@starci/hfs 5.0.5 → 5.0.6

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 5.0.6
+
+- Changed: Support sealed per-project quality-service credentials and preserve valid composite cache entries and reused spec records.
+
+- Fixed: Preserve generated-contract provenance in front-end tier and bounds checks.
+
 ## 5.0.5
 
 - Changed: Govern each app-check linter, compiler, test discovery and coverage, contract emitter and boot child through the CLI execution port with actual worker limits and complete output capture. Preserve cache identities, closure, flush behavior and coverage thresholds. Record source-proven native Page body layouts with their contextual constraints.

package/README.md

@@ -26,6 +26,7 @@ starci app slot <path> [--cwd <dir>] [--json]
 starci app emit [--cwd <dir>]
 starci app db drift [--db-url-env <NAME>] [--json] [--cwd <dir>]
 starci app secret init | <set|get|unset|rename|remove|materialize|list|verify|recipients|migrate|split|audit|server-key> --env <env> ... [--cwd <dir>]
+starci app ci secret set <NAME> [--from-custody] [--env <env>] [--repo <owner/name>] [--execute]
 ```
 
 `starci app add` writes every front-end unit, in either edition, already in the shape of the harness's `contexts/code/fe`
@@ -227,8 +228,9 @@ read until `migrate` moves it (`runtime/scripts/lib/sealed-member.mjs` names bot
 seals every named key in one sops write (`runtime/scripts/hfs/secret.mjs`): on a terminal it prompts `<KEY>: ` for each with
 masked input (one `*` per character; a paste, backspace, Enter, Ctrl+C to cancel with nothing written), redirected stdin gives
 one key its whole text or several one `KEY=value` line each, `--from-file KEY=path` reads a key byte for byte
-(`secret-prompt.mjs`), and `--generate <bytes>` makes a random value per key. It then declares the keys in the environment's
-`secrets:` of a compose environment (`declareKeys`, `secret-standard.mjs`) and names a swarm environment's to wire by hand.
+(`secret-prompt.mjs`), and `--generate <bytes>` makes a random value per key. Keys declared by exact service credential
+references stay with that consumer; other keys are declared in the environment's `secrets:` of a compose environment
+(`declareKeys`, `secret-standard.mjs`), while a swarm environment's are named to wire by hand.
 A member is sealed to its environment's rule of the managed `.sops.yaml`; `recipients --env <env> [--add|--remove <age1...|owner>]`
 rewrites that rule (`environmentRecipients`, `secret-init.mjs`), and `init` takes the owner's identity as the app's recipient.
 Re-sealing a member whose every key the set replaces needs no age identity; adding a key to one does, and the identity is found
@@ -244,6 +246,24 @@ except `get --reveal`.
 
 ## Sonar
 
+The product's `.starcistacks/application-stacks.yaml` holds its connection profile: provider, local/hosted mode, public
+URL and `projects` entries. Each stored username, password, private URL or token has a separate `credentials[]` reference
+to its actual sealed member and `key`; a private endpoint uses `host.fromCredential`. A project analysis reference has
+`project: <projects[].key>`, independently of its reference `id`. Operator/admin login keys live in a separate authority
+member and are never selected implicitly by analysis or CI. Change the declared connection profile when moving to a
+hosted/cloud server; usernames, passwords and tokens remain sealed.
+
+The CI execution copy is explicit: `services.sonar.ci.secrets: [{name: <CI_NAME>, credential: <analysis-id>}]`, with
+`ci.token: <CI_NAME>` and the name/scope declared in the top-level `ci.secrets`. Declare the exact product credential
+first, seal it with `starci app secret set --env <declared-env> <provider> <KEY>`, then run
+`starci app ci secret set <CI_NAME> --from-custody` to inspect the plan and add `--execute` to stream its selected value
+to the CI provider. A dry run decrypts no credential, reads no stdin and reaches no remote. Custody input uses terminal or
+closed/null stdin; a competing pipe/file channel, even empty, is refused without reading it. A private endpoint has its
+own explicit secret-copy link selected by `ci.hostVar`; public endpoint selectors read CI variables. The native local release opens
+the selected product token through the common SOPS identity loader in memory and passes it only to the scanner child.
+Missing, ambiguous, unopenable, wrong-project or runtime-granted custody is a failure, with no host/global fallback.
+Analysis never creates a project, replaces its history or rotates a token. OIDC Codecov keeps no synthetic token member.
+
 One mechanism for both sides: every finding of the canon is imported into Sonar, and the quality gate
 fails while any is open. Nothing is configured per app; the pieces are managed files (`starci app sync`) and this package.
