@invarn/cibuild 2.9.6 → 2.9.8

package/dist/src/commands/a-properties-stand-in-declares-the-keys-the-build-reads.test.js

@@ -1,382 +0,0 @@
-/**
- * An empty properties file fixes "file missing", not "field missing".
- *
- * The Secrets Gradle plugin turns each key of the properties file it loads
- * into a `BuildConfig` constant and a manifest placeholder. A checkout without
- * that file gets neither, so handing the build an empty stand-in clears the
- * plugin's own throw and then fails one step later, inside Gradle, at the first
- * reference to a constant that was never generated.
- *
- * `missingPropertyKeys` is the list a stand-in has to declare for that
- * reference to resolve: what the build reads, read off the build files and the
- * source under the modules that apply the plugin.
- */
-import { mkdtempSync, rmSync, mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { scanAndroidProject } from "./android-scanner.js";
-let root;
-beforeEach(() => {
-    root = mkdtempSync(join(tmpdir(), "cibuild-props-"));
-});
-afterEach(() => {
-    rmSync(root, { recursive: true, force: true });
-});
-function write(relative, content) {
-    const path = join(root, relative);
-    mkdirSync(join(path, ".."), { recursive: true });
-    writeFileSync(path, content);
-}
-async function keys() {
-    return (await scanAndroidProject(root)).missingPropertyKeys;
-}
-/**
- * The shape the whole thing is for: one module applying the plugin, no
- * properties file anywhere, and the root declaring the plugin without
- * applying it — which is where a version catalog alias is nearly always named.
- */
-function projectApplyingTheSecretsPlugin(appBuildFileExtra = "") {
-    write("settings.gradle.kts", 'include(":app")\n');
-    write("build.gradle.kts", "plugins {\n  alias(libs.plugins.secrets) apply false\n}\n");
-    write("app/build.gradle.kts", `plugins {\n  id("com.android.application")\n  alias(libs.plugins.secrets)\n}\n\nandroid {\n  namespace = "com.example.app"\n${appBuildFileExtra}}\n`);
-    write(".gitignore", "local.properties\n");
-}
-describe("the keys a generated properties file has to declare", () => {
-    test("names a BuildConfig field referenced from Kotlin source", async () => {
-        projectApplyingTheSecretsPlugin();
-        write("app/src/main/java/com/example/app/Maps.kt", "package com.example.app\n\nval key: String = BuildConfig.MAPS_API_KEY\n");
-        expect(await keys()).toEqual(["MAPS_API_KEY"]);
-    });
-    test("names one referenced from Java source", async () => {
-        projectApplyingTheSecretsPlugin();
-        write("app/src/main/java/com/example/app/Maps.java", "package com.example.app;\n\nclass Maps { String k = BuildConfig.MAPS_API_KEY; }\n");
-        expect(await keys()).toEqual(["MAPS_API_KEY"]);
-    });
-    test("names a manifestPlaceholders key — Kotlin DSL, indexed", async () => {
-        projectApplyingTheSecretsPlugin('  defaultConfig {\n    manifestPlaceholders["mapsApiKey"] = "unused"\n  }\n');
-        expect(await keys()).toEqual(["mapsApiKey"]);
-    });
-    test("names a manifestPlaceholders key — Kotlin DSL, whole map", async () => {
-        projectApplyingTheSecretsPlugin('  defaultConfig {\n    manifestPlaceholders += mapOf("mapsApiKey" to "u", "adsAppId" to "u")\n  }\n');
-        expect(await keys()).toEqual(["adsAppId", "mapsApiKey"]);
