laneyard 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Martin Frouin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,175 @@
+# Laneyard
+
+**A self-hosted web UI for fastlane.**
+
+Laneyard is a browser interface for the fastlane lanes you already have, running on hardware you
+own. Pick a lane, click run, watch the output stream, download the artifact. Nobody else holds
+your signing keys, and nobody meters your minutes.
+
+It replaces neither fastlane nor your Fastfile — it drives them. Your lanes stay exactly where
+they are.
+
+![A build running in Laneyard: step timeline on the left, live output on the right, artifacts below](docs/screenshots/run.png)
+
+## Why
+
+**You keep the keys.** Signing certificates, keystores, provisioning profiles, store
+credentials — everything needed to publish under your name — stays on your machine. A hosted CI
+is a third party holding all of it.
+
+**Minutes stop existing.** Hardware you already own costs less than a year of most CI plans,
+and never bills by the second. Long builds stop being a budget decision.
+
+**It is just fastlane.** No new DSL, no YAML dialect, no vendor config to port. Laneyard reads
+the Fastfile you already have and asks *your* fastlane what it can do — plugins included. It
+hard-codes no knowledge of fastlane at all, so upgrading fastlane or adding a plugin needs no
+change here.
+
+## Where it fits
+
+|                              | Laneyard    | Hosted CI    | Self-hosted runner |
+| ---------------------------- | ----------- | ------------ | ------------------ |
+| who holds your signing keys  | you         | the vendor   | you                |
+| cost per build               | electricity | per minute   | electricity        |
+| setup                        | one command | a signup form| a weekend          |
+| works offline                | yes         | no           | yes                |
+| build queue across a team    | planned     | yes          | yes                |
+| runs on pull requests        | planned     | yes          | yes                |
+
+If your team needs parallel builds across a fleet today, use something else and come back later.
+Laneyard is for one machine you control.
+
+## Requirements
+
+- **Node 22 or newer** — the server.
+- **Ruby with fastlane**, either through a project `Gemfile` (recommended) or installed for the
+  active Ruby. Laneyard never bundles its own fastlane; it uses your project's.
+- **git**.
+- macOS or Linux. iOS builds need a Mac, as they always have; Android builds do not.
+
+## Install
+
+```bash
+npm install -g laneyard
+```
+
+Then, from a project you already build with fastlane:
+
+```bash
+cd ~/code/your-app
+laneyard add     # adopt this project
+laneyard         # start the server
+```
+
+`laneyard add` inspects what is there — the `fastlane` directory even when nested in a monorepo, a
+`Gemfile`, an Xcode project or a Gradle build — writes the matching block into
+`~/.laneyard/config.yml`, and prints a generated server password once. Write it down; it is not
+shown again.
+
+<details>
+<summary>Running from source instead</summary>
+
+```bash
+git clone https://github.com/martinfrouin/laneyard.git
+cd laneyard
+npm install      # builds on install
+npm link         # puts `laneyard` on your PATH
+```
+
+</details>
+
+Open it from any machine on your network, sign in, and your lanes are listed — because Laneyard
+asked your project's own fastlane for them.
+
+![The project screen: lanes read from the Fastfile, with their descriptions, and the run history](docs/screenshots/project.png)
+
+## Configuration
+
+All configuration lives in files. The database holds execution state only, so backing up
+Laneyard means copying one file, and restoring it means copying it back.
+
+### `~/.laneyard/config.yml` — the server and its projects
+
+```yaml
+server:
+  port: 7890
+  bind: 0.0.0.0
+  password_hash: "scrypt$…"      # written by `laneyard add`
+  max_concurrent_runs: 1
+  retention: { runs: 50, artifact_days: 30 }
+
+projects:
+  - slug: cartes-ios
+    name: Cartes iOS
+    git_url: git@github.com:you/cartes.git
+    default_branch: main
+    git_auth: { kind: ssh_key, ref: ~/.ssh/id_ed25519 }
+```
+
+### `laneyard.yml` — optional, committed in your repository
+
+Build behaviour belongs next to the code, so it can be versioned with it:
+
+```yaml
+fastlane_dir: fastlane
+runtime: bundle                  # or `system`
+timeout_minutes: 60
+artifact_globs:
+  - "build/**/*.ipa"
+  - "build/**/*.app.dSYM.zip"
+```
+
+Field by field, the repository file wins over the server block, which wins over the defaults. Any
+field of `laneyard.yml` may also be written in the server block, so a repository you would rather
+not touch can be configured entirely from `config.yml`.
+
+Both files are watched: edit them by hand and Laneyard picks the change up. An invalid file is
+reported and the last valid configuration stays live — a typo never takes the server down.
+
+## Security
+
+Read this before putting Laneyard on a network.
+
+- **It is built for a local network, not the internet.** It listens on `0.0.0.0` so you can reach
+  it from your laptop, behind one password. Do not expose it publicly. If you need remote access,
+  put it behind a VPN or an SSH tunnel.
+- **The password** is stored as an scrypt hash and repeated failures are throttled. Sessions live
+  in memory and do not survive a restart.
+- **There is no secret vault yet.** Today, fastlane sees the environment the Laneyard process was
+  started with, so credentials are managed the way you already manage them — an `.env` read by
+  your Fastfile, the system keychain, or exported variables. Do not put secrets in `config.yml`.
+- **Logs are not redacted yet.** A run's full output is written to disk under `~/.laneyard/logs/`.
+  Assume anything fastlane prints is stored in the clear. Laneyard does remove its own git remote
+  URL from error messages, so a token embedded in a repository URL does not leak that way.
+
+The encrypted vault and log redaction are the next milestone, and the reason this section is
+this blunt.
+
+## Status
+
+`✓` shipped · `▸` being built · `○` planned
+
+- `✓` declare a project, clone it, list its lanes, run one, watch it live, download the artifact
+- `✓` configuration entirely in files you can version and back up
+- `✓` adopt an existing fastlane project with one command
+- `▸` encrypted secret vault and log redaction
+- `▸` build queue, cancellation, timeouts surfaced in the UI
+- `○` a checklist that gets a project running unattended
+- `○` Fastfile editor in the browser
+- `○` git-triggered and scheduled builds
+
+Two limitations worth knowing today: listing lanes does not fetch the repository, so a lane you
+have just pushed appears after the next run; and a second run on a project is refused while the
+first is still going, since they would share one git workspace.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). The short version: `npm test` runs the whole suite in
+seconds against a fake fastlane, so you can work on any machine, with no Xcode, no signing
+certificates and no network.
+
+## Licence
+
+MIT — see [LICENSE](LICENSE).
+
+Built on [fastlane](https://fastlane.tools), and not affiliated with it.