 

package/cache/session.mjs

@@ -137,7 +137,7 @@ export function createDiskSession(options) {
             // A file edited while the run read it gets no record.
             const settled = new Map();
             for (const [folder, { records }] of replaced) {
-                settled.set(folder, records.filter((record) => index.hashOf(record.path) === undefined || hashFile(path.join(root, record.path)) === record.hash));
+                settled.set(folder, records.filter((record) => index.hashOf(record.path) === undefined || hashFile(path.join(root, record.path)) === index.hashOf(record.path)));
             }
             if (trust.kind === 'base') {
                 const committed = new Map();

package/cache/test-family.d.mts

@@ -68,7 +68,7 @@ export interface TestFamilyResult {
     readonly ok: boolean;
     readonly ran: readonly string[];
     readonly reused: readonly string[];
-    /** Specs that failed or did not report: nothing of theirs is stored. */
+    /** Specs that failed, did not report, or whose inputs changed: nothing of theirs is stored. */
     readonly failed: readonly string[];
     /** The merged lcov, or undefined when no spec has a record. */
     readonly lcov: string | undefined;

package/cache/test-family.mjs

@@ -83,9 +83,8 @@ export async function runTestFamily(options) {
             const reported = new Map(jest.readCoverage(scratch).map((file) => [file.spec, file]));
             for (const spec of toRun) {
                 const file = reported.get(posix(path.relative(path.join(session.root, side), path.join(session.root, spec))));
-                const key = specKey({ spec, closure: jest.closureOf(spec), configHash: jest.configHash, hashOf });
-                // A spec that failed, did not report, or whose files changed while it ran stores nothing.
-                if (file?.passed === true && key === keys.get(spec))
+                const key = keys.get(spec);
+                if (file?.passed === true && key !== undefined)
                     fresh.push(recordOf(spec, key, file.sources, side));
                 else
                     failed.push(spec);
@@ -96,9 +95,18 @@ export async function runTestFamily(options) {
                 fs.rmSync(scratch, { recursive: true, force: true });
         }
     }
-    progress.tick(jest.specs.length, kept.length, toRun.length);
+    // Recheck every candidate against disk, including a reused spec whose inputs another running spec could change.
+    const records = [...kept, ...fresh].filter((record) => {
+        const key = specKey({ spec: record.path, closure: jest.closureOf(record.path), configHash: jest.configHash, hashOf: (file) => hashFile(path.join(session.root, file)) });
+        if (key === keys.get(record.path))
+            return true;
+        failed.push(record.path);
+        return false;
+    });
+    const settled = new Set(records.map((record) => record.path));
+    const reused = kept.filter((record) => settled.has(record.path));
+    progress.tick(jest.specs.length, reused.length, toRun.length);
     progress.end();
-    const records = [...kept, ...fresh];
     session.replace(TEST_FOLDER, records);
     let lcov;
     let threshold;
@@ -117,13 +125,13 @@ export async function runTestFamily(options) {
         mode: decision.mode,
         reason: decision.reason,
         checked: toRun.length,
-        reused: kept.length,
+        reused: reused.length,
         newFindings: failed.length + thresholdFindings,
         knownFindings: 0,
         fixedFindings: 0,
     };
     session.report(report);
-    return { ok: failed.length === 0 && (threshold?.ok ?? records.length === 0), ran: toRun, reused: kept.map((record) => record.path), failed, lcov, threshold, report, output };
+    return { ok: failed.length === 0 && (threshold?.ok ?? records.length === 0), ran: toRun, reused: reused.map((record) => record.path), failed, lcov, threshold, report, output };
 }
 /** The digest of a project config with host paths turned into `<root>` and the keys that differ per host dropped. */
 export function projectConfigHash(config) {

package/ci/cli.d.mts

@@ -1,9 +1,11 @@
+import { type SecretSops } from '../runtime/scripts/hfs/secret-sops.mjs';
+import type { AgeHost } from '../runtime/scripts/hfs/secret-init.mjs';
 import type { GhSpawn, StdinSource } from './github.mjs';
 /** The commands of `starci app ci` (besides `local`) with the options each takes; the parser refuses every other. */
 export declare const COMMANDS: Record<string, string[]>;
 export declare const BOOLEAN: Set<string>;
 /** Manifest and sealed key reads remain offline; only github.mjs may invoke the GitHub CLI. */
-export declare function ciMain(argv: string[], { cwd, stdout, stderr, stdin, env, tools }?: {
+export declare function ciMain(argv: string[], { cwd, stdout, stderr, stdin, env, tools, hostIdentity, sops, platform, inputRedirected }?: {
     cwd?: string | undefined;
     stdout?: ((text: string) => unknown) | undefined;
