@invarn/cibuild 2.9.6 → 2.9.8

package/dist/src/commands/build.js

@@ -1,1433 +0,0 @@
-import { resolve } from "node:path";
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
-import prompts from "prompts";
-import { scanAndroidProject, formatScanResult, runnableJavaVersion, javaVersionProblem, } from "./android-scanner.js";
-import { scanIosProject, formatIosScanResult } from "./ios-scanner.js";
-import { SecretsManager } from "../yaml/secrets-manager.js";
-import { collectFileSecret } from "./file-secret-collector.js";
-import { generateGitHubActionsWorkflow } from "./github-workflow.js";
-import { detectDefaultBranch, FALLBACK_DEFAULT_BRANCH } from "../shared/git.js";
-function variantFromName(name) {
-    const buildType = name.charAt(0).toUpperCase() + name.slice(1);
-    return { variant: name, buildType, gradleTask: `assemble${buildType}` };
-}
-const DEFAULT_VARIANTS = {
-    primary: variantFromName("debug"),
-    pullRequest: variantFromName("debug"),
-    release: variantFromName("release"),
-};
-async function promptScheme(workflowLabel, defaultScheme, detectedSchemes) {
-    const choices = detectedSchemes.map((s) => ({ title: s, value: s }));
-    choices.push({ title: "Other (enter custom scheme)", value: "__custom__" });
-    const defaultIndex = detectedSchemes.indexOf(defaultScheme);
-    const initial = defaultIndex !== -1 ? defaultIndex : 0;
-    const { choice } = await prompts({
-        type: "select",
-        name: "choice",
-        message: `Xcode scheme for ${workflowLabel}:`,
-        choices,
-        initial,
-    });
-    if (!choice)
-        return defaultScheme;
-    if (choice === "__custom__") {
-        const { name } = await prompts({
-            type: "text",
-            name: "name",
-            message: "Enter scheme name:",
-            validate: (v) => (v.trim().length > 0 ? true : "Scheme name is required"),
-        });
-        return name?.trim() || defaultScheme;
-    }
-    return choice;
-}
-async function promptConfiguration(workflowLabel, defaultConfig) {
-    const choices = [
-        { title: "Debug", value: "Debug" },
-        { title: "Release", value: "Release" },
-        { title: "Other (enter custom configuration)", value: "__custom__" },
-    ];
-    const defaultIndex = choices.findIndex((c) => c.value === defaultConfig);
-    const initial = defaultIndex !== -1 ? defaultIndex : 0;
-    const { choice } = await prompts({
-        type: "select",
-        name: "choice",
-        message: `Build configuration for ${workflowLabel}:`,
-        choices,
-        initial,
-    });
-    if (!choice)
-        return defaultConfig;
-    if (choice === "__custom__") {
-        const { name } = await prompts({
-            type: "text",
-            name: "name",
-            message: "Enter configuration name (e.g. Staging, AdHoc):",
-            validate: (v) => (v.trim().length > 0 ? true : "Configuration name is required"),
-        });
-        return name?.trim() || defaultConfig;
-    }
-    return choice;
-}
-async function promptDistributionMethod(workflowLabel, defaultMethod) {
-    const choices = [
-        { title: "development — development signing, internal use", value: "development" },
-        { title: "ad-hoc    — Ad Hoc distribution (specific devices)", value: "ad-hoc" },
-        { title: "app-store  — App Store / TestFlight upload", value: "app-store" },
-        { title: "enterprise — Enterprise in-house distribution", value: "enterprise" },
-    ];
-    const defaultIndex = choices.findIndex((c) => c.value === defaultMethod);
-    const initial = defaultIndex !== -1 ? defaultIndex : 0;
-    const { choice } = await prompts({
-        type: "select",
-        name: "choice",
-        message: `Distribution method for ${workflowLabel}:`,
-        choices,
-        initial,
-    });
-    return choice || defaultMethod;
-}
-async function promptVariant(workflowLabel, defaultName, detectedVariants) {
-    const choices = detectedVariants.map((v) => ({ title: v, value: v }));
-    choices.push({ title: "Other (enter custom variant)", value: "__custom__" });
-    const defaultIndex = detectedVariants.indexOf(defaultName);
-    const initial = defaultIndex !== -1 ? defaultIndex : 0;
-    const { choice } = await prompts({
-        type: "select",
-        name: "choice",
-        message: `Build variant for ${workflowLabel}:`,
-        choices,
-        initial,
-    });
-    if (!choice)
-        return variantFromName(defaultName);
-    if (choice === "__custom__") {
-        const { name } = await prompts({
-            type: "text",
-            name: "name",
-            message: "Enter variant name (e.g. stagingDebug, freeRelease):",
-            validate: (v) => (v.trim().length > 0 ? true : "Variant name is required"),
-        });
-        return variantFromName(name?.trim() || defaultName);
-    }
-    return variantFromName(choice);
-}
-/**
- * The properties file the Secrets Gradle Plugin reads, out of the warnings the
- * scanner produced for it.
- *
- * The two `secrets-plugin` warnings disagree about `location`, and reading the
- * wrong one aims the `file@` step at a build file. The per-key warning carries
- * the **properties file** there; the fallback warning carries the *build file
- * that applies the plugin* and names the properties file only in its message.
- */
-export function secretsPropertiesFileFrom(warnings) {
-    const plugin = warnings.filter((w) => w.category === "secrets-plugin");
-    if (plugin.length === 0)
-        return null;
-    const fromLocation = plugin.find((w) => w.location?.endsWith(".properties"));
-    if (fromLocation?.location)
-        return fromLocation.location;
-    for (const w of plugin) {
-        const named = /reads '([^']+)'/.exec(w.message);
-        if (named)
-            return named[1];
-    }
-    return "local.properties";
-}
-/**
- * The product flavor a variant builds, out of the flavors the scanner found —
- * `ciDynamicDebug` is a build of `ciDynamic`, `prodRelease` of `prod`.
- *
- * An Android variant name is the flavor followed by the capitalised build
- * type, so the character after the flavor has to be an upper-case one. That
- * check is load-bearing: without it a flavor called `pro` would claim
- * `prodRelease`. The longest match wins, so `ciDynamic` beats `ci` on a
- * repository that declares both.
- */
-export function flavorOfVariant(variant, productFlavors) {
-    const matches = productFlavors
-        .filter((flavor) => {
-        if (flavor.length === 0 || !variant.startsWith(flavor))
-            return false;
-        const head = variant.slice(flavor.length)[0];
-        return head !== undefined && head === head.toUpperCase() && head !== head.toLowerCase();
-    })
-        .sort((a, b) => b.length - a.length);
-    return matches[0] ?? null;
-}
-/** Where a flavor's `google-services.json` belongs inside the app module. */
-export function googleServicesPathFor(flavor, module = "app") {
-    return flavor
-        ? `${module}/src/${flavor}/google-services.json`
-        : `${module}/google-services.json`;
-}
-/**
- * The per-workflow path and key maps for `SetupOptions`, from the variants the
- * workflows build and the flavors the scanner found.
- *
- * `app/google-services.json` used to be hardcoded here. For a flavored build
- * that is the plugin's *fallback* location, not the right one, and writing
- * there is silently wrong rather than loudly wrong: the plugin finds a file,
- * parses it, and fails on a package name — which reads as a Firebase
- * misconfiguration rather than as the wrong file having been delivered. That
- * is what `bld_8e60d90ab4e55f85d2f72459` spent 1292 Gradle tasks proving.
- */
-export function googleServicesTargets(variants, productFlavors, module = "app") {
-    const paths = {};
-    for (const [workflow, config] of variantByWorkflow(variants)) {
-        const flavor = flavorOfVariant(config.variant, productFlavors);
-        paths[workflow] = googleServicesPathFor(flavor, module);
-    }
-    return paths;
-}
-/** The three workflows every generated pipeline has, in the order they are emitted. */
-export const GENERATED_WORKFLOWS = ["primary", "pull-request", "release"];
-/** The variant each workflow builds, keyed by the workflow's name in the YAML. */
-function variantByWorkflow(variants) {
-    return [
-        ["primary", variants.primary],
-        ["pull-request", variants.pullRequest],
-        ["release", variants.release],
-    ];
-}
-/**
- * The `workflowFlavors` map for `SetupOptions`, from the variants the
- * workflows build and the flavors the scanner found.
