@invarn/cibuild 2.9.4 → 2.9.7

package/dist/src/yaml/steps/bitrise-ssh.test.js

@@ -1,205 +0,0 @@
-/**
- * Unit tests for Bitrise activate-ssh-key step
- */
-import { describe, test, expect } from '@jest/globals';
-import { BitriseSSHStepExecutor } from './bitrise-ssh.js';
-describe('BitriseSSHStepExecutor', () => {
-    const mockConfig = {
-        artifactsDir: '/ci/artifacts',
-        interpreters: {
-            python: '/usr/bin/python3',
-            ruby: '/usr/bin/ruby',
-            node: '/usr/bin/node',
-            bash: '/bin/bash',
-        },
-        maxConcurrentJobs: 4,
-        paths: {
-            buildsDir: '/ci/builds',
-            cacheDir: '/ci/cache',
-            derivedDataDir: '/ci/derived_data',
-        },
-    };
-    describe('Basic functionality', () => {
-        test('should create SSH activation script with default values', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: '-----BEGIN RSA PRIVATE KEY-----\ntest-key-content\n-----END RSA PRIVATE KEY-----',
-            };
-            const result = await executor.execute({}, env, mockConfig);
-            expect(result.kind).toBe('script');
-            expect(result.name).toBe('activate-ssh-key');
-            expect(result.script).toContain('mkdir -p ~/.ssh');
-            expect(result.script).toContain('chmod 700 ~/.ssh');
-            expect(result.script).toContain('echo "${SSH_RSA_PRIVATE_KEY}" | tr \'\\r\' \'\\n\' > ~/.ssh/default.pem');
-            expect(result.script).toContain('chmod 600 ~/.ssh/default.pem');
-        });
-        test('should include SSH agent commands', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: '-----BEGIN RSA PRIVATE KEY-----\ntest-key\n-----END RSA PRIVATE KEY-----',
-            };
-            const result = await executor.execute({}, env, mockConfig);
-            expect(result.script).toContain('eval "$(ssh-agent -s)"');
-            expect(result.script).toContain('ssh-add ~/.ssh/default.pem');
-        });
-        test('should configure SSH client settings', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: 'test-key',
-            };
-            const result = await executor.execute({}, env, mockConfig);
-            expect(result.script).toContain('cat >> ~/.ssh/config');
-            expect(result.script).toContain('StrictHostKeyChecking no');
-            expect(result.script).toContain('UserKnownHostsFile=/dev/null');
-            expect(result.script).toContain('chmod 600 ~/.ssh/config');
-        });
-    });
-    describe('Custom SSH key path', () => {
-        test('should use custom ssh_key_save_path when provided', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: 'test-key',
-            };
-            const inputs = {
-                ssh_key_save_path: '~/.ssh/custom_key',
-            };
-            const result = await executor.execute(inputs, env, mockConfig);
-            expect(result.script).toContain('echo "${SSH_RSA_PRIVATE_KEY}" | tr \'\\r\' \'\\n\' > ~/.ssh/custom_key');
-            expect(result.script).toContain('chmod 600 ~/.ssh/custom_key');
-            expect(result.script).toContain('ssh-add ~/.ssh/custom_key');
-        });
-    });
-    describe('Remove other identities', () => {
-        test('should remove other SSH identities when is_remove_other_identities is true', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: 'test-key',
-            };
-            const inputs = {
-                is_remove_other_identities: 'true',
-            };
-            const result = await executor.execute(inputs, env, mockConfig);
-            expect(result.script).toContain('ssh-add -D');
-        });
-        test('should remove other SSH identities when is_remove_other_identities is yes', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: 'test-key',
-            };
-            const inputs = {
-                is_remove_other_identities: 'yes',
-            };
-            const result = await executor.execute(inputs, env, mockConfig);
-            expect(result.script).toContain('ssh-add -D');
-        });
-        test('should not remove other identities when is_remove_other_identities is false', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: 'test-key',
-            };
-            const inputs = {
-                is_remove_other_identities: 'false',
-            };
-            const result = await executor.execute(inputs, env, mockConfig);
-            expect(result.script).not.toContain('ssh-add -D');
-        });
-        test('should remove other identities by default', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: 'test-key',
-            };
-            const result = await executor.execute({}, env, mockConfig);
-            // Default is 'true'
-            expect(result.script).toContain('ssh-add -D');
-        });
-    });
-    describe('Error handling', () => {
-        test('should throw error when SSH_RSA_PRIVATE_KEY is missing', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {}; // No SSH key
-            await expect(executor.execute({}, env, mockConfig)).rejects.toThrow(/Missing environment variable: 'SSH_RSA_PRIVATE_KEY'/);
-        });
-        test('should include helpful error message for missing SSH key', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {};
-            await expect(executor.execute({}, env, mockConfig)).rejects.toThrow(/SSH private key used for Git authentication/);
-        });
-        test('should suggest how to configure SSH key in error message', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {};
-            await expect(executor.execute({}, env, mockConfig)).rejects.toThrow(/Store private key in CI secrets/);
-        });
-    });
-    describe('Script structure', () => {
-        test('should include bash error handling directives', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: 'test-key',
-            };
-            const result = await executor.execute({}, env, mockConfig);
-            expect(result.script).toContain('#!/bin/bash');
-            expect(result.script).toContain('set -e');
-            expect(result.script).toContain('set -o pipefail');
-        });
-        test('should include informative messages', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: 'test-key',
-            };
-            const result = await executor.execute({}, env, mockConfig);
-            expect(result.script).toContain('Bitrise activate-ssh-key step → CI Build SSH activation');
-            expect(result.script).toContain('Setting up SSH key for Git operations');
-            expect(result.script).toContain('SSH key activated successfully');
-        });
-    });
-    describe('Integration scenarios', () => {
-        test('should handle complex SSH key with newlines', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: `-----BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEA1234567890abcdef
-ghijklmnopqrstuvwxyz0123456789
------END RSA PRIVATE KEY-----`,
-            };
-            const result = await executor.execute({}, env, mockConfig);
-            expect(result.script).toContain('echo "${SSH_RSA_PRIVATE_KEY}"');
-            expect(result.kind).toBe('script');
-        });
-        test('should work with custom path and remove identities disabled', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: 'custom-key-content',
-            };
-            const inputs = {
-                ssh_key_save_path: '~/.ssh/my_ssh_key',
-                is_remove_other_identities: 'false',
-            };
-            const result = await executor.execute(inputs, env, mockConfig);
-            expect(result.script).toContain('echo "${SSH_RSA_PRIVATE_KEY}" | tr \'\\r\' \'\\n\' > ~/.ssh/my_ssh_key');
-            expect(result.script).toContain('chmod 600 ~/.ssh/my_ssh_key');
-            expect(result.script).toContain('ssh-add ~/.ssh/my_ssh_key');
-            expect(result.script).not.toContain('ssh-add -D');
-        });
-    });
-    describe('Bitrise compatibility', () => {
-        test('should support Bitrise environment variable naming', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: 'bitrise-compatible-key',
-            };
-            const result = await executor.execute({}, env, mockConfig);
-            // Should reference the exact environment variable name
-            expect(result.script).toContain('${SSH_RSA_PRIVATE_KEY}');
-        });
-        test('should map to CI Build SSH activation pattern', async () => {
-            const executor = new BitriseSSHStepExecutor();
-            const env = {
-                SSH_RSA_PRIVATE_KEY: 'test-key',
-            };
-            const result = await executor.execute({}, env, mockConfig);
-            // Should include CI Build branding
-            expect(result.script).toContain('CI Build SSH activation');
-        });
-    });
-});
-//# sourceMappingURL=bitrise-ssh.test.js.map

