@invarn/cibuild 2.9.5 → 2.9.7

package/dist/src/shared/prompts.d.ts

@@ -1,30 +0,0 @@
-import type { YAMLPipeline } from "../yaml/types.js";
-import type { CIConfig } from "../types.js";
-/**
- * True only when stdin AND stdout are real TTYs AND the caller has not
- * explicitly opted out of interactivity.
- *
- * `process.stdin.isTTY` is unreliable as a sole signal: Tart guest
- * sessions opened via `tart exec` attach a pseudo-TTY, so the check
- * passes and the prompt runs — only for nobody to ever answer it. The
- * runner sets `CIBUILD_NON_INTERACTIVE=1` (and the generic `CI=1` env
- * is also honored) to make the override unambiguous regardless of
- * whether the shell looks interactive.
- */
-export declare function isInteractiveTTY(): boolean;
-/**
- * Shows an interactive workflow picker. If exactly one workflow exists,
- * returns it without prompting. Returns `undefined` when the user cancels
- * or no workflows are defined.
- */
-export declare function promptForWorkflow(workflows: string[]): Promise<string | undefined>;
-/**
- * Runs pre-execution validation, separates issues into user-fillable
- * (missing env vars) vs hard-blocking, and collects all missing values
- * upfront in a single form-like pass before execution begins.
- *
- * @returns true if it's safe to proceed, false if the user cancelled or
- *   hard errors exist.
- */
-export declare function promptForMissingVariables(yamlPipeline: YAMLPipeline, workflowName: string, config: CIConfig, yamlFilePath: string): Promise<boolean>;
-//# sourceMappingURL=prompts.d.ts.map

package/dist/src/shared/prompts.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../../src/shared/prompts.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAU1C;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA0BxF;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,QAAQ,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAwFlB"}

package/dist/src/shared/prompts.js

@@ -1,121 +0,0 @@
-import prompts from "prompts";
-import { StepValidator, formatValidationResult } from "../yaml/step-validator.js";
-import { MissingEnvHandler } from "../yaml/missing-env-handler.js";
-import { MissingEnvironmentVariableError } from "../yaml/env-resolver.js";
-/**
- * True only when stdin AND stdout are real TTYs AND the caller has not
- * explicitly opted out of interactivity.
- *
- * `process.stdin.isTTY` is unreliable as a sole signal: Tart guest
- * sessions opened via `tart exec` attach a pseudo-TTY, so the check
- * passes and the prompt runs — only for nobody to ever answer it. The
- * runner sets `CIBUILD_NON_INTERACTIVE=1` (and the generic `CI=1` env
- * is also honored) to make the override unambiguous regardless of
- * whether the shell looks interactive.
- */
-export function isInteractiveTTY() {
-    if (process.env.CIBUILD_NON_INTERACTIVE === '1' ||
-        process.env.CIBUILD_NON_INTERACTIVE === 'true' ||
-        process.env.CI === '1' ||
-        process.env.CI === 'true') {
-        return false;
-    }
-    return Boolean(process.stdin.isTTY && process.stdout.isTTY);
-}
-/**
- * Shows an interactive workflow picker. If exactly one workflow exists,
- * returns it without prompting. Returns `undefined` when the user cancels
- * or no workflows are defined.
- */
-export async function promptForWorkflow(workflows) {
-    if (workflows.length === 0) {
-        console.error("Error: No workflows found in pipeline file");
-        return undefined;
-    }
-    if (workflows.length === 1) {
-        console.log(`Using workflow: ${workflows[0]}\n`);
-        return workflows[0];
-    }
-    const response = await prompts({
-        type: "select",
-        name: "workflow",
-        message: "Select a workflow to run:",
-        choices: workflows.map((name) => ({ title: name, value: name })),
-        initial: 0,
-    });
-    if (!response.workflow) {
-        console.log("\nWorkflow selection cancelled");
-        return undefined;
-    }
-    console.log();
-    return response.workflow;
-}
-/**
- * Runs pre-execution validation, separates issues into user-fillable
- * (missing env vars) vs hard-blocking, and collects all missing values
- * upfront in a single form-like pass before execution begins.
- *
- * @returns true if it's safe to proceed, false if the user cancelled or
- *   hard errors exist.
- */
-export async function promptForMissingVariables(yamlPipeline, workflowName, config, yamlFilePath) {
-    console.log(`\n🔍 Running pre-execution validation...`);
-    const validator = new StepValidator(yamlPipeline, workflowName, config, yamlFilePath);
-    const result = await validator.validateWorkflow();
-    const errorIssues = result.issues.filter((i) => i.requirement.severity === "error" && i.result && !i.result.passed);
-    const fillable = errorIssues.filter((i) => i.requirement.timing === "pre-execution" &&
-        (i.requirement.category === "environment" || i.requirement.category === "input"));
-    const blocking = errorIssues.filter((i) => !(i.requirement.timing === "pre-execution" &&
-        (i.requirement.category === "environment" || i.requirement.category === "input")));
-    if (blocking.length > 0) {
-        console.log(formatValidationResult(result));
-        return false;
-    }
-    if (fillable.length === 0) {
-        if (result.counts.warnings > 0 || result.counts.info > 0) {
-            console.log(formatValidationResult(result));
-        }
-        else {
-            console.log("✅ Pre-execution validation passed\n");
-        }
-        return true;
-    }
-    console.log(`\n${fillable.length} required value(s) missing — provide them to continue:\n`);
-    for (const issue of fillable) {
-        const stepInfo = issue.stepName ? `  needed by: ${issue.stepName}` : "";
-        console.log(`  • ${issue.requirement.name.padEnd(30)}${stepInfo}`);
-    }
-    console.log();
-    if (!isInteractiveTTY()) {
-        console.error("\n❌ Cannot prompt for missing values: no interactive TTY available (running in a sandbox / CI).\n" +
-            "   Define the required values as env vars, secrets, or app.envs before dispatch, then retry.");
-        return false;
-    }
-    const handler = new MissingEnvHandler({
-        interactive: true,
-        workflow: workflowName,
-    });
-    for (let i = 0; i < fillable.length; i++) {
-        const issue = fillable[i];
-        const error = new MissingEnvironmentVariableError(issue.requirement.name, issue.stepName, issue.requirement.hint);
-        const original = console.log;
-        const label = `(${i + 1} of ${fillable.length})`;
-        let patched = false;
-        console.log = (...args) => {
-            if (!patched && typeof args[0] === "string" && args[0].includes("MISSING REQUIRED")) {
-                original(`║  MISSING REQUIRED ENVIRONMENT VARIABLE ${label.padEnd(28)}║`);
-                patched = true;
-                return;
-            }
-            original(...args);
-        };
-        const handleResult = await handler.handleMissingVariable(error);
-        console.log = original;
-        if (handleResult.cancelled) {
-            return false;
-        }
-    }
-    handler.close();
-    return true;
-}
-//# sourceMappingURL=prompts.js.map