- */
-export function variantFlavors(variants, productFlavors) {
-    const flavors = {};
-    for (const [workflow, config] of variantByWorkflow(variants)) {
-        flavors[workflow] = flavorOfVariant(config.variant, productFlavors);
-    }
-    return flavors;
-}
-/**
- * The `envs` slots one credential needs: one when every workflow that reads it
- * wants the same bytes, one per workflow when they do not.
- *
- * What "the same bytes" means is the credential's own business — a keystore
- * follows the target path the pipeline declares for it, `google-services.json`
- * the flavor's source set, `local.properties` the flavor itself — so the
- * caller passes the discriminator it already computed, one entry per workflow
- * that reads the credential, and this decides only whether they agree. A
- * credential only one workflow reads can never disagree, which is why the
- * genuinely release-only ones keep one slot however flavored the repository
- * is.
- *
- * **The name never changes — the block it sits in does.** An agreed credential
- * is declared once in `app.envs`; a disagreement is declared under the plain
- * credential name in **each workflow's own `envs`**, which is where the YAML
- * already says which workflow something belongs to. `EnvResolver` merges
- * `app.envs` and then the running workflow's own, so `release`'s declaration is
- * invisible to `primary` without anything being encoded.
- *
- * `CIBUILD_SW__<WORKFLOW>__<VAR>` is deliberately *not* used here. That prefix
- * is the transport encoding `ci secrets upload` carries a workflow-scoped
- * **value** under — Invarn's secret scopes have no workflow column, so the
- * workflow travels in the key. A pipeline has structure instead, and spending
- * the encoding there would be a second way to say what the block already says
- * (Alex, 2026-09-10).
- *
- * Every workflow gets a slot, not only the odd one out: a workflow left without
- * one would have neither a value nor the declaration `file@1.0.0` refuses over.
- *
- * The `file@` step's `var_name` is the same plain name either way.
- */
-export function credentialSlots(varName, discriminatorByWorkflow) {
-    const distinct = new Set(Object.values(discriminatorByWorkflow));
-    if (distinct.size <= 1)
-        return [{ slot: varName, workflow: null }];
-    return Object.keys(discriminatorByWorkflow).map((workflow) => ({
-        slot: varName,
-        workflow,
-    }));
-}
-/**
- * One discriminator per workflow, defaulted the way the step that writes the
- * credential defaults its own input — so a repository whose scan resolved
- * nothing does not read as three workflows that disagree.
- */
-function discriminators(map, fallback) {
-    const out = {};
-    for (const workflow of GENERATED_WORKFLOWS)
-        out[workflow] = map[workflow] ?? fallback;
-    return out;
-}
-/**
- * The groups `ci init` collects a credential's value in: one per distinct value
- * of whatever that credential follows, in workflow order.
- *
- * The same discriminator `credentialSlots` splits the *declaration* by, and
- * deliberately the same function computing it, so what `ci init` asks for and
- * what the pipeline declares cannot drift apart. One group means one slot and
- * one question; two groups mean one slot per workflow and a question per group.
- */
-export function collectionGroups(discriminatorByWorkflow, label) {
-    const byDiscriminator = new Map();
-    for (const [workflow, value] of Object.entries(discriminatorByWorkflow)) {
-        byDiscriminator.set(value, [...(byDiscriminator.get(value) ?? []), workflow]);
-    }
-    return [...byDiscriminator].map(([discriminator, workflows]) => ({
-        label: label(discriminator, workflows),
-        workflows,
-        discriminator,
-    }));
-}
-/**
- * The groups the Secrets Gradle Plugin's properties file is collected in: one
- * per flavor.
- *
- * Unlike `google-services.json`, nothing about this credential's target says
- * the bytes differ — every workflow writes the same file to the same path.
- * What differs is the content: the plugin turns the file into `BuildConfig`,
- * and a flavor is an environment. Asking once and storing one value gives
- * `prod` the CI backend's base URL, on a green build.
- */
-export function propertiesFileGroups(workflowFlavors) {
-    return collectionGroups(discriminators(workflowFlavors, ""), (flavor, workflows) => flavor ? `the ${flavor} flavor (${workflows.join(", ")})` : "every workflow");
-}
-export function detectSetupNeeds(warnings) {
-    const secretsPropertiesPath = secretsPropertiesFileFrom(warnings);
-    return {
-        secretsProperties: secretsPropertiesPath !== null,
-        secretsPropertiesPath: secretsPropertiesPath ?? "local.properties",
-        keystore: warnings.some((w) => w.category === "missing-file" && /keystore/i.test(w.message)),
-        keystoreProperties: warnings.some((w) => w.category === "missing-file" && /keystore\.properties/i.test(w.message)),
-        googleServices: warnings.some((w) => w.category === "firebase" ||
-            (w.category === "missing-file" && /google-services/i.test(w.message))),
-        googlePlayDeploy: false,
-        googlePlayPackageName: '',
-        artifactType: 'apk',
-    };
-}
-/**
- * The `trigger_map` block appended to every generated pipeline.
- *
- * Without it the pipeline is inert on the Invarn side: `dispatchRepoEvent`
- * skips any pipeline whose YAML declares no trigger_map, so a scaffolded repo
- * receives pushes and builds nothing, with no error to explain it.
- *
- * `release` is deliberately absent — it deploys to Google Play / App Store,
- * and a webhook must never reach it.
- */
-export function triggerMapBlock(defaultBranch = FALLBACK_DEFAULT_BRANCH) {
-    const branch = defaultBranch.trim() || FALLBACK_DEFAULT_BRANCH;
-    // JSON.stringify gives a valid double-quoted YAML scalar for any branch
-    // name git will accept. Quoting is not cosmetic: a branch called `no` or
-    // `y` parses as a boolean unquoted, and one called `1.0` as a number.
-    return `
-# Which GitHub events build which workflow. Without this block the pipeline
-# is never triggered by a push or a pull request.
-trigger_map:
-  - push_branch: ${JSON.stringify(branch)}
-    workflow: primary
-  - pull_request_target_branch: "*"
-    workflow: pull-request
-`;
-}
-/**
- * The JDK a generated pipeline names when the project's own constraints have
- * no answer — nothing declared and no readable wrapper, or a declaration no
- * installed JDK can meet. A generated pipeline has to write something; what it
- * must not do is write a number the wrapper cannot start on and call that a
- * choice.
- */
-export const DEFAULT_PIPELINE_JAVA_VERSION = 17;
-export function generateAndroidPipeline(javaVersion = DEFAULT_PIPELINE_JAVA_VERSION, setup = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {}, googleServicesPaths: {}, workflowFlavors: {}, secretsProperties: false, secretsPropertiesPath: 'local.properties' }, variants = DEFAULT_VARIANTS, cacheTechnology = "gradle", metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
-    const keystoreStepFor = (wf) => {
-        if (!setup.keystore)
-            return "";
-        const path = setup.keystorePaths[wf] ?? "keystore.jks";
-        return `
-      - file@1.0.0:
-          title: Setup Keystore
-          is_skippable: true
-          inputs:
-            target_path: ${path}
-            var_name: KEYSTORE_BASE64
-            base64_encoded: true
-`;
-    };
-    // Add BUILD_TYPE override to workflow envs when it differs from the global default ("Debug")
-    const buildTypeEnvOverride = (v) => v.buildType !== "Debug" ? `      - BUILD_TYPE: ${v.buildType}\n` : "";
-    // Optional env var stubs (empty defaults — filled via ci secrets add).
-    //
-    // Declared and not merely used by a step: `unsetEnvKeys` — what `invarn
-    // setup` searches the developer's machine by — reads `envs`, never step
-    // inputs. An undeclared credential is never discovered and never offered for
-    // upload, however many steps name it. The same declaration is what
-    // `file@1.0.0` refuses over when nobody supplied the value.