-    });
-    test("names a manifestPlaceholders key — Groovy map literal", async () => {
-        write("settings.gradle", "include ':app'\n");
-        write("build.gradle", "// root\n");
-        write("app/build.gradle", "plugins {\n  id 'com.google.android.libraries.mapsplatform.secrets-gradle-plugin'\n}\n" +
-            "android {\n  defaultConfig {\n" +
-            "    manifestPlaceholders = [mapsApiKey: \"unused\", 'adsAppId': \"unused\"]\n" +
-            "  }\n}\n");
-        expect(await keys()).toEqual(["adsAppId", "mapsApiKey"]);
-    });
-    test("names a manifestPlaceholders key — Groovy put", async () => {
-        write("settings.gradle", "include ':app'\n");
-        write("build.gradle", "// root\n");
-        write("app/build.gradle", "plugins {\n  id 'com.google.android.libraries.mapsplatform.secrets-gradle-plugin'\n}\n" +
-            "android {\n  defaultConfig {\n" +
-            "    manifestPlaceholders.put('mapsApiKey', 'unused')\n" +
-            "  }\n}\n");
-        expect(await keys()).toEqual(["mapsApiKey"]);
-    });
-    test("merges both sources, sorted and deduplicated", async () => {
-        projectApplyingTheSecretsPlugin('  defaultConfig {\n    manifestPlaceholders["MAPS_API_KEY"] = "u"\n  }\n');
-        write("app/src/main/java/com/example/app/Keys.kt", "val a = BuildConfig.MAPS_API_KEY\nval b = BuildConfig.ADS_APP_ID\nval c = BuildConfig.MAPS_API_KEY\n");
-        expect(await keys()).toEqual(["ADS_APP_ID", "MAPS_API_KEY"]);
-    });
-});
-describe("what it deliberately leaves out", () => {
-    /**
-     * `BuildConfig.DEBUG` is the most-referenced constant in Android source, and
-     * AGP generates it whether or not a properties file exists. Declaring it
-     * would make the Secrets plugin generate a `String DEBUG` beside AGP's
-     * `boolean DEBUG` — the file meant to rescue the build breaking it instead.
-     */
-    test("the fields AGP generates by itself", async () => {
-        projectApplyingTheSecretsPlugin();
-        write("app/src/main/java/com/example/app/Env.kt", [
-            "val d = BuildConfig.DEBUG",
-            "val a = BuildConfig.APPLICATION_ID",
-            "val t = BuildConfig.BUILD_TYPE",
-            "val f = BuildConfig.FLAVOR",
-            "val fd = BuildConfig.FLAVOR_environment",
-            "val vc = BuildConfig.VERSION_CODE",
-            "val vn = BuildConfig.VERSION_NAME",
-            "val lp = BuildConfig.LIBRARY_PACKAGE_NAME",
-            "val mine = BuildConfig.MAPS_API_KEY",
-        ].join("\n"));
-        expect(await keys()).toEqual(["MAPS_API_KEY"]);
-    });
-    test("a project that applies no Secrets plugin", async () => {
-        write("settings.gradle.kts", 'include(":app")\n');
-        write("build.gradle.kts", "// root\n");
-        write("app/build.gradle.kts", 'plugins {\n  id("com.android.application")\n}\n');
-        write("app/src/main/java/com/example/app/Maps.kt", "val k = BuildConfig.MAPS_API_KEY\n");
-        expect(await keys()).toEqual([]);
-    });
-    /**
-     * `apply false` names the plugin's version for the modules that will apply
-     * it; the root project loads no properties file of its own. Reading it as an
-     * application would aim the source walk at the whole repository — every
-     * module's source, on the strength of a line that applies nothing.
