laneyard 0.2.0 → 0.4.0

package/dist/src/main.js

@@ -3,20 +3,24 @@ import { realpathSync } from "node:fs";
 import { mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { bold, dim, field, heading } from "./cli/style.js";
 import { fileURLToPath } from "node:url";
-import { runAddCommand } from "./cli/add.js";
+import { PromptAborted } from "./cli/prompt.js";
+import { runSetupCommand } from "./cli/setup.js";
 import { runSecretCommand } from "./cli/secret.js";
+import { runUserCommand } from "./cli/user.js";
 import { ConfigStore } from "./config/store.js";
 import { CacheStore } from "./db/cache.js";
 import { openDatabase } from "./db/open.js";
 import { RunStore } from "./db/runs.js";
+import { CredentialStore } from "./db/credentials.js";
 import { SecretStore } from "./db/secrets.js";
 import { buildApp } from "./server/app.js";
 import { Vault } from "./secrets/vault.js";
 import { makeInvoke } from "./sidecar/bridge.js";
 import { LaneReader } from "./sidecar/lanes.js";
 import { UsesReader } from "./sidecar/uses.js";
-export const version = "0.2.0";
+export const version = "0.3.0";
 /** Assembles the server from a data folder. */
 export async function createServerFromConfig(root) {
     const config = new ConfigStore(join(root, "config.yml"));
@@ -28,7 +32,7 @@ export async function createServerFromConfig(root) {
     // it. Queued runs never began, so they stay queued for the next start.
     new RunStore(db).interruptInFlight();
     const cache = new CacheStore(db);
-    const vault = await Vault.open(root, new SecretStore(db));
+    const vault = await Vault.open(root, new SecretStore(db), new CredentialStore(db));
     const app = await buildApp({
         config,
         db,
@@ -61,7 +65,24 @@ async function main() {
     });
     const server = config.server();
     await app.listen({ port: server.port, host: server.bind });
-    console.log(`Laneyard is listening on http://localhost:${server.port}`);
+    const projects = config.projects();
+    process.stdout.write(heading(`laneyard ${version}`) +
+        field("listening", `http://localhost:${server.port}`) +
+        "\n" +
+        field("config", join(root, "config.yml")) +
+        "\n" +
+        field("projects", projects.length === 0
+            ? dim("none yet")
+            : projects.map((p) => p.slug).join(", ")) +
+        "\n" +
+        (projects.length === 0
+            ? // A server with nothing to build should say what to do next rather
+                // than sit there looking successful.
+                "\n" +
+                    dim("  No project yet. From a folder that already uses fastlane:\n") +
+                    `  ${bold("laneyard setup")}\n`
+            : "") +
+        "\n");
 }
 /**
  * True when this file is what the user launched, rather than something that
@@ -84,9 +105,12 @@ function invokedDirectly() {
 }
 const USAGE = `laneyard — a self-hosted web UI for fastlane
 
-  laneyard add        adopt the project in the current directory
+  laneyard setup      set up the project in the current directory
+                      --yes accepts every detected value without asking
   laneyard secret set NAME [--project <slug>]
                       store a secret, its value read from standard input
+  laneyard user add NAME [--role admin|builder]
+                      create an account, its password read from standard input
   laneyard            start the server
   laneyard --version  print the version
 