package/dist/src/yaml/steps/cache-pull-daemon.test.d.ts

@@ -1,27 +0,0 @@
-/**
- * `cache-pull` over the daemon: a miss and a broken daemon are different things.
- *
- * `{ curl | zstd | tar; } 2>/dev/null` swallowed curl's message entirely, so a
- * 401, a 400, a 503, a 500 and a daemon that was not listening all printed the
- * same line as an empty cache:
- *
- *     No cache found for key: pods-0fc6c3e8f03403bc5fb869d95e505969-HEAD
- *
- * Same class as the push-side defect in `27e05e5`, where `curl -f` threw the
- * response body away so `invalid_cache_key` never reached the log. A cold cache
- * is the normal case and must stay quiet; the point is only that a broken
- * daemon stops looking like one.
- *
- * These tests RUN the generated script against a **real listener with the real
- * curl**. Stubbing curl onto PATH cannot see this: the whole question is what
- * the real curl reports and where it writes it, so a stub that emits the status
- * itself would pass against a step that never asked for one.
- *
- * `zstd` and `tar` *are* stubbed, for two different reasons. zstd is not on
- * every host, and without it the pipeline fails before curl is reached — which
- * would make these pass vacuously. tar is stubbed because the generated script
- * extracts with `-C /`: nothing under test here is worth writing to the root of
- * the machine running the suite.
- */
-export {};
-//# sourceMappingURL=cache-pull-daemon.test.d.ts.map

