@invarn/cibuild 2.9.4 → 2.9.7

package/dist/src/commands/a-credential-target-follows-the-flavor-source-set.test.js

@@ -1,222 +0,0 @@
-/**
- * A credential's target path and the value chosen for it both have to follow
- * the product flavor the workflow builds.
- *
- * An Android module has one source set per flavor, and each carries its own
- * copies of whatever the build needs — the manifest, the resources, and
- * `google-services.json`. The google-services plugin resolves the file by
- * specificity (variant, then build type, then flavor, then the module root)
- * and takes the first it finds. So a workflow building `ciDynamicDebug` wants
- * `app/src/ciDynamic/google-services.json`, and only falls back to the module
- * root when that is absent.
- *
- * The generator assumed one file at the module root. Writing there on a
- * flavored repository is *silently* wrong rather than loudly wrong: the plugin
- * finds a file, parses it, and fails on a package name. That is what
- * `bld_8e60d90ab4e55f85d2f72459` (2026-09-09) spent 1292 Gradle tasks
- * discovering:
- *
- *     Execution failed for task ':app:processCiDynamicDebugGoogleServices'.
- *     > No matching client found for package name '….ciDynamic'
- *
- * The chain worked. The file was the wrong one of four, and the error names
- * Firebase rather than the credential we delivered.
- *
- * Two flavors cannot share one secret, and the key is how a value varies. A
- * dispatched build's secrets are a flat key→value map — Invarn's scopes are
- * org, connection and pipeline, with no workflow *column* — but a flat map
- * carries a workflow perfectly well when the workflow is part of the key,
- * which is what `ci secrets upload` has encoded as
- * `CIBUILD_SW__<WORKFLOW>__<VAR>` all along. So the differing keys are
- * per-workflow ones, not per-flavor ones: the flavor is a property of the
- * variant the workflow builds, so keying by workflow is one indirection less,
- * and it is the convention already implemented end to end. A per-flavor
- * suffix (`GOOGLE_SERVICES_JSON_CIDYNAMIC`) was briefly shipped here as a
- * second answer to the same question and was reverted (Alex, 2026-09-09).
- */
-import { describe, test, expect } from '@jest/globals';
-import { load } from 'js-yaml';
-import { generateAndroidPipeline, flavorOfVariant, googleServicesPathFor, googleServicesTargets, } from './build.js';
-const BASE = {
-    keystore: false,
-    keystoreProperties: false,
-    googleServices: false,
-    googlePlayDeploy: false,
-    googlePlayPackageName: '',
-    artifactType: 'apk',
-    keystorePaths: {},
-    googleServicesPaths: {},
-    workflowFlavors: {},
-    secretsProperties: false,
-    secretsPropertiesPath: 'local.properties',
-};
-function variant(name) {
-    const buildType = name.charAt(0).toUpperCase() + name.slice(1);
-    return { variant: name, buildType, gradleTask: `assemble${buildType}` };
-}
-/** The real repository's shape: two debug workflows on one flavor, release on another. */
-const FLAVORED = {
-    primary: variant('ciDynamicDebug'),
-    pullRequest: variant('ciDynamicDebug'),
-    release: variant('prodRelease'),
-};
-const UNFLAVORED = {
-    primary: variant('debug'),
-    pullRequest: variant('debug'),
-    release: variant('release'),
-};
-const FLAVORS = ['ciDynamic', 'dev', 'prod', 'gandalf'];
-function parse(yaml) {
-    return load(yaml);
-}
-function envs(parsed) {
-    return Object.assign({}, ...(parsed.app?.envs ?? []));
-}
-/** The `file@` step of `workflow` that writes a google-services.json, if any. */
-function googleServicesStep(parsed, workflow) {
-    return (parsed.workflows?.[workflow]?.steps ?? [])
-        .filter((s) => Object.keys(s)[0] === 'file@1.0.0')
-        .map((s) => s['file@1.0.0'].inputs)
-        .find((inputs) => String(inputs.target_path).endsWith('google-services.json'));
-}
-function generate(variants, flavors) {
-    return parse(generateAndroidPipeline(17, {
-        ...BASE,
-        googleServices: true,
-        googleServicesPaths: googleServicesTargets(variants, flavors),
-    }, variants));
-}
-describe('which flavor a variant builds', () => {
-    test('is the flavor the variant name starts with', () => {
-        expect(flavorOfVariant('ciDynamicDebug', FLAVORS)).toBe('ciDynamic');
-        expect(flavorOfVariant('prodRelease', FLAVORS)).toBe('prod');
-        expect(flavorOfVariant('devDebug', FLAVORS)).toBe('dev');
-    });
-    test('is nothing when the variant is a bare build type', () => {
-        expect(flavorOfVariant('debug', FLAVORS)).toBeNull();
-        expect(flavorOfVariant('release', FLAVORS)).toBeNull();
-        // A repository with no product flavors can never match one.
