@invarn/cibuild 2.9.5 → 2.9.7

package/dist/src/yaml/a-declared-slot-may-name-the-workflow-it-belongs-to.test.js

@@ -1,255 +0,0 @@
-/**
- * A pipeline may declare a credential slot under the name a *workflow-scoped*
- * secret carries, and the workflow it names reads it under the plain name.
- *
- * Two workflows that build different product flavors cannot share one value.
- * `local.properties` is the clearest case: every workflow writes the same file
- * to the same path, and what belongs in it is the flavor's environment — a
- * different base API URL and twenty other keys the Secrets Gradle Plugin turns
- * into `BuildConfig`. One slot, one value, and one of the two flavors builds
- * against the wrong environment.
- *
- * The value side of that has always worked. `ci secrets upload` encodes a
- * workflow-scoped secret as `CIBUILD_SW__<WORKFLOW>__<VAR>`, `SecretsManager`
- * decodes it back, and `EnvResolver` asks for the workflow being run — proved
- * end to end on the dispatch path, where a fresh clone has no
- * `.cibuild-secrets.json` and the value arrives as a bare environment
- * variable. What did not work is *declaring* it. A pipeline declares its
- * credentials as empty `envs` slots, and that declaration does two jobs
- * nothing else does:
- *
- *   - `unsetEnvKeys` — what `invarn setup` searches the developer's machine
- *     by — reads `envs`, never step inputs. An undeclared credential is never
- *     discovered and never offered for upload.
- *   - `file@1.0.0` tells "nobody supplied this" from "this workflow does not
- *     need it" by whether the key is in the env map at all, and only a
- *     declaration puts an unsupplied key there. Without one, a credential that
- *     went missing is skipped with a warning and the build fails later inside
- *     the project's own build tool (issue 03).
- *
- * So a per-workflow slot has to be declarable, and a declaration naming one
- * workflow has to mean nothing in the others — otherwise `release` would
- * demand `primary`'s value. The decoding belongs here, beside the decoding of
- * the secret itself, and not in `file@`: the step keeps reading its plain
- * `var_name` and never learns the convention exists.
- */
-import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
-import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { convertYAMLToPipelineDef } from './converter.js';
-import { EnvResolver } from './env-resolver.js';
-import { clearRegistry, registerStep } from './steps/registry.js';
-import { FileStepExecutor } from './steps/file.js';
-const mockConfig = {
-    artifactsDir: '/test/artifacts',
-    maxConcurrentJobs: 1,
-    paths: {
-        buildsDir: '/test/builds',
-        cacheDir: '/test/cache',
-        derivedDataDir: '/test/derived-data',
-    },
-    interpreters: {
-        bash: '/bin/bash',
-        python: 'python3',
-        ruby: 'ruby',
-        node: 'node',
-    },
-};
-const TARGET = 'local.properties';
-/** Two flavors, two environments, and nothing in common but the file name. */
-const CI_DYNAMIC = 'BASE_API_URL=https://ci-dynamic.example.test/api\n';
-const PROD = 'BASE_API_URL=https://prod.example.test/api\n';
-/** Every environment variable a test here may set, cleared around each one. */
-const TOUCHED = [
-    'LOCAL_PROPERTIES',
-    'CIBUILD_S__LOCAL_PROPERTIES',
-    'CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES',
-    'CIBUILD_SW__PULL_REQUEST__LOCAL_PROPERTIES',
-    'CIBUILD_SW__RELEASE__LOCAL_PROPERTIES',
-];
-let workdir;
-let previousCwd;
-function clearTouched() {
-    for (const key of TOUCHED)
-        delete process.env[key];
-}
-beforeEach(() => {
-    clearRegistry();
-    registerStep('file', new FileStepExecutor());
-    previousCwd = process.cwd();
-    workdir = mkdtempSync(join(tmpdir(), 'cibuild-workflow-slot-'));
-    process.chdir(workdir);
-    // `workdir` is the pre-symlink path on macOS; the steps resolve paths from
-    // CIBUILD_SOURCE_DIR, which is cwd, so read files back the same way.