     stderr?: ((text: string) => unknown) | undefined;
@@ -12,4 +14,8 @@ export declare function ciMain(argv: string[], { cwd, stdout, stderr, stdin, env
     tools?: {
         spawn?: GhSpawn | undefined;
     } | undefined;
+    hostIdentity?: AgeHost | null | undefined;
+    sops?: Pick<SecretSops, 'decrypt'> | null | undefined;
+    platform?: NodeJS.Platform | undefined;
+    inputRedirected?: (() => boolean) | undefined;
 }): Promise<number>;

package/ci/cli.mjs

@@ -1,19 +1,22 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { parseYaml } from '../runtime/engine/yaml.mjs';
-import { isValidCiDeclaration, readCiDeclaration, sealedKeyNames } from '../runtime/scripts/hfs/ci-declaration.mjs';
+import { isValidCiDeclaration, readCiDeclaration, sealedKeyNames, serviceBindings, serviceCredentialNames, runtimeGranted } from '../runtime/scripts/hfs/ci-declaration.mjs';
+import { repositoryName, identityQueryEnvironment } from '../runtime/scripts/hfs/repo-identity.mjs';
+import { serviceCredentialFile, serviceCredentialValue } from '../runtime/scripts/hfs/secret-store.mjs';
+import { defaultSops } from '../runtime/scripts/hfs/secret-sops.mjs';
 import { github, refuse } from './github.mjs';
 import { setSecret } from './secret.mjs';
 import { setVariable, syncVariables } from './vars.mjs';
 import { badgeVisibilityNotices, verifyCi } from './verify.mjs';
 /** The commands of `starci app ci` (besides `local`) with the options each takes; the parser refuses every other. */
 export const COMMANDS = {
-    'secret set': ['env', 'dependabot', 'repo', 'execute'],
+    'secret set': ['env', 'dependabot', 'repo', 'execute', 'from-custody'],
     'var set': ['env', 'value', 'repo', 'execute'],
     'var sync': ['execute', 'repo'],
     verify: ['json', 'repo'],
 };
-export const BOOLEAN = new Set(['dependabot', 'execute', 'json']);
+export const BOOLEAN = new Set(['dependabot', 'execute', 'json', 'from-custody']);
 /** Invalid options never echo argv, because an extra argument may itself contain a secret. */
 function parse(argv) {
     const command = argv[0] === 'verify' ? 'verify' : argv.slice(0, 2).join(' ');
@@ -52,7 +55,7 @@ function parse(argv) {
     return { command, options: options, name: positional[0] };
 }
 /** Manifest and sealed key reads remain offline; only github.mjs may invoke the GitHub CLI. */
-export async function ciMain(argv, { cwd = process.cwd(), stdout = (s) => process.stdout.write(s), stderr = (s) => process.stderr.write(s), stdin, env = process.env, tools = {} } = {}) {
+export async function ciMain(argv, { cwd = process.cwd(), stdout = (s) => process.stdout.write(s), stderr = (s) => process.stderr.write(s), stdin, env = process.env, tools = {}, hostIdentity, sops, platform = process.platform, inputRedirected } = {}) {
     // `ci local` runs the rendered CI on this machine (local.mjs): no manifest custody and no GitHub.
     if (argv[0] === 'local')
         return (await import('./local.mjs')).ciLocalMain(argv.slice(1), { cwd, stdout, stderr, env });
@@ -69,8 +72,36 @@ export async function ciMain(argv, { cwd = process.cwd(), stdout = (s) => proces
         }
         if (!isValidCiDeclaration(declaration))
             throw refuse('CI_DECLARATION_INVALID', 'correct the CI declaration before using GitHub');
-        const gh = github({ cwd, env, spawn: tools.spawn });
-        const context = { ...parsed, declaration, sealed, gh, stdin, stdout };
+        const childEnv = identityQueryEnvironment(env, serviceCredentialNames(doc));
+        const repository = repositoryName(cwd, { env: childEnv }), selected = serviceBindings(doc, repository);
+        if (selected.problems.length)
+            throw refuse('CI_CUSTODY_INVALID', 'correct the explicit project service credential bindings before using CI');
+        const runtime = sealed.filter((entry) => runtimeGranted(doc, entry.env, entry.member, entry.key));
+        if (parsed.command.endsWith(' set') && runtime.some((entry) => entry.key === parsed.name))
+            throw refuse('APP_SECRET_IN_CI', 'the selected key belongs to app runtime authority');
+        if (parsed.options['from-custody']) {
+            const binding = selected.bindings.find((item) => item.name === parsed.name);
+            if (!binding || parsed.options.dependabot)
+                throw refuse('CI_CUSTODY_INVALID', 'one project service binding is required');
+            try {
+                serviceCredentialFile(cwd, binding);
+            }
+            catch {
+                throw refuse('CI_CUSTODY_INVALID', 'the selected project member is missing, ambiguous or outside this product');
+            }
+            if (parsed.options.repo && (parsed.options.repo.split('/')[1] !== repository || (doc.ci?.github?.repository && parsed.options.repo !== doc.ci.github.repository)))
+                throw refuse('CI_CUSTODY_INVALID', 'the destination repository differs from this project');
+        }
+        const gh = github({ cwd, env: childEnv, spawn: tools.spawn });