package/dist/src/yaml/steps/cache-pull-daemon.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cache-pull-daemon.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache-pull-daemon.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}

package/dist/src/yaml/steps/cache-pull-daemon.test.js

@@ -1,212 +0,0 @@
-/**
- * `cache-pull` over the daemon: a miss and a broken daemon are different things.
- *
- * `{ curl | zstd | tar; } 2>/dev/null` swallowed curl's message entirely, so a
- * 401, a 400, a 503, a 500 and a daemon that was not listening all printed the
- * same line as an empty cache:
- *
- *     No cache found for key: pods-0fc6c3e8f03403bc5fb869d95e505969-HEAD
- *
- * Same class as the push-side defect in `27e05e5`, where `curl -f` threw the
- * response body away so `invalid_cache_key` never reached the log. A cold cache
- * is the normal case and must stay quiet; the point is only that a broken
- * daemon stops looking like one.
- *
- * These tests RUN the generated script against a **real listener with the real
- * curl**. Stubbing curl onto PATH cannot see this: the whole question is what
- * the real curl reports and where it writes it, so a stub that emits the status
- * itself would pass against a step that never asked for one.
- *
- * `zstd` and `tar` *are* stubbed, for two different reasons. zstd is not on
- * every host, and without it the pipeline fails before curl is reached — which
- * would make these pass vacuously. tar is stubbed because the generated script
- * extracts with `-C /`: nothing under test here is worth writing to the root of
- * the machine running the suite.
- */
-import { describe, test, expect } from '@jest/globals';
-import { execFile } from 'child_process';
-import { createHash } from 'crypto';
-import { mkdtempSync, writeFileSync, rmSync, mkdirSync, chmodSync } from 'fs';
-import { createServer } from 'http';
-import { join } from 'path';
-import { tmpdir } from 'os';
-import { promisify } from 'util';
-import { CachePullStepExecutor } from './cache.js';
-import { testConfigNoPeer } from './test-config.js';
-/**
- * Async on purpose. The listener below lives in this process, and
- * `execFileSync` blocks the event loop — so it would never answer curl, every
- * request would time out, and every case would look like a dead daemon
- * whatever the test asked for.
- */
-const run = promisify(execFile);
-const CACHE_KEY = 'pods-abc123def456-release-1.4';
-/**
- * An explicit `cache_key` is prefixed with a project scope so two repositories
- * writing the same key don't share a tarball. These fixtures run outside a git
- * remote, so the step's shell hashes the literal `"no-remote"` — derived here
- * rather than pasted, so it tracks the step.
- */
-const PROJECT_SCOPE = createHash('sha256').update('no-remote', 'utf8').digest('hex').slice(0, 8);
-const SCOPED_CACHE_KEY = `${PROJECT_SCOPE}-${CACHE_KEY}`;
-async function listen(handler, paths) {
-    const server = createServer((req, res) => {
-        const path = req.url ?? '/';
-        paths.push(path);
-        const { status, body } = handler(path);
-        res.writeHead(status, { 'content-type': 'application/octet-stream' });
-        res.end(body);
-    });
-    const port = await new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(0, '127.0.0.1', () => {
-            const address = server.address();
-            resolve(typeof address === 'object' && address !== null ? address.port : 0);
-        });
-    });
-    return { server, port };
-}
-async function runPull(options) {
-    const dir = mkdtempSync(join(tmpdir(), 'cibuild-pull-'));
-    const paths = [];
-    const { server, port } = await listen((path) => {
-        if (path.includes('/scope/')) {
-            return { status: options.scopeStatus ?? 404, body: '{"error":"no_cache_for_scope"}' };
-        }
-        const status = options.keyStatus === 'dead' ? 404 : options.keyStatus;
-        return {
-            status,
-            body: status === 200 ? 'a-tarball-shaped-payload' : '{"error":"cache_miss"}',
-        };
-    }, paths);
-    // A dead daemon is a port nothing answers on — the one the listener just
-    // released. Anything else and curl would be diagnosing the wrong failure.
-    if (options.keyStatus === 'dead') {
-        await new Promise((resolve) => server.close(() => resolve()));
-    }
-    try {
-        const bin = join(dir, 'bin');
-        mkdirSync(bin, { recursive: true });
-        writeFileSync(join(bin, 'zstd'), '#!/bin/bash\ncat\n', 'utf-8');
-        chmodSync(join(bin, 'zstd'), 0o755);
-        // Writes nothing: see the file header on `-C /`.
-        //
-        // It has to answer `-tf` as well as extract. A restore now stages the
-        // archive and reads its top-level names to decide which of them were
-        // recorded against `/` and which against the checkout, so a stub that only
-        // drained the stream made every hit look like a miss. Both project-relative
-        // names this suite can ask about are listed, so the split runs whichever
-        // form is under test. Where the bytes actually land is asserted against a
-        // real tar in `cache-pull-restore-roots.test.ts`.
-        writeFileSync(join(bin, 'tar'), [
-            '#!/bin/bash',
-            "case \"$1\" in",
-            "  -tf) printf 'Pods/\\nPods/marker\\nnode_modules/\\n'; exit 0 ;;",
