@invarn/cibuild 2.9.4 → 2.9.7

package/dist/src/yaml/steps/git-clone.js

@@ -1,171 +0,0 @@
-/**
- * Git clone step implementation
- */
-import { BaseStepExecutor } from './base.js';
-/**
- * The inputs this step declares, in the order a warning should name them.
- * Declared so existing YAML keeps parsing; read by nothing.
- */
-const DECLARED_INPUTS = [
-    'repository',
-    'clone_url',
-    'branch',
-    'clone_depth',
-    'clone_into_dir',
-];
-/**
- * Every input the step was handed — all of which it ignores.
- *
- * Not limited to `DECLARED_INPUTS`: a `git-clone@8` migrated from Bitrise
- * arrives with `fetch_tags` and `submodule_update_depth`, which the name split
- * carries through untouched and `execute()` ignores just as completely. A
- * warning that only knew the declared five would let exactly those vanish
- * quietly. Declared names come first; the rest keep their document order.
- */
-function ignoredInputNames(inputs) {
-    const present = Object.entries(inputs ?? {})
-        .filter(([, value]) => value !== undefined && value !== null)
-        .map(([name]) => name);
-    return [
-        ...DECLARED_INPUTS.filter((name) => present.includes(name)),
-        ...present.filter((name) => !DECLARED_INPUTS.includes(name)),
-    ];
-}
-/**
- * git-clone step executor.
- *
- * Does not clone. The source is already on disk when this runs — on a runner
- * the dispatched commit was checked out before cibuild started (see
- * cibuild-runner's GitCloneRunner); locally it is the developer's working copy.
- * The step locates that checkout and republishes its commit metadata. Every
- * input in GitCloneInputs is accepted so existing YAML keeps parsing, and none
- * of them is read.
- */
-export class GitCloneStepExecutor extends BaseStepExecutor {
-    getValidationRequirements(inputs, _env, _config) {
-        const requirements = [
-            this.requireCommand('git', 'Git is required', 'Install git: brew install git (macOS) or apt install git (Linux)'),
-        ];
-        // Silently accepting configuration that has no effect is the defect: a
-        // `branch: release/2.0` validated, ran green, and built whatever was
-        // dispatched. One warning, naming what was given — never an error, because
-        // every pipeline written before this release carries some of these and all
-        // of them must keep building.
-        const ignored = ignoredInputNames(inputs);
-        if (ignored.length > 0) {
-            const named = ignored.join(', ');
-            requirements.push({
-                category: 'input',
-                name: 'git-clone',
-                description: `git-clone ignores ${named}`,
-                timing: 'pre-execution',
-                severity: 'warning',
-                check: async () => ({
-                    passed: false,
-                    message: 'The runner checks out the dispatched ref, submodules included, ' +
-                        'before cibuild starts; git-clone only records the commit already ' +
-                        'on disk and reads none of its inputs. That checkout fetches no ' +
-                        'tags, no LFS objects and no history beyond the dispatched commit.',
-                }),
-                hint: `Remove ${named} from the step. To build a different ref, dispatch that ref.`,
-            });
-        }
-        return requirements;
-    }
-    getOutputs() {
-        return [
-            {
-                name: 'CIBUILD_SOURCE_DIR',
-                type: 'environment',
-                description: 'Path to cloned repository',
-            },
-            {
-                name: 'GIT_CLONE_COMMIT_HASH',
-                type: 'environment',
-                description: 'Commit hash of the cloned repository',
-            },
-            {
-                name: 'CIBUILD_GIT_COMMIT',
-                type: 'environment',
-                description: 'Commit hash of the cloned repository',
-            },
-            {
-                name: 'GIT_CLONE_COMMIT_AUTHOR_NAME',
-                type: 'environment',
-                description: 'Author name of the cloned commit',
-            },