-    //
-    // One slot per credential where every workflow that reads it wants the same
-    // bytes, and one per workflow where they do not — see `credentialSlots`. The
-    // name is the plain credential either way; a per-workflow one is declared in
-    // that workflow's own `envs` rather than under an encoded name.
-    const appEnvDeclarations = [];
-    const workflowEnvDeclarations = {};
-    const declare = (varName, discriminatorByWorkflow, comment) => {
-        for (const { slot, workflow } of credentialSlots(varName, discriminatorByWorkflow)) {
-            if (workflow === null) {
-                appEnvDeclarations.push(`    - ${slot}: ""${comment(null)}\n`);
-                continue;
-            }
-            // Six spaces, not four: a workflow's `envs` sits one level deeper.
-            (workflowEnvDeclarations[workflow] ??= []).push(`      - ${slot}: ""${comment(workflow)}\n`);
-        }
-    };
-    /** Every credential declaration this workflow owns, after its own variables. */
-    const workflowEnvFor = (workflow) => (workflowEnvDeclarations[workflow] ?? []).join("");
-    // Declared in the order they appear in `app.envs`, which the byte-identity
-    // test on an unflavored pipeline pins.
-    if (setup.keystore) {
-        declare("KEYSTORE_BASE64", discriminators(setup.keystorePaths, "keystore.jks"), (wf) => wf
-            ? `  # Set via: ci secrets add KEYSTORE_BASE64 -w ${wf}`
-            : `         # Set via: ci secrets add KEYSTORE_BASE64 -w primary`);
-    }
-    // Release-only, and legitimately so: nothing but `release` signs a release
-    // or talks to Google Play, so there is no second workflow to disagree with.
-    if (setup.keystoreProperties) {
-        appEnvDeclarations.push(`    - KEYSTORE_PROPERTIES: ""      # Release signing — set via: ci secrets add KEYSTORE_PROPERTIES -w release\n`);
-    }
-    if (setup.googleServices) {
-        declare("GOOGLE_SERVICES_JSON", discriminators(setup.googleServicesPaths, "app/google-services.json"), (wf) => wf
-            ? `  # Set via: ci secrets add GOOGLE_SERVICES_JSON -w ${wf}`
-            : `     # Set via: ci secrets add GOOGLE_SERVICES_JSON`);
-    }
-    if (setup.googlePlayDeploy) {
-        appEnvDeclarations.push(`    - GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ""  # Set via: ci secrets add GOOGLE_PLAY_SERVICE_ACCOUNT_JSON -w release\n`);
-    }
-    if (setup.secretsProperties) {
-        declare("LOCAL_PROPERTIES", discriminators(setup.workflowFlavors, ""), (wf) => wf
-            ? `  # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES -w ${wf}`
-            : `         # Read by the Secrets Gradle Plugin — set via: ci secrets add LOCAL_PROPERTIES`);
-    }
-    const appEnv = appEnvDeclarations.join("");
-    /**
-     * The Secrets Gradle Plugin's properties file, written into every workflow
-     * that builds. Its evaluation listener runs for every variant, so a debug
-     * build fails to *configure* without it — the error names a module of the
-     * user's own project and nothing connects it to a missing credential.
-     */
-    const secretsPropertiesStep = setup.secretsProperties
-        ? `
-      - file@1.0.0:
-          title: Setup ${setup.secretsPropertiesPath}
-          is_skippable: true
-          inputs:
-            target_path: ${setup.secretsPropertiesPath}
-            var_name: LOCAL_PROPERTIES
-`
-        : "";
-    /**
-     * Per workflow, exactly as the keystore is: the flavor a workflow builds
-     * decides where the file is written. A workflow whose variant names no
-     * flavor is unchanged — `app/google-services.json`.
-     *
-     * The `var_name` is the same in every workflow on purpose. Scoping a value
-     * to a workflow is the *secret's* job, not the step's: `CIBUILD_SW__<WF>__X`
-     * is decoded by `SecretsManager` and resolved by `EnvResolver` for the
-     * workflow being run, so one name here reads a different value there.
-     */
-    const googleServicesStepFor = (wf) => {
-        if (!setup.googleServices)
-            return "";
-        const path = setup.googleServicesPaths[wf] ?? "app/google-services.json";
-        return `
-      - file@1.0.0:
-          is_skippable: true
-          inputs:
-            target_path: ${path}
-            var_name: GOOGLE_SERVICES_JSON
-`;
-    };
-    const googlePlayStep = setup.googlePlayDeploy
-        ? `
-      - file@1.0.0:
-          title: Setup Google Play Service Account
-          is_skippable: true
-          inputs:
-            target_path: .ci/keys/google-play-service-account.json
-            var_name: GOOGLE_PLAY_SERVICE_ACCOUNT_JSON
-
-      - google-play-deploy@1.0.0:
-          inputs:
-            service_account_json_key_path: .ci/keys/google-play-service-account.json
-            package_name: ${setup.googlePlayPackageName}
-            artifact_type: ${setup.artifactType}
-            track: internal
-`
-        : "";
-    const keystorePropertiesStep = setup.keystoreProperties
-        ? `
-      - script@1.0.0:
-          title: Setup keystore.properties
-          is_skippable: true
-          inputs:
-            content: |
-              if [ -z "\$KEYSTORE_PROPERTIES" ]; then
-                echo "KEYSTORE_PROPERTIES not set — skipping keystore.properties setup"
-                exit 0
-              fi
-              printf '%s' "\$KEYSTORE_PROPERTIES" > "\$PROJECT_LOCATION/keystore.properties"
-              echo "✓ keystore.properties created"
-`
-        : "";
-    const { primary: pv, pullRequest: prv, release: rv } = variants;
-    // When deploying to Google Play as AAB, override the release gradle task and labels
-    const isAab = setup.googlePlayDeploy && setup.artifactType === 'aab';
-    const releaseGradleTask = isAab ? `bundle${rv.buildType}` : rv.gradleTask;
-    const releaseArtifactLabel = isAab ? 'AAB' : 'APK';
-    const releaseArtifactExt = isAab ? '*.aab' : '*.apk';
-    const stack = cacheTechnology === "kmm" ? "macos-xcode-26.4" : "linux-docker-android-22.04";
-    const platformMeta = cacheTechnology === "kmm" ? "kmm" : "android";
-    return `format_version: '1'
-
-meta:
-  ${metaNamespace}:
-    stack: ${stack}
-    machine_type: standard
-    platform: ${platformMeta}
-
-app:
-  envs:
-    - PROJECT_LOCATION: .