package/dist/src/cli/add.js

@@ -0,0 +1,81 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
+import { Document, parseDocument, YAMLSeq } from "yaml";
+import { hashPassword } from "../server/auth.js";
+import { detectProject } from "./detect.js";
+/**
+ * Adds a project block to config.yml while preserving the rest of the file.
+ *
+ * The edit goes through the YAML document rather than a parse/serialize
+ * round trip: the user's comments — and the order of their keys — survive.
+ * It's the same requirement as for the Fastfile: a hand-written file must
+ * never come back out damaged.
+ */
+export async function addProjectToConfig(path, entry) {
+    let doc;
+    try {
+        doc = parseDocument(await readFile(path, "utf8"));
+    }
+    catch {
+        doc = new Document({});
+    }
+    if (doc.contents === null)
+        doc = new Document({});
+    if (!doc.hasIn(["server", "password_hash"])) {
+        // A server with no password would refuse every connection: we generate one
+        // and print it once, leaving it to the caller to note it down.
+        const generated = randomBytes(9).toString("base64url");
+        doc.setIn(["server", "password_hash"], hashPassword(generated));
+        process.stdout.write(`\nGenerated password: ${generated}\n  (write it down, it won't be shown again)\n`);
+    }
+    const projects = doc.getIn(["projects"]);
+    const seq = projects instanceof YAMLSeq ? projects : new YAMLSeq();
+    if (!(projects instanceof YAMLSeq))
+        doc.setIn(["projects"], seq);
+    for (const item of seq.items) {
+        const slug = item.get?.("slug");
+        if (slug === entry.slug) {
+            throw new Error(`A project already uses the slug "${entry.slug}" in ${path}`);
+        }
+    }
+    seq.add(doc.createNode(entry));
+    await writeFile(path, doc.toString(), "utf8");
+}
+/** Entry point for `laneyard add`. */
+export async function runAddCommand(cwd, configPath, slugOverride) {
+    const d = await detectProject(cwd);
+    if (d.fastlaneDir === null) {
+        process.stderr.write("No Fastfile found here. Laneyard drives fastlane: run the command from a project " +
+            "that already uses it, or run `fastlane init` first.\n");
+        return 1;
+    }
+    if (d.gitUrl === null) {
+        process.stderr.write("No git remote named \"origin\". Laneyard clones projects from their repository: " +
+            "add a remote, or set git_url by hand in config.yml.\n");
+        return 1;
+    }
+    const slug = slugOverride ?? d.slug;
+    // A slug is used as a folder name and a URL segment. Left unvalidated, a
+    // `--slug ../evil` would be written without complaint and would then make
+    // config.yml invalid, taking every other project offline.
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) {
+        process.stderr.write(`Invalid slug: "${slug}". Lowercase letters, digits and hyphens only.\n`);
+        return 1;
+    }
+    await addProjectToConfig(configPath, {
+        slug,
+        name: slug,
+        git_url: d.gitUrl,
+        default_branch: d.defaultBranch,
+        fastlane_dir: d.fastlaneDir,
+        runtime: d.runtime,
+        artifact_globs: d.artifactGlobs,
+    });
+    process.stdout.write(`\nProject "${slug}" added to ${configPath}\n` +
+        `  repository   ${d.gitUrl} (${d.defaultBranch})\n` +
+        `  fastlane     ${d.fastlaneDir}\n` +
+        `  runtime      ${d.runtime}\n` +
+        `  artifacts    ${d.artifactGlobs.join(", ") || "no pattern detected — fill in manually"}\n` +
+        `\nRestart Laneyard or wait for the automatic reload, the project will appear in the interface.\n`);
+    return 0;
+}