-            {
-                name: 'GIT_CLONE_COMMIT_AUTHOR_EMAIL',
-                type: 'environment',
-                description: 'Author email of the cloned commit',
-            },
-            {
-                name: 'GIT_CLONE_COMMIT_COMMITER_NAME',
-                type: 'environment',
-                description: 'Committer name of the cloned commit',
-            },
-            {
-                name: 'GIT_CLONE_COMMIT_COMMITER_EMAIL',
-                type: 'environment',
-                description: 'Committer email of the cloned commit',
-            },
-            {
-                name: 'GIT_CLONE_COMMIT_MESSAGE_SUBJECT',
-                type: 'environment',
-                description: 'First line of the commit message',
-            },
-            {
-                name: 'GIT_CLONE_COMMIT_MESSAGE_BODY',
-                type: 'environment',
-                description: 'Body of the commit message (everything after first line)',
-            },
-        ];
-    }
-    async execute(_inputs, _env, _config) {
-        const stepName = 'git-clone';
-        // The project is already present on the local machine — no cloning needed.
-        // Detect the git root of the current project and export it as CIBUILD_SOURCE_DIR
-        // so subsequent build steps (gradle, xcodebuild, etc.) can cd into it.
-        const commands = [];
-        commands.push('# git-clone → using existing local project checkout');
-        commands.push('echo "📁 Locating local project..."');
-        commands.push('');
-        commands.push('GIT_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo "")"');
-        commands.push('if [ -z "$GIT_ROOT" ]; then');
-        commands.push('  echo "❌ Error: Not inside a git repository"');
-        commands.push('  exit 1');
-        commands.push('fi');
-        commands.push('');
-        commands.push('cd "$GIT_ROOT"');
-        commands.push('echo "Project root: $GIT_ROOT"');
-        commands.push('');
-        commands.push('# Read current commit metadata from the existing checkout');
-        commands.push('COMMIT_HASH="$(git rev-parse HEAD)"');
-        commands.push('COMMIT_AUTHOR_NAME="$(git log -1 --format="%an")"');
-        commands.push('COMMIT_AUTHOR_EMAIL="$(git log -1 --format="%ae")"');
-        commands.push('COMMIT_COMMITTER_NAME="$(git log -1 --format="%cn")"');
-        commands.push('COMMIT_COMMITTER_EMAIL="$(git log -1 --format="%ce")"');
-        commands.push('COMMIT_MESSAGE_SUBJECT="$(git log -1 --format="%s")"');
-        commands.push('COMMIT_MESSAGE_BODY="$(git log -1 --format="%b")"');
-        commands.push('');
-        commands.push('echo "Branch: $(git branch --show-current)"');
-        commands.push('echo "Commit: $COMMIT_HASH"');
-        commands.push('echo "Author: $COMMIT_AUTHOR_NAME <$COMMIT_AUTHOR_EMAIL>"');
-        commands.push('echo "Message: $COMMIT_MESSAGE_SUBJECT"');
-        commands.push('');
-        commands.push('# Export source directory and commit metadata for subsequent steps');
-        commands.push('envman add --key CIBUILD_SOURCE_DIR --value "$GIT_ROOT"');
-        commands.push('envman add --key GIT_CLONE_COMMIT_HASH --value "$COMMIT_HASH"');
-        commands.push('envman add --key CIBUILD_GIT_COMMIT --value "$COMMIT_HASH"');
-        commands.push('envman add --key GIT_CLONE_COMMIT_AUTHOR_NAME --value "$COMMIT_AUTHOR_NAME"');
-        commands.push('envman add --key GIT_CLONE_COMMIT_AUTHOR_EMAIL --value "$COMMIT_AUTHOR_EMAIL"');
-        commands.push('envman add --key GIT_CLONE_COMMIT_COMMITER_NAME --value "$COMMIT_COMMITTER_NAME"');
-        commands.push('envman add --key GIT_CLONE_COMMIT_COMMITER_EMAIL --value "$COMMIT_COMMITTER_EMAIL"');
-        commands.push('envman add --key GIT_CLONE_COMMIT_MESSAGE_SUBJECT --value "$COMMIT_MESSAGE_SUBJECT"');
-        commands.push('envman add --key GIT_CLONE_COMMIT_MESSAGE_BODY --value "$COMMIT_MESSAGE_BODY"');
-        commands.push('echo "✅ Source directory: $GIT_ROOT"');
-        const script = this.createBashScriptFromCommands(commands, stepName);
-        return this.createScriptStep(script, stepName);
-    }
-}
-//# sourceMappingURL=git-clone.js.map