@@ -101,7 +125,7 @@ function explainStartupFailure(cause) {
     if (message.includes("ENOENT") && message.includes("config.yml")) {
         return ("No configuration yet.\n\n" +
             "  cd into a project that already uses fastlane, then run:\n" +
-            "    laneyard add\n\n" +
+            "    laneyard setup\n\n" +
             "That writes " + join(homeDir(), "config.yml") + " for you.");
     }
     return message;
@@ -116,15 +140,25 @@ if (invokedDirectly()) {
         process.stdout.write(`${version}\n`);
         process.exit(0);
     }
-    if (command === "add") {
+    if (command === "setup") {
         const home = homeDir();
         await mkdir(home, { recursive: true });
         const slugIndex = rest.indexOf("--slug");
         const slug = slugIndex === -1 ? undefined : rest[slugIndex + 1];
+        // `--yes` accepts every proposal, for scripts and for anyone who has done
+        // this before. Interactive is the default because the values are guesses.
+        const yes = rest.includes("--yes") || rest.includes("-y");
         try {
-            process.exit(await runAddCommand(process.cwd(), join(home, "config.yml"), slug));
+            process.exit(await runSetupCommand(process.cwd(), join(home, "config.yml"), { slug, yes }));
         }
         catch (cause) {
+            // Ctrl-C in the middle of the questions. Nothing is written before the
+            // last confirmation, so the only thing worth saying is that it is safe to
+            // start over. 130 is what a shell expects from a command killed by SIGINT.
+            if (cause instanceof PromptAborted) {
+                process.stdout.write(`\n${dim("Setup interrupted — nothing was written. Run `laneyard setup` again.")}\n`);
+                process.exit(130);
+            }
             // A taken slug or an unreadable file are ordinary situations. A stack
             // trace is not an error message; it just suggests the tool is broken.
             process.stderr.write(`${cause.message}\n`);
@@ -142,6 +176,22 @@ if (invokedDirectly()) {
             err: (text) => process.stderr.write(text),
         }));
     }
+    if (command === "user") {
+        const home = homeDir();
+        await mkdir(home, { recursive: true });
+        process.exit(await runUserCommand(home, rest, {
+            stdin: process.stdin,
+            interactive: process.stdin.isTTY === true,
+            out: (text) => process.stdout.write(text),
+            err: (text) => process.stderr.write(text),
+        }));
+    }
+    // 0.1.0 shipped this as `add`. Anyone who learned that name deserves a
+    // sentence rather than "Unknown command".
+    if (command === "add") {
+        process.stderr.write("`laneyard add` is now `laneyard setup`.\n");
+        process.exit(1);
+    }
     if (command !== undefined) {
         process.stderr.write(`Unknown command: ${command}\n\n${USAGE}`);
         process.exit(1);