+        const custody = (binding) => {
+            try {
+                return serviceCredentialValue(cwd, binding, sops ?? defaultSops(env, cwd, platform, undefined, hostIdentity));
+            }
+            catch {
+                throw refuse('CI_CUSTODY_UNAVAILABLE', 'the selected service member could not be opened with the owner identity');
+            }
+        };
+        const context = { ...parsed, declaration, sealed, runtime, gh, stdin, stdout, bindings: selected.bindings, custody, inputRedirected };
         if (parsed.command === 'secret set')
             return await setSecret(context);
         if (parsed.command === 'var set')

package/ci/github.d.mts

@@ -11,6 +11,7 @@ export interface CiOptions extends CiScope {
     value?: string | undefined;
     execute?: boolean | undefined;
     json?: boolean | undefined;
+    'from-custody'?: boolean | undefined;
 }
 /** One declared CI secret or variable of a declaration without problems (runtime/scripts/hfs/ci-declaration.mjs readCiDeclaration). */
 export type CiEntry = ValidCiEntry;

package/ci/secret.d.mts

@@ -1,10 +1,16 @@
 import type { CiDeclaration, CiEntry, CiOptions, Gh, StdinSource } from './github.mjs';
+import { type ServiceBinding } from '../runtime/scripts/hfs/ci-declaration.mjs';
+/** An input pipe or file is an input source even before its bytes arrive; fstat never consumes its value. */
+export declare function redirectedSecretInput(): boolean;
 /** A declared name must belong to the requested store before a secret body is read. */
 export declare function declaredEntry(entries: readonly CiEntry[], name: string, options: CiOptions): CiEntry;
 /** Secret input is read once, stripped of one trailing newline, and passed only to the child stdin; without options.execute nothing is read or written. */
-export declare function setSecret({ declaration, sealed, gh, options, name, stdin, stdout }: {
+export declare function setSecret({ declaration, sealed, gh, options, name, stdin, stdout, bindings, custody, inputRedirected }: {
     declaration: CiDeclaration;
     sealed: readonly {
+        env?: string;
+        member?: string;
+        file?: string;
         key: string;
     }[];
     gh: Gh;
@@ -12,4 +18,7 @@ export declare function setSecret({ declaration, sealed, gh, options, name, stdi
     name: string;
     stdin: StdinSource;
     stdout: (text: string) => unknown;
+    bindings?: ServiceBinding[];
+    custody?: ((binding: ServiceBinding) => string) | undefined;
+    inputRedirected?: (() => boolean) | undefined;
 }): Promise<number>;

package/ci/secret.mjs

@@ -1,5 +1,16 @@
 import fs from 'node:fs';
 import { refuse, scopeArgs, scopeName } from './github.mjs';
+import { boundSealedKey } from '../runtime/scripts/hfs/ci-declaration.mjs';
+/** An input pipe or file is an input source even before its bytes arrive; fstat never consumes its value. */
+export function redirectedSecretInput() {
+    try {
+        const input = fs.fstatSync(0);
+        return !input.isCharacterDevice();
+    }
+    catch {
+        return false;
+    }
+}
 /** A declared name must belong to the requested store before a secret body is read. */
 export function declaredEntry(entries, name, options) {
     const entry = entries.find((item) => item.name === name);
@@ -11,24 +22,33 @@ export function declaredEntry(entries, name, options) {
     return entry;
 }
 /** Secret input is read once, stripped of one trailing newline, and passed only to the child stdin; without options.execute nothing is read or written. */
-export async function setSecret({ declaration, sealed, gh, options, name, stdin, stdout }) {
-    if (sealed.some((item) => item.key === name))
-        throw refuse('CI_SECRET_SEALED', 'the name belongs to a sealed app secret');
+export async function setSecret({ declaration, sealed, gh, options, name, stdin, stdout, bindings = [], custody, inputRedirected = redirectedSecretInput }) {
     declaredEntry(options.dependabot ? declaration.dependabotSecrets : declaration.secrets, name, options);
+    const binding = options.dependabot ? undefined : bindings.find((item) => item.name === name);
+    if (sealed.some((item) => (item.key === name || (binding && item.key === binding.key)) && !(binding && boundSealedKey(binding, item))))
+        throw refuse('CI_SECRET_SEALED', 'the name or selected key belongs to unrelated sealed app custody');
+    if (binding && options['from-custody'] !== true)
+        throw refuse('CI_CUSTODY_REQUIRED', 'this service secret is an execution copy; use --from-custody');
+    if (options['from-custody'] && (!binding || !custody))
+        throw refuse('CI_CUSTODY_INVALID', 'one explicit project service credential binding is required');
+    if (options['from-custody'] && (stdin !== undefined || inputRedirected()))
+        throw refuse('CI_VALUE_AMBIGUOUS', 'choose custody or stdin, never both');
     // Dry until --execute: the name is judged, but no value is read and GitHub is not reached; the line never carries a value.
