on remote runner (production)
-  ci run <path> [-w <name>] --validate-only       Validate only, don't execute
-  ci run <path> [-w <name>] --skip-validation     Skip validation, run with interactive prompts
-  ci validate <path> [-w <name>]                  Validate pipeline (alias for --validate-only)
-  ci detect-platform <path> [-w <name>]           Detect platform from YAML pipeline
-  ci detect-project                               Detect project type (android, ios, kmm)
-  ci reset [--force]                              Remove all cibuild files and folders
-  ci edit <path> [-w <name>]                      View pipeline and edit step inputs
-  ci secrets add <var_name> <path> [-w <name>]              Add a secret (prompted interactively)
-  ci secrets add <var_name> <path> --file <file> [-w <name>] Add a secret from a file
-  ci secrets upload [--env <name>] [--repo <owner/repo>] [--dry-run]  Upload secrets to GitHub environment
-  ci --version                                      Show version
-  ci --help                                       Show this help
-
-Options:
-  --workflow, -w <name>        Workflow name (YAML only, defaults to first workflow)
-  --production                 Execute on remote runner after validation (vs local)
-  --validate-only              Run validation only, don't execute pipeline
-  --skip-validation            Skip pre-execution validation (for development)
-  --help, -h                   Show this help message
-
-Supported Formats:
-  .ts                          TypeScript pipeline files
-  .yml, .yaml                  YAML pipeline files
-
-Examples:
-  ci init                                        # Interactive setup
-  ci init --create                               # Non-interactive: create pipeline
-  ci init --import pipeline.yml                  # Non-interactive: import YAML
-  ci build                                       # Generate standard pipeline
-  ci run examples/android-build.yml -w pull-request-java-17
-  ci run build.pipeline.ts
-  ci run ios-build.yml
-  ci run android.yml --workflow qa
-  ci run multi-platform.yaml -w ios-build
-  ci run android.yml --production                # Run on remote runner
-  ci validate ios-build.yml                      # Validate only
-  ci detect-platform ios-build.yml
-  ci secrets add SLACK_CHANNEL bitrise.yml              # Add secret (prompted)
-  ci secrets add GOOGLE_SERVICES_JSON bitrise.yml --file app/google-services.json
-  ci detect-platform multi-platform.yaml -w android
-  ci edit android-build.yml                      # View + edit step inputs
-  ci edit android-build.yml -w debug             # Edit specific workflow
-    `);
-        process.exit(0);
-    }
-    // Handle fidelity-trim — the internal trim/align helper spawned by the
-    // generated UI-fidelity render scripts (kept flag-free and fast: it must
-    // behave identically whether invoked as `ci`, the pkg binary re-exec, or
-    // `node dist/cli.cjs`).
-    if (args[0] === "fidelity-trim") {
-        const { handleFidelityTrimCommand } = await import("./commands/fidelity-trim.js");
-        process.exit(handleFidelityTrimCommand(args.slice(1)));
-    }
-    // Handle envman subcommand — delegates to envman CLI
-    if (args[0] === "envman") {
-        // Re-write process.argv so envman sees its own args
-        process.argv = [process.argv[0], "envman", ...args.slice(1)];
-        await import("./envman/cli.js");
-        return;
-    }
-    // Handle detect-project command
-    if (args[0] === "detect-project") {
-        await handleDetectProjectCommand();
-        return;
-    }
-    // Handle init command
-    if (args[0] === "init") {
-        const importIdx = args.indexOf("--import");
-        const importPath = importIdx !== -1 ? args[importIdx + 1] : undefined;
-        const createFlag = args.includes("--create");
-        await handleInitCommand({ importPath, create: createFlag });
-        process.exit(0);
-    }
-    // Handle reset command
-    if (args[0] === "reset") {
-        const force = args.includes("--force") || args.includes("-f");
-        await handleResetCommand({ force });
-        process.exit(0);
-    }
-    // Handle build command
-    if (args[0] === "build") {
-        await handleBuildCommand(detectMobileProjectRoot);
-        process.exit(0);
-    }
-    // Handle secrets command
-    if (args[0] === "secrets") {
-        const subCommand = args[1];
-        if (subCommand === "upload") {
-            const envFlagIdx = args.findIndex((a) => a === '--env' || a === '-e');
-            const envName = envFlagIdx !== -1 ? args[envFlagIdx + 1] : 'cibuild';
-            const repoFlagIdx = args.findIndex((a) => a === '--repo' || a === '-r');
-            const repo = repoFlagIdx !== -1 ? args[repoFlagIdx + 1] : undefined;
-            const dryRun = args.includes('--dry-run');
-            await handleSecretsUploadCommand({ envName, repo, dryRun });
-            process.exit(0);
-        }
-        if (subCommand === "sync-workflow") {
-            const pathFlagIdx = args.findIndex((a) => a === '--path' || a === '-p');
-            let workflowPath = pathFlagIdx !== -1 ? args[pathFlagIdx + 1] : undefined;
-            if (!workflowPath) {
-                // Auto-discover workflow files
-                const ghWorkflowDir = resolve(process.cwd(), '.github', 'workflows');