-            'esac',
-            '# `-xf -` must drain the stream, or the writer upstream dies of SIGPIPE',
-            '# and the pipeline reports a failure that never happened.',
-            'for a in "$@"; do',
-            '  if [ "$a" = "-" ]; then cat > /dev/null; exit 0; fi',
-            'done',
-            'exit 0',
-            '',
-        ].join('\n'), 'utf-8');
-        chmodSync(join(bin, 'tar'), 0o755);
-        // The preset form derives its key from a lockfile, so it needs one.
-        if (options.technology) {
-            writeFileSync(join(dir, 'package-lock.json'), '{"lockfileVersion":3}\n', 'utf-8');
-        }
-        const { script } = await new CachePullStepExecutor().execute(options.technology
-            ? { technology: options.technology }
-            : { cache_key: CACHE_KEY, cache_paths: ['Pods'] }, {}, testConfigNoPeer);
-        const scriptPath = join(dir, '__cache_pull.sh');
-        writeFileSync(scriptPath, script, 'utf-8');
-        let stdout = '';
-        try {
-            const result = await run('bash', [scriptPath], {
-                cwd: dir,
-                encoding: 'utf-8',
-                env: {
-                    ...process.env,
-                    PATH: `${bin}:${process.env.PATH}`,
-                    CIBUILD_CACHE_DAEMON: `http://127.0.0.1:${port}`,
-                    CIBUILD_CACHE_TOKEN: 'tok',
-                },
-                timeout: 20000,
-            });
-            stdout = String(result.stdout) + String(result.stderr);
-        }
-        catch (e) {
-            const err = e;
-            stdout = String(err.stdout ?? '') + String(err.stderr ?? '');
-        }
-        return { stdout, paths };
-    }
-    finally {
-        if (options.keyStatus !== 'dead') {
-            await new Promise((resolve) => server.close(() => resolve()));
-        }
-        rmSync(dir, { recursive: true, force: true });
-    }
-}
-describe('cache-pull with an explicit key, over the daemon', () => {
-    test('an empty cache is reported, and nothing else', async () => {
-        // 404 is the daemon's answer for `cache_miss`. The normal case on any
-        // first build: it must not start printing warnings.
-        const { stdout, paths } = await runPull({ keyStatus: 404 });
-        expect(paths).toEqual([`/cache/${SCOPED_CACHE_KEY}.tar.zst`]);
-        expect(stdout).toContain(`No cache found for key: ${SCOPED_CACHE_KEY}`);
-        expect(stdout).toContain('CACHE_SOURCE=cold');
-        expect(stdout).not.toContain('Warning');
-    });
-    test('an auth failure no longer looks like an empty cache', async () => {
-        const { stdout } = await runPull({ keyStatus: 401 });
-        expect(stdout).toContain('Warning: cache-pull could not restore');
-        expect(stdout).toContain('401');
-        // Still not fatal, and still cold: a build that cannot read a cache builds
-        // anyway. Only the silence is gone.
-        expect(stdout).toContain('CACHE_SOURCE=cold');
-    });
-    test.each([
-        ['a rejected key', 400],
-        ['a busy cache', 503],
-        ['a daemon that broke', 500],
-    ])('%s says so, with the status', async (_label, status) => {
-        const { stdout } = await runPull({ keyStatus: status });
-        expect(stdout).toContain('Warning: cache-pull could not restore');
-        expect(stdout).toContain(String(status));
-    });
-    test('a daemon that is not listening says so, rather than reporting a miss', async () => {
-        const { stdout } = await runPull({ keyStatus: 'dead' });
-        expect(stdout).toContain('Warning: cache-pull could not restore');
-        // curl's own words for it. There is no HTTP status to report — which is
-        // itself the distinction from every case above.
-        expect(stdout).toMatch(/Failed to connect|Couldn't connect|Connection refused/u);
-    });
-    test('a hit is still a hit', async () => {
-        const { stdout } = await runPull({ keyStatus: 200 });
-        expect(stdout).toContain('Cache found (daemon), extracting...');
-        expect(stdout).toContain('CACHE_SOURCE=daemon');
-        expect(stdout).not.toContain('Warning');
-    });
-});
-describe('cache-pull from a preset, over the daemon', () => {
-    test('an empty cache is quiet through the scope fallback too', async () => {
-        const { stdout, paths } = await runPull({ keyStatus: 404, technology: 'npm' });
-        // Exact key first, then the scope's newest — the shape the fallback needs.
-        expect(paths).toHaveLength(2);
-        expect(paths[1]).toContain('/cache/scope/');
-        expect(stdout).toContain('No cache found for key: npm-');
-        expect(stdout).not.toContain('Warning');
-    });
-    test('a broken daemon is named on the preset path as well', async () => {
-        // The two forms emit the same diagnosis from one definition. They used to
-        // carry byte-identical copies of the upload block, and that is exactly how
-        // the push-side defect got in.
-        const { stdout } = await runPull({ keyStatus: 401, technology: 'npm' });
-        expect(stdout).toContain('Warning: cache-pull could not restore');
-        expect(stdout).toContain('401');
-        expect(stdout).toContain('CACHE_SOURCE=cold');
-    });
-});
-//# sourceMappingURL=cache-pull-daemon.test.js.map