-    workdir = process.cwd();
-    clearTouched();
-});
-afterEach(() => {
-    process.chdir(previousCwd);
-    rmSync(workdir, { recursive: true, force: true });
-    clearRegistry();
-    clearTouched();
-});
-/**
- * The shape a flavored repository's generated pipeline has: the credential
- * declared once per workflow under the encoded name, and the same unsuffixed
- * `var_name` in every workflow's `file@` step.
- */
-function probePipeline(declared) {
-    const step = {
-        'file@1.0.0': {
-            title: 'Setup local.properties',
-            is_skippable: true,
-            inputs: { target_path: TARGET, var_name: 'LOCAL_PROPERTIES' },
-        },
-    };
-    return {
-        format_version: '1',
-        app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) },
-        workflows: {
-            primary: { envs: [{ VARIANT: 'ciDynamicDebug' }], steps: [step] },
-            'pull-request': { envs: [{ VARIANT: 'ciDynamicDebug' }], steps: [step] },
-            release: { envs: [{ VARIANT: 'prodRelease' }], steps: [step] },
-        },
-    };
-}
-/**
- * Converts one workflow and runs the steps it generated the way the runner
- * does, then reads back whatever landed at `local.properties`.
- */
-async function land(pipeline, workflow) {
-    const result = await convertYAMLToPipelineDef(pipeline, mockConfig, workflow);
-    const chunks = [...result.warnings];
-    for (const step of result.pipeline.steps) {
-        const scriptPath = join(workdir, `__step_${step.id}.sh`);
-        writeFileSync(scriptPath, step.script, 'utf-8');
-        const proc = spawnSync('bash', [scriptPath], {
-            cwd: workdir,
-            encoding: 'utf-8',
-            env: { ...process.env },
-        });
-        expect(proc.status).toBe(0);
-        chunks.push(proc.stdout ?? '', proc.stderr ?? '');
-    }
-    const landedAt = join(workdir, TARGET);
-    return {
-        output: chunks.join('\n'),
-        contents: existsSync(landedAt) ? readFileSync(landedAt, 'utf-8') : undefined,
-    };
-}
-/** The conversion's outcome, without letting a throw escape the assertion. */
-async function convert(pipeline, workflow) {
-    try {
-        const result = await convertYAMLToPipelineDef(pipeline, mockConfig, workflow);
-        return { steps: result.pipeline.steps };
-    }
-    catch (error) {
-        return { error: error };
-    }
-}
-function resolverFor(pipeline, workflow) {
-    return new EnvResolver(pipeline, pipeline.workflows[workflow], workflow, 'linux');
-}
-/** The three slots a flavored repository's pipeline declares. */
-const PER_WORKFLOW_SLOTS = {
-    CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: '',
-    CIBUILD_SW__PULL_REQUEST__LOCAL_PROPERTIES: '',
-    CIBUILD_SW__RELEASE__LOCAL_PROPERTIES: '',
-};
-describe('a slot naming a workflow', () => {
-    test('delivers that workflow its own bytes, and the other workflow the other bytes', async () => {
-        // Exactly what a dispatch hands the build: bare environment variables
-        // under the encoded names, and no `.cibuild-secrets.json` anywhere.
-        process.env.CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES = CI_DYNAMIC;
-        process.env.CIBUILD_SW__RELEASE__LOCAL_PROPERTIES = PROD;
-        expect(existsSync(join(workdir, '.cibuild-secrets.json'))).toBe(false);
-        const primary = await land(probePipeline(PER_WORKFLOW_SLOTS), 'primary');
-        expect(primary.contents).toBe(CI_DYNAMIC);
-        rmSync(join(workdir, TARGET));
-        const release = await land(probePipeline(PER_WORKFLOW_SLOTS), 'release');
-        expect(release.contents).toBe(PROD);
-    });
-    test('reaches a workflow whose name the encoding had to change', async () => {
-        // `pull-request` cannot be an environment variable name, so the encoding
-        // upper-cases it and turns the dash into an underscore. If the decoding
-        // did not turn it back the slot would belong to a workflow nobody runs.