-        expect(flavorOfVariant('ciDynamicDebug', [])).toBeNull();
-    });
-    test('needs the capital that starts the build type, so a prefix cannot claim it', () => {
-        // Without this check `pro` claims `prodRelease` and the credential lands
-        // in the wrong source set — the same arbitrariness, one layer down.
-        expect(flavorOfVariant('prodRelease', ['pro'])).toBeNull();
-        expect(flavorOfVariant('prodRelease', ['pro', 'prod'])).toBe('prod');
-    });
-    test('gives the longest flavor the win when two both match', () => {
-        expect(flavorOfVariant('ciDynamicDebug', ['ci', 'ciDynamic'])).toBe('ciDynamic');
-    });
-});
-describe('the path a flavor implies', () => {
-    test('is the module root when there is no flavor', () => {
-        expect(googleServicesPathFor(null)).toBe('app/google-services.json');
-    });
-    test('is that flavor\'s source set when there is one', () => {
-        expect(googleServicesPathFor('ciDynamic')).toBe('app/src/ciDynamic/google-services.json');
-        expect(googleServicesPathFor('prod')).toBe('app/src/prod/google-services.json');
-    });
-    test('follows the module when the app is not in `app/`', () => {
-        expect(googleServicesPathFor('ciDynamic', 'androidApp')).toBe('androidApp/src/ciDynamic/google-services.json');
-    });
-});
-describe('the pipeline a flavored repository gets', () => {
-    test('writes each workflow into its own flavor source set', () => {
-        const parsed = generate(FLAVORED, FLAVORS);
-        // One object per workflow so a failure names the workflow that lost it.
-        expect(['primary', 'pull-request', 'release'].map((workflow) => ({
-            workflow,
-            target_path: googleServicesStep(parsed, workflow)?.target_path,
-        }))).toEqual([
-            { workflow: 'primary', target_path: 'app/src/ciDynamic/google-services.json' },
-            { workflow: 'pull-request', target_path: 'app/src/ciDynamic/google-services.json' },
-            { workflow: 'release', target_path: 'app/src/prod/google-services.json' },
-        ]);
-    });
-    test('names one secret in every workflow, whatever the flavor', () => {
-        // The value differs per workflow; the *name* does not. Scoping a value to
-        // a workflow is the secret's job — `ci secrets add GOOGLE_SERVICES_JSON
-        // <pipeline> -w primary` stores it per workflow, `ci secrets upload`
-        // encodes it as `CIBUILD_SW__PRIMARY__GOOGLE_SERVICES_JSON`, and
-        // `EnvResolver` resolves it for the workflow being run. A second naming
-        // convention in the step would be a second way to say the same thing.
-        const parsed = generate(FLAVORED, FLAVORS);
-        expect(['primary', 'pull-request', 'release'].map((workflow) => googleServicesStep(parsed, workflow)?.var_name)).toEqual(['GOOGLE_SERVICES_JSON', 'GOOGLE_SERVICES_JSON', 'GOOGLE_SERVICES_JSON']);
-    });
-    test('declares that one secret under no invented per-flavor name', () => {
-        // Declared, and declared empty: `unsetEnvKeys` — what `invarn setup`
-        // searches the developer's machine by — reads `envs`, never step inputs.