package/dist/src/shared/xcode-container.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=xcode-container.test.d.ts.map

package/dist/src/shared/xcode-container.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"xcode-container.test.d.ts","sourceRoot":"","sources":["../../../src/shared/xcode-container.test.ts"],"names":[],"mappings":""}

package/dist/src/shared/xcode-container.test.js

@@ -1,123 +0,0 @@
-/**
- * A `.xcodeproj` with no `project.pbxproj` is not a project.
- *
- * `Uwi0/Oakane` is the row. Its `iosApp/` ships two Xcode projects: a tracked
- * `iosApp.xcodeproj` holding nothing but `project.xcworkspace/`, and the real
- * `oakane.xcodeproj` beside it. The scan chose the husk — `iosApp` is the name
- * the KMM wizard gives, so the conventional name outranked the project that
- * exists — and the build died at step 9 on
- *
- *   xcodebuild: error: Unable to read project 'iosApp.xcodeproj' …
- *     Reason: … missing its project.pbxproj file.
- *
- * The husk supplied `IOS_SCHEME` too: with no shared schemes anywhere in that
- * repository, `detectSchemes` falls back to each project's own directory name,
- * so the husk contributed the scheme `iosApp` as well as the project path.
- *
- * This is the iOS twin of the Gradle module scan once treating "a directory
- * holding a file called build.gradle" as a module, and it is fixed the same
- * way: one reader, used by everyone.
- */
-import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { isXcodeContainer, xcodeContainersIn, detectMobileProjectRoot } from "./detect-project.js";
-import { scanIosProject } from "../commands/ios-scanner.js";
-let root;
-beforeEach(() => {
-    root = mkdtempSync(join(tmpdir(), "cibuild-husk-"));
-});
-afterEach(() => {
-    rmSync(root, { recursive: true, force: true });
-});
-/** A project Xcode could open. */
-function project(name) {
-    mkdirSync(join(root, `${name}.xcodeproj`), { recursive: true });
-    writeFileSync(join(root, `${name}.xcodeproj`, "project.pbxproj"), "// !$*UTF8*$!\n");
-}
-/** Oakane's shape: the name, the inner workspace, and no project at all. */
-function husk(name) {
-    mkdirSync(join(root, `${name}.xcodeproj`, "project.xcworkspace"), { recursive: true });
-    writeFileSync(join(root, `${name}.xcodeproj`, "project.xcworkspace", "contents.xcworkspacedata"), '<?xml version="1.0" encoding="UTF-8"?>\n<Workspace version = "1.0"></Workspace>\n');
-}
-function workspace(name) {
-    mkdirSync(join(root, `${name}.xcworkspace`), { recursive: true });
-    writeFileSync(join(root, `${name}.xcworkspace`, "contents.xcworkspacedata"), '<?xml version="1.0" encoding="UTF-8"?>\n<Workspace version = "1.0"></Workspace>\n');
-}
-describe("isXcodeContainer", () => {
-    test("a project with a project.pbxproj is one", () => {
-        project("Real");
-        expect(isXcodeContainer(join(root, "Real.xcodeproj"))).toBe(true);
-    });
-    test("a project with no project.pbxproj is not", () => {
-        husk("iosApp");
-        expect(isXcodeContainer(join(root, "iosApp.xcodeproj"))).toBe(false);
-    });
-    test("an empty project.pbxproj is not a project either", () => {
-        mkdirSync(join(root, "Empty.xcodeproj"), { recursive: true });
-        writeFileSync(join(root, "Empty.xcodeproj", "project.pbxproj"), "");
-        expect(isXcodeContainer(join(root, "Empty.xcodeproj"))).toBe(false);
-    });
-    test("a workspace needs its contents.xcworkspacedata", () => {