-        process.env.CIBUILD_SW__PULL_REQUEST__LOCAL_PROPERTIES = CI_DYNAMIC;
-        const { contents } = await land(probePipeline(PER_WORKFLOW_SLOTS), 'pull-request');
-        expect(contents).toBe(CI_DYNAMIC);
-    });
-    test('is not a declaration in any other workflow', async () => {
-        // `release` is asked for nothing here. If `primary`'s slot declared
-        // `LOCAL_PROPERTIES` everywhere, `release` would refuse the build over a
-        // value it was never going to be given.
-        const pipeline = probePipeline({ CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: '' });
-        const { error, steps } = await convert(pipeline, 'release');
-        expect(error).toBeUndefined();
-        expect(steps).toBeDefined();
-        expect(resolverFor(pipeline, 'release').has('LOCAL_PROPERTIES')).toBe(false);
-    });
-    test('still refuses the build in the workflow it does name', async () => {
-        // The tripwire that makes per-workflow slots safe to emit. Replacing one
-        // flat declaration with three scoped ones must not turn issue 03's loud
-        // refusal back into a green skip.
-        const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: '' }), 'primary');
-        expect(error).toBeDefined();
-        expect(error.message).toContain('LOCAL_PROPERTIES');
-        expect(error.message).toContain(TARGET);
-        // Named as the build reads it. The encoding is ours, not the user's, and
-        // `ci secrets add CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES` is not a command.
-        expect(error.message).not.toContain('CIBUILD_SW__');
-    });
-    test('does not put its own spelling into the build environment', () => {
-        process.env.CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES = CI_DYNAMIC;
-        const resolver = resolverFor(probePipeline(PER_WORKFLOW_SLOTS), 'primary');
-        expect(resolver.get('LOCAL_PROPERTIES')).toBe(CI_DYNAMIC);
-        expect(resolver.has('CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES')).toBe(false);
-        expect(Object.keys(resolver.getAll()).filter((k) => k.startsWith('CIBUILD_SW__'))).toEqual([]);
-    });
-    test('carries a value the pipeline itself supplies, under the plain name', () => {
-        const resolver = resolverFor(probePipeline({ CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: CI_DYNAMIC }), 'primary');
-        expect(resolver.get('LOCAL_PROPERTIES')).toBe(CI_DYNAMIC);
-    });
-});
-describe('a value delivered the old way', () => {
-    test('still reaches a per-workflow slot under its plain name', async () => {
-        // A project whose secret was uploaded before any of this existed holds one
-        // flat `LOCAL_PROPERTIES`. Regenerating its pipeline must not strand that
-        // value: the slot declares the plain name, so step 5 imports it.
-        process.env.LOCAL_PROPERTIES = CI_DYNAMIC;
-        const { contents } = await land(probePipeline(PER_WORKFLOW_SLOTS), 'primary');
-        expect(contents).toBe(CI_DYNAMIC);
-    });
-    test('is beaten by the value scoped to the workflow being run', async () => {
-        process.env.LOCAL_PROPERTIES = CI_DYNAMIC;
-        process.env.CIBUILD_SW__RELEASE__LOCAL_PROPERTIES = PROD;
-        const { contents } = await land(probePipeline(PER_WORKFLOW_SLOTS), 'release');
-        expect(contents).toBe(PROD);
-    });
-    test('reaches a globally encoded slot too', () => {
-        // `CIBUILD_S__X` is the other half of the same convention: a secret with
-        // no workflow. A pipeline declaring it means `X`, in every workflow.
-        process.env.CIBUILD_S__LOCAL_PROPERTIES = CI_DYNAMIC;
-        const resolver = resolverFor(probePipeline({ CIBUILD_S__LOCAL_PROPERTIES: '' }), 'release');
-        expect(resolver.get('LOCAL_PROPERTIES')).toBe(CI_DYNAMIC);
-        expect(resolver.has('CIBUILD_S__LOCAL_PROPERTIES')).toBe(false);
-    });
-});
-describe('a pipeline that declares one flat slot', () => {
-    test('is untouched — every workflow reads the one value', async () => {
-        process.env.LOCAL_PROPERTIES = CI_DYNAMIC;
-        for (const workflow of ['primary', 'pull-request', 'release']) {
-            const { contents } = await land(probePipeline({ LOCAL_PROPERTIES: '' }), workflow);
-            expect(contents).toBe(CI_DYNAMIC);
-            rmSync(join(workdir, TARGET));
-        }
-    });
-    test('keeps refusing when nobody supplied it', async () => {
-        const { error } = await convert(probePipeline({ LOCAL_PROPERTIES: '' }), 'primary');
-        expect(error).toBeDefined();
-        expect(error.message).toContain('LOCAL_PROPERTIES');
-    });
-});
-//# sourceMappingURL=a-declared-slot-may-name-the-workflow-it-belongs-to.test.js.map

package/dist/src/yaml/a-missing-credential-is-loud.test.d.ts

@@ -1,32 +0,0 @@
-/**
- * A credential the pipeline declares and nobody supplied fails the build,
- * naming itself, instead of being skipped with a warning.