-        // A key no `envs` entry names is never discovered and never uploaded.
-        //
-        // *How many* slots it takes is a later ruling and lives in
-        // `a-credential-two-workflows-cannot-share-is-declared-per-workflow`: two
-        // flavors need two values, and `invarn setup` fills one slot with one
-        // value, so a flavored repository declares one slot per workflow under the
-        // `CIBUILD_SW__` name the upload already encodes. What this test still
-        // holds is the naming: whatever the flavor, the credential is
-        // `GOOGLE_SERVICES_JSON` and never `GOOGLE_SERVICES_JSON_CIDYNAMIC`.
-        const yaml = generateAndroidPipeline(17, {
-            ...BASE,
-            googleServices: true,
-            googleServicesPaths: googleServicesTargets(FLAVORED, FLAVORS),
-        }, FLAVORED);
-        // One declaration per workflow, in that workflow's own `envs`, under the
-        // plain credential name — the block says which workflow, so nothing is
-        // encoded into the key.
-        const parsed = parse(yaml);
-        const declaringWorkflows = Object.keys(parsed.workflows ?? {}).filter((workflow) => 'GOOGLE_SERVICES_JSON' in
-            Object.assign({}, ...(parsed.workflows?.[workflow]?.envs ?? [])));
-        expect(declaringWorkflows).toEqual(['primary', 'pull-request', 'release']);
-        expect(envs(parsed)).not.toHaveProperty('GOOGLE_SERVICES_JSON');
-        expect(yaml).not.toMatch(/GOOGLE_SERVICES_JSON_[A-Z]/);
-        expect(yaml).not.toContain('CIBUILD_SW__');
-    });
-});
-describe('a repository with no product flavors', () => {
-    test('is exactly what it was: one key, one path, in every workflow', () => {
-        const parsed = generate(UNFLAVORED, []);
-        expect(envs(parsed).GOOGLE_SERVICES_JSON).toBe('');
-        for (const workflow of ['primary', 'pull-request', 'release']) {
-            expect(googleServicesStep(parsed, workflow)).toMatchObject({
-                target_path: 'app/google-services.json',
-                var_name: 'GOOGLE_SERVICES_JSON',
-            });
-        }
-    });
-    test('is unchanged even when the pipeline is generated with no options at all', () => {
-        // The defaulted `SetupOptions` has empty maps; the step must still fall
-        // back to the module root rather than emitting `undefined`.
-        const parsed = parse(generateAndroidPipeline(17, { ...BASE, googleServices: true }, UNFLAVORED));
-        expect(googleServicesStep(parsed, 'primary')).toMatchObject({
-            target_path: 'app/google-services.json',
-            var_name: 'GOOGLE_SERVICES_JSON',
-        });
-    });
-    test('emits nothing at all when the scan found no google-services.json', () => {
-        const parsed = parse(generateAndroidPipeline(17, BASE, UNFLAVORED));
-        expect(envs(parsed)).not.toHaveProperty('GOOGLE_SERVICES_JSON');
-        for (const workflow of ['primary', 'pull-request', 'release']) {
-            expect(googleServicesStep(parsed, workflow)).toBeUndefined();
-        }
-    });
-});
-describe('a repository whose workflows all build one flavor', () => {
-    test('gets a single flavored key, written to that flavor everywhere', () => {
-        const allCiDynamic = {
-            primary: variant('ciDynamicDebug'),
-            pullRequest: variant('ciDynamicDebug'),
-            release: variant('ciDynamicRelease'),
-        };
-        const parsed = generate(allCiDynamic, FLAVORS);
-        expect(Object.keys(envs(parsed)).filter((k) => k.startsWith('GOOGLE_SERVICES_JSON'))).toEqual([
-            'GOOGLE_SERVICES_JSON',
-        ]);
-        for (const workflow of ['primary', 'pull-request', 'release']) {
-            expect(googleServicesStep(parsed, workflow)).toMatchObject({
-                target_path: 'app/src/ciDynamic/google-services.json',
-                var_name: 'GOOGLE_SERVICES_JSON',
-            });
-        }
-    });
-});
-//# sourceMappingURL=a-credential-target-follows-the-flavor-source-set.test.js.map

package/dist/src/commands/a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.d.ts

@@ -1,41 +0,0 @@
-/**
- * A credential two workflows cannot share is declared once per workflow, not
- * once for the pipeline.