package/dist/src/cli/detect.js

@@ -0,0 +1,70 @@
+import { execFile } from "node:child_process";
+import { access } from "node:fs/promises";
+import { basename, join, relative, sep } from "node:path";
+import { promisify } from "node:util";
+import { glob } from "tinyglobby";
+const exec = promisify(execFile);
+const exists = async (p) => {
+    try {
+        await access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const gitOr = async (args, cwd, fallback) => {
+    try {
+        const { stdout } = await exec("git", args, { cwd });
+        return stdout.trim() || fallback;
+    }
+    catch {
+        return fallback;
+    }
+};
+/** A folder name isn't a slug: normalize it, but never fail. */
+function slugify(name) {
+    const s = name
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    return s === "" ? "project" : s;
+}
+/**
+ * Inspects an existing project and proposes a configuration.
+ *
+ * Decides nothing irreversible: everything it returns is a proposal the
+ * user sees and can correct before it's written.
+ */
+export async function detectProject(dir) {
+    // The Fastfile can be at the root or under a subfolder, for monorepos.
+    const fastfiles = await glob(["fastlane/Fastfile", "*/fastlane/Fastfile", "*/*/fastlane/Fastfile"], {
+        cwd: dir,
+        absolute: true,
+        onlyFiles: true,
+    });
+    const fastfile = fastfiles.sort((a, b) => a.length - b.length)[0] ?? null;
+    const fastlaneDir = fastfile
+        ? relative(dir, join(fastfile, "..")).split(sep).join("/")
+        : null;
+    const isIos = (await glob(["*.xcodeproj", "*.xcworkspace", "*/*.xcodeproj"], { cwd: dir, onlyDirectories: true }))
+        .length > 0;
+    const isAndroid = (await glob(["build.gradle", "build.gradle.kts", "*/build.gradle", "*/build.gradle.kts"], {
+        cwd: dir,
+        onlyFiles: true,
+    })).length > 0;
+    const artifactGlobs = [];
+    if (isIos)
+        artifactGlobs.push("**/*.ipa", "**/*.app.dSYM.zip");
+    if (isAndroid)
+        artifactGlobs.push("**/*.apk", "**/*.aab");
+    return {
+        slug: slugify(basename(dir)),
+        gitUrl: await gitOr(["remote", "get-url", "origin"], dir, null),
+        defaultBranch: (await gitOr(["rev-parse", "--abbrev-ref", "HEAD"], dir, "main")) ?? "main",
+        fastlaneDir,
+        runtime: (await exists(join(dir, "Gemfile"))) ? "bundle" : "system",
+        artifactGlobs,
+        platform: isIos ? "ios" : isAndroid ? "android" : "unknown",
+    };
+}