package/dist/src/yaml/steps/cache-pull-restore-roots.test.d.ts

@@ -1,42 +0,0 @@
-/**
- * `cache-pull` restores every cached path to the root it was recorded against.
- *
- * `cache-push` archives two kinds of entry in one tarball. A `~`- or `/`-rooted
- * path is expanded and tar stores it with the leading `/` stripped
- * (`/home/builder/.gradle/caches` -> `home/builder/.gradle/caches`). A
- * project-relative path (`Pods`, `.gradle`, `node_modules`) is stored as-is,
- * relative to the step's working directory. Every restore then used a single
- * `tar -xf - -C /`, which is right for the first kind and impossible for the
- * second: the build user cannot create `/Pods`.
- *
- * Three shapes, three different failures, all measured before this was fixed:
- *
- * | `cache_paths`                            | before                          |
- * |------------------------------------------|---------------------------------|
- * | all `~`-rooted                           | correct                         |
- * | mixed (every Gradle/Android pipeline)    | `~` half landed, relative half never did, tar exited non-zero, reported **cold** on a build that was warm |
- * | all project-relative (Pods, node_modules)| **nothing** landed — those caches were written on every build and had never restored |
- *
- * So the mixed shape lied and the all-relative shape silently did nothing. Both
- * are asserted here, and the all-`~` shape is asserted too because it already
- * worked and the fix must not cost it anything.
- *
- * ### Why this runs the real `tar`
- *
- * The sibling daemon suite stubs `tar` to `cat > /dev/null`, because the
- * generated script extracts with `-C /` and nothing there is worth writing to
- * the root of the machine running the suite. This suite cannot: *where the
- * bytes land* is the entire question, and a stub answers it by construction.
- *
- * It stays out of the real root by pointing `CIBUILD_USER_HOME` at a temporary
- * directory. `~/.gradle/caches` then expands to an absolute path *inside* that
- * directory, so `-C /` reassembles it exactly where it belongs and writes
- * nothing outside the temp tree. The path is resolved through `realpath` first:
- * on macOS `/var` is a symlink to `/private/var`, and tar refuses to extract
- * through a symlink.
- *
- * `zstd` is stubbed to an identity copy, as in the sibling suite — it is not on
- * every host, and compression is not what is under test.
- */
-export {};
-//# sourceMappingURL=cache-pull-restore-roots.test.d.ts.map

package/dist/src/yaml/steps/cache-pull-restore-roots.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cache-pull-restore-roots.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/cache-pull-restore-roots.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG"}