- *
- * The generator declares each credential it finds as one empty `app.envs`
- * slot — `- LOCAL_PROPERTIES: ""` — and emits the same unsuffixed `var_name`
- * in every workflow's `file@` step. On a repository with one flavor that is
- * exactly right. On a flavored one it is one value where the build needs two,
- * and the pipeline says so nowhere: `invarn setup` finds one slot, uploads one
- * value, and all three workflows read it.
- *
- * `LOCAL_PROPERTIES` is the case that matters most and the one with no target
- * path to give it away. Every workflow writes the same `local.properties` to
- * the same place; what belongs *in* it is the flavor's environment — a
- * different base API URL plus twenty other keys the Secrets Gradle Plugin
- * turns into `BuildConfig`. `ciDynamic` and `prod` are different environments,
- * so `prodRelease` built against `ciDynamic`'s properties is a release
- * pointing at the CI backend. Two credentials give themselves away by path
- * instead, and both were measured: `google-services.json` per flavor source
- * set (`bld_8e60d90ab4e55f85d2f72459`) and the keystore per declared target
- * (`bld_f3cc37d81…`).
- *
- * The name is the whole mechanism. Invarn's secret scopes are org, connection
- * and pipeline, with no workflow column for a value to vary along — but a flat
- * key→value map carries a workflow perfectly well when the workflow is part of
- * the key, which is what `ci secrets upload` has always encoded and
- * `SecretsManager` has always decoded. So the slot names the workflow and the
- * step does not: `var_name` stays unsuffixed in every workflow, the decoding
- * does the mapping, and a second naming convention in the step would be a
- * second way to say the same thing (`GOOGLE_SERVICES_JSON_CIDYNAMIC` was that
- * second way, and it was reverted).
- *
- * What decides is whether the workflows disagree about the thing the
- * credential follows, and each credential follows something different: a
- * keystore its declared target path, `google-services.json` the flavor's
- * source set, `local.properties` the flavor itself. A credential only one
- * workflow reads can never disagree, which is why the two genuinely
- * release-only credentials keep one slot however flavored the repository is.
- */
-export {};
-//# sourceMappingURL=a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.d.ts.map

package/dist/src/commands/a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.d.ts","sourceRoot":"","sources":["../../../src/commands/a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG"}

package/dist/src/commands/a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.js

@@ -1,324 +0,0 @@
-/**
- * A credential two workflows cannot share is declared once per workflow, not
- * once for the pipeline.
- *
- * The generator declares each credential it finds as one empty `app.envs`
- * slot — `- LOCAL_PROPERTIES: ""` — and emits the same unsuffixed `var_name`
- * in every workflow's `file@` step. On a repository with one flavor that is
- * exactly right. On a flavored one it is one value where the build needs two,
- * and the pipeline says so nowhere: `invarn setup` finds one slot, uploads one
- * value, and all three workflows read it.
- *
- * `LOCAL_PROPERTIES` is the case that matters most and the one with no target
- * path to give it away. Every workflow writes the same `local.properties` to
- * the same place; what belongs *in* it is the flavor's environment — a
- * different base API URL plus twenty other keys the Secrets Gradle Plugin
- * turns into `BuildConfig`. `ciDynamic` and `prod` are different environments,
- * so `prodRelease` built against `ciDynamic`'s properties is a release
- * pointing at the CI backend. Two credentials give themselves away by path
- * instead, and both were measured: `google-services.json` per flavor source
- * set (`bld_8e60d90ab4e55f85d2f72459`) and the keystore per declared target
- * (`bld_f3cc37d81…`).