package/dist/src/runner/gradle-properties.js

@@ -0,0 +1,187 @@
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, normalize, relative, resolve } from "node:path";
+import { findAndroidBuild } from "../heuristics/android-root.js";
+/**
+ * The file the build already asks for, supplied rather than demanded.
+ *
+ * `heuristics/android-signing.ts` describes the trap: the Flutter documentation
+ * ships a release build that falls back to the debug signing config when
+ * `key.properties` is absent, and gitignores that file. On a build server it is
+ * therefore always absent, the release build succeeds, and the `.aab` is signed
+ * with the debug key.
+ *
+ * The obvious fix is to tell the user to rewrite their build script. Laneyard
+ * does not do that — the project never adapts to Laneyard. So it writes the file
+ * the script is already looking for, for the length of one run, and only where
+ * its absence would ship a debug-signed artifact.
+ *
+ * **The property names are a convention, not a reading.** `conditionalOn` gave
+ * the file's *name*, because that is what appears in the script; the keys inside
+ * it are read somewhere else entirely, usually through a `Properties` object
+ * indexed by string. The four defaults below are the Flutter documentation's,
+ * which is why they are right most of the time and never certain. A project
+ * reading `keystoreProperties["alias"]` says so in the block's `property_names`
+ * setting — asking at configuration time is allowed; requiring a repository
+ * change is not.
+ *
+ * This is the one credential written into the persistent clone, because Gradle
+ * resolves the path relative to the build rather than to anything a run owns.
+ * Three guards earn that:
+ *
+ *  1. The first line is a marker, and Laneyard removes a marked file at the end
+ *     of the run and sweeps for one again at the start of the next, so a process
+ *     killed mid-build cannot leave passwords in a working tree indefinitely.
+ *  2. A file without the marker is never written over and never removed. It is
+ *     the user's own — possibly their real signing configuration — and clobbering
+ *     it would be far worse than any warning Laneyard could print.
+ *  3. Readiness must not read this file back and report the project ready
+ *     because of something Laneyard wrote. That is enforced elsewhere; nothing
+ *     here may make it impossible, which is the other reason for the marker.
+ */
+export const LANEYARD_MARKER = "# written by laneyard, do not commit";
+/**
+ * The keys the Flutter documentation uses, in the order `property_names` lists
+ * them. The setting is a plain comma-separated list because that is the form a
+ * user can correct in one keystroke: the field arrives pre-filled with exactly
+ * these four, and a project that reads `alias` edits the fourth one.
+ */
+const DEFAULT_PROPERTY_NAMES = ["storeFile", "storePassword", "keyPassword", "keyAlias"];
+/** Where each of those four names gets its value from. */
+const SLOTS = ["storeFile", "store_password", "key_password", "key_alias"];
+/**
+ * Where the file goes, or null when nobody can say.
+ *
+ * The configured path wins outright: it exists precisely because detection
+ * cannot always tell, and a setting the user corrected must not be second-
+ * guessed by the guess it corrected. It is read relative to the app root, the
+ * same root the build script was found under, and a path climbing out of it is
+ * refused rather than followed — the value came from a form, and a run must not
+ * be able to drop a file with passwords in it anywhere on the server.
+ *
+ * Otherwise the parser's answer decides, and `unknown` means the file is not
+ * written at all. Writing it in the likelier of two directories would be worse
+ * than writing nothing: the build would go on signing with the debug key while
+ * a file sat next to it looking like the problem had been dealt with.
+ */
+async function locate(root, fields) {
+    const build = await findAndroidBuild(root);
+    // The build makes no such bet — or there is no android build here at all — so
+    // nothing is at stake and nothing is written. Checked even when the path was
+    // configured by hand: the setting says where the file would go, never that it
+    // is wanted, and a project that has since fixed its build script should stop
+    // being written into without having to remember to clear a field.
+    if (!build || !build.facts.releaseCanUseDebugKey)
+        return null;
+    const configured = (fields["properties_path"] ?? "").trim();
+    if (configured !== "") {
+        const path = resolve(root, normalize(configured));
+        const inside = relative(root, path);
+        if (inside === "" || inside.startsWith("..") || isAbsolute(inside))
+            return null;
+        return path;
+    }
+    if (build.facts.conditionalOn === null)
+        return null;
+    const { name, scope } = build.facts.conditionalOn;
+    if (scope === "root")
+        return join(build.gradleRoot, name);
+    if (scope === "module")
+        return join(build.moduleDir, name);
+    return null;
+}
+/** The first line of a file, or null when there is no file to read. */
+async function firstLine(path) {
+    const text = await readFile(path, "utf8").catch(() => null);
+    return text === null ? null : (text.split("\n")[0] ?? "");
+}
+/**
+ * Java `.properties` escaping, applied to values only.
+ *
+ * A backslash is an escape character in that format, and the store path ends in
+ * a file name that came from an upload — so a value can genuinely contain one.
+ * Newlines are escaped rather than dropped: a password truncated at a line break
+ * would produce a file Gradle reads happily and signs wrongly with.
+ */
+function escapeValue(value) {
+    return value.replace(/\\/g, "\\\\").replace(/\r/g, "\\r").replace(/\n/g, "\\n");
+}
+/**
+ * The names to write, positionally overridden by the block's setting.
+ *
+ * Exported because the readiness check names them on screen: what Laneyard is
+ * going to write into someone's build is not something to leave implicit, and
+ * the check must read the same list the writer does rather than a copy of it.
+ */
+export function propertyNames(fields) {
+    const configured = (fields["property_names"] ?? "").split(",").map((n) => n.trim());
+    return DEFAULT_PROPERTY_NAMES.map((fallback, i) => configured[i] || fallback);
+}
+/**
+ * Writes the properties file, and returns its path — or null, having written
+ * nothing.
+ *
+ * Null is the ordinary outcome, and there are four ways to reach it: no keystore
+ * block applies, the build does not fall back to the debug key, nobody could say
+ * where the file goes, or a file is already there that Laneyard did not write.
+ * Only the last of those is worth a word to the user, and it is the checklist's
+ * word to say, not the runner's.
+ */
+export async function writeGradleProperties(root, keystore) {
+    if (!keystore)
+        return null;
+    const path = await locate(root, keystore.fields);
+    if (path === null)
+        return null;
+    // Guard two. Anything already there without the marker is the user's, and the
+    // build using it is the correct outcome — their real signing configuration
+    // beats the one Laneyard would have assembled.
+    const existing = await firstLine(path);
+    if (existing !== null && existing.trimEnd() !== LANEYARD_MARKER)
+        return null;
+    const names = propertyNames(keystore.fields);
+    const values = SLOTS.map((slot) => slot === "storeFile" ? keystore.storeFile : (keystore.fields[slot] ?? ""));
+    const body = names
+        .map((name, i) => `${name}=${escapeValue(values[i])}`)
+        .join("\n");
+    await mkdir(dirname(path), { recursive: true });
+    // The mode is set twice deliberately, as in `materialise.ts`: `writeFile`'s
+    // mode is masked by the process umask and ignored outright for a file that
+    // already exists, and this one holds a signing password.
+    await writeFile(path, `${LANEYARD_MARKER}\n${body}\n`, { mode: 0o600 });
+    await chmod(path, 0o600);
+    return path;
+}
+/**
+ * Removes a file this run wrote, and only such a file.
+ *
+ * Called from the run's `finally`, beside the removal of the run's secrets
+ * directory, so a keystore password does not outlive the build that needed it.
+ * Takes null so the caller can hand it whatever `writeGradleProperties`
+ * returned without a branch of its own.
+ */
+export async function removeGradleProperties(path) {
+    if (path === null)
+        return;
+    if ((await firstLine(path))?.trimEnd() !== LANEYARD_MARKER)
+        return;
+    await rm(path, { force: true }).catch(() => { });
+}
+/**
+ * Removes a marked file left where this run would write one.
+ *
+ * A run killed between writing the file and reaching its `finally` — an
+ * unplugged server, a `kill -9`, a container that lost its node — leaves
+ * passwords in a working tree that is kept between runs. Nothing at that moment
+ * can clean up after itself, so the next run does it before doing anything else.
+ *
+ * Silent about everything: a workspace that was never cloned has nothing to
+ * sweep, and a sweep that failed must not be the reason a build did not start.
+ */
+export async function sweepGradleProperties(root, keystore) {
+    // Deliberately not conditional on there being a block. The leftover to remove
+    // is from a *previous* run, and a keystore deleted since then would otherwise
+    // make the file that run wrote permanent — the one arrangement in which
+    // nothing would ever come back to clean it up.
+    const path = await locate(root, keystore?.fields ?? {}).catch(() => null);
+    await removeGradleProperties(path).catch(() => { });
+}