-        workspace("Real");
-        mkdirSync(join(root, "Husk.xcworkspace"), { recursive: true });
-        expect(isXcodeContainer(join(root, "Real.xcworkspace"))).toBe(true);
-        expect(isXcodeContainer(join(root, "Husk.xcworkspace"))).toBe(false);
-    });
-    test("a path that is not named like a container is never one", () => {
-        mkdirSync(join(root, "Sources"), { recursive: true });
-        expect(isXcodeContainer(join(root, "Sources"))).toBe(false);
-        expect(isXcodeContainer(join(root, "does-not-exist"))).toBe(false);
-    });
-});
-describe("xcodeContainersIn", () => {
-    test("keeps the real projects and drops the husks", () => {
-        husk("iosApp");
-        project("oakane");
-        expect(xcodeContainersIn(root)).toEqual(["oakane.xcodeproj"]);
-    });
-    test("an unreadable directory is empty, not a throw", () => {
-        expect(xcodeContainersIn(join(root, "nowhere"))).toEqual([]);
-    });
-});
-describe("detectMobileProjectRoot", () => {
-    test("a husk alone is not an iOS project root", () => {
-        husk("iosApp");
-        expect(detectMobileProjectRoot(root)).toBeNull();
-    });
-    test("a real project beside a husk still is", () => {
-        husk("iosApp");
-        project("oakane");
-        expect(detectMobileProjectRoot(root)).toBe("ios");
-    });
-});
-describe("scanIosProject", () => {
-    test("Oakane's shape resolves the project that exists, and its scheme", async () => {
-        husk("iosApp");
-        project("oakane");
-        const scan = await scanIosProject(root);
-        expect(scan.projectPath).toBe("oakane.xcodeproj");
-        // No shared schemes anywhere, so each project falls back to its own name —
-        // and only one of them is a project.
-        expect(scan.detectedSchemes).toEqual(["oakane"]);
-    });
-    test("a repository whose only project is a husk resolves nothing", async () => {
-        husk("iosApp");
-        const scan = await scanIosProject(root);
-        expect(scan.projectPath).toBe("");
-        expect(scan.detectedSchemes).toEqual([]);
-    });
-    test("a single valid project is unchanged", async () => {
-        project("Contributions");
-        const scan = await scanIosProject(root);
-        expect(scan.projectPath).toBe("Contributions.xcodeproj");
-        expect(scan.detectedSchemes).toEqual(["Contributions"]);
-    });
-    test("a workspace still outranks a project beside it", async () => {
-        project("QiniuSDK");
-        workspace("QiniuSDK");
-        const scan = await scanIosProject(root);
-        expect(scan.projectPath).toBe("QiniuSDK.xcworkspace");
-    });
-});
-//# sourceMappingURL=xcode-container.test.js.map

package/dist/src/step-marker.d.ts

@@ -1,12 +0,0 @@
-export declare function formatStepMarker(stepNumber: number, stepName: string): string;
-/**
- * cibuild ships publicly on npm as `@invarn/cibuild`. Emitting the marker
- * unconditionally would leak Invarn's log-parsing protocol into external
- * users' stdout. The Invarn runner (cibuild-runner) opts in by exporting
- * INVARN_RUNNER=1 into the sandbox; everywhere else this returns false
- * and the runner stays quiet.
- *
- * Strict equality to "1" — no truthy parsing — keeps the contract crisp.
- */
-export declare function shouldEmitStepMarker(env?: NodeJS.ProcessEnv): boolean;
-//# sourceMappingURL=step-marker.d.ts.map