- *
- * The name is the whole mechanism. Invarn's secret scopes are org, connection
- * and pipeline, with no workflow column for a value to vary along — but a flat
- * key→value map carries a workflow perfectly well when the workflow is part of
- * the key, which is what `ci secrets upload` has always encoded and
- * `SecretsManager` has always decoded. So the slot names the workflow and the
- * step does not: `var_name` stays unsuffixed in every workflow, the decoding
- * does the mapping, and a second naming convention in the step would be a
- * second way to say the same thing (`GOOGLE_SERVICES_JSON_CIDYNAMIC` was that
- * second way, and it was reverted).
- *
- * What decides is whether the workflows disagree about the thing the
- * credential follows, and each credential follows something different: a
- * keystore its declared target path, `google-services.json` the flavor's
- * source set, `local.properties` the flavor itself. A credential only one
- * workflow reads can never disagree, which is why the two genuinely
- * release-only credentials keep one slot however flavored the repository is.
- */
-import { describe, test, expect } from '@jest/globals';
-import { load } from 'js-yaml';
-import { generateAndroidPipeline, googleServicesTargets, variantFlavors, credentialSlots, GENERATED_WORKFLOWS, } from './build.js';
-function variant(name) {
-    const buildType = name.charAt(0).toUpperCase() + name.slice(1);
-    return { variant: name, buildType, gradleTask: `assemble${buildType}` };
-}
-/** The real repository's shape: two debug workflows on one flavor, release on another. */
-const FLAVORED = {
-    primary: variant('ciDynamicDebug'),
-    pullRequest: variant('ciDynamicDebug'),
-    release: variant('prodRelease'),
-};
-const UNFLAVORED = {
-    primary: variant('debug'),
-    pullRequest: variant('debug'),
-    release: variant('release'),
-};
-const FLAVORS = ['ciDynamic', 'dev', 'prod'];
-/** The keystore targets the real repository resolves: debug key, release key. */
-const SPLIT_KEYSTORES = {
-    primary: 'config/debug.keystore',
-    'pull-request': 'config/debug.keystore',
-    release: 'app/release.jks',
-};
-const BASE = {
-    keystore: false,
-    keystoreProperties: false,
-    googleServices: false,
-    googlePlayDeploy: false,
-    googlePlayPackageName: '',
-    artifactType: 'apk',
-    keystorePaths: {},
-    googleServicesPaths: {},
-    workflowFlavors: {},
-    secretsProperties: false,
-    secretsPropertiesPath: 'local.properties',
-};
-/** Every credential the Android generator knows how to declare, all switched on. */
-const ALL_CREDENTIALS = {
-    keystore: true,
-    keystoreProperties: true,
-    googleServices: true,
-    googlePlayDeploy: true,
-    googlePlayPackageName: 'com.example.app',
-    artifactType: 'aab',
-    secretsProperties: true,
-};
-function parse(yaml) {
-    return load(yaml);
-}
-function envs(parsed) {
-    return Object.assign({}, ...(parsed.app?.envs ?? []));
-}
-/** What one workflow's own `envs` block declares. */
-function workflowEnvs(parsed, workflow) {
-    return Object.assign({}, ...(parsed.workflows?.[workflow]?.envs ?? []));
-}
-/**
- * The workflows whose own `envs` declare `varName`, in pipeline order.
- *
- * The name is the plain credential now, so *where* the declaration sits is the
- * whole answer to which workflow it belongs to.