package/dist/src/yaml/steps/git-fetch-retry-exec.test.d.ts

@@ -1,10 +0,0 @@
-/**
- * Executes the generated shell rather than grepping it.
- *
- * The retry lives entirely in emitted bash, so string assertions prove only
- * that the text was written. These run it: a first-attempt refusal followed by
- * a second-attempt success has to actually pass, and a non-refusal has to fail
- * without burning the retry budget.
- */
-export {};
-//# sourceMappingURL=git-fetch-retry-exec.test.d.ts.map

package/dist/src/yaml/steps/git-fetch-retry-exec.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"git-fetch-retry-exec.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-fetch-retry-exec.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/src/yaml/steps/git-fetch-retry-exec.test.js

@@ -1,162 +0,0 @@
-/**
- * Executes the generated shell rather than grepping it.
- *
- * The retry lives entirely in emitted bash, so string assertions prove only
- * that the text was written. These run it: a first-attempt refusal followed by
- * a second-attempt success has to actually pass, and a non-refusal has to fail
- * without burning the retry budget.
- */
-import { describe, test, expect } from '@jest/globals';
-import { execFileSync } from 'child_process';
-import { mkdtempSync, writeFileSync, rmSync, readFileSync, existsSync } from 'fs';
-import { join } from 'path';
-import { tmpdir } from 'os';
-import { refusedFetchHelpers, retryOnRefusedFetch } from './git-fetch-retry.js';
-const REFUSAL = "fatal: could not read Username for 'https://github.com': terminal prompts disabled";
-/** Wraps the emitted block in the same preamble the real step scripts use. */
-function buildScript(command, attempts = 3) {
-    return [
-        '#!/bin/bash',
-        'set -e',
-        'set -o pipefail',
-        '',
-        ...refusedFetchHelpers(),
-        ...retryOnRefusedFetch({
-            label: 'Package resolution',
-            command,
-            attempts,
-            backoffSeconds: [0, 0, 0, 0],
-        }),
-        'echo "REACHED_THE_END"',
-    ].join('\n');
-}
-function run(command, attempts = 3) {
-    const dir = mkdtempSync(join(tmpdir(), 'cibuild-fetch-retry-'));
-    const scriptPath = join(dir, 'step.sh');
-    writeFileSync(scriptPath, buildScript(command, attempts), { mode: 0o755 });
-    try {
-        const output = execFileSync('bash', [scriptPath], {
-            encoding: 'utf-8',
-            stdio: ['ignore', 'pipe', 'pipe'],
-            cwd: dir,
-            env: { ...process.env, COUNTER: join(dir, 'attempts') },
-        });
-        return { status: 0, output };
-    }
-    catch (e) {
-        return {
-            status: e.status ?? -1,
-            output: `${e.stdout ?? ''}${e.stderr ?? ''}`,
-        };
-    }
-    finally {
-        rmSync(dir, { recursive: true, force: true });
-    }
-}
-/**
- * A command that records each invocation and refuses the first `n` of them the
- * way git does, then succeeds.
- */
-function refuseFirst(n) {
-    return (`bash -c 'echo x >> "$COUNTER"; ` +
-        `if [ "$(wc -l < "$COUNTER")" -le ${n} ]; then echo "${REFUSAL}" >&2; exit 128; fi; ` +
-        `echo RESOLVED_OK'`);
-}
-describe('retryOnRefusedFetch, executed', () => {
-    test('a first-attempt refusal and a second-attempt success still passes', () => {
-        const r = run(refuseFirst(1));
-        expect(r.status).toBe(0);
-        expect(r.output).toContain('RESOLVED_OK');
-        expect(r.output).toContain('REACHED_THE_END');
-        expect(r.output).toContain('was refused by the server (attempt 1 of 3)');
-    });
-    test('a command that succeeds first time is run exactly once', () => {
-        const r = run(refuseFirst(0));
-        expect(r.status).toBe(0);
-        expect(r.output).toContain('RESOLVED_OK');
-        expect(r.output).not.toContain('was refused by the server');
-    });
-    test('a refusal that never clears fails with the original exit code', () => {
-        const r = run(refuseFirst(99));
-        expect(r.status).toBe(128);
-        expect(r.output).not.toContain('REACHED_THE_END');
-        // and it explains itself rather than blaming a package