- *
- * `file@1.0.0` carries `is_skippable: true` in every pipeline the Android
- * generator emits, so an absent value printed `⚠️  X not set — skipping <file>`
- * and returned success. The build then failed several steps later inside the
- * project's own build tool, with an error naming the project rather than the
- * value we dropped. Both failure modes in this defect were green, which is why
- * it survived.
- *
- * The two absences are not the same absence, and the map the step already
- * receives tells them apart by presence:
- *
- *   - a `var_name` the pipeline **declares** and leaves empty is a key of the
- *     map with an empty value — the value was supposed to arrive as a secret
- *     and did not. After issue 01 that means it is in none of the four places
- *     a value can come from, so the diagnosis is not a guess.
- *   - a `var_name` **nothing declares** is not a key of the map at all — a
- *     release keystore on a debug workflow. Skipping is correct there.
- *
- * One case sits between them, and it decides the rule (issue 03 §2.3, Alex,
- * 2026-09-08): the generator declares `KEYSTORE_BASE64` globally but emits its
- * `file@` step in all three workflows, so a project that ran `ci init` with a
- * keystore and never uploaded one would go from three green skips to three
- * hard failures — including on `pull-request`, where nothing signs anything.
- * So the question the step asks is the one that actually matters: **will the
- * file be there when the build reads it?** A repository that carries the file
- * keeps warning and building; only an absence with nothing behind it fails.
- */
-export {};
-//# sourceMappingURL=a-missing-credential-is-loud.test.d.ts.map

package/dist/src/yaml/a-missing-credential-is-loud.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"a-missing-credential-is-loud.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-missing-credential-is-loud.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG"}

package/dist/src/yaml/a-missing-credential-is-loud.test.js

@@ -1,301 +0,0 @@
-/**
- * A credential the pipeline declares and nobody supplied fails the build,
- * naming itself, instead of being skipped with a warning.
- *
- * `file@1.0.0` carries `is_skippable: true` in every pipeline the Android
- * generator emits, so an absent value printed `⚠️  X not set — skipping <file>`
- * and returned success. The build then failed several steps later inside the
- * project's own build tool, with an error naming the project rather than the
- * value we dropped. Both failure modes in this defect were green, which is why
- * it survived.
- *
- * The two absences are not the same absence, and the map the step already
- * receives tells them apart by presence:
- *
- *   - a `var_name` the pipeline **declares** and leaves empty is a key of the
- *     map with an empty value — the value was supposed to arrive as a secret
- *     and did not. After issue 01 that means it is in none of the four places
- *     a value can come from, so the diagnosis is not a guess.
- *   - a `var_name` **nothing declares** is not a key of the map at all — a
- *     release keystore on a debug workflow. Skipping is correct there.
- *
- * One case sits between them, and it decides the rule (issue 03 §2.3, Alex,
- * 2026-09-08): the generator declares `KEYSTORE_BASE64` globally but emits its
- * `file@` step in all three workflows, so a project that ran `ci init` with a
- * keystore and never uploaded one would go from three green skips to three
- * hard failures — including on `pull-request`, where nothing signs anything.
- * So the question the step asks is the one that actually matters: **will the
- * file be there when the build reads it?** A repository that carries the file
- * keeps warning and building; only an absence with nothing behind it fails.