     if (options.execute !== true) {
-        stdout(`dry run: would set secret ${name} (${scopeName(options)}) from the value on stdin; add --execute\n`);
+        stdout(`dry run: would set secret ${name} (${scopeName(options)}) from ${binding ? 'its declared service custody' : 'the value on stdin'}; add --execute\n`);
         return 0;
     }
     let value;
-    if (stdin === undefined) {
+    if (binding && custody)
+        value = custody(binding);
+    else if (stdin === undefined) {
         if (process.stdin.isTTY)
             throw refuse('CI_VALUE_EMPTY', 'a secret value is required on stdin');
         value = fs.readFileSync(0, 'utf8');
     }
     else
         value = typeof stdin === 'function' ? await stdin() : stdin;
-    value = String(value ?? '').replace(/\r?\n$/, '');
+    value = binding ? value : String(value ?? '').replace(/\r?\n$/, '');
     if (!value.length)
         throw refuse('CI_VALUE_EMPTY', 'a secret value is required on stdin');
     const repo = gh.repository(options.repo);

package/ci/verify.d.mts

@@ -1,14 +1,22 @@
 import type { CiDeclaration, CiOptions, Gh } from './github.mjs';
+import { type ServiceBinding } from '../runtime/scripts/hfs/ci-declaration.mjs';
 /** Verification reports names and scopes only; values are compared in memory and excluded from findings. */
-export declare function verifyCi({ declaration, sealed, gh, options, stdout, notices }: {
+export declare function verifyCi({ declaration, sealed, gh, options, stdout, notices, bindings, runtime }: {
     declaration: CiDeclaration;
     sealed: readonly {
+        env?: string;
+        member?: string;
+        file?: string;
         key: string;
     }[];
     gh: Gh;
     options: CiOptions;
     stdout: (text: string) => unknown;
     notices?: string[];
+    bindings?: ServiceBinding[];
+    runtime?: readonly {
+        key: string;
+    }[];
 }): number;
 /** Manifest visibility wins; optional GitHub visibility discovery never changes verification findings or errors. */
 export declare function badgeVisibilityNotices({ doc, gh, repo }: {

package/ci/verify.mjs

@@ -1,7 +1,8 @@
 import { badgeTokenNotices } from '../sync/readme-badges.mjs';
 import { refuse, scopeArgs, scopeName } from './github.mjs';
+import { boundSealedKey } from '../runtime/scripts/hfs/ci-declaration.mjs';
 /** Verification reports names and scopes only; values are compared in memory and excluded from findings. */
-export function verifyCi({ declaration, sealed, gh, options, stdout, notices = [] }) {
+export function verifyCi({ declaration, sealed, gh, options, stdout, notices = [], bindings = [], runtime = [] }) {
     const repo = gh.repository(options.repo), stores = [];
     const environments = [...new Set([...declaration.secrets, ...declaration.vars].filter((item) => item.scope === 'environment').map((item) => item.environment))].sort();
     for (const scope of [{}, ...environments.map((env) => ({ env })), { dependabot: true }]) {
@@ -12,7 +13,7 @@ export function verifyCi({ declaration, sealed, gh, options, stdout, notices = [
             stores.push({ scope, kind, rows });
         }
     }
-    const findings = [], sealedNames = new Set(sealed.map((item) => item.key));
+    const findings = [];
     const declarations = (store) => store.scope.dependabot ? declaration.dependabotSecrets : store.kind === 'secret' ? declaration.secrets : declaration.vars;
     const matches = (entry, scope) => (entry.scope === 'environment' ? entry.environment : undefined) === scope.env;
     const add = (code, name, scope) => { findings.push({ code, name, scope: scopeName(scope) }); };
@@ -26,7 +27,8 @@ export function verifyCi({ declaration, sealed, gh, options, stdout, notices = [
                 add('CI_VAR_DRIFT', entry.name, store.scope);
         }
         for (const row of store.rows) {
-            if (store.kind === 'secret' && sealedNames.has(row.name))
+            const binding = store.scope.dependabot ? undefined : bindings.find((item) => item.name === row.name);
+            if (runtime.some((item) => item.key === row.name) || (store.kind === 'secret' && sealed.some((item) => (item.key === row.name || (binding && item.key === binding.key)) && !(binding && boundSealedKey(binding, item)))))
                 add('APP_SECRET_IN_CI', row.name, store.scope);
             if (entries.some((entry) => entry.name === row.name && matches(entry, store.scope)))
                 continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "5.0.5",
+  "version": "5.0.6",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/release/candidate-ci.mjs

@@ -8,7 +8,7 @@ const PASSING = new Set(['success', 'neutral']);
 export const candidateRef = (tag, prefix = 'v') => `${CANDIDATE_PREFIX}${String(tag).startsWith(prefix) ? String(tag).slice(prefix.length) : String(tag)}`;
 function run(ctx, command, args) {
     try {
-        return ctx.spawn(command, args, { cwd: ctx.cwd });
+        return ctx.spawn(command, args, { cwd: ctx.cwd, env: ctx.env });