-        expect(r.output).toContain('A dependency fetch was refused.');
-        expect(r.output).toContain('HTTP 401');
-    });
-    test('it gives up after exactly the configured number of attempts', () => {
-        const r = run(refuseFirst(99), 3);
-        expect(r.output).toContain('(attempt 1 of 3)');
-        expect(r.output).toContain('(attempt 2 of 3)');
-        // the third attempt runs but is not announced as a retry
-        expect(r.output).not.toContain('(attempt 3 of 3)');
-    });
-    test('a failure that is NOT a refused fetch fails immediately', () => {
-        const r = run(`bash -c 'echo x >> "$COUNTER"; echo "error: no such module" >&2; exit 65'`);
-        expect(r.status).toBe(65);
-        // no retry, and no misleading refused-fetch diagnostic
-        expect(r.output).not.toContain('was refused by the server');
-        expect(r.output).not.toContain('A dependency fetch was refused.');
-    });
-    test('a non-refusal failure is attempted once, not three times', () => {
-        const dir = mkdtempSync(join(tmpdir(), 'cibuild-fetch-count-'));
-        const counter = join(dir, 'attempts');
-        const scriptPath = join(dir, 'step.sh');
-        writeFileSync(scriptPath, buildScript(`bash -c 'echo x >> "${counter}"; exit 65'`), { mode: 0o755 });
-        try {
-            execFileSync('bash', [scriptPath], { stdio: 'ignore', cwd: dir });
-        }
-        catch {
-            /* expected */
-        }
-        const attempts = existsSync(counter)
-            ? readFileSync(counter, 'utf-8').trim().split('\n').length
-            : 0;
-        expect(attempts).toBe(1);
-        rmSync(dir, { recursive: true, force: true });
-    });
-    test('the command output still reaches the log while being captured', () => {
-        const r = run(`bash -c 'echo x >> "$COUNTER"; echo VISIBLE_TO_THE_USER'`);
-        expect(r.output).toContain('VISIBLE_TO_THE_USER');
-    });
-});
-describe('the steps that embed it emit syntactically valid bash', () => {
-    // A syntax error in generated shell is not caught by any string assertion
-    // and would break every build of that type on the first run.
-    const parses = async (script) => {
-        const dir = mkdtempSync(join(tmpdir(), 'cibuild-syntax-'));
-        const p = join(dir, 'step.sh');
-        writeFileSync(p, script);
-        try {
-            execFileSync('bash', ['-n', p], { stdio: 'pipe' });
-        }
-        finally {
-            rmSync(dir, { recursive: true, force: true });
-        }
-    };
-    test('xcode-build-for-test', async () => {
-        const { XcodeBuildForTestStepExecutor } = await import('./xcode.js');
-        const { testConfig } = await import('./test-config.js');
-        const r = await new XcodeBuildForTestStepExecutor().execute({ project_path: "My App.xcworkspace", scheme: "My Scheme", xcconfig_content: 'ARCHS = arm64' }, {}, testConfig);
-        await parses(r.script);
-    });
-    test('xcodebuild', async () => {
-        const { XcodeBuildStepExecutor } = await import('./xcode.js');
-        const { testConfig } = await import('./test-config.js');
-        const r = await new XcodeBuildStepExecutor().execute({ project_path: 'MyApp.xcodeproj', scheme: 'MyApp', is_clean_build: true }, {}, testConfig);
-        await parses(r.script);
-    });
-    test('xcode-build-for-simulator', async () => {
-        const { XcodeBuildForSimulatorStepExecutor } = await import('./xcode.js');
-        const { testConfig } = await import('./test-config.js');
-        const r = await new XcodeBuildForSimulatorStepExecutor().execute({ project_path: "My App.xcworkspace", scheme: "My Scheme", perform_clean_action: 'yes' }, {}, testConfig);
-        await parses(r.script);
-    });
-    test('cocoapods-install', async () => {
-        const { CocoapodsInstallStepExecutor } = await import('./ios-deps.js');
-        const { testConfig } = await import('./test-config.js');
-        const r = await new CocoapodsInstallStepExecutor().execute({ verbose: true }, {}, testConfig);
-        await parses(r.script);
-    });
-});
-//# sourceMappingURL=git-fetch-retry-exec.test.js.map