-     */
-    test("a root that declares the plugin with apply false", async () => {
-        write("settings.gradle.kts", 'include(":app", ":other")\n');
-        write("build.gradle.kts", "plugins {\n  alias(libs.plugins.secrets) apply false\n}\n");
-        write("app/build.gradle.kts", 'plugins {\n  id("com.android.application")\n}\n');
-        write("other/build.gradle.kts", "// nothing\n");
-        write("other/src/main/java/Other.kt", "val k = BuildConfig.ELSEWHERE\n");
-        expect(await keys()).toEqual([]);
-    });
-    test("generated sources under build/", async () => {
-        projectApplyingTheSecretsPlugin();
-        write("app/build/generated/source/buildConfig/debug/com/example/app/BuildConfig.java", "public final class BuildConfig { public static final String STALE = BuildConfig.STALE; }\n");
-        write("app/src/main/java/com/example/app/Maps.kt", "val k = BuildConfig.MAPS_API_KEY\n");
-        expect(await keys()).toEqual(["MAPS_API_KEY"]);
-    });
-});
-describe("the module boundary", () => {
-    test("reads source of the module that applies the plugin, not its siblings", async () => {
-        write("settings.gradle.kts", 'include(":app", ":other")\n');
-        write("build.gradle.kts", "// root\n");
-        write("app/build.gradle.kts", 'plugins {\n  alias(libs.plugins.secrets)\n}\n');
-        write("app/src/main/java/App.kt", "val k = BuildConfig.MAPS_API_KEY\n");
-        write("other/build.gradle.kts", "// nothing\n");
-        write("other/src/main/java/Other.kt", "val k = BuildConfig.ELSEWHERE\n");
-        expect(await keys()).toEqual(["MAPS_API_KEY"]);
-    });
-    test("a root module that really applies the plugin covers the whole tree", async () => {
-        write("settings.gradle.kts", 'include(":app")\n');
-        write("build.gradle.kts", 'plugins {\n  id("com.android.application")\n  alias(libs.plugins.secrets)\n}\n');
-        write("app/build.gradle.kts", "// nothing\n");
-        write("app/src/main/java/App.kt", "val k = BuildConfig.MAPS_API_KEY\n");
-        expect(await keys()).toEqual(["MAPS_API_KEY"]);
-    });
-});
-/**
- * The warnings a customer already sees. This scan adds a field and reads more
- * files; it must not add, drop or reword a single warning, so the two paths
- * that emit a `secrets-plugin` warning are asserted whole.
- */
-describe("the Secrets-plugin warning path is unchanged", () => {
-    test("with no companion defaults file, the one file-absent warning", async () => {
-        projectApplyingTheSecretsPlugin();
-        write("app/src/main/java/com/example/app/Maps.kt", "val k = BuildConfig.MAPS_API_KEY\n");
-        const result = await scanAndroidProject(root);
-        expect(result.warnings.filter((w) => w.category === "secrets-plugin")).toEqual([
-            {
-                category: "secrets-plugin",
-                severity: "warning",
-                message: "Google Secrets Gradle Plugin reads 'local.properties' which is absent in CI",
-                hint: "Inject 'local.properties' as a file step using a secret variable",
-                // The root build file, which is where the version-catalog alias is
-                // named with `apply false`. The warning path counts that as an
-                // application and always has; `missingPropertyKeys` does not, which is
-                // why the two ask the question through different functions.
-                location: "build.gradle.kts",
-            },
-        ]);
-        // And the new field is populated in the same scan, from the same files.
-        expect(result.missingPropertyKeys).toEqual(["MAPS_API_KEY"]);
-    });
-    test("with a companion defaults file, one warning per expected key", async () => {
-        projectApplyingTheSecretsPlugin();
-        write("secrets.defaults.properties", "MAPS_API_KEY=\nADS_APP_ID=\n");
-        write("app/src/main/java/com/example/app/Maps.kt", "val k = BuildConfig.MAPS_API_KEY\n");
-        const result = await scanAndroidProject(root);
-        expect(result.warnings.filter((w) => w.category === "secrets-plugin")).toEqual([
-            {
-                category: "secrets-plugin",
-                severity: "warning",
-                message: "Secrets plugin key: MAPS_API_KEY",
-                hint: "Add via: ci secrets add MAPS_API_KEY",
-                location: "local.properties",
-            },
-            {
-                category: "secrets-plugin",
-                severity: "warning",
-                message: "Secrets plugin key: ADS_APP_ID",
-                hint: "Add via: ci secrets add ADS_APP_ID",
-                location: "local.properties",
-            },
-        ]);
-    });
-    test("a properties file that is present but not gitignored warns about neither", async () => {
-        write("settings.gradle.kts", 'include(":app")\n');
-        write("build.gradle.kts", "// root\n");
-        write("app/build.gradle.kts", "plugins {\n  alias(libs.plugins.secrets)\n}\n");
-        write("local.properties", "sdk.dir=/opt/android\n");
-        write("app/src/main/java/App.kt", "val k = BuildConfig.MAPS_API_KEY\n");
-        const result = await scanAndroidProject(root);
-        expect(result.warnings.filter((w) => w.category === "secrets-plugin")).toEqual([]);
-        // The keys are still reported. `invarn`-style callers run this scan on a
-        // developer's own checkout, where the file is nearly always present and
-        // holds nothing but `sdk.dir` — gating the keys on its absence would
-        // return nothing in exactly the case they are needed for.