package/dist/src/config/load.js

@@ -0,0 +1,46 @@
+import { readFile } from "node:fs/promises";
+import { parse as parseYaml } from "yaml";
+import { repoConfigSchema, serverConfigSchema } from "./schema.js";
+/** Reads and validates a YAML file. Never fails by throwing: the caller decides. */
+async function loadYamlFile(path, schema) {
+    let raw;
+    try {
+        raw = await readFile(path, "utf8");
+    }
+    catch (cause) {
+        return { ok: false, error: `Could not read ${path}: ${cause.message}` };
+    }
+    let data;
+    try {
+        data = parseYaml(raw);
+    }
+    catch (cause) {
+        return { ok: false, error: `Invalid YAML in ${path}: ${cause.message}` };
+    }
+    const parsed = schema.safeParse(data ?? {});
+    if (!parsed.success) {
+        const details = parsed.error.issues
+            .map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`)
+            .join("; ");
+        return { ok: false, error: `Invalid configuration in ${path} — ${details}` };
+    }
+    return { ok: true, config: parsed.data };
+}
+export async function loadServerConfig(path) {
+    const res = await loadYamlFile(path, serverConfigSchema);
+    if (!res.ok)
+        return res;
+    const seen = new Set();
+    for (const p of res.config.projects) {
+        if (seen.has(p.slug)) {
+            return { ok: false, error: `Invalid configuration in ${path} — duplicate slug: ${p.slug}` };
+        }
+        seen.add(p.slug);
+    }
+    // The display name falls back to the slug rather than being optional everywhere downstream.
+    const projects = res.config.projects.map((p) => ({ ...p, name: p.name ?? p.slug }));
+    return { ok: true, config: { ...res.config, projects } };
+}
+export async function loadRepoConfig(path) {
+    return loadYamlFile(path, repoConfigSchema);
+}

package/dist/src/config/resolve.js

@@ -0,0 +1,29 @@
+import { projectSettingsSchema } from "./schema.js";
+const SETTING_KEYS = Object.keys(projectSettingsSchema.shape);
+/**
+ * Merges the three sources field by field.
+ * `undefined` means "not set"; any other value, including an empty array
+ * or `false`, is an explicit decision by the user.
+ */
+export function resolveProjectSettings(entry, repo) {
+    const chosen = {};
+    const provenance = {};
+    for (const key of SETTING_KEYS) {
+        const fromRepo = repo?.[key];
+        const fromServer = entry[key];
+        if (fromRepo !== undefined) {
+            chosen[key] = fromRepo;
+            provenance[key] = "repo";
+        }
+        else if (fromServer !== undefined) {
+            chosen[key] = fromServer;
+            provenance[key] = "server";
+        }
+        else {
+            provenance[key] = "default";
+        }
+    }
+    // The schema applies the defaults for anything still absent.
+    const settings = projectSettingsSchema.parse(chosen);
+    return { settings, provenance };
+}

package/dist/src/config/schema.js

@@ -0,0 +1,55 @@
+import { z } from "zod";
+/** Build behaviour settings. They can come from the repository or the server. */
+export const projectSettingsSchema = z.object({
+    fastlane_dir: z.string().default("fastlane"),
+    runtime: z.enum(["bundle", "system"]).default("bundle"),
+    timeout_minutes: z.number().int().positive().default(60),
+    interactive_default: z.boolean().default(false),
+    artifact_globs: z.array(z.string()).default([]),
+    required_secrets: z.array(z.string()).default([]),
+    retention: z
+        .object({
+        runs: z.number().int().positive(),
+        artifact_days: z.number().int().positive(),
+    })
+        .optional(),
+});
+/** Same vocabulary, but everything is optional in the files. */
+export const projectSettingsInputSchema = projectSettingsSchema.partial();
+/** A slug is used as a folder name and a URL segment. */
+const slugSchema = z
+    .string()
+    .regex(/^[a-z0-9][a-z0-9-]*$/, "slug: lowercase letters, digits and hyphens only");
+export const projectEntrySchema = projectSettingsInputSchema.extend({
+    slug: slugSchema,
+    name: z.string().optional(),
+    git_url: z.string().min(1),
+    default_branch: z.string().default("main"),
+    git_auth: z
+        .object({
+        kind: z.enum(["none", "ssh_key", "token"]),
+        /** File path if kind is ssh_key, secret name if kind is token. */
+        ref: z.string().optional(),
+    })
+        .default({ kind: "none" }),
+    color: z.string().default("green"),
+    notify_browser: z.boolean().default(true),
+    webhook_url: z.string().optional(),
+});
+export const serverConfigSchema = z.object({
+    server: z.object({
+        port: z.number().int().positive().default(7890),
+        bind: z.string().default("0.0.0.0"),
+        password_hash: z.string().min(1),
+        max_concurrent_runs: z.number().int().positive().default(1),
+        retention: z
+            .object({
+            runs: z.number().int().positive().default(50),
+            artifact_days: z.number().int().positive().default(30),
+        })
+            .default({ runs: 50, artifact_days: 30 }),
+    }),
+    projects: z.array(projectEntrySchema).default([]),
+});
+/** Content of laneyard.yml: build behaviour only. */
+export const repoConfigSchema = projectSettingsInputSchema;