package/dist/src/step-marker.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"step-marker.d.ts","sourceRoot":"","sources":["../../src/step-marker.ts"],"names":[],"mappings":"AAcA,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAElF"}

package/dist/src/step-marker.js

@@ -1,29 +0,0 @@
-/**
- * Producer side of the INVARN_STEP marker contract.
- *
- * The dashboard's `lib/shared/step-progress.ts` parses runtime logs for
- * lines matching `/▸ INVARN_STEP:(\d+):(.+)/` to populate
- * `BuildEnrichment.parsedSteps`. The runner emits one marker per step
- * via `console.log(formatStepMarker(...))` before executing it, so every
- * build (agent or not) gets symmetric step telemetry.
- *
- * Step name is embedded as-is. The dashboard parser uses `(.+)` (greedy),
- * so step names containing colons (`build:android:debug`) round-trip.
- */
-const STEP_MARKER_PREFIX = '▸ INVARN_STEP';
-export function formatStepMarker(stepNumber, stepName) {
-    return `${STEP_MARKER_PREFIX}:${stepNumber}:${stepName}`;
-}
-/**
- * cibuild ships publicly on npm as `@invarn/cibuild`. Emitting the marker
- * unconditionally would leak Invarn's log-parsing protocol into external
- * users' stdout. The Invarn runner (cibuild-runner) opts in by exporting
- * INVARN_RUNNER=1 into the sandbox; everywhere else this returns false
- * and the runner stays quiet.
- *
- * Strict equality to "1" — no truthy parsing — keeps the contract crisp.
- */
-export function shouldEmitStepMarker(env = process.env) {
-    return env.INVARN_RUNNER === '1';
-}
-//# sourceMappingURL=step-marker.js.map

package/dist/src/step-marker.test.d.ts

@@ -1,11 +0,0 @@
-/**
- * Unit tests for the INVARN_STEP marker formatter.
- *
- * The dashboard's `lib/shared/step-progress.ts` parses runtime logs for
- * lines matching `/▸ INVARN_STEP:(\d+):(.+)/` to populate
- * `BuildEnrichment.parsedSteps`. This formatter is the producer side of
- * that contract — the runner emits one marker per step before executing
- * it so non-agent builds get symmetric step telemetry.
- */
-export {};
-//# sourceMappingURL=step-marker.test.d.ts.map

package/dist/src/step-marker.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"step-marker.test.d.ts","sourceRoot":"","sources":["../../src/step-marker.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/src/step-marker.test.js

@@ -1,45 +0,0 @@
-/**
- * Unit tests for the INVARN_STEP marker formatter.
- *
- * The dashboard's `lib/shared/step-progress.ts` parses runtime logs for
- * lines matching `/▸ INVARN_STEP:(\d+):(.+)/` to populate
- * `BuildEnrichment.parsedSteps`. This formatter is the producer side of
- * that contract — the runner emits one marker per step before executing
- * it so non-agent builds get symmetric step telemetry.
- */
-import { describe, test, expect } from '@jest/globals';
-import { formatStepMarker, shouldEmitStepMarker } from './step-marker.js';
-describe('formatStepMarker', () => {
-    test('formats a step number and name as the wire-format marker', () => {
-        expect(formatStepMarker(1, 'install-deps')).toBe('▸ INVARN_STEP:1:install-deps');
-    });
-    test('preserves colons in the step name (the dashboard parser is greedy on the trailing capture)', () => {
-        expect(formatStepMarker(2, 'build:android:debug')).toBe('▸ INVARN_STEP:2:build:android:debug');
-    });
-    test('uses 1-indexed step numbers (matches the agent generator and dashboard parser)', () => {
-        expect(formatStepMarker(3, 'lint')).toBe('▸ INVARN_STEP:3:lint');
-    });
-});
-/**
- * Gate that keeps the marker off when cibuild is used outside Invarn
- * infrastructure. cibuild ships publicly on npm as @invarn/cibuild and
- * must not leak Invarn's log-parsing protocol into external users' stdout.
- * The Invarn runner (cibuild-runner) opts in by exporting INVARN_RUNNER=1
- * into the sandbox alongside CIBUILD_NON_INTERACTIVE / CI.
- */
-describe('shouldEmitStepMarker', () => {
-    test('returns true only when INVARN_RUNNER === "1"', () => {
-        expect(shouldEmitStepMarker({ INVARN_RUNNER: '1' })).toBe(true);
-    });
-    test('returns false when INVARN_RUNNER is absent (public/external cibuild use)', () => {
-        expect(shouldEmitStepMarker({})).toBe(false);
-    });
-    test('returns false for INVARN_RUNNER values that are not literally "1"', () => {
-        // Strict equality keeps the wire-level handshake unambiguous — no truthy parsing.
-        expect(shouldEmitStepMarker({ INVARN_RUNNER: '0' })).toBe(false);
-        expect(shouldEmitStepMarker({ INVARN_RUNNER: 'true' })).toBe(false);
-        expect(shouldEmitStepMarker({ INVARN_RUNNER: '' })).toBe(false);
-        expect(shouldEmitStepMarker({ INVARN_RUNNER: ' 1 ' })).toBe(false);
-    });
-});
-//# sourceMappingURL=step-marker.test.js.map