-        expect(result.missingPropertyKeys).toEqual(["MAPS_API_KEY"]);
-    });
-});
-/**
- * The commonest shape of all, and the one the first three sources missed.
- *
- * The Secrets plugin's own documentation, and every Google Maps setup guide,
- * puts the key in the manifest and nowhere else. There is no `BuildConfig`
- * reference and no `manifestPlaceholders` block — the plugin substitutes the
- * value during manifest merging. A scan reading only build files and source
- * returns nothing for such a repository, which is the majority of them.
- */
-describe("a key referenced only in AndroidManifest.xml", () => {
-    test("names a placeholder the plugin fills", async () => {
-        projectApplyingTheSecretsPlugin();
-        write("app/src/main/AndroidManifest.xml", '<manifest xmlns:android="http://schemas.android.com/apk/res/android">\n' +
-            "  <application>\n" +
-            '    <meta-data android:name="com.google.android.geo.API_KEY"\n' +
-            '               android:value="${MAPS_API_KEY}" />\n' +
-            "  </application>\n</manifest>\n");
-        expect(await keys()).toEqual(["MAPS_API_KEY"]);
-    });
-    // AGP supplies this one from the variant, so it is not a value anybody owes.
-    test("ignores ${applicationId}", async () => {
-        projectApplyingTheSecretsPlugin();
-        write("app/src/main/AndroidManifest.xml", '<manifest>\n  <provider android:authorities="${applicationId}.provider" />\n</manifest>\n');
-        expect(await keys()).toEqual([]);
-    });
-    test("finds them in flavor source sets too", async () => {
-        projectApplyingTheSecretsPlugin();
-        write("app/src/main/AndroidManifest.xml", '<manifest a="${BASE_KEY}" />\n');
-        write("app/src/prod/AndroidManifest.xml", '<manifest a="${PROD_KEY}" />\n');
-        expect(await keys()).toEqual(["BASE_KEY", "PROD_KEY"]);
-    });
-    test("skips a merged manifest under build/", async () => {
-        projectApplyingTheSecretsPlugin();
-        write("app/src/main/AndroidManifest.xml", '<manifest a="${REAL_KEY}" />\n');
-        write("app/build/intermediates/merged_manifest/AndroidManifest.xml", '<manifest a="${STALE}" />\n');
-        expect(await keys()).toEqual(["REAL_KEY"]);
-    });
-});
-/**
- * A build that loads the properties file itself, with no Secrets plugin
- * anywhere. The file existing is not the fix for these — only the file
- * existing *with the key in it* is, because `getProperty` on an absent key
- * returns null whether or not the file is there.