     }
     catch {
         return { status: null };

package/release/gate.d.mts

@@ -72,6 +72,7 @@ export declare const refName: (value: unknown) => value is string;
 export declare function normalizeRelease(block: unknown, scripts?: Record<string, unknown> | undefined, services?: Services, options?: {
     example?: boolean;
     entities?: boolean;
+    repository?: string;
 }): {
     config: ReleaseConfig;
     problems?: undefined;

package/release/gate.mjs

@@ -7,7 +7,9 @@ import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { isPlainObject as plain } from '../runtime/engine/plain-object.mjs';
-import { qualityServices } from '../runtime/scripts/hfs/ci-declaration.mjs';
+import { qualityServices, serviceBindings, projectServiceCredential, serviceCredentialNames } from '../runtime/scripts/hfs/ci-declaration.mjs';
+import { repositoryName, identityQueryEnvironment } from '../runtime/scripts/hfs/repo-identity.mjs';
+import { serviceCredentialFile, serviceCredentialValue } from '../runtime/scripts/hfs/secret-store.mjs';
 import { openHfs } from '../runtime/scripts/hfs/slots.mjs';
 import { firstLine, lines, tool } from '../stack/context.mjs';
 import { failure, refusal } from '../stack/errors.mjs';
@@ -74,21 +76,72 @@ function auditGate(audit) {
         throw refusal(RELEASE_CODE, 'services.audit.level must be an npm audit level');
     return { name: 'audit', command: ['npm', 'audit', ...(audit.omitDev ? ['--omit=dev'] : []), `--audit-level=${audit.level}`], summary: null, env: {} };
 }
-/** A requested local Sonar scan uses only the declared host and token variable; the token never enters argv. */
-function sonarGate(services, env) {
+/** The CI execution copy is job-local; a native owner run opens the selected product credential only when executed. */
+function sonarGate(services, ctx, execute) {
+    const env = ctx.env;
     const configured = services?.sonar;
-    const sonar = configured?.provider === 'sonarcloud' ? { ...configured, host: 'https://sonarcloud.io' } : configured;
+    let sonar = configured?.provider === 'sonarcloud' ? { ...configured, host: configured.host || 'https://sonarcloud.io' } : configured;
     const tokenName = sonar?.token;
-    if (!sonar?.host || !ENV_KEY.test(tokenName) || !env[tokenName])
-        throw refusal('RELEASE_SONAR_UNAVAILABLE', 'declare an enabled services.sonar host and set its ci.token environment variable');
-    const command = ['npx', '--yes', '@sonar/scan@4.3.0', `-Dsonar.host.url=${sonar.host}`];
+    if (!sonar || !ENV_KEY.test(tokenName))
+        throw refusal('RELEASE_SONAR_UNAVAILABLE', 'declare an enabled services.sonar host and ci.token selector');
+    let token;
+    let privateHost;
+    if (env.GITHUB_ACTIONS === 'true') {
+        token = env[tokenName];
+        if (!token)
+            throw refusal('RELEASE_SONAR_UNAVAILABLE', 'the declared Sonar CI execution copy is missing');
+        if (sonar.hostCredential) {
+            privateHost = env[sonar.hostVar || 'SONAR_HOST_URL'];
+            sonar = { ...sonar, host: privateHost ?? null, privateHost: true };
+        }
+    }
+    else {
+        const doc = services.declaration;
+        const repository = repositoryName(ctx.cwd, { env: identityQueryEnvironment(env, serviceCredentialNames(doc)) });
+        const selected = serviceBindings(doc, repository);
+        const binding = selected.bindings.find((item) => item.service === 'sonar' && item.name === tokenName);
+        if (selected.problems.length || !binding)
+            throw refusal('RELEASE_SONAR_UNAVAILABLE', 'declare one explicit Sonar project credential binding in this product');
+        try {
+            serviceCredentialFile(ctx.cwd, binding);
+            if (execute)
+                token = serviceCredentialValue(ctx.cwd, binding, ctx.sops);
+            if (sonar.hostCredential) {
+                const endpoint = projectServiceCredential(doc, 'sonar', sonar.hostCredential, repository);
+                if (!endpoint)
+                    throw new Error('invalid endpoint reference');
+                serviceCredentialFile(ctx.cwd, endpoint);
+                if (execute)
+                    privateHost = serviceCredentialValue(ctx.cwd, endpoint, ctx.sops);
+                sonar = { ...sonar, host: privateHost ?? null, privateHost: true };
+            }
+        }
+        catch {
+            throw refusal('RELEASE_SONAR_UNAVAILABLE', 'the selected Sonar project custody is missing or cannot be opened');
+        }
+    }
+    if (!sonar.host && !(sonar.hostCredential && !execute))
+        throw refusal('RELEASE_SONAR_UNAVAILABLE', 'the declared Sonar connection URL is missing');
+    if (sonar.host) {
+        try {
+            const url = new URL(sonar.host);
+            if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
+                throw new Error('invalid URL');
+        }
+        catch {
+            throw refusal('RELEASE_SONAR_UNAVAILABLE', 'the Sonar connection must be HTTP(S), with login kept in separate sealed credential keys');