package/dist/src/yaml/steps/git-fetch-retry.d.ts

@@ -1,62 +0,0 @@
-/**
- * Retrying a refused third-party dependency fetch, and naming the reason when
- * the retry does not save it.
- *
- * A build that resolves its dependencies from public git repositories fetches
- * them anonymously. When a host answers one of those fetches with HTTP 401,
- * git has no credential to fall back on and prints
- *
- *     fatal: could not read Username for 'https://<host>': terminal prompts disabled
- *     fatal: expected flush after ref listing
- *
- * Those two lines are one failure, not two: the transport child asks for a
- * username, cannot prompt, and dies; the parent then finds the ref listing
- * truncated. git asks for a username *only* on a 401, which makes the first
- * line an exact signature for "the server refused this fetch".
- *
- * Such a refusal has been observed to be transient — the same repository
- * readable again a minute or two later, from the same machine and the same
- * address — while landing in the middle of a dependency resolution and taking
- * a multi-minute build down with it.
- *
- * Two things are emitted here, and they are deliberately separate:
- *
- *   - a retry around the fetch, gated on that signature, so a compile error
- *     still fails on the first attempt instead of three attempts later; and
- *   - a diagnostic that re-probes every refused URL and prints the HTTP status
- *     it gets back. Nothing else in the pipeline records that status, so a
- *     build failing this way otherwise reports a missing package rather than a
- *     refused fetch, and a recurrence is unattributable after the fact. The
- *     probe is the whole reason the second occurrence will be cheaper to
- *     explain than the first.
- *
- * The emitted shell is bash and runs under `set -e` / `set -o pipefail`, which
- * is why the exit code is measured explicitly rather than inferred.
- */
-/**
- * The line git prints when, and only when, a server answers a fetch with
- * HTTP 401 and no credential is available.
- */
-export declare const REFUSED_FETCH_SIGNATURE = "could not read Username for";
-export interface RefusedFetchRetryOptions {
-    /** What is being fetched, as it should read in a log line. */
-    label: string;
-    /** The command to run, exactly as it would appear on one shell line. */
-    command: string;
-    /** Total attempts, including the first. Defaults to 3. */
-    attempts?: number;
-    /** Seconds to wait before each retry. Defaults to 15s then 45s. */
-    backoffSeconds?: number[];
-}
-/**
- * Shell functions and state the retry depends on. Emit once per script, before
- * the first `retryOnRefusedFetch` block.
- */
-export declare function refusedFetchHelpers(): string[];
-/**
- * Runs `command`, retrying it while the failure looks like a refused fetch.
- * On the last failure the diagnostic runs and the step exits with the
- * command's own status, so the reported exit code is still the real one.
- */
-export declare function retryOnRefusedFetch(options: RefusedFetchRetryOptions): string[];
-//# sourceMappingURL=git-fetch-retry.d.ts.map

package/dist/src/yaml/steps/git-fetch-retry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"git-fetch-retry.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-fetch-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;GAGG;AACH,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAErE,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAiE9C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,EAAE,CAuC/E"}