-                const discoveredFiles = [];
-                if (existsSync(ghWorkflowDir)) {
-                    try {
-                        const entries = readdirSync(ghWorkflowDir);
-                        for (const entry of entries) {
-                            if (entry.endsWith('.yml') || entry.endsWith('.yaml')) {
-                                discoveredFiles.push(`.github/workflows/${entry}`);
-                            }
-                        }
-                    }
-                    catch { /* ignore read errors */ }
-                }
-                const choices = discoveredFiles.map((f) => ({
-                    title: f,
-                    value: f,
-                }));
-                choices.push({ title: 'Enter path manually…', value: '__manual__' });
-                if (choices.length === 1) {
-                    // Only the manual option — no files found
-                    console.log('No workflow files found in .github/workflows/\n');
-                }
-                const { selected } = await prompts({
-                    type: 'select',
-                    name: 'selected',
-                    message: 'Select a workflow file to sync secrets into:',
-                    choices,
-                });
-                if (!selected) {
-                    process.exit(0);
-                }
-                if (selected === '__manual__') {
-                    const { manualPath } = await prompts({
-                        type: 'text',
-                        name: 'manualPath',
-                        message: 'Enter the path to the workflow YAML file:',
-                        validate: (v) => v.trim() ? true : 'Path is required',
-                    });
-                    if (!manualPath) {
-                        process.exit(0);
-                    }
-                    workflowPath = manualPath;
-                }
-                else {
-                    workflowPath = selected;
-                }
-            }
-            const dryRun = args.includes('--dry-run');
-            await handleSecretsSyncWorkflowCommand({ workflowPath: resolve(process.cwd(), workflowPath), dryRun });
-            process.exit(0);
-        }
-        if (subCommand !== "add") {
-            console.error("Error: Unknown secrets subcommand. Available: add, upload, sync-workflow");
-            console.error("Usage: ci secrets add <var_name> <pipeline_path> [--file <file>] [--workflow <name>]");
-            console.error("       ci secrets upload [--env <name>] [--repo <owner/repo>] [--dry-run]");
-            console.error("       ci secrets sync-workflow --path <workflow.yml> [--dry-run]");
-            process.exit(1);
-        }
-        // ci secrets add <var_name> <pipeline_path> [--file <file>] [--workflow <name>]
-        const varName = args[2];
-        const pipelinePath = args[3];
-        if (!varName || !pipelinePath) {
-            console.error("Error: Variable name and pipeline path are required");
-            console.error("Usage: ci secrets add <var_name> <pipeline_path> [--file <file>] [-w <workflow>]");
-            console.error("\nExamples:");
-            console.error("  ci secrets add SLACK_CHANNEL bitrise.yml                              # prompted interactively");
-            console.error("  ci secrets add GOOGLE_SERVICES_JSON bitrise.yml --file google-services.json  # read from file");
-            process.exit(1);
-        }
-        const resolvedPath = resolve(process.cwd(), pipelinePath);
-        if (!existsSync(resolvedPath)) {
-            console.error(`Error: Pipeline file not found: ${resolvedPath}`);
-            process.exit(1);
-        }
-        // Only works with YAML files
-        const fileExt = extname(resolvedPath).toLowerCase();
-        const isYAML = fileExt === '.yml' || fileExt === '.yaml';
-        if (!isYAML) {
-            console.error("Error: secrets command only works with YAML pipeline files (.yml, .yaml)");
-            process.exit(1);
-        }
-        // Parse --file / -f flag
-        const fileFlagIdx = args.findIndex((a) => a === '--file' || a === '-f');
-        const secretFilePath = fileFlagIdx !== -1 ? args[fileFlagIdx + 1] : undefined;
-        // Parse -w / --workflow flag
-        const workflowFlagIdx = args.findIndex((a) => a === '-w' || a === '--workflow');
-        const workflowArg = workflowFlagIdx !== -1 ? args[workflowFlagIdx + 1] : undefined;
-        try {
-            const secretsManager = new SecretsManager();
-            console.log('\n╔═══════════════════════════════════════════════════════════════════╗');
-            console.log('║  ADD SECRET                                                       ║');
-            console.log('╚═══════════════════════════════════════════════════════════════════╝\n');
-            console.log(`Variable: ${varName}`);
-            console.log(`Location: ${secretsManager.getSecretsFilePath()}`);
-            // Check if this variable already exists
-            const existingSecretId = secretsManager.getSecretIdByName(varName);
-            if (existingSecretId) {
-                console.log(`\nℹ️  This variable already exists in your secrets file.`);
-                const confirmResponse = await prompts({
-                    type: 'confirm',