+        }
+    }
+    const command = ['npx', '--yes', '@sonar/scan@4.3.0', ...(sonar.privateHost ? [] : [`-Dsonar.host.url=${sonar.host}`])];
+    if (sonar.projectKey)
+        command.push(`-Dsonar.projectKey=${sonar.projectKey}`);
     const organization = sonar.organization ?? (sonar.organizationVar ? env[sonar.organizationVar] : null);
     if (organization)
         command.push(`-Dsonar.organization=${organization}`);
     if (!command.every((word) => TOKEN.test(word)))
         throw refusal('RELEASE_SONAR_UNAVAILABLE', 'Sonar host and organization must be plain command arguments');
-    return { name: 'sonar', command, summary: null, env: { SONAR_TOKEN: env[tokenName] }, provider: sonar,
-        credentialNames: [...new Set(['SONAR_TOKEN', tokenName])] };
+    return { name: 'sonar', command, summary: null, env: { ...(token === undefined ? {} : { SONAR_TOKEN: token }), ...(privateHost ? { SONAR_HOST_URL: privateHost } : {}) }, provider: sonar,
+        credentialNames: [...new Set(['SONAR_TOKEN', tokenName, ...serviceCredentialNames(services.declaration), ...(sonar.hostCredential ? ['SONAR_HOST_URL', sonar.hostVar] : [])].filter((name) => typeof name === 'string'))] };
 }
 function gateProblems(entry, at, seen) {
     const found = [];
@@ -261,7 +314,7 @@ async function sonarAvailability(ctx, gate) {
     }
     if (up)
         return null;
-    return { pass: false, detail: `${SONAR_UNREACHABLE}: ${sonar.host} did not report UP within ten seconds` };
+    return { pass: false, detail: `${SONAR_UNREACHABLE}: ${sonar.privateHost ? 'the declared private host' : sonar.host} did not report UP within ten seconds` };
 }
 /** An unreachable Sonar host stays a red row with a real log and no scan invocation. */
 export async function runAvailableGate(ctx, gate, options) {
@@ -292,12 +345,18 @@ async function judgeQualityGate(ctx, gate, row) {
         return row;
     const started = ctx.now();
     const verdict = await sonarQualityGate(ctx, { cwd: ctx.cwd, host: gate.provider.host, token: gate.env.SONAR_TOKEN });
-    const failed = (verdict.conditions ?? []).map((line) => `  failed: ${line}\n`).join('');
-    fs.appendFileSync(row.log, `\nquality gate: ${verdict.detail}\n${failed}`);
-    return { ...row, pass: verdict.pass, detail: verdict.detail, seconds: row.seconds + Math.round((ctx.now() - started) / 1000), logSha256: sha256(row.log) };
+    const detail = redactGateText(gate, verdict.detail);
+    const failed = (verdict.conditions ?? []).map((line) => `  failed: ${redactGateText(gate, line)}\n`).join('');
+    fs.appendFileSync(row.log, `\nquality gate: ${detail}\n${failed}`);
+    return { ...row, pass: verdict.pass, detail, seconds: row.seconds + Math.round((ctx.now() - started) / 1000), logSha256: sha256(row.log) };
+}
+/** Scanner output and the later server verdict share one redaction boundary. */
+function redactGateText(gate, text) {
+    const values = gate.provider ? [gate.env.SONAR_TOKEN, ...(gate.provider.privateHost ? [gate.env.SONAR_HOST_URL] : [])].filter((value) => Boolean(value)) : [];
+    return values.reduce((redacted, value) => redacted.replaceAll(value, '[REDACTED]'), text);
 }
 export const withoutCredentials = (values, credentialNames) => {
-    const selected = new Set(credentialNames);
+    const selected = new Set([...credentialNames, 'SOPS_AGE_KEY', 'SOPS_AGE_KEY_FILE'].map((name) => name.toUpperCase()));
     return Object.fromEntries(Object.entries(values ?? {}).filter(([key]) => !selected.has(key.toUpperCase())));
 };
 export function runGate(ctx, gate, { dir, platform, credentialNames, preface = '' }) {
@@ -308,11 +367,10 @@ export function runGate(ctx, gate, { dir, platform, credentialNames, preface = '
     const env = { ...ctx.env, ...(gate.provider ? gate.env : withoutCredentials(gate.env, credentialNames)), ...RELEASE_CACHE_ENV };
     const run = tool(ctx, command, args, { cwd: ctx.cwd, env });
     const output = `${run.stdout ?? ''}${run.stderr ?? ''}`;
-    const text = gate.name === 'sonar' && gate.env.SONAR_TOKEN ? output.replaceAll(gate.env.SONAR_TOKEN, '[REDACTED]') : output;
+    const text = redactGateText(gate, output);
     fs.writeFileSync(log, preface + text);
     const verdict = judgeVerdict(run, gate, text);
-    if (gate.name === 'sonar' && gate.env.SONAR_TOKEN)
-        verdict.detail = verdict.detail.replaceAll(gate.env.SONAR_TOKEN, '[REDACTED]');
+    verdict.detail = redactGateText(gate, verdict.detail);
     const seconds = Math.round((ctx.now() - started) / 1000);
     return {
         name: gate.name, command: gate.command.join(' '), pass: verdict.pass, detail: verdict.detail, seconds,
@@ -459,7 +517,7 @@ function backfillRed(ctx, { common, urgent, failed, openTicket }) {
 export async function releaseGate(ctx, config, options = {}) {
     // Sonar is a row of the managed CI, so it is a row of the local gate whenever the app declares services.sonar; a missing token is a refusal, never a skip.