-    - MODULE: app
-    - BUILD_TYPE: Debug
-    - GRADLE_OPTS: -Dorg.gradle.daemon=false -Dorg.gradle.parallel=true
-${appEnv}
-workflows:
-  primary:
-    envs:
-      - VARIANT: ${pv.variant}
-${buildTypeEnvOverride(pv)}${workflowEnvFor("primary")}
-    steps:
-${keystoreStepFor("primary")}${googleServicesStepFor("primary")}${secretsPropertiesStep}
-      - set-java-version@1.0.0:
-          inputs:
-            java_version: '${javaVersion}'
-
-      - cache-pull@1.0.0:
-          inputs:
-            technology: ${cacheTechnology}
-
-      - android-lint@1.0.0:
-          is_skippable: true
-          inputs:
-            project_location: \$PROJECT_LOCATION
-            module: \$MODULE
-            variant: \$VARIANT
-
-      - gradle-build@1.0.0:
-          title: Build ${pv.buildType} APK
-          inputs:
-            project_location: \$PROJECT_LOCATION
-            build_type: ${pv.buildType}
-            gradle_task: ${pv.gradleTask}
-            gradle_options: --stacktrace
-
-      - android-unit-test@1.0.0:
-          is_skippable: true
-          inputs:
-            project_location: \$PROJECT_LOCATION
-            module: \$MODULE
-            variant: \$VARIANT
-
-      - cache-push@1.0.0:
-          inputs:
-            technology: ${cacheTechnology}
-
-  pull-request:
-    envs:
-      - VARIANT: ${prv.variant}
-${buildTypeEnvOverride(prv)}${workflowEnvFor("pull-request")}
-    steps:
-${keystoreStepFor("pull-request")}${googleServicesStepFor("pull-request")}${secretsPropertiesStep}
-      - set-java-version@1.0.0:
-          inputs:
-            java_version: '${javaVersion}'
-
-      - cache-pull@1.0.0:
-          inputs:
-            technology: ${cacheTechnology}
-
-      - android-lint@1.0.0:
-          is_skippable: true
-          inputs:
-            project_location: \$PROJECT_LOCATION
-            module: \$MODULE
-            variant: \$VARIANT
-
-      - android-unit-test@1.0.0:
-          is_skippable: true
-          inputs:
-            project_location: \$PROJECT_LOCATION
-            module: \$MODULE
-            variant: \$VARIANT
-
-      - gradle-build@1.0.0:
-          title: Build PR APK
-          inputs:
-            project_location: \$PROJECT_LOCATION
-            build_type: ${prv.buildType}
-            gradle_task: ${prv.gradleTask}
-
-      - cache-push@1.0.0:
-          inputs:
-            technology: ${cacheTechnology}
-
-  release:
-    envs:
-      - VARIANT: ${rv.variant}
-${buildTypeEnvOverride(rv)}${workflowEnvFor("release")}
-    steps:
-${keystoreStepFor("release")}${keystorePropertiesStep}${googleServicesStepFor("release")}${secretsPropertiesStep}
-      - set-java-version@1.0.0:
-          inputs:
-            java_version: '${javaVersion}'
-
-      - gradle-build@1.0.0:
-          title: Build ${rv.buildType} ${releaseArtifactLabel}
-          inputs:
-            project_location: \$PROJECT_LOCATION
-            build_type: ${rv.buildType}
-            gradle_task: ${releaseGradleTask}
-            gradle_options: --stacktrace
-
-      - android-unit-test@1.0.0:
-          is_skippable: true
-          inputs:
-            project_location: \$PROJECT_LOCATION
-            module: \$MODULE
-            variant: \$VARIANT
-${googlePlayStep}
-      - script@1.0.0:
-          title: Build Summary
-          inputs:
-            content: |
-              echo "Build Complete"
-              if [ -d ".ci/artifacts" ]; then
-                find .ci/artifacts -name "${releaseArtifactExt}" | while read -r artifact; do
-                  echo "${releaseArtifactLabel}: \$artifact"
-                done
-              fi
-${triggerMapBlock(defaultBranch)}`;
-}
-export function generateIosPipeline(projectPath, setup, variants, metaNamespace = 'cibuild.io', defaultBranch = FALLBACK_DEFAULT_BRANCH) {
-    const { primary: pv, pullRequest: prv, release: rv } = variants;
-    // Global scheme is the primary scheme (used as default across workflows)
-    const globalScheme = pv.scheme;
-    // Only emit per-workflow scheme env if it differs from global
-    const schemeEnvFor = (scheme) => scheme !== globalScheme ? `      - SCHEME: ${scheme}\n` : "";
-    // Configuration override env (global default is Debug)
-    const configEnvFor = (cfg) => cfg !== "Debug" ? `      - CONFIGURATION: ${cfg}\n` : "";
-    // Optional env var stubs
-    const certEnv = setup.codeSigning
-        ? `    - CERTIFICATE_P12: ""         # Set via: ci secrets add CERTIFICATE_P12 -w release\n` +
-            `    - CERTIFICATE_PASSWORD: ""    # Set via: ci secrets add CERTIFICATE_PASSWORD -w release\n` +
-            `    - PROVISIONING_PROFILE: ""   # Set via: ci secrets add PROVISIONING_PROFILE -w release\n`
-        : "";
-    // CocoaPods install step
-    const podInstallStep = setup.cocoaPods
-        ? `
-      - script@1.0.0:
-          title: Install CocoaPods
-          inputs:
-            content: |
-              pod install --repo-update
-`
-        : "";
-    const podInstallStepPR = setup.cocoaPods
-        ? `
-      - script@1.0.0:
-          title: Install CocoaPods
-          inputs:
-            content: |
-              pod install
-`
-        : "";
-    // Code signing setup step (release only)
-    const codeSigningStep = setup.codeSigning
-        ? `
-      - script@1.0.0:
-          title: Setup Code Signing
-          is_skippable: true
-          inputs:
-            content: |
-              if [ -z "\$CERTIFICATE_P12" ]; then
-                echo "CERTIFICATE_P12 not set — skipping code signing setup"
-                exit 0
-              fi
-              echo "\$CERTIFICATE_P12" | base64 --decode > /tmp/certificate.p12
-              security create-keychain -p "" ci-build.keychain
-              security import /tmp/certificate.p12 -k ci-build.keychain -P "\$CERTIFICATE_PASSWORD" -A -T /usr/bin/codesign
-              security list-keychains -s ci-build.keychain
-              security default-keychain -s ci-build.keychain
-              security unlock-keychain -p "" ci-build.keychain
-              security set-keychain-settings ci-build.keychain
-              if [ -n "\$PROVISIONING_PROFILE" ]; then
-                mkdir -p ~/Library/MobileDevice/Provisioning\\ Profiles
-                echo "\$PROVISIONING_PROFILE" | base64 --decode > ~/Library/MobileDevice/Provisioning\\ Profiles/profile.mobileprovision
-                echo "✓ Provisioning profile installed"
-              fi
-              rm -f /tmp/certificate.p12
-              echo "✓ Code signing setup complete"
-`
-        : "";
-    // App Store Connect deploy step (release only)
-    const appStoreDeployStep = setup.appStoreDeploy
-        ? `
-      - app-store-deploy@1.0.0:
-          inputs:
-            skip_metadata: 'yes'
-            skip_screenshots: 'yes'
-            submit_for_review: 'no'
-`
-        : "";
-    // Cache technology depends on whether CocoaPods is used
-    const iosCacheTechnology = setup.cocoaPods ? "cocoapods" : "spm";
-    return `format_version: '1'
-
-meta:
-  ${metaNamespace}:
-    stack: macos-xcode-26.4
-    machine_type: performance
-    platform: ios
-
-app:
-  envs:
-    - PROJECT_PATH: ${projectPath}
-    - SCHEME: ${globalScheme}
-    - CONFIGURATION: Debug
-${certEnv}
-workflows:
-  primary:
-    envs:
-${schemeEnvFor(pv.scheme)}${configEnvFor(pv.configuration)}
-    steps:
-      - cache-pull@1.0.0:
-          inputs:
-            technology: ${iosCacheTechnology}
-${podInstallStep}
-      - xcode-archive@1.0.0:
-          inputs:
-            project_path: \$PROJECT_PATH
-            scheme: \$SCHEME
-            configuration: \$CONFIGURATION
-            distribution_method: ${pv.distributionMethod}
-            output_dir: .ci/artifacts
-
-      - xcode-test@1.0.0:
-          is_skippable: true
-          inputs:
-            project_path: \$PROJECT_PATH
-            scheme: \$SCHEME
-            destination: platform=iOS Simulator,OS=latest
-            is_code_coverage_enabled: true
-
-      - cache-push@1.0.0:
-          inputs:
-            technology: ${iosCacheTechnology}
-
-  pull-request:
-    envs:
-${schemeEnvFor(prv.scheme)}${configEnvFor(prv.configuration)}
-    steps:
-      - cache-pull@1.0.0:
-          inputs:
-            technology: ${iosCacheTechnology}
-${podInstallStepPR}
-      - xcode-test@1.0.0:
-          is_skippable: true
-          inputs:
-            project_path: \$PROJECT_PATH
-            scheme: \$SCHEME
-            destination: platform=iOS Simulator,OS=latest
-
-      - xcodebuild@1.0.0:
-          inputs:
-            project_path: \$PROJECT_PATH
-            scheme: \$SCHEME
-            configuration: \$CONFIGURATION
-            destination: generic/platform=iOS Simulator
-
-      - cache-push@1.0.0:
-          inputs:
-            technology: ${iosCacheTechnology}
-
-  release:
-    envs:
-      - CONFIGURATION: Release
-${schemeEnvFor(rv.scheme)}
-    steps:
-${codeSigningStep}
-      - cache-pull@1.0.0:
-          inputs:
-            technology: ${iosCacheTechnology}
-${podInstallStep}
-      - xcode-archive@1.0.0:
-          inputs:
-            project_path: \$PROJECT_PATH
-            scheme: \$SCHEME
-            configuration: \$CONFIGURATION
-            distribution_method: ${rv.distributionMethod}
-            perform_clean_action: 'yes'
-            automatic_code_signing: '${setup.codeSigning || setup.appStoreDeploy ? 'on' : 'off'}'
-            compile_bitcode: 'no'
-            upload_bitcode: 'no'
-            output_dir: .ci/artifacts
-${appStoreDeployStep}
-      - script@1.0.0:
-          title: Build Summary
-          inputs:
-            content: |
-              echo "Build Complete"
-              if [ -n "\$CIBUILD_IPA_PATH" ]; then
-                echo "IPA: \$CIBUILD_IPA_PATH"
-              fi
-              if [ -n "\$CIBUILD_XCARCHIVE_PATH" ]; then
-                echo "Archive: \$CIBUILD_XCARCHIVE_PATH"
-              fi
-${triggerMapBlock(defaultBranch)}`;
-}
-/**
- * Prints a hint listing env vars / Gradle properties detected during scanning
- * that haven't been handled by the setup flow (keystore, google-services, etc.).