- */
-function declaringWorkflows(parsed, varName) {
-    return Object.keys(parsed.workflows ?? {}).filter((workflow) => varName in workflowEnvs(parsed, workflow));
-}
-/** The `var_name` of every `file@` step in `workflow`, in order. */
-function fileVarNames(parsed, workflow) {
-    return (parsed.workflows?.[workflow]?.steps ?? [])
-        .filter((s) => Object.keys(s)[0] === 'file@1.0.0')
-        .map((s) => s['file@1.0.0'].inputs.var_name);
-}
-/** The declared slots that carry `varName`, however they are named. */
-function slotsFor(parsed, varName) {
-    return Object.keys(envs(parsed)).filter((key) => key === varName || key.endsWith(`__${varName}`));
-}
-function flavoredPipeline(over = {}) {
-    return parse(generateAndroidPipeline(17, {
-        ...BASE,
-        ...ALL_CREDENTIALS,
-        keystorePaths: SPLIT_KEYSTORES,
-        googleServicesPaths: googleServicesTargets(FLAVORED, FLAVORS),
-        workflowFlavors: variantFlavors(FLAVORED, FLAVORS),
-        ...over,
-    }, FLAVORED));
-}
-describe('what a credential follows', () => {
-    test('is the flavor each workflow builds, for the properties file', () => {
-        expect(variantFlavors(FLAVORED, FLAVORS)).toEqual({
-            primary: 'ciDynamic',
-            'pull-request': 'ciDynamic',
-            release: 'prod',
-        });
-    });
-    test('is nothing at all on a repository with no product flavors', () => {
-        expect(variantFlavors(UNFLAVORED, [])).toEqual({
-            primary: null,
-            'pull-request': null,
-            release: null,
-        });
-    });
-});
-describe('the slots one credential gets', () => {
-    test('are one, unsuffixed, when every workflow wants the same bytes', () => {
-        expect(credentialSlots('LOCAL_PROPERTIES', {
-            primary: 'ciDynamic',
-            'pull-request': 'ciDynamic',
-            release: 'ciDynamic',
-        })).toEqual([{ slot: 'LOCAL_PROPERTIES', workflow: null }]);
-    });
-    test('are one per workflow, under the plain name, when they do not', () => {
-        // The name never changes; the block it is declared in does.
-        // `CIBUILD_SW__<WF>__<VAR>` is the encoding `ci secrets upload` carries a
-        // workflow-scoped *value* under, and a pipeline has structure instead.
-        expect(credentialSlots('LOCAL_PROPERTIES', {
-            primary: 'ciDynamic',
-            'pull-request': 'ciDynamic',
-            release: 'prod',
-        })).toEqual([
-            { slot: 'LOCAL_PROPERTIES', workflow: 'primary' },
-            { slot: 'LOCAL_PROPERTIES', workflow: 'pull-request' },
-            { slot: 'LOCAL_PROPERTIES', workflow: 'release' },
-        ]);
-    });
-    test('include the workflows that agree, not only the odd one out', () => {
-        // `pull-request` wants the same bytes as `primary`. It still needs a slot
-        // of its own: the encoded name is per workflow, and a workflow with no
-        // slot has no value and no tripwire.
-        const workflows = credentialSlots('KEYSTORE_BASE64', SPLIT_KEYSTORES).map((s) => s.workflow);
-        expect(workflows).toEqual(['primary', 'pull-request', 'release']);
-    });
-    test('are one when only one workflow reads the credential', () => {
-        expect(credentialSlots('KEYSTORE_PROPERTIES', { release: 'keystore.properties' })).toEqual([
-            { slot: 'KEYSTORE_PROPERTIES', workflow: null },
-        ]);
-    });
-});
-describe('a flavored repository', () => {
-    test('declares the properties file in each workflow, and not globally', () => {
-        const parsed = flavoredPipeline();
-        expect(declaringWorkflows(parsed, 'LOCAL_PROPERTIES')).toEqual([
-            'primary',
-            'pull-request',
-            'release',
-        ]);
-        // Globally would be one value for three workflows, which is the bug.
-        expect(envs(parsed)).not.toHaveProperty('LOCAL_PROPERTIES');
-    });
-    test('declares google-services.json and the keystore per workflow too', () => {
-        const parsed = flavoredPipeline();
-        for (const varName of ['GOOGLE_SERVICES_JSON', 'KEYSTORE_BASE64']) {
-            expect(declaringWorkflows(parsed, varName)).toEqual([
-                'primary',
-                'pull-request',
-                'release',
-            ]);
-            expect(envs(parsed)).not.toHaveProperty(varName);
-        }
-    });
-    test('keeps one slot for the credentials only `release` reads', () => {
-        // Genuinely release-only, and legitimately so: nothing else signs a
-        // release or talks to Google Play. A second slot for a workflow that never
-        // reads the value is a value the user is asked for and nothing consumes.