package/dist/src/runner/materialise.js

@@ -0,0 +1,92 @@
+import { chmod, mkdir, rm, rmdir, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { defaultVarNames } from "../credentials/kinds.js";
+/**
+ * Turns the stored signing blocks into real files, for the length of one run.
+ *
+ * A keystore has no string form. Gradle's `storeFile` is a path, `sign_apk`
+ * wants a path, `app_store_connect_api_key` wants a path — so a block that
+ * exists only as ciphertext in SQLite cannot be used by anything, and something
+ * has to put bytes on a disk. This is that something, and the files it writes
+ * live exactly as long as the run does.
+ *
+ * The variable names are the project's, never Laneyard's. A Fastfile written
+ * around `ENV["ASC_KEY_FILEPATH"]` is not a Fastfile doing it wrong, and asking
+ * it to rename anything would make Laneyard a thing projects adapt to. So the
+ * name stored with the block is the only name exported: no default is emitted
+ * alongside it as a courtesy, because that courtesy is what makes a typo in the
+ * configured name look like it worked.
+ *
+ * **Every applicable block is materialised, whether or not the lane looks like
+ * it needs it.** Narrowing this to what a lane appears to use is tempting: it
+ * would shrink the window a private key spends unencrypted on disk, which is
+ * the one cost this module carries. It is not worth it. Detection reads a
+ * Fastfile that can call anything through `sh`, a plugin, or a lane in another
+ * file; a detector that guesses "not needed" and guesses wrong turns a build
+ * that worked into a build that fails — or worse, into a debug-signed artifact
+ * that ships. Detection decides what Laneyard *asks* for, never what