-                    name: 'value',
-                    message: 'Update existing value?',
-                    initial: true,
-                });
-                if (!confirmResponse.value) {
-                    console.log('\n❌ Cancelled');
-                    process.exit(0);
-                }
-            }
-            let secretValue;
-            if (secretFilePath) {
-                // Read value from file
-                const resolvedFilePath = resolve(process.cwd(), secretFilePath);
-                if (!existsSync(resolvedFilePath)) {
-                    console.error(`\nError: File not found: ${resolvedFilePath}`);
-                    process.exit(1);
-                }
-                secretValue = readFileSync(resolvedFilePath, 'utf-8');
-                console.log(`\nReading value from: ${secretFilePath}`);
-            }
-            else {
-                // Collect value interactively via readline (handles multiline paste cleanly)
-                console.log(`\n  Enter value for ${varName}`);
-                console.log('  Paste content, then type . on its own line and press Enter:\n');
-                if (process.stdin.isTTY) {
-                    try {
-                        process.stdin.setRawMode(false);
-                    }
-                    catch { /* ignore */ }
-                }
-                process.stdin.resume();
-                secretValue = await new Promise((res) => {
-                    const rl = createInterface({ input: process.stdin, terminal: false });
-                    const lines = [];
-                    rl.on('line', (line) => {
-                        if (line.trim() === '.') {
-                            rl.close();
-                            return;
-                        }
-                        lines.push(line);
-                    });
-                    rl.once('close', () => { process.stdin.pause(); res(lines.join('\n')); });
-                    rl.on('SIGINT', () => { rl.close(); res(''); });
-                });
-                if (!secretValue.trim()) {
-                    console.log('\n❌ Cancelled');
-                    process.exit(0);
-                }
-            }
-            secretsManager.storeSecret(varName, secretValue, workflowArg);
-            console.log(`\n✅ Secret stored: ${varName}${workflowArg ? ` (workflow: ${workflowArg})` : ' (global)'}`);
-            console.log(`   Location: ${secretsManager.getSecretsFilePath()}`);
-            console.log(`\n💡 This value will be loaded automatically when you run the pipeline.\n`);
-            process.exit(0);
-        }
-        catch (error) {
-            console.error("\n✗ Failed to add secret:");
-            console.error(error instanceof Error ? error.message : String(error));
-            process.exit(1);
-        }
-    }
-    // Handle edit command
-    if (args[0] === "edit") {
-        const pipelineIndex = args.findIndex((arg) => arg === "--pipeline" || arg === "-p");
-        let pipelinePath;
-        if (pipelineIndex !== -1 && args[pipelineIndex + 1]) {
-            pipelinePath = resolve(process.cwd(), args[pipelineIndex + 1]);
-        }
-        else if (args[1] && !args[1].startsWith("-")) {
-            pipelinePath = resolve(process.cwd(), args[1]);
-        }
-        else {
-            console.error("Error: Pipeline path is required");
-            console.error("Usage: ci edit <path> [-w <name>]");
-            process.exit(1);
-        }
-        const workflowIndex = args.findIndex((arg) => arg === "--workflow" || arg === "-w");
-        const workflowName = workflowIndex !== -1 && args[workflowIndex + 1]
-            ? args[workflowIndex + 1]
-            : undefined;
-        if (!existsSync(pipelinePath)) {
-            console.error(`Error: Pipeline file not found: ${pipelinePath}`);
-            process.exit(1);
-        }
-        const fileExt = extname(pipelinePath).toLowerCase();
-        if (fileExt !== ".yml" && fileExt !== ".yaml") {
-            console.error("Error: edit only works with YAML pipeline files (.yml, .yaml)");
-            process.exit(1);
-        }
-        try {
-            await handleEditCommand(pipelinePath, workflowName);
-            process.exit(0);
-        }
-        catch (error) {
-            console.error("\n✗ Edit failed:");
-            console.error(error instanceof Error ? error.message : String(error));
-            process.exit(1);
-        }
-    }
-    // Resolve --pipeline / -p flag OR a positional path (ci <cmd> <path>).
-    const resolvePipelinePath = (usage) => {
-        const flagIdx = args.findIndex((a) => a === "--pipeline" || a === "-p");
-        if (flagIdx !== -1 && args[flagIdx + 1]) {
-            return resolve(process.cwd(), args[flagIdx + 1]);
-        }
-        if (args[1] && !args[1].startsWith("-")) {
-            return resolve(process.cwd(), args[1]);
-        }
-        console.error("Error: Pipeline path is required");
-        for (const line of usage)
-            console.error(line);
-        process.exit(1);
-    };
-    const resolveWorkflowFlag = () => {
-        const idx = args.findIndex((a) => a === "--workflow" || a === "-w");
-        return idx !== -1 && args[idx + 1] ? args[idx + 1] : undefined;
-    };
-    // Handle validate command (and legacy `ci run <path> --validate-only`).