package/dist/src/config/store.js

@@ -0,0 +1,71 @@
+import { watch } from "node:fs";
+import { loadRepoConfig, loadServerConfig } from "./load.js";
+import { resolveProjectSettings } from "./resolve.js";
+import { join } from "node:path";
+/**
+ * The server's live configuration.
+ *
+ * Safety rule: an invalid configuration never replaces a valid one. The
+ * server keeps running with what it had, and the error is exposed to the
+ * interface — never a half-configured startup.
+ */
+export class ConfigStore {
+    path;
+    config = null;
+    error = null;
+    constructor(path) {
+        this.path = path;
+    }
+    async load() {
+        const res = await loadServerConfig(this.path);
+        if (!res.ok) {
+            this.error = res.error;
+            return { ok: false, error: res.error };
+        }
+        this.config = res.config;
+        this.error = null;
+        return { ok: true };
+    }
+    /** Watches the file and reloads, absorbing bursts of events. */
+    watch(onReload) {
+        let timer;
+        const watcher = watch(this.path, () => {
+            if (timer)
+                clearTimeout(timer);
+            timer = setTimeout(() => {
+                void this.load().then((r) => onReload(r.ok));
+            }, 150);
+        });
+        return () => {
+            if (timer)
+                clearTimeout(timer);
+            watcher.close();
+        };
+    }
+    server() {
+        return this.config?.server ?? null;
+    }
+    projects() {
+        return this.config?.projects ?? [];
+    }
+    project(slug) {
+        return this.projects().find((p) => p.slug === slug) ?? null;
+    }
+    lastError() {
+        return this.error;
+    }
+    /**
+     * Resolves a project's effective settings by reading its workspace's
+     * laneyard.yml if it exists. The workspace may not be cloned yet: we
+     * then fall back to the project's block and the defaults.
+     */
+    async resolve(slug, workspacePath) {
+        const entry = this.project(slug);
+        if (!entry)
+            return null;
+        const repoRes = await loadRepoConfig(join(workspacePath, "laneyard.yml"));
+        const repo = repoRes.ok ? repoRes.config : null;
+        const { settings, provenance } = resolveProjectSettings(entry, repo);
+        return { entry, settings, provenance };
+    }
+}

package/dist/src/db/cache.js

@@ -0,0 +1,22 @@
+export class CacheStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    get(slug, hash) {
+        const row = this.db
+            .prepare("SELECT payload FROM introspection_cache WHERE project_slug = ? AND config_hash = ?")
+            .get(slug, hash);
+        return row ? JSON.parse(row.payload) : null;
+    }
+    put(slug, hash, payload) {
+        this.db
+            .prepare(`INSERT INTO introspection_cache (project_slug, config_hash, payload, fetched_at)
+         VALUES (?, ?, ?, ?)
+         ON CONFLICT (project_slug) DO UPDATE
+           SET config_hash = excluded.config_hash,
+               payload = excluded.payload,
+               fetched_at = excluded.fetched_at`)
+            .run(slug, hash, JSON.stringify(payload), new Date().toISOString());
+    }
+}

package/dist/src/db/open.js

@@ -0,0 +1,12 @@
+import Database from "better-sqlite3";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+export function openDatabase(path) {
+    const db = new Database(path);
+    db.pragma("journal_mode = WAL");
+    db.pragma("foreign_keys = ON");
+    const here = dirname(fileURLToPath(import.meta.url));
+    db.exec(readFileSync(join(here, "schema.sql"), "utf8"));
+    return db;
+}