- * Prompts the user to add them as secrets before running the pipeline.
- */
-function showMissingSecretsHint(scanResult, setupOptions) {
-    // Build a set of var names already configured by the setup flow
-    const alreadyHandled = new Set();
-    if (setupOptions.keystore)
-        alreadyHandled.add("KEYSTORE_BASE64");
-    if (setupOptions.keystoreProperties)
-        alreadyHandled.add("KEYSTORE_PROPERTIES");
-    if (setupOptions.googleServices)
-        alreadyHandled.add("GOOGLE_SERVICES_JSON");
-    // Only show actionable warnings that have a "ci secrets add VAR" hint
-    const ACTIONABLE = new Set(["build-config", "env-var", "signing-config", "gradle-property", "secrets-plugin"]);
-    const remaining = scanResult.warnings.filter((w) => {
-        if (!ACTIONABLE.has(w.category) || w.severity !== "warning")
-            return false;
-        const varName = w.hint?.match(/ci secrets add (\S+)/)?.[1];
-        return varName && !alreadyHandled.has(varName);
-    });
-    if (remaining.length === 0)
-        return;
-    const LABELS = {
-        "build-config": "BuildConfig env vars",
-        "env-var": "Environment variables",
-        "signing-config": "Signing credentials",
-        "gradle-property": "Gradle properties",
-        "secrets-plugin": "Google Secrets Gradle Plugin (local.properties keys)",
-    };
-    // Group by category — secrets-plugin keys are grouped separately and shown with a file hint
-    const byCategory = new Map();
-    for (const w of remaining) {
-        if (!byCategory.has(w.category))
-            byCategory.set(w.category, []);
-        byCategory.get(w.category).push(w);
-    }
-    console.log("\n──────────────────────────────────────────────────");
-    console.log("⚠  Additional secrets detected in your Gradle files");
-    console.log("──────────────────────────────────────────────────");
-    console.log("   These variables were found but not yet configured.\n");
-    for (const [cat, items] of byCategory) {
-        console.log(`   ${LABELS[cat] ?? cat}:`);
-        if (cat === "secrets-plugin") {
-            // These all go into a single properties file — show as a block with a file-step hint
-            const propertiesFile = items[0]?.location ?? "local.properties";
-            console.log(`   → These keys are read from '${propertiesFile}' by the Secrets Gradle Plugin.`);
-            console.log(`   → The file is gitignored — inject it as a file step before building.\n`);
-            console.log(`   Suggested step (add via: ci edit → Add step → file):`);
-            console.log(`     target_path: ${propertiesFile}`);
-            console.log(`     var_name:    <SECRET_NAME_HOLDING_FILE_CONTENT>\n`);
-            console.log(`   Keys needed in '${propertiesFile}':`);
-            for (const w of items) {
-                const key = w.hint?.match(/ci secrets add (\S+)/)?.[1] ?? w.message;
-                console.log(`     ${key}`);
-            }
-        }
-        else {
-            for (const w of items) {
-                const varName = w.hint?.match(/ci secrets add (\S+)/)?.[1] ?? w.message;
-                const loc = w.location ? `  (${w.location})` : "";
-                console.log(`     ci secrets add ${varName}${loc}`);
-            }
-        }
-        console.log("");
-    }
-}
-async function handleIosBuildCommand(cwd, options = {}) {
-    // 1. Scan the project
-    console.log("\n🔍 Scanning iOS project for potential unknowns...\n");
-    const iosScanResult = await scanIosProject(cwd);
-    console.log(formatIosScanResult(iosScanResult));
-    // 2. Determine available schemes
-    const detectedSchemes = iosScanResult.detectedSchemes.length > 0
-        ? iosScanResult.detectedSchemes
-        : ["MyApp"];
-    if (iosScanResult.detectedSchemes.length > 1) {
-        console.log(`ℹ  Detected schemes: ${iosScanResult.detectedSchemes.join(", ")}\n`);
-    }
-    // 3. Prompt for scheme + configuration + distribution method per workflow
-    const ni = options.nonInteractive;
-    if (!ni)
-        console.log("⚙  Configure build schemes and configurations\n");
-    const primaryScheme = ni ? detectedSchemes[0] : await promptScheme("primary", detectedSchemes[0], detectedSchemes);
-    const primaryConfig = ni ? "Debug" : await promptConfiguration("primary", "Debug");
-    const primaryMethod = ni ? "development" : await promptDistributionMethod("primary", "development");
-    const pullRequestScheme = ni ? detectedSchemes[0] : await promptScheme("pull-request", primaryScheme, detectedSchemes);
-    const pullRequestConfig = ni ? "Debug" : await promptConfiguration("pull-request", "Debug");
-    const pullRequestMethod = ni ? "development" : await promptDistributionMethod("pull-request", "development");
-    const releaseScheme = ni ? detectedSchemes[0] : await promptScheme("release", primaryScheme, detectedSchemes);
-    const releaseConfig = ni ? "Release" : await promptConfiguration("release", "Release");
-    const releaseMethod = ni ? "app-store" : await promptDistributionMethod("release", "app-store");
-    const iosVariants = {
-        primary: { scheme: primaryScheme, configuration: primaryConfig, distributionMethod: primaryMethod },
-        pullRequest: { scheme: pullRequestScheme, configuration: pullRequestConfig, distributionMethod: pullRequestMethod },
-        release: { scheme: releaseScheme, configuration: releaseConfig, distributionMethod: releaseMethod },
-    };
-    // 4. Setup options
-    const iosSetupOptions = {
-        cocoaPods: false,
-        codeSigning: false,
-        appStoreDeploy: false,
-        bundleId: "",
-    };
-    const secretsManager = new SecretsManager();
-    // CocoaPods
-    if (iosScanResult.hasCocoaPods) {
-        if (ni) {
-            iosSetupOptions.cocoaPods = true;
-        }
-        else {
-            const { create } = await prompts({
-                type: "confirm",
-                name: "create",
-                message: "Generate a pod install step for CocoaPods dependencies?",
-                initial: true,
-            });
-            iosSetupOptions.cocoaPods = !!create;
-        }
-    }
-    // Code signing
-    if (iosScanResult.hasSigningConfig) {
-        if (ni) {
-            iosSetupOptions.codeSigning = true;
-        }
-        else {
-            const { create } = await prompts({
-                type: "confirm",
-                name: "create",
-                message: "Generate a code signing setup step for the release workflow?",
-                initial: true,
-            });
-            iosSetupOptions.codeSigning = !!create;
-        }
-        if (iosSetupOptions.codeSigning) {
-            await collectFileSecret({
-                displayName: "certificate (.p12)",
-                secretName: "CERTIFICATE_P12",
-                fileMatch: (name) => name.endsWith(".p12"),
-                readAs: "base64",
-                workflowGroups: [{ label: "release", workflows: ["release"] }],
-            }, cwd, secretsManager, ni);
-            if (ni) {
-                console.log("   Add later: ci secrets add CERTIFICATE_PASSWORD -w release");
-            }
-            else {
-                const { password } = await prompts({
-                    type: "password",
-                    name: "password",
-                    message: "Certificate password (leave blank to add later):",
-                });
-                if (password?.trim()) {
-                    secretsManager.storeSecret("CERTIFICATE_PASSWORD", password.trim(), "release");
-                    console.log("   ✅ CERTIFICATE_PASSWORD stored for workflow: release");
-                }
-                else {
-                    console.log("   Add later: ci secrets add CERTIFICATE_PASSWORD -w release");
-                }
-            }
-            await collectFileSecret({
-                displayName: "provisioning profile (.mobileprovision)",
-                secretName: "PROVISIONING_PROFILE",