- */
-describe("a build that reads the properties file directly", () => {
-    test("names a getProperty key, with no plugin applied", async () => {
-        write("settings.gradle.kts", 'include(":app")\n');
-        write("build.gradle.kts", "// root\n");
-        write("app/build.gradle.kts", 'import com.android.build.gradle.internal.cxx.configure.gradleLocalProperties\n' +
-            'val url: String = gradleLocalProperties(rootDir).getProperty("api.url.release")\n');
-        expect(await keys()).toEqual(["api.url.release"]);
-    });
-    test("keeps dotted keys, which a direct reader may use freely", async () => {
-        write("settings.gradle", "include ':app'\n");
-        write("build.gradle", "// root\n");
-        write("app/build.gradle", "def props = new Properties()\n" +
-            "props.load(rootProject.file('local.properties').newDataInputStream())\n" +
-            "def a = props.getProperty('api.url.debug')\n" +
-            "def b = props.getProperty('tv.isDebug')\n");
-        expect(await keys()).toEqual(["api.url.debug", "tv.isDebug"]);
-    });
-    test("honours a default argument without treating it as a key", async () => {
-        write("settings.gradle.kts", 'include(":app")\n');
-        write("build.gradle.kts", "// root\n");
-        write("app/build.gradle.kts", 'val p = java.util.Properties()\n' +
-            'p.load(rootProject.file("local.properties").reader())\n' +
-            'val u = p.getProperty("api.url.release", "")\n');
-        expect(await keys()).toEqual(["api.url.release"]);
-    });
-    /**
-     * The idiom that hides every key behind a name the repository chose. Without
-     * following it, a repository like this reads as having no keys at all.
-     */
-    test("follows a hand-rolled accessor to its call sites", async () => {
-        write("settings.gradle", "include ':app'\n");
-        write("build.gradle", "// root\n");
-        write("app/build.gradle", "def getProps(String propName) {\n" +
-            "    def propsFile = rootProject.file('local.properties')\n" +
-            "    if (propsFile.exists()) {\n" +
-            "        def props = new Properties()\n" +
-            "        props.load(new FileInputStream(propsFile))\n" +
-            "        return props[propName]\n" +
-            "    } else {\n" +
-            "        return \"\";\n" +
-            "    }\n" +
-            "}\n" +
-            "\n" +
-            "String signFilePath = getProps(\"sign.file\")\n" +
-            "Boolean noObfuscate = getProps(\"app.dontobfuscate\")?.toBoolean() ?: false\n");
-        expect(await keys()).toEqual(["app.dontobfuscate", "sign.file"]);
-    });
-    test("does not follow a function that reads something else", async () => {
-        write("settings.gradle", "include ':app'\n");
-        write("build.gradle", "// root\n");
-        write("app/build.gradle", "def getProps(String n) {\n" +
-            "    def p = new Properties()\n" +
-            "    p.load(rootProject.file('local.properties').newDataInputStream())\n" +
-            "    return p[n]\n" +
-            "}\n" +
-            "def version(String n) {\n" +
-            "    def p = new Properties()\n" +
-            "    p.load(rootProject.file('version.properties').newDataInputStream())\n" +
-            "    return p[n]\n" +
-            "}\n" +
-            "def a = getProps('wanted')\n" +
-            "def b = version('unwanted')\n");
-        expect(await keys()).toEqual(["wanted"]);
-    });
-    /**
-     * `properties["x"]` is the Gradle *project* property channel —
-     * `gradle.properties` and `-P` — which the scan already reports separately.
-     * Declaring those in a properties file would be the wrong file entirely.
-     */
-    test("does not confuse Gradle project properties for properties-file keys", async () => {
-        write("settings.gradle.kts", 'include(":app")\n');
-        write("build.gradle.kts", "// root\n");
-        write("app/build.gradle.kts", 'val p = java.util.Properties()\n' +
-            'p.load(rootProject.file("local.properties").reader())\n' +
-            'val a = p.getProperty("wanted")\n' +
-            'val b = properties["projectScoped"]\n' +
-            'val c = findProperty("alsoProjectScoped")\n');
-        expect(await keys()).toEqual(["wanted"]);
-    });
-    /** A developer's own SDK path is not a value anybody owes the build. */
-    test("never names a machine-local key", async () => {
-        write("settings.gradle.kts", 'include(":app")\n');
-        write("build.gradle.kts", "// root\n");
-        write("app/build.gradle.kts", 'val p = java.util.Properties()\n' +
-            'p.load(rootProject.file("local.properties").reader())\n' +
-            'val sdk = p.getProperty("sdk.dir")\n' +
-            'val ndk = p.getProperty("ndk.dir")\n' +
-            'val cmake = p.getProperty("cmake.dir")\n' +
-            'val real = p.getProperty("api.key")\n');
-        expect(await keys()).toEqual(["api.key"]);
-    });
-});
-/**
- * A scan that answers well on a small repository and thins out on a large one
- * is the worse of the two failures, because the large one is the one someone
- * is paid to build.