     if (config.services?.sonar)
-        config = { ...config, gates: [...config.gates.filter((gate) => gate.name !== 'sonar'), sonarGate(config.services, ctx.env)] };
+        config = { ...config, gates: [...config.gates.filter((gate) => gate.name !== 'sonar'), sonarGate(config.services, ctx, options.execute === true)] };
     const credentialNames = config.gates.find(gate => gate.provider)?.credentialNames ?? ['SONAR_TOKEN', config.services?.sonar?.token].filter(Boolean);
     ctx = Object.create(ctx, { env: { value: withoutCredentials(ctx.env, credentialNames) } });
     // The CI verdict of a release is the candidate run of its own sha, judged by `starci app release push` (candidate-ci.mjs, OWNER RULING candidate-ci 2026-10-18):

package/release/index.d.mts

@@ -42,13 +42,13 @@ export declare function contextOf(io?: VerbIo): VerbContext;
 export declare function readDeclaration(root: string): Record<string, any>;
 /** The normalised `release:` block (tolerant of absence) with the package version: { root, version, gates, tagPrefix, defaultBranch, requireCi }. */
 export declare function loadReleaseConfig(root: string): {
+    services: any;
     root: string;
     version: any;
     gates: import("./gate.mjs").Gate[];
     tagPrefix: string;
     defaultBranch: string;
     requireCi: boolean;
-    services: any;
 };
 /** Parses the flags, runs `run(ctx, flags, positional)` and prints its result; returns the exit code. Only StackError is mapped, anything else is a bug and propagates. */
 export declare function runVerb({ label, name, io, argv, spec, run, code }: {

package/release/index.mjs

@@ -10,11 +10,13 @@ import path from 'node:path';
 import { isPlainObject as plain } from '../runtime/engine/plain-object.mjs';
 import { parseYaml } from '../runtime/engine/yaml.mjs';
 import { isRuntimeExampleApp } from '../runtime/scripts/lib/runtime-example.mjs';
+import { repositoryName, identityQueryEnvironment } from '../runtime/scripts/hfs/repo-identity.mjs';
+import { serviceCredentialNames } from '../runtime/scripts/hfs/ci-declaration.mjs';
 import { hasEntityList } from '../db/entity-list.mjs';
 import { STACKS_DIR, STACKS_FILE } from '../stack/config.mjs';
 import { stackContext } from '../stack/context.mjs';
 import { EXIT, StackError, refusal } from '../stack/errors.mjs';
-import { RELEASE_CODE, VERSION, normalizeRelease, releaseGate } from './gate.mjs';
+import { RELEASE_CODE, VERSION, normalizeRelease, releaseGate, withoutCredentials } from './gate.mjs';
 import { releasePush } from './push.mjs';
 import { releaseUrgentPush } from './urgent.mjs';
 const IO_KEYS = ['cwd', 'stdout', 'stderr', 'env', 'sops', 'hostIdentity'];
@@ -77,10 +79,11 @@ export function loadReleaseConfig(root) {
     if (typeof pkg.version !== 'string' || !VERSION.test(pkg.version))
         throw refusal(RELEASE_CODE, 'package.json needs a version like 1.2.3 (the release tag derives from it)');
     const declaration = readDeclaration(root);
-    const { config, problems } = normalizeRelease(declaration.release, pkg.scripts, declaration.services, { example: isRuntimeExampleApp(root), entities: hasEntityList(root) });
+    const { config, problems } = normalizeRelease(declaration.release, pkg.scripts, declaration.services, { example: isRuntimeExampleApp(root), entities: hasEntityList(root),
+        repository: repositoryName(root, { env: identityQueryEnvironment(process.env, serviceCredentialNames(declaration)) }) });
     if (!config)
         throw refusal(RELEASE_CODE, `${problems.length} problem(s) in release: ${problems.slice(0, 6).join('; ')}`);
-    return { root, version: pkg.version, ...config };
+    return { root, version: pkg.version, ...config, services: { ...config.services, declaration } };
 }
 function print(ctx, name, flags, result) {
     if (flags.json)
@@ -119,6 +122,7 @@ const ACTIONS = {
             if (flags.reason !== undefined && flags.urgent !== true)
                 throw refusal('RELEASE_USAGE', '--reason belongs to an urgent release (--urgent)');
             const config = loadReleaseConfig(ctx.cwd);
+            ctx = Object.create(ctx, { env: { value: withoutCredentials(ctx.env, serviceCredentialNames(config.services?.declaration)) } });
             if (flags.urgent === true)
                 return releaseUrgentPush(ctx, config, { execute: flags.execute === true, remote: flags.remote, reason: flags.reason, role: harness?.role ?? ctx.env.STARCI_ROLE });
             return releasePush(ctx, config, { execute: flags.execute === true, remote: flags.remote });