-                fileMatch: (name) => name.endsWith(".mobileprovision"),
-                readAs: "base64",
-                workflowGroups: [{ label: "release", workflows: ["release"] }],
-            }, cwd, secretsManager, ni);
-        }
-    }
-    // App Store Connect deploy — skip in non-interactive mode (requires credentials)
-    if (!ni) {
-        const { deployToAppStore } = await prompts({
-            type: "confirm",
-            name: "deployToAppStore",
-            message: "Add App Store Connect / TestFlight upload step to release workflow?",
-            initial: false,
-        });
-        iosSetupOptions.appStoreDeploy = !!deployToAppStore;
-        if (iosSetupOptions.appStoreDeploy) {
-            await collectFileSecret({
-                displayName: "App Store Connect API key (.p8)",
-                secretName: "APPLE_API_KEY_PATH",
-                fileMatch: (name) => name.endsWith(".p8"),
-                readAs: "base64",
-                workflowGroups: [{ label: "release", workflows: ["release"] }],
-            }, cwd, secretsManager);
-            const { keyId } = await prompts({
-                type: "text",
-                name: "keyId",
-                message: "Apple API Key ID (leave blank to add later):",
-            });
-            if (keyId?.trim()) {
-                secretsManager.storeSecret("APPLE_API_KEY_ID", keyId.trim(), "release");
-                console.log("   ✅ APPLE_API_KEY_ID stored for workflow: release");
-            }
-            else {
-                console.log("   Add later: ci secrets add APPLE_API_KEY_ID -w release");
-            }
-            const { issuerId } = await prompts({
-                type: "text",
-                name: "issuerId",
-                message: "Apple API Issuer ID (leave blank to add later):",
-            });
-            if (issuerId?.trim()) {
-                secretsManager.storeSecret("APPLE_API_ISSUER_ID", issuerId.trim(), "release");
-                console.log("   ✅ APPLE_API_ISSUER_ID stored for workflow: release");
-            }
-            else {
-                console.log("   Add later: ci secrets add APPLE_API_ISSUER_ID -w release");
-            }
-            const detectedTeamId = iosScanResult.developmentTeam;
-            let teamIdToStore = detectedTeamId;
-            if (detectedTeamId) {
-                console.log(`   ℹ  Detected Apple Team ID from project: ${detectedTeamId}`);
-                secretsManager.storeSecret("APPLE_TEAM_ID", detectedTeamId, "release");
-                console.log("   ✅ APPLE_TEAM_ID stored for workflow: release");
-            }
-            else {
-                const { teamId } = await prompts({
-                    type: "text",
-                    name: "teamId",
-                    message: "Apple Team ID (leave blank to add later):",
-                });
-                teamIdToStore = teamId?.trim() || "";
-                if (teamIdToStore) {
-                    secretsManager.storeSecret("APPLE_TEAM_ID", teamIdToStore, "release");
-                    console.log("   ✅ APPLE_TEAM_ID stored for workflow: release");
-                }
-                else {
-                    console.log("   Add later: ci secrets add APPLE_TEAM_ID -w release");
-                }
-            }
-        }
-    }
-    // 5. Ensure .ci/pipelines/ exists
-    const pipelinesDir = resolve(cwd, ".ci", "pipelines");
-    if (!existsSync(pipelinesDir)) {
-        if (options.createPipelinesDir) {
-            mkdirSync(pipelinesDir, { recursive: true });
-            console.log("✅ Created .ci/pipelines/");
-        }
-        else {
-            console.error("Project not initialised. Run 'ci init' first.");
-            process.exit(1);
-        }
-    }
-    // 6. Check if cibuild.yml already exists
-    const outputPath = resolve(pipelinesDir, "cibuild.yml");
-    if (existsSync(outputPath) && !ni) {
-        const { overwrite } = await prompts({
-            type: "confirm",
-            name: "overwrite",
-            message: ".ci/pipelines/cibuild.yml already exists. Overwrite?",
-            initial: false,
-        });
-        if (!overwrite) {
-            console.log("\nCancelled. Existing pipeline was not modified.");
-            process.exit(0);
-        }
-    }
-    // 7. Generate and write the pipeline
-    const yaml = generateIosPipeline(iosScanResult.projectPath, iosSetupOptions, iosVariants, options.metaNamespace, detectDefaultBranch());
-    writeFileSync(outputPath, yaml, "utf-8");
-    console.log("\n✅ Generated .ci/pipelines/cibuild.yml");
-    console.log("   Platform: iOS");
-    console.log(`   Workflows: primary (${iosVariants.primary.scheme}/${iosVariants.primary.configuration}), pull-request (${iosVariants.pullRequest.scheme}/${iosVariants.pullRequest.configuration}), release (${iosVariants.release.scheme}/${iosVariants.release.configuration})`);
-    if (iosSetupOptions.cocoaPods || iosSetupOptions.codeSigning || iosSetupOptions.appStoreDeploy) {
-        console.log("   Setup steps included:");
-        if (iosSetupOptions.cocoaPods)
-            console.log("     • Install CocoaPods (pod install)");
-        if (iosSetupOptions.codeSigning)
-            console.log("     • Setup Code Signing (CERTIFICATE_P12, PROVISIONING_PROFILE) — release only");
-        if (iosSetupOptions.appStoreDeploy)
-            console.log("     • App Store Connect / TestFlight upload (app-store-deploy) — release only");
-    }
-    // Generate GitHub Actions workflow
-    let githubWorkflowGenerated = false;
-    if (options.createPipelinesDir) {
-        githubWorkflowGenerated = generateGitHubActionsWorkflow({ platform: "ios", cwd });
-    }
-    // Show env var secrets hint
-    const envVarWarnings = iosScanResult.warnings.filter((w) => w.category === "env-var" && w.severity === "warning");
-    if (envVarWarnings.length > 0) {
-        console.log("\n──────────────────────────────────────────────────");
-        console.log("⚠  Additional secrets detected in your xcconfig files");
-        console.log("──────────────────────────────────────────────────");
-        console.log("   These variables were found but not yet configured.\n");
-        console.log("   Environment variables:");
-        for (const w of envVarWarnings) {
-            const varName = w.hint?.match(/ci secrets add (\S+)/)?.[1] ?? w.message;
-            const loc = w.location ? `  (${w.location})` : "";
-            console.log(`     ci secrets add ${varName}${loc}`);
-        }
-        console.log("");
-    }
-    const hasSecrets = existsSync(resolve(cwd, ".cibuild-secrets.json"));
-    const hasWorkflow = existsSync(resolve(cwd, ".github", "workflows", "ci.yml"));
-    console.log("\nNext steps:");
-    console.log("  ci run .ci/pipelines/cibuild.yml -w primary   # Run locally");
-    if (hasWorkflow) {
-        if (hasSecrets) {
-            console.log("  ci secrets upload                               # Upload secrets to GitHub");
-        }
-        console.log("  git add . && git push                          # Push to GitHub - CI runs automatically");
-    }
-    console.log("");
-}
-export async function handleBuildCommand(detectMobileProjectRoot, options = {}) {
-    const cwd = process.cwd();
-    // 1. Detect project type
-    const projectType = detectMobileProjectRoot(cwd);
-    if (projectType === "ios") {
-        await handleIosBuildCommand(cwd, options);
-        return;
-    }
-    if (projectType === "kmm" || projectType === "android") {
-        await handleAndroidBuildCommand(cwd, options, projectType === "kmm" ? "kmm" : "gradle");
-        return;
-    }
-    console.error("Error: Not a mobile project root.");
-    console.error("'ci build' must be run from the root folder of an Android, iOS, or KMM project.");
-    console.error("\nAndroid/KMM projects must contain one of:");
-    console.error("  build.gradle, build.gradle.kts, settings.gradle, settings.gradle.kts, gradlew");