package/dist/src/yaml/steps/git-fetch-retry.js

@@ -1,155 +0,0 @@
-/**
- * Retrying a refused third-party dependency fetch, and naming the reason when
- * the retry does not save it.
- *
- * A build that resolves its dependencies from public git repositories fetches
- * them anonymously. When a host answers one of those fetches with HTTP 401,
- * git has no credential to fall back on and prints
- *
- *     fatal: could not read Username for 'https://<host>': terminal prompts disabled
- *     fatal: expected flush after ref listing
- *
- * Those two lines are one failure, not two: the transport child asks for a
- * username, cannot prompt, and dies; the parent then finds the ref listing
- * truncated. git asks for a username *only* on a 401, which makes the first
- * line an exact signature for "the server refused this fetch".
- *
- * Such a refusal has been observed to be transient — the same repository
- * readable again a minute or two later, from the same machine and the same
- * address — while landing in the middle of a dependency resolution and taking
- * a multi-minute build down with it.
- *
- * Two things are emitted here, and they are deliberately separate:
- *
- *   - a retry around the fetch, gated on that signature, so a compile error
- *     still fails on the first attempt instead of three attempts later; and
- *   - a diagnostic that re-probes every refused URL and prints the HTTP status
- *     it gets back. Nothing else in the pipeline records that status, so a
- *     build failing this way otherwise reports a missing package rather than a
- *     refused fetch, and a recurrence is unattributable after the fact. The
- *     probe is the whole reason the second occurrence will be cheaper to
- *     explain than the first.
- *
- * The emitted shell is bash and runs under `set -e` / `set -o pipefail`, which
- * is why the exit code is measured explicitly rather than inferred.
- */
-/**
- * The line git prints when, and only when, a server answers a fetch with
- * HTTP 401 and no credential is available.
- */
-export const REFUSED_FETCH_SIGNATURE = 'could not read Username for';
-/**
- * Shell functions and state the retry depends on. Emit once per script, before
- * the first `retryOnRefusedFetch` block.
- */
-export function refusedFetchHelpers() {
-    return [
-        '# --- refused dependency fetch: retry, then explain -------------------------',
-        'CIBUILD_FETCH_LOG="$(mktemp -t cibuild-fetch)"',
-        '',
-        '# git asks for a username only when a server answers with HTTP 401, so this',
-        '# line means the fetch was refused, not that a package is missing.',
-        'cibuild_fetch_was_refused() {',
-        `  grep -q '${REFUSED_FETCH_SIGNATURE}' "$CIBUILD_FETCH_LOG" 2>/dev/null`,
-        '}',
-        '',
-        '# The status that caused the refusal is recorded nowhere, so ask again and',
-        '# put it in the build log where the next person will find it.',
-        'cibuild_diagnose_refused_fetch() {',
-        '  echo ""',
-        '  echo "──────────────────────────────────────────────────────────────"',
-        '  echo "A dependency fetch was refused."',
-        '  echo ""',
-        '  echo "git asked for a username, which it does only when the server answered"',
-        '  echo "with HTTP 401. That is an authentication refusal, not a missing"',
-        '  echo "package. Re-probing each repository named above:"',
-        '  echo ""',
-        // Every stage here can legitimately match nothing, and under `set -e` with
-        // `pipefail` an empty grep would abort the step and replace the command's
-        // real exit code with 1. The diagnostic must never do that: it runs on the
-        // failure path, and its whole job is to explain a failure it did not cause.
-        `  grep -oE 'https://[^ "'"'"']+' "$CIBUILD_FETCH_LOG" 2>/dev/null \\`,
-        `    | sed -e "s/[.,:;')]*$//" -e 's/\\.git$//' \\`,
-        `    | grep -E '^https://[^/]+/[^/]+/[^/]+$' \\`,
-        '    | sort -u | head -20 \\',
-        '    | while IFS= read -r CIBUILD_FETCH_PROBE_URL; do',