package/dist/src/types.d.ts

@@ -1,58 +0,0 @@
-export interface StepDef {
-    id: string;
-    name: string;
-    kind: "script" | "python" | "ruby" | "node";
-    shell?: string;
-    script: string;
-    isSkippable?: boolean;
-}
-export interface PipelineDef {
-    name: string;
-    artifacts: string[];
-    steps: StepDef[];
-    stepsOrder: string[];
-}
-export interface CIConfig {
-    artifactsDir: string;
-    interpreters: {
-        python: string;
-        ruby: string;
-        node: string;
-        bash: string;
-    };
-    maxConcurrentJobs: number;
-    paths: {
-        buildsDir: string;
-        cacheDir: string;
-        peerCacheDir?: string;
-        derivedDataDir: string;
-    };
-    /** When true, steps that require remote infrastructure (S3, servers) skip gracefully */
-    local?: boolean;
-}
-export interface StepBuilders {
-    script(name: string, options: {
-        id: string;
-        shell?: string;
-        script: string;
-    }): void;
-    python(name: string, options: {
-        id: string;
-        script: string;
-    }): void;
-    ruby(name: string, options: {
-        id: string;
-        script: string;
-    }): void;
-    node(name: string, options: {
-        id: string;
-        script: string;
-    }): void;
-}
-export interface PipelineContext {
-    artifacts(paths: string[]): void;
-    steps(builder: (s: StepBuilders) => void): void;
-    stepsOrder(ids: string[]): void;
-}
-export type PipelineFactory = (name: string, builder: (ctx: PipelineContext) => void) => PipelineDef;
-//# sourceMappingURL=types.d.ts.map

package/dist/src/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,wFAAwF;IACxF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACpF,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACpE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAClE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACnE;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,GAAG,IAAI,CAAC;IAChD,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,IAAI,KAAK,WAAW,CAAC"}

package/dist/src/types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=types.js.map

package/dist/src/yaml/a-cache-path-must-not-swallow-a-credential.test.d.ts

@@ -1,28 +0,0 @@
-/**
- * A `cache_paths` entry must not contain the file a `file@` step writes.
- *
- * Everything else about a credential's life inside a build is bounded, and was
- * checked on the three boxes after the first build that ever wrote one: the
- * runner pushes the checkout and the guest root onto `cleanupPaths` and
- * removes them in a `finally`, the guest gets `rm -rf`, and `tart delete`
- * reclaims the VM. Nothing was left anywhere.
- *
- * The cache store is the one place a file can survive all of that.
- * `cache-push` archives whatever `cache_paths` names and uploads it to where
- * the *next* build pulls it from, so a credential swept into that archive
- * outlives the build it was delivered to — and outlives the sandbox that was
- * supposed to contain it.
- *
- * No pipeline in play trips this. Every one of them caches
- * `~/.gradle/caches`, `~/.gradle/wrapper` and `.gradle`, and none of those
- * holds a credential. It is a guard on a mistake that is easy to make and
- * invisible once made: adding `.` to `cache_paths` is a plausible way to make
- * a build faster, and it would publish the signing key.
- *
- * Refused at generation time, like issue 03's missing credential, because that
- * is the only place that can see a whole workflow at once — a cache step can
- * be written before the `file@` step whose target it would swallow — and
- * because the alternative is a build that goes green while leaking.
- */
-export {};
-//# sourceMappingURL=a-cache-path-must-not-swallow-a-credential.test.d.ts.map

package/dist/src/yaml/a-cache-path-must-not-swallow-a-credential.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"a-cache-path-must-not-swallow-a-credential.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-cache-path-must-not-swallow-a-credential.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}