-    console.error("\nKMM projects additionally need: iosApp/, shared/, or composeApp/ directory");
-    console.error("\niOS projects must contain one of:");
-    console.error("  *.xcodeproj, *.xcworkspace, Podfile");
-    process.exit(1);
-}
-async function handleAndroidBuildCommand(cwd, options, cacheTechnology) {
-    const platformLabel = cacheTechnology === "kmm" ? "KMM (Kotlin Multiplatform)" : "Android";
-    // 2. Scan the project for potential unknowns
-    console.log(`\n🔍 Scanning ${platformLabel} project for potential unknowns...\n`);
-    const scanResult = await scanAndroidProject(cwd);
-    console.log(formatScanResult(scanResult));
-    // 3. Prompt for build variants per workflow
-    const ni = options.nonInteractive;
-    const { variants: detectedVariants, productFlavors } = scanResult.buildVariants;
-    if (productFlavors.length > 0) {
-        console.log(`ℹ  Detected product flavors: ${productFlavors.join(", ")}`);
-        console.log(`   Available variants: ${detectedVariants.join(", ")}\n`);
-    }
-    let variants;
-    if (ni) {
-        variants = DEFAULT_VARIANTS;
-    }
-    else {
-        console.log("⚙  Configure build variants\n");
-        const primaryVariant = await promptVariant("primary", "debug", detectedVariants);
-        const pullRequestVariant = await promptVariant("pull-request", "debug", detectedVariants);
-        const releaseVariant = await promptVariant("release", "release", detectedVariants);
-        variants = {
-            primary: primaryVariant,
-            pullRequest: pullRequestVariant,
-            release: releaseVariant,
-        };
-    }
-    // 4. Prompt to generate setup steps for detected file issues
-    const setupNeeds = detectSetupNeeds(scanResult.warnings);
-    // Which flavor each workflow builds decides where its google-services.json
-    // is written, and — with no path to give it away — whether the properties
-    // file can be one value or has to be one per workflow. Both maps are
-    // derived from the variants chosen just above.
-    const googleServicesPaths = googleServicesTargets(variants, productFlavors);
-    const workflowFlavors = variantFlavors(variants, productFlavors);
-    const setupOptions = { keystore: false, keystoreProperties: false, googleServices: false, googlePlayDeploy: false, googlePlayPackageName: '', artifactType: 'apk', keystorePaths: {}, googleServicesPaths, workflowFlavors, secretsProperties: false, secretsPropertiesPath: setupNeeds.secretsPropertiesPath };
-    const secretsManager = new SecretsManager();
-    const keystoreWorkflowGroups = [
-        { label: "debug builds (primary, pull-request)", workflows: ["primary", "pull-request"] },
-        { label: "release", workflows: ["release"] },
-    ];
-    if (setupNeeds.keystore) {
-        if (ni) {
-            setupOptions.keystore = true;
-        }
-        else {
-            const { create } = await prompts({
-                type: "confirm",
-                name: "create",
-                message: "Generate a setup script step for the keystore?",
-                initial: true,
-            });
-            setupOptions.keystore = !!create;
-        }
-        if (setupOptions.keystore) {
-            setupOptions.keystorePaths = await collectFileSecret({
-                displayName: "keystore",
-                secretName: "KEYSTORE_BASE64",
-                fileMatch: (name) => name.endsWith(".jks") || name.endsWith(".keystore"),
-                readAs: "base64",
-                workflowGroups: keystoreWorkflowGroups,
-                promptTargetPath: true,
-            }, cwd, secretsManager, ni);
-        }
-    }
-    if (setupNeeds.keystoreProperties) {
-        if (ni) {
-            setupOptions.keystoreProperties = true;
-        }
-        else {
-            const { create } = await prompts({
-                type: "confirm",
-                name: "create",
-                message: "Generate a setup script step for keystore.properties (release signing)?",
-                initial: true,
-            });
-            setupOptions.keystoreProperties = !!create;
-        }
-        if (setupOptions.keystoreProperties) {
-            await collectFileSecret({
-                displayName: "keystore.properties",
-                secretName: "KEYSTORE_PROPERTIES",
-                fileMatch: (name) => name === "keystore.properties",
-                readAs: "text",
-                workflowGroups: [
-                    { label: "release", workflows: ["release"] },
-                ],
-            }, cwd, secretsManager, ni);
-        }
-    }
-    // Resolve missing keystore target paths for all configured workflows.
-    // For each workflow with no file-selected path: extract storeFile from any
-    // KEYSTORE_PROPERTIES secret, then fall back to Gradle-detected paths.
-    if (setupOptions.keystore) {
-        const gradleKeystorePaths = scanResult.warnings
-            .filter((w) => w.category === "missing-file" && w.message.startsWith("Keystore file not found:"))
-            .map((w) => w.message.replace("Keystore file not found: ", ""));
-        for (const wf of keystoreWorkflowGroups.flatMap((g) => g.workflows)) {
-            if (setupOptions.keystorePaths[wf])
-                continue;
-            const kpContent = secretsManager.getSecret("KEYSTORE_PROPERTIES", wf);
-            if (kpContent) {
-                const line = kpContent.split("\n").find((l) => l.trim().startsWith("storeFile="));
-                if (line) {
-                    setupOptions.keystorePaths[wf] = line.split("=").slice(1).join("=").trim();
-                    continue;
-                }
-            }
-            if (gradleKeystorePaths.length > 0) {
-                setupOptions.keystorePaths[wf] = gradleKeystorePaths[0];
-            }
-        }
-    }
-    if (setupNeeds.googleServices) {
-        if (ni) {
-            setupOptions.googleServices = true;
-        }
-        else {
-            const { create } = await prompts({
-                type: "confirm",
-                name: "create",
-                message: "Generate a setup script step for google-services.json?",
-                initial: true,
-            });
-            setupOptions.googleServices = !!create;
-        }
-        if (setupOptions.googleServices) {
-            // One collection per distinct target path. Workflows building the same
-            // flavor write to the same place and are collected together; workflows
-            // building different flavors need different files, so each is asked
-            // separately and pinned to its own source set — which is what lets a
-            // flavored repository auto-select rather than guess.
-            //
-            // The secret name is the same every time, and the *value* is stored per
-            // workflow. That is what `SecretsManager` has always done, what
-            // `ci secrets upload` encodes as `CIBUILD_SW__<WF>__<VAR>`, and what
-            // `EnvResolver` resolves for the workflow being run.
-            const byTarget = collectionGroups(discriminators(setupOptions.googleServicesPaths, "app/google-services.json"), (_path, workflows) => workflows.join(", "));
-            for (const group of byTarget) {
-                const flavorDir = /\/src\/([^/]+)\//.exec(group.discriminator)?.[1] ?? null;
-                await collectFileSecret({
-                    displayName: flavorDir
-                        ? `google-services.json for the ${flavorDir} flavor`
-                        : "google-services.json",
-                    secretName: "GOOGLE_SERVICES_JSON",
-                    fileMatch: (name) => name === "google-services.json",
-                    // A flavored target takes the copy from that flavor's source set. An
-                    // unflavored one takes anything that is *not* a flavor's copy, so
-                    // the module root wins rather than an arbitrary source set.
-                    pathMatch: flavorDir
-                        ? (rel) => rel.includes(`/src/${flavorDir}/`) || rel.startsWith(`src/${flavorDir}/`)
-                        : (rel) => !/(?:^|\/)src\/[^/]+\//.test(rel),
-                    readAs: "text",
-                    // One group per call, not all of them: each group narrows the search
-                    // to its own flavor's source set, which is what lets a flavored
-                    // repository auto-select rather than ask.
-                    workflowGroups: [group],
-                }, cwd, secretsManager, ni);
-            }
-        }
-    }
-    if (setupNeeds.secretsProperties) {
-        const propertiesFile = setupNeeds.secretsPropertiesPath;
-        if (ni) {
-            setupOptions.secretsProperties = true;
-        }
-        else {
-            const { create } = await prompts({
-                type: "confirm",
-                name: "create",
-                message: `Generate a setup step for '${propertiesFile}' (read by the Secrets Gradle Plugin)?`,
-                initial: true,
-            });
-            setupOptions.secretsProperties = !!create;
-        }
-        if (setupOptions.secretsProperties) {
-            // Every workflow, not just release: the plugin's evaluation listener
-            // runs for every variant, so a debug build cannot configure without it.
-            //
-            // And one group per flavor, because the plugin turns this file into
-            // BuildConfig and a flavor is an environment. Every group in one call,
-            // unlike google-services.json above: there is no per-flavor path
-            // convention for a properties file to narrow the search by, so the
-            // groups differ only in which answer they take.
-            await collectFileSecret({
-                displayName: propertiesFile,
-                secretName: "LOCAL_PROPERTIES",
-                fileMatch: (name) => name === propertiesFile.split("/").pop(),
-                readAs: "text",
-                workflowGroups: propertiesFileGroups(setupOptions.workflowFlavors),
-            }, cwd, secretsManager, ni);
-        }
-    }
-    // 4b. Prompt for Google Play deployment setup — skip in non-interactive mode (requires package name + credentials)
-    if (!ni) {
-        const { setupGooglePlay } = await prompts({
-            type: "confirm",
-            name: "setupGooglePlay",
-            message: "Add a Google Play deploy step to the release workflow?",
-            initial: false,
-        });
-        if (setupGooglePlay) {
-            const { packageName } = await prompts({
-                type: "text",
-                name: "packageName",
-                message: "Android package name (e.g. com.example.app):",
-                validate: (v) => (v.trim().length > 0 ? true : "Package name is required"),
-            });
-            setupOptions.googlePlayDeploy = true;
-            setupOptions.googlePlayPackageName = packageName?.trim() || '';
-            const { artifactType } = await prompts({
-                type: "select",
-                name: "artifactType",
-                message: "Artifact format for Google Play upload:",
-                choices: [
-                    { title: "AAB  — Android App Bundle (recommended by Google Play)", value: "aab" },
-                    { title: "APK  — traditional APK format", value: "apk" },
-                ],
-                initial: 0,
-            });
-            setupOptions.artifactType = artifactType || 'aab';
-            await collectFileSecret({
-                displayName: "Google Play service account JSON",
-                secretName: "GOOGLE_PLAY_SERVICE_ACCOUNT_JSON",
-                fileMatch: (name) => name.endsWith(".json"),
-                readAs: "text",
-                workflowGroups: [
-                    { label: "release", workflows: ["release"] },
-                ],
-            }, cwd, secretsManager);
-        }
-    }
-    // 5. Ensure .ci/pipelines/ exists
-    const pipelinesDir = resolve(cwd, ".ci", "pipelines");
-    if (!existsSync(pipelinesDir)) {
-        if (options.createPipelinesDir) {
-            mkdirSync(pipelinesDir, { recursive: true });
-            console.log("✅ Created .ci/pipelines/");
-        }
-        else {
-            console.error("Project not initialised. Run 'ci init' first.");
-            process.exit(1);
-        }
-    }
-    // 6. Check if cibuild.yml already exists
-    const outputPath = resolve(pipelinesDir, "cibuild.yml");
-    if (existsSync(outputPath) && !ni) {
-        const { overwrite } = await prompts({
-            type: "confirm",
-            name: "overwrite",
-            message: ".ci/pipelines/cibuild.yml already exists. Overwrite?",
-            initial: false,
-        });
-        if (!overwrite) {
-            console.log("\nCancelled. Existing pipeline was not modified.");
-            process.exit(0);
-        }
-    }
-    // 7. Generate and write the pipeline
-    //
-    // The chooser abstains rather than falling back, so `undefined` here means
-    // "no installed JDK meets this project's constraints" — not "17 is fine".
-    // The default is what gets written in that case, and the warning below is
-    // what says so; it is never silent when the answer is not what was asked
-    // for, which is the whole reason the two are resolved together.
-    const javaVersion = runnableJavaVersion(scanResult.detectedJavaVersion, scanResult.detectedGradleVersion);
-    const javaProblem = javaVersionProblem(scanResult.detectedJavaVersion, scanResult.detectedGradleVersion, scanResult.detectedJavaVersionSource);
-    if (javaProblem)
-        console.log(`\n⚠️  ${javaProblem}`);
-    const yaml = generateAndroidPipeline(javaVersion ?? DEFAULT_PIPELINE_JAVA_VERSION, setupOptions, variants, cacheTechnology, options.metaNamespace, detectDefaultBranch());
-    writeFileSync(outputPath, yaml, "utf-8");
-    console.log("\n✅ Generated .ci/pipelines/cibuild.yml");
-    console.log(`   Platform: ${platformLabel}`);
-    console.log(`   Workflows: primary (${variants.primary.variant}), pull-request (${variants.pullRequest.variant}), release (${variants.release.variant})`);
-    if (setupOptions.keystore || setupOptions.keystoreProperties || setupOptions.googleServices || setupOptions.googlePlayDeploy) {
-        console.log("   Setup steps included:");
-        if (setupOptions.keystore)
-            console.log("     • Setup Keystore (KEYSTORE_BASE64)");
-        if (setupOptions.keystoreProperties)
-            console.log("     • Setup keystore.properties (KEYSTORE_PROPERTIES) — release only");
-        if (setupOptions.googleServices) {
-            const seen = new Set();
-            for (const wf of GENERATED_WORKFLOWS) {
-                const path = setupOptions.googleServicesPaths[wf];
-                if (!path || seen.has(path))
-                    continue;
-                seen.add(path);
-                console.log(`     • Setup ${path} (GOOGLE_SERVICES_JSON)`);
-            }
-        }
-        if (setupOptions.googlePlayDeploy)
-            console.log(`     • Google Play deploy (${setupOptions.googlePlayPackageName}) — release only`);
-    }
-    showMissingSecretsHint(scanResult, setupOptions);
-    // Generate GitHub Actions workflow
-    let githubWorkflowGenerated = false;
-    if (options.createPipelinesDir) {
-        githubWorkflowGenerated = generateGitHubActionsWorkflow({ platform: "android", cwd });
-    }
-    const hasSecrets = existsSync(resolve(cwd, ".cibuild-secrets.json"));
-    const hasWorkflow = existsSync(resolve(cwd, ".github", "workflows", "ci.yml"));
-    console.log("\nNext steps:");
-    console.log("  ci run .ci/pipelines/cibuild.yml -w primary   # Run locally");
-    if (hasWorkflow) {
-        if (hasSecrets) {
-            console.log("  ci secrets upload                               # Upload secrets to GitHub");
-        }
-        console.log("  git add . && git push                          # Push to GitHub - CI runs automatically");
-    }
-    console.log("");
-}
-//# sourceMappingURL=build.js.map