-    const isValidateCommand = args[0] === "validate";
-    const hasValidateOnlyFlag = args.includes("--validate-only");
-    if (isValidateCommand || (args[0] === "run" && hasValidateOnlyFlag)) {
-        const pipelinePath = resolvePipelinePath([
-            "Usage: ci validate <path> [--workflow <name>]",
-            "   or: ci validate --pipeline <path> [--workflow <name>]",
-        ]);
-        await handleValidateCommand({ pipelinePath, workflow: resolveWorkflowFlag() });
-        return;
-    }
-    if (args[0] === "detect-platform") {
-        const pipelinePath = resolvePipelinePath([
-            "Usage: ci detect-platform <path> [--workflow <name>]",
-            "   or: ci detect-platform --pipeline <path> [--workflow <name>]",
-        ]);
-        await handleDetectPlatformCommand({ pipelinePath, workflow: resolveWorkflowFlag() });
-        return;
-    }
-    if (args[0] === "run") {
-        // Path is optional for `ci run` — handler discovers from .ci/pipelines/.
-        const flagIdx = args.findIndex((a) => a === "--pipeline" || a === "-p");
-        let pipelinePath;
-        if (flagIdx !== -1 && args[flagIdx + 1]) {
-            pipelinePath = resolve(process.cwd(), args[flagIdx + 1]);
-        }
-        else if (args[1] && !args[1].startsWith("-")) {
-            pipelinePath = resolve(process.cwd(), args[1]);
-        }
-        await handleRunCommand({
-            pipelinePath,
-            workflow: resolveWorkflowFlag(),
-            production: args.includes("--production"),
-            skipValidation: args.includes("--skip-validation"),
-            local: args.includes("--local"),
-        });
-        return;
-    }
-    console.error(`Unknown command: ${args[0]}`);
-    console.error("Run 'ci --help' for usage information");
-    process.exit(1);
-}
-main();
-//# sourceMappingURL=cli.js.map

package/dist/src/commands/a-credential-target-follows-the-flavor-source-set.test.d.ts

@@ -1,38 +0,0 @@
-/**
- * A credential's target path and the value chosen for it both have to follow
- * the product flavor the workflow builds.
- *
- * An Android module has one source set per flavor, and each carries its own
- * copies of whatever the build needs — the manifest, the resources, and
- * `google-services.json`. The google-services plugin resolves the file by
- * specificity (variant, then build type, then flavor, then the module root)
- * and takes the first it finds. So a workflow building `ciDynamicDebug` wants
- * `app/src/ciDynamic/google-services.json`, and only falls back to the module
- * root when that is absent.
- *
- * The generator assumed one file at the module root. Writing there on a
- * flavored repository is *silently* wrong rather than loudly wrong: the plugin
- * finds a file, parses it, and fails on a package name. That is what
- * `bld_8e60d90ab4e55f85d2f72459` (2026-09-09) spent 1292 Gradle tasks
- * discovering:
- *
- *     Execution failed for task ':app:processCiDynamicDebugGoogleServices'.
- *     > No matching client found for package name '….ciDynamic'
- *
- * The chain worked. The file was the wrong one of four, and the error names
- * Firebase rather than the credential we delivered.
- *
- * Two flavors cannot share one secret, and the key is how a value varies. A
- * dispatched build's secrets are a flat key→value map — Invarn's scopes are
- * org, connection and pipeline, with no workflow *column* — but a flat map
- * carries a workflow perfectly well when the workflow is part of the key,
- * which is what `ci secrets upload` has encoded as
- * `CIBUILD_SW__<WORKFLOW>__<VAR>` all along. So the differing keys are
- * per-workflow ones, not per-flavor ones: the flavor is a property of the
- * variant the workflow builds, so keying by workflow is one indirection less,
- * and it is the convention already implemented end to end. A per-flavor
- * suffix (`GOOGLE_SERVICES_JSON_CIDYNAMIC`) was briefly shipped here as a
- * second answer to the same question and was reverted (Alex, 2026-09-09).
- */
-export {};
-//# sourceMappingURL=a-credential-target-follows-the-flavor-source-set.test.d.ts.map

package/dist/src/commands/a-credential-target-follows-the-flavor-source-set.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"a-credential-target-follows-the-flavor-source-set.test.d.ts","sourceRoot":"","sources":["../../../src/commands/a-credential-target-follows-the-flavor-source-set.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG"}