- *
- * Manifests and source shared a file budget at first, and source was walked
- * first. Measured on a real application — 1743 source files, 47 manifests —
- * the source walk spent the whole budget and the manifests were never opened,
- * so every key referenced only as `${KEY}` in a manifest came back missing.
- * Nine of that application's twenty declared keys were lost that way, and the
- * scan reported the other eleven with no sign anything was wrong.
- *
- * This is the only test here that builds a tree big enough to exhaust a
- * budget, because that is the only way to express the defect. It costs about
- * half a second.
- */
-describe("a repository larger than the source budget", () => {
-    test("still reads its manifests", async () => {
-        projectApplyingTheSecretsPlugin();
-        write("app/src/main/AndroidManifest.xml", '<manifest android:value="${MANIFEST_ONLY_KEY}" />\n');
-        // Past SOURCE_FILE_CAP, spread over directories so no single readdir is
-        // unrepresentative.
-        for (let i = 0; i < 8100; i++) {
-            write(`app/src/main/java/p${i % 40}/F${i}.kt`, `val x${i} = 1\n`);
-        }
-        expect(await keys()).toContain("MANIFEST_ONLY_KEY");
-    }, 60_000);
-});
-//# sourceMappingURL=a-properties-stand-in-declares-the-keys-the-build-reads.test.js.map

package/dist/src/commands/an-already-stored-value-does-not-answer-the-target-question.test.d.ts

@@ -1,29 +0,0 @@
-/**
- * A value already in `.cibuild-secrets.json` answers "what are the bytes".
- * It does not answer "where does each workflow write them", and
- * `collectFileSecret` used to treat the two as one question.
- *
- * `pendingGroups` is empty when every group already has the secret — and a
- * **global** entry satisfies `hasSecret(name, workflow)` for every workflow, so
- * one `ci init` in the repository's past is enough. The call then returned an
- * empty paths map, the caller assigned that to `setupOptions.keystorePaths`,
- * and the fallback filled every workflow from one source: the `storeFile=`
- * line of whatever `keystore.properties` was collected, or the first path
- * Gradle mentioned. One path for three workflows is one discriminator, so
- * `credentialSlots` declared a single flat `KEYSTORE_BASE64` and the whole
- * per-workflow split was lost — silently, and on exactly the credential the
- * split exists for.
- *
- * Measured on the real repository, 2026-09-09: the store held
- * `KEYSTORE_BASE64` globally, the keystore prompt never appeared, and all
- * three workflows were generated writing to `customer-android.jks` — the
- * release key's path, over the two debug workflows. A fresh clone of the same
- * repository prompts and splits correctly, which is why this never showed up
- * in a test that builds its own fixture from nothing.
- *
- * The store records values and never paths, so the path has to be asked for
- * whichever the value's state is. Only a caller that consumes the returned map
- * is affected — `promptTargetPath` marks it — so nothing else gains a prompt.
- */
-export {};
-//# sourceMappingURL=an-already-stored-value-does-not-answer-the-target-question.test.d.ts.map

package/dist/src/commands/an-already-stored-value-does-not-answer-the-target-question.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"an-already-stored-value-does-not-answer-the-target-question.test.d.ts","sourceRoot":"","sources":["../../../src/commands/an-already-stored-value-does-not-answer-the-target-question.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG"}

package/dist/src/commands/an-already-stored-value-does-not-answer-the-target-question.test.js

@@ -1,160 +0,0 @@
-/**
- * A value already in `.cibuild-secrets.json` answers "what are the bytes".
- * It does not answer "where does each workflow write them", and
- * `collectFileSecret` used to treat the two as one question.