-        const parsed = flavoredPipeline();
-        expect(slotsFor(parsed, 'KEYSTORE_PROPERTIES')).toEqual(['KEYSTORE_PROPERTIES']);
-        expect(slotsFor(parsed, 'GOOGLE_PLAY_SERVICE_ACCOUNT_JSON')).toEqual([
-            'GOOGLE_PLAY_SERVICE_ACCOUNT_JSON',
-        ]);
-    });
-    test('leaves the step naming the credential, not the slot', () => {
-        // The `file@` step never learns the convention exists. `EnvResolver`
-        // resolves the plain name for the workflow being run, so one name in the
-        // step reads a different value in each workflow.
-        const parsed = flavoredPipeline();
-        for (const workflow of GENERATED_WORKFLOWS) {
-            const names = fileVarNames(parsed, workflow);
-            expect(names.length).toBeGreaterThan(0);
-            expect(names.filter((n) => n.startsWith('CIBUILD_'))).toEqual([]);
-        }
-    });
-    test('declares every slot empty, which is what `invarn setup` searches by', () => {
-        // `unsetEnvKeys` collects `envs` keys whose declared value is the empty
-        // string — from `app.envs` and from each workflow's own. A slot with
-        // anything else in it is never discovered on the developer's machine and
-        // never offered for upload.
-        const parsed = flavoredPipeline();
-        const isCredential = (k) => /^(KEYSTORE|GOOGLE|LOCAL)_/.test(k);
-        const declared = [
-            ...Object.entries(envs(parsed)),
-            ...Object.keys(parsed.workflows ?? {}).flatMap((w) => Object.entries(workflowEnvs(parsed, w))),
-        ].filter(([key]) => isCredential(key));
-        // Three per-workflow slots each for the properties file,
-        // google-services.json and the keystore; one flat slot each for the two
-        // release-only ones.
-        expect(declared.length).toBe(11);
-        for (const [, value] of declared)
-            expect(value).toBe('');
-    });
-    test('spends no encoding on what the block already says', () => {
-        // The workflow a declaration belongs to is the block it sits in. The
-        // `CIBUILD_SW__` prefix stays what it has always been: how `ci secrets
-        // upload` transports a workflow-scoped value into a flat key→value store
-        // that has no workflow column (Alex, 2026-09-10).
-        const yaml = generateAndroidPipeline(17, {
-            ...BASE,
-            ...ALL_CREDENTIALS,
-            keystorePaths: SPLIT_KEYSTORES,
-            googleServicesPaths: googleServicesTargets(FLAVORED, FLAVORS),
-            workflowFlavors: variantFlavors(FLAVORED, FLAVORS),
-        }, FLAVORED);
-        expect(yaml).not.toContain('CIBUILD_SW__');
-        expect(yaml).not.toContain('CIBUILD_S__');
-    });
-    test('puts a per-workflow declaration in a workflow the pipeline has', () => {
-        // Structural now, and that is the point: a declaration cannot name a
-        // workflow that does not exist, because it lives inside one.
-        const parsed = flavoredPipeline();
-        const present = Object.keys(parsed.workflows ?? {});
-        const perWorkflow = ['KEYSTORE_BASE64', 'GOOGLE_SERVICES_JSON', 'LOCAL_PROPERTIES'].flatMap((varName) => declaringWorkflows(parsed, varName));
-        expect(perWorkflow.length).toBe(9);
-        expect(perWorkflow.every((w) => present.includes(w))).toBe(true);
-    });
-});
-describe('a repository whose workflows all want the same bytes', () => {
-    test('is byte-identical to what the generator emitted before any of this', () => {
-        // The whole `app.envs` block, as it stood at cibuild d8263a1 with every
-        // credential switched on and no flavors anywhere. Item 02 must be inert
-        // here: this is what every already-onboarded project regenerates to.