-        '        CIBUILD_FETCH_PROBE_CODE="$(curl -sS -o /dev/null -m 20 \\',
-        `          -w '%{http_code}' \\`,
-        '          "$CIBUILD_FETCH_PROBE_URL/info/refs?service=git-upload-pack" 2>/dev/null)" \\',
-        '          || CIBUILD_FETCH_PROBE_CODE="000"',
-        '        case "$CIBUILD_FETCH_PROBE_CODE" in',
-        '          200)',
-        '            echo "  200  $CIBUILD_FETCH_PROBE_URL"',
-        '            echo "       readable anonymously now — the refusal was transient"',
-        '            ;;',
-        '          401|403)',
-        '            echo "  $CIBUILD_FETCH_PROBE_CODE  $CIBUILD_FETCH_PROBE_URL"',
-        '            echo "       still refused — this repository needs a credential, or the"',
-        '            echo "       host is refusing anonymous reads from this machine"',
-        '            ;;',
-        '          404)',
-        '            echo "  404  $CIBUILD_FETCH_PROBE_URL"',
-        '            echo "       no such repository — check the dependency URL"',
-        '            ;;',
-        '          000)',
-        '            echo "  ---  $CIBUILD_FETCH_PROBE_URL"',
-        '            echo "       unreachable from this machine — network, DNS or TLS"',
-        '            ;;',
-        '          *)',
-        '            echo "  $CIBUILD_FETCH_PROBE_CODE  $CIBUILD_FETCH_PROBE_URL"',
-        '            ;;',
-        '        esac',
-        '      done || true',
-        '  echo ""',
-        '  echo "A 200 above means the fetch would succeed if it ran again now."',
-        '  echo "──────────────────────────────────────────────────────────────"',
-        '  echo ""',
-        '}',
-        '',
-    ];
-}
-/**
- * Runs `command`, retrying it while the failure looks like a refused fetch.
- * On the last failure the diagnostic runs and the step exits with the
- * command's own status, so the reported exit code is still the real one.
- */
-export function retryOnRefusedFetch(options) {
-    const attempts = options.attempts ?? 3;
-    const backoff = options.backoffSeconds ?? [15, 45];
-    const label = options.label.replace(/"/g, '\\"');
-    return [
-        `CIBUILD_FETCH_MAX_ATTEMPTS=${attempts}`,
-        `CIBUILD_FETCH_BACKOFF=(${backoff.join(' ')})`,
-        'CIBUILD_FETCH_ATTEMPT=1',
-        'while :; do',
-        '  set +e',
-        `  ${options.command} 2>&1 | tee "$CIBUILD_FETCH_LOG"`,
-        '  CIBUILD_FETCH_RC=${PIPESTATUS[0]}',
-        '  set -e',
-        '  if [ "$CIBUILD_FETCH_RC" -eq 0 ]; then',
-        '    break',
-        '  fi',
-        // Anything that is not a refused fetch is a real failure: fail now.
-        '  if ! cibuild_fetch_was_refused; then',
-        '    break',
-        '  fi',
-        '  if [ "$CIBUILD_FETCH_ATTEMPT" -ge "$CIBUILD_FETCH_MAX_ATTEMPTS" ]; then',
-        '    break',
-        '  fi',
-        '  CIBUILD_FETCH_WAIT="${CIBUILD_FETCH_BACKOFF[$((CIBUILD_FETCH_ATTEMPT - 1))]:-30}"',
-        `  echo "⚠️  ${label} was refused by the server (attempt $CIBUILD_FETCH_ATTEMPT of $CIBUILD_FETCH_MAX_ATTEMPTS)."`,
-        '  echo "   A refused anonymous fetch is usually transient. Retrying in ${CIBUILD_FETCH_WAIT}s..."',
-        '  sleep "$CIBUILD_FETCH_WAIT"',
-        '  CIBUILD_FETCH_ATTEMPT=$((CIBUILD_FETCH_ATTEMPT + 1))',
-        'done',
-        '',
-        'if [ "$CIBUILD_FETCH_RC" -ne 0 ]; then',
-        '  if cibuild_fetch_was_refused; then',
-        '    cibuild_diagnose_refused_fetch',
-        '  fi',
-        '  exit "$CIBUILD_FETCH_RC"',
-        'fi',
-        '',
-    ];
-}
-//# sourceMappingURL=git-fetch-retry.js.map

package/dist/src/yaml/steps/git-fetch-retry.test.d.ts

@@ -1,5 +0,0 @@
-/**
- * Tests for retrying a refused third-party dependency fetch.
- */
-export {};
-//# sourceMappingURL=git-fetch-retry.test.d.ts.map

package/dist/src/yaml/steps/git-fetch-retry.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"git-fetch-retry.test.d.ts","sourceRoot":"","sources":["../../../../src/yaml/steps/git-fetch-retry.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}