- *
- * `pendingGroups` is empty when every group already has the secret — and a
- * **global** entry satisfies `hasSecret(name, workflow)` for every workflow, so
- * one `ci init` in the repository's past is enough. The call then returned an
- * empty paths map, the caller assigned that to `setupOptions.keystorePaths`,
- * and the fallback filled every workflow from one source: the `storeFile=`
- * line of whatever `keystore.properties` was collected, or the first path
- * Gradle mentioned. One path for three workflows is one discriminator, so
- * `credentialSlots` declared a single flat `KEYSTORE_BASE64` and the whole
- * per-workflow split was lost — silently, and on exactly the credential the
- * split exists for.
- *
- * Measured on the real repository, 2026-09-09: the store held
- * `KEYSTORE_BASE64` globally, the keystore prompt never appeared, and all
- * three workflows were generated writing to `customer-android.jks` — the
- * release key's path, over the two debug workflows. A fresh clone of the same
- * repository prompts and splits correctly, which is why this never showed up
- * in a test that builds its own fixture from nothing.
- *
- * The store records values and never paths, so the path has to be asked for
- * whichever the value's state is. Only a caller that consumes the returned map
- * is affected — `promptTargetPath` marks it — so nothing else gains a prompt.
- */
-import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, resolve } from 'node:path';
-import prompts from 'prompts';
-import { collectFileSecret } from './file-secret-collector.js';
-import { SecretsManager } from '../yaml/secrets-manager.js';
-import { credentialSlots } from './build.js';
-const KEYSTORE_GROUPS = [
-    { label: 'debug builds (primary, pull-request)', workflows: ['primary', 'pull-request'] },
-    { label: 'release', workflows: ['release'] },
-];
-let workdir;
-let secretsManager;
-// `prompts.inject` concatenates, so a sentinel one test leaves queued becomes
-// the next test's answer. The queue itself is the only reset there is.
-const clearInjected = () => {
-    prompts._injected = undefined;
-};
-beforeEach(() => {
-    clearInjected();
-    workdir = resolve(mkdtempSync(join(tmpdir(), 'cibuild-stored-value-target-')));
-    secretsManager = new SecretsManager(join(workdir, '.cibuild-secrets.json'));
-});
-afterEach(() => {
-    clearInjected();
-    rmSync(workdir, { recursive: true, force: true });
-});
-function put(relPath, contents) {
-    const full = join(workdir, relPath);
-    mkdirSync(join(full, '..'), { recursive: true });
-    writeFileSync(full, contents, 'utf-8');
-    return full;
-}
-/** The repository's shape: a committed debug key and an uncommitted release key. */
-function twoKeystores() {
-    return {
-        debug: put('config/debug.keystore', 'debug-key-bytes'),
-        release: put('app/customer-android.jks', 'release-key-bytes'),
-    };
-}
-function collectKeystore() {
-    return collectFileSecret({
-        displayName: 'keystore',
-        secretName: 'KEYSTORE_BASE64',
-        fileMatch: (name) => name.endsWith('.jks') || name.endsWith('.keystore'),
-        readAs: 'base64',
-        workflowGroups: KEYSTORE_GROUPS,
-        promptTargetPath: true,
-    }, workdir, secretsManager);
-}
-describe('a keystore whose value the store already holds', () => {
-    test('is still asked where each workflow writes it', async () => {
-        const { debug, release } = twoKeystores();
-        // One `ci init` in this repository's past, filed globally — which is what
-        // the real repository had.
-        secretsManager.storeSecret('KEYSTORE_BASE64', 'already-here');
-        prompts.inject([debug, release]);
-        const paths = await collectKeystore();
-        expect(paths).toEqual({
-            primary: 'config/debug.keystore',
-            'pull-request': 'config/debug.keystore',
-            release: 'app/customer-android.jks',
-        });
-    });
-    test('so the credential still declares one slot per workflow', async () => {
-        const { debug, release } = twoKeystores();
-        secretsManager.storeSecret('KEYSTORE_BASE64', 'already-here');
-        prompts.inject([debug, release]);
-        const paths = await collectKeystore();
-        const discriminatorByWorkflow = Object.fromEntries(Object.entries(paths).map(([workflow, path]) => [workflow, path]));
-        // One declaration per workflow, each under the plain name — what varies is
-        // the `envs` block it is emitted into, not the key.