-        const yaml = generateAndroidPipeline(17, { ...BASE, ...ALL_CREDENTIALS });
-        const block = yaml.slice(yaml.indexOf('app:\n'), yaml.indexOf('\nworkflows:'));
-        expect(block).toBe('app:\n' +
-            '  envs:\n' +
-            '    - PROJECT_LOCATION: .\n' +
-            '    - MODULE: app\n' +
-            '    - BUILD_TYPE: Debug\n' +
-            '    - GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.parallel=true\n' +
-            '    - KEYSTORE_BASE64: ""         # Set via: ci secrets add KEYSTORE_BASE64 -w primary\n' +
-            '    - KEYSTORE_PROPERTIES: ""      # Release signing — set via: ci secrets add KEYSTORE_PROPERTIES -w release\n' +
-            '    - GOOGLE_SERVICES_JSON: ""     # Set via: ci secrets add GOOGLE_SERVICES_JSON\n' +
-            '    - GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ""  # Set via: ci secrets add GOOGLE_PLAY_SERVICE_ACCOUNT_JSON -w release\n' +
-            '    - LOCAL_PROPERTIES: ""         # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES\n');
-        expect(yaml).not.toContain('CIBUILD_SW__');
-    });
-    test('is flat on one flavor as much as on none', () => {
-        // Three workflows, one flavor, three different build types. The build type
-        // is not what any of these credentials follows, so nothing splits.
-        const allCiDynamic = {
-            primary: variant('ciDynamicDebug'),
-            pullRequest: variant('ciDynamicDebug'),
-            release: variant('ciDynamicRelease'),
-        };
-        const yaml = generateAndroidPipeline(17, {
-            ...BASE,
-            ...ALL_CREDENTIALS,
-            googleServicesPaths: googleServicesTargets(allCiDynamic, FLAVORS),
-            workflowFlavors: variantFlavors(allCiDynamic, FLAVORS),
-        }, allCiDynamic);
-        expect(yaml).not.toContain('CIBUILD_SW__');
-        expect(slotsFor(parse(yaml), 'LOCAL_PROPERTIES')).toEqual(['LOCAL_PROPERTIES']);
-    });
-    test('is flat when one keystore serves every workflow', () => {
-        const yaml = generateAndroidPipeline(17, {
-            ...BASE,
-            keystore: true,
-            keystorePaths: { primary: 'app/one.jks', 'pull-request': 'app/one.jks', release: 'app/one.jks' },
-        });
-        expect(slotsFor(parse(yaml), 'KEYSTORE_BASE64')).toEqual(['KEYSTORE_BASE64']);
-    });
-    test('is flat when the scan resolved no keystore path at all', () => {
-        // Empty maps default the way the step defaults them, so a repository the
-        // scan could not resolve does not read as three disagreeing workflows.
-        const yaml = generateAndroidPipeline(17, { ...BASE, keystore: true });
-        expect(slotsFor(parse(yaml), 'KEYSTORE_BASE64')).toEqual(['KEYSTORE_BASE64']);
-    });
-    test('is flat when only some workflows resolved a path, and it is the default', () => {
-        const yaml = generateAndroidPipeline(17, {
-            ...BASE,
-            keystore: true,
-            keystorePaths: { release: 'keystore.jks' },
-        });
-        expect(slotsFor(parse(yaml), 'KEYSTORE_BASE64')).toEqual(['KEYSTORE_BASE64']);
-    });
-});
-//# sourceMappingURL=a-credential-two-workflows-cannot-share-is-declared-per-workflow.test.js.map

package/dist/src/commands/a-properties-stand-in-declares-the-keys-the-build-reads.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=a-properties-stand-in-declares-the-keys-the-build-reads.test.d.ts.map

package/dist/src/commands/a-properties-stand-in-declares-the-keys-the-build-reads.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"a-properties-stand-in-declares-the-keys-the-build-reads.test.d.ts","sourceRoot":"","sources":["../../../src/commands/a-properties-stand-in-declares-the-keys-the-build-reads.test.ts"],"names":[],"mappings":""}