- */
-import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
-import { spawnSync } from 'node:child_process';
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync, } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join } from 'node:path';
-import { convertYAMLToPipelineDef } from './converter.js';
-import { StepValidator } from './step-validator.js';
-import { clearRegistry, registerStep } from './steps/registry.js';
-import { FileStepExecutor } from './steps/file.js';
-const mockConfig = {
-    artifactsDir: '/test/artifacts',
-    maxConcurrentJobs: 1,
-    paths: {
-        buildsDir: '/test/builds',
-        cacheDir: '/test/cache',
-        derivedDataDir: '/test/derived-data',
-    },
-    interpreters: {
-        bash: '/bin/bash',
-        python: 'python3',
-        ruby: 'ruby',
-        node: 'node',
-    },
-};
-/** The 61-byte document from the PRD's reproduction. Synthetic. */
-const JSON_CREDENTIAL = '{"project_info":{"project_id":"synthetic-probe"},"client":[]}';
-const TARGET = 'app/google-services.json';
-let workdir;
-let previousCwd;
-beforeEach(() => {
-    clearRegistry();
-    registerStep('file', new FileStepExecutor());
-    previousCwd = process.cwd();
-    workdir = mkdtempSync(join(tmpdir(), 'cibuild-missing-credential-'));
-    process.chdir(workdir);
-    // `workdir` is the pre-symlink path on macOS; the step resolves paths from
-    // CIBUILD_SOURCE_DIR, which is cwd, so read and write files the same way.
-    workdir = process.cwd();
-    delete process.env.GOOGLE_SERVICES_JSON;
-    delete process.env.KEYSTORE_BASE64;
-    delete process.env.OTHER_SECRET;
-});
-afterEach(() => {
-    process.chdir(previousCwd);
-    rmSync(workdir, { recursive: true, force: true });
-    clearRegistry();
-    delete process.env.GOOGLE_SERVICES_JSON;
-    delete process.env.KEYSTORE_BASE64;
-    delete process.env.OTHER_SECRET;
-});
-/**
- * The shape the Android generator emits: empty slots under `app.envs` and one
- * skippable `file@1.0.0` step per credential, in declaration order.
- */
-function probePipeline(declared, fileSteps, options = {}) {
-    const skippable = options.skippable ?? true;
-    const app = declared
-        ? { app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) } }
-        : {};
-    return {
-        format_version: '1',
-        ...app,
-        workflows: {
-            probe: {
-                steps: fileSteps.map((inputs) => ({
-                    'file@1.0.0': {
-                        title: `Setup ${String(inputs.var_name)}`,
-                        is_skippable: skippable,
-                        inputs,
-                    },
-                })),
-            },
-        },
-    };
-}
-function writeSecretStore(global) {
-    writeFileSync(join(workdir, '.cibuild-secrets.json'), JSON.stringify({ global, workflows: {} }), { mode: 0o600 });
-}
-/** Puts a file in the checkout, the way a repository that carries one does. */
-function commitToCheckout(relPath, contents) {
-    const target = join(workdir, relPath);
-    mkdirSync(dirname(target), { recursive: true });
-    writeFileSync(target, contents, 'utf-8');
-}
-/**
- * Converts the pipeline and runs the generated steps the way the runner does,
- * then reads back whatever landed at `target`.
- */
-async function land(pipeline, target = TARGET) {
-    const result = await convertYAMLToPipelineDef(pipeline, mockConfig, 'probe');
-    const chunks = [...result.warnings];
-    for (const step of result.pipeline.steps) {
-        const scriptPath = join(workdir, `__step_${step.id}.sh`);
-        writeFileSync(scriptPath, step.script, 'utf-8');
-        const proc = spawnSync('bash', [scriptPath], {
-            cwd: workdir,
-            encoding: 'utf-8',
-            env: { ...process.env },
-        });
-        expect(proc.status).toBe(0);
-        chunks.push(proc.stdout ?? '', proc.stderr ?? '');
-    }
-    const landedAt = join(workdir, target);
-    return {
-        output: chunks.join('\n'),
-        bytes: existsSync(landedAt) ? readFileSync(landedAt) : undefined,
-    };
-}
-/** The conversion's outcome, without letting a throw escape the assertion. */
-async function convert(pipeline) {
-    try {
-        const result = await convertYAMLToPipelineDef(pipeline, mockConfig, 'probe');
-        return { steps: result.pipeline.steps };
-    }
-    catch (error) {
-        return { error: error };
-    }
-}
-describe('a declared credential nothing supplied', () => {
-    test('fails, naming the key and the target path', async () => {
-        const { error, steps } = await convert(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
-            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
-        ]));
-        expect(error).toBeDefined();
-        expect(error.message).toContain('GOOGLE_SERVICES_JSON');
-        expect(error.message).toContain(TARGET);
-        // Not a stack trace and not a step that runs: conversion is what builds
-        // the step list, so nothing at all is handed to the runner.
-        expect(steps).toBeUndefined();
-    });
-    test('says both places the value can come from', async () => {
-        const { error } = await convert(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
-            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
-        ]));
-        // A user reading this should not have to know that a slot, an upload and
-        // a `file@` step are three separate things.
-        expect(error.message).toContain('ci secrets add GOOGLE_SERVICES_JSON');
-        expect(error.message).toMatch(/organization or pipeline secret/);
-    });
-    test('is_skippable does not turn it into a pass', async () => {
-        // Every `file@` step the Android generator emits carries this, which is
-        // the whole reason the defect was invisible.
-        const skippable = await convert(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [{ target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' }], { skippable: true }));
-        const notSkippable = await convert(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [{ target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' }], { skippable: false }));
-        expect(skippable.error).toBeDefined();
-        expect(notSkippable.error).toBeDefined();
-    });
-    test('fails on the first unfilled slot, not the last and not all three', async () => {
-        // What a real Android pipeline carries: three slots, none filled.
-        const { error } = await convert(probePipeline({
-            KEYSTORE_BASE64: '',
-            KEYSTORE_PROPERTIES: '',
-            GOOGLE_SERVICES_JSON: '',
-        }, [
-            {
-                target_path: 'release.keystore',
-                var_name: 'KEYSTORE_BASE64',
-                base64_encoded: true,
-            },
-            { target_path: 'keystore.properties', var_name: 'KEYSTORE_PROPERTIES' },
-            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
-        ]));
-        expect(error).toBeDefined();
-        expect(error.message).toContain('KEYSTORE_BASE64');
-        expect(error.message).not.toContain('KEYSTORE_PROPERTIES');
-        expect(error.message).not.toContain('GOOGLE_SERVICES_JSON');
-    });
-    test('no secret value appears in the message', async () => {
-        // The failing slot has no value by definition, so the assertion that
-        // means anything is about the values the build *does* hold.
-        process.env.OTHER_SECRET = JSON_CREDENTIAL;
-        const { error } = await convert(probePipeline({ OTHER_SECRET: '', GOOGLE_SERVICES_JSON: '' }, [
-            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
-        ]));
-        expect(error).toBeDefined();
-        expect(error.message).not.toContain(JSON_CREDENTIAL);
-        expect(error.message).not.toContain('synthetic-probe');
-    });
-});
-describe('a credential the repository already carries', () => {
-    test('warns and proceeds — the file will be there when the build reads it', async () => {
-        // The `pull-request` collision: the generator declares KEYSTORE_BASE64
-        // globally and emits its step on every workflow, so a project whose
-        // keystore is in the repository must not be refused a build over a value
-        // it never needed.
-        commitToCheckout('release.keystore', 'a keystore the repository carries');
-        const { output } = await land(probePipeline({ KEYSTORE_BASE64: '' }, [
-            {
-                target_path: 'release.keystore',
-                var_name: 'KEYSTORE_BASE64',
-                base64_encoded: true,
-            },
-        ]), 'release.keystore');
-        expect(output).toContain('KEYSTORE_BASE64');
-        expect(output).toContain('release.keystore');
-        // The escape hatch has to be visible in the log, or a build that passes
-        // this way is unexplainable to whoever reads it later.
-        expect(output).toMatch(/already in the checkout/);
-    });
-    test('leaves the file it found exactly as it was', async () => {
-        const carried = 'the repository\'s own google-services.json';
-        commitToCheckout(TARGET, carried);
-        const { bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
-            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
-        ]));
-        expect(bytes?.toString('utf-8')).toBe(carried);
-    });
-    test('an uploaded value still wins over the one in the checkout', async () => {
-        // A repository carrying a placeholder is the ordinary case for
-        // google-services.json, and the point of the upload is to replace it.
-        commitToCheckout(TARGET, 'placeholder committed for local development');
-        process.env.GOOGLE_SERVICES_JSON = JSON_CREDENTIAL;
-        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
-            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
-        ]));
-        expect(output).toContain('✓ Written google-services.json');
-        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
-    });
-});
-describe('what issue 03 must not change', () => {
-    test('an undeclared key still warns and passes, is_skippable and all', async () => {
-        // Issue 01's class-A case, and the one this change is most likely to
-        // break: HOME exists in every environment this runs in, and nothing
-        // declares it.
-        expect(process.env.HOME).toBeTruthy();
-        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
-            { target_path: 'home.txt', var_name: 'HOME' },
-        ]), 'home.txt');
-        expect(output).toContain('HOME not set — skipping home.txt');
-        expect(bytes).toBeUndefined();
-    });
-    test('a declared value from the local store still writes', async () => {
-        writeSecretStore({ GOOGLE_SERVICES_JSON: JSON_CREDENTIAL });
-        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
-            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
-        ]));
-        expect(output).toContain('✓ Written google-services.json');
-        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
-    });
-    test('a declared value from the dispatched environment still writes', async () => {
-        process.env.GOOGLE_SERVICES_JSON = JSON_CREDENTIAL;
-        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: '' }, [
-            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
-        ]));
-        expect(output).toContain('✓ Written google-services.json');
-        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
-    });
-    test('a value the YAML itself supplies still writes', async () => {
-        const { output, bytes } = await land(probePipeline({ GOOGLE_SERVICES_JSON: JSON_CREDENTIAL }, [
-            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
-        ]));
-        expect(output).toContain('✓ Written google-services.json');
-        expect(bytes?.toString('utf-8')).toBe(JSON_CREDENTIAL);
-    });
-    test('ci validate still passes on a pipeline with empty slots', async () => {
-        // Option 3 was rejected so validation does not start refusing builds
-        // that are green today. This is the line that holds it.
-        const pipeline = probePipeline({ KEYSTORE_BASE64: '', GOOGLE_SERVICES_JSON: '' }, [
-            {
-                target_path: 'release.keystore',
-                var_name: 'KEYSTORE_BASE64',
-                base64_encoded: true,
-            },
-            { target_path: TARGET, var_name: 'GOOGLE_SERVICES_JSON' },
-        ]);
-        const validator = new StepValidator(pipeline, 'probe', mockConfig);
-        const result = await validator.validateWorkflow();
-        expect(result.valid).toBe(true);
-    });
-});
-//# sourceMappingURL=a-missing-credential-is-loud.test.js.map

package/dist/src/yaml/a-runtime-requirement-names-a-real-provider.test.d.ts

@@ -1,18 +0,0 @@
-/**
- * A requirement that cannot be checked yet must not name a step as its source
- * unless a step is its source.
- *
- * Nine runtime requirements — `gradlew` in the three Android steps and the
- * Bitrise gradle wrapper, `project_path` in five Xcode steps — carried
- * `providedBy: 'git-clone'`. The lookup behind `providedBy` is keyed by step
- * *output names* (`CIBUILD_SOURCE_DIR`, `GIT_CLONE_COMMIT_HASH`, …) and these
- * requirements are named after a path or a command, so it could never match:
- * every Android validation printed "'gradlew' will be provided by 'git-clone'
- * step at runtime" whether the step was in the workflow or not.
- *
- * `git-clone` provides no files at all — the runner's checkout does, before
- * any step runs — and once it is out of the curated templates the sentence
- * names a step the pipeline does not contain.
- */
-import './steps/index.js';
-//# sourceMappingURL=a-runtime-requirement-names-a-real-provider.test.d.ts.map

package/dist/src/yaml/a-runtime-requirement-names-a-real-provider.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"a-runtime-requirement-names-a-real-provider.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-runtime-requirement-names-a-real-provider.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,kBAAkB,CAAC"}