-        expect(credentialSlots('KEYSTORE_BASE64', discriminatorByWorkflow)).toEqual([
-            { slot: 'KEYSTORE_BASE64', workflow: 'primary' },
-            { slot: 'KEYSTORE_BASE64', workflow: 'pull-request' },
-            { slot: 'KEYSTORE_BASE64', workflow: 'release' },
-        ]);
-    });
-    test('and a workflow-scoped entry hides the question just as well as a global one', async () => {
-        const { debug, release } = twoKeystores();
-        for (const workflow of ['primary', 'pull-request', 'release']) {
-            secretsManager.storeSecret('KEYSTORE_BASE64', 'already-here', workflow);
-        }
-        prompts.inject([debug, release]);
-        expect(await collectKeystore()).toEqual({
-            primary: 'config/debug.keystore',
-            'pull-request': 'config/debug.keystore',
-            release: 'app/customer-android.jks',
-        });
-    });
-    test('and the value the user picks now replaces the one that was there', async () => {
-        const { debug, release } = twoKeystores();
-        secretsManager.storeSecret('KEYSTORE_BASE64', 'already-here');
-        prompts.inject([debug, release]);
-        await collectKeystore();
-        // Re-reading it is the point: a stale global value is what would otherwise
-        // be uploaded for all three workflows.
-        expect(secretsManager.getSecret('KEYSTORE_BASE64', 'primary')).toBe(Buffer.from('debug-key-bytes').toString('base64'));
-        expect(secretsManager.getSecret('KEYSTORE_BASE64', 'release')).toBe(Buffer.from('release-key-bytes').toString('base64'));
-    });
-});
-describe('a credential whose caller does not need a path back', () => {
-    test('still short-circuits on an already-stored value, and asks nothing', async () => {
-        // `google-services.json`, `local.properties` and `keystore.properties` take
-        // their targets from the pipeline's own flavors, not from this call, so the
-        // early return is right for them and must stay. No answer is injected: a
-        // prompt here would hang or take undefined, and either fails the test.
-        put('app/src/prod/google-services.json', '{}');
-        secretsManager.storeSecret('GOOGLE_SERVICES_JSON', 'already-here');
-        const paths = await collectFileSecret({
-            displayName: 'google-services.json',
-            secretName: 'GOOGLE_SERVICES_JSON',
-            fileMatch: (name) => name === 'google-services.json',
-            readAs: 'text',
-            workflowGroups: [{ label: 'release', workflows: ['release'] }],
-        }, workdir, secretsManager);
-        expect(paths).toEqual({});
-        expect(secretsManager.getSecret('GOOGLE_SERVICES_JSON', 'release')).toBe('already-here');
-    });
-});
-describe('a keystore the store has never seen', () => {
-    test('behaves exactly as it did before', async () => {
-        const { debug, release } = twoKeystores();
-        prompts.inject([debug, release]);
-        expect(await collectKeystore()).toEqual({
-            primary: 'config/debug.keystore',
-            'pull-request': 'config/debug.keystore',
-            release: 'app/customer-android.jks',
-        });
-    });
-});
-//# sourceMappingURL=an-already-stored-value-does-not-answer-the-target-question.test.js.map

package/dist/src/commands/android-gms-guard.test.d.ts

@@ -1,9 +0,0 @@
-/**
- * A plugin applied inside `if (file("…").exists()) { … }` is conditional on a
- * file the build may not have. Counting it as a hard credential requirement
- * sends the user looking for a file the build never asks for — and, when the
- * same rule is used to predict outcomes, reports projects as blocked that
- * build green with no credential at all.
- */
-export {};
-//# sourceMappingURL=android-gms-guard.test.d.ts.map

package/dist/src/commands/android-gms-guard.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"android-gms-guard.test.d.ts","sourceRoot":"","sources":["../../../src/commands/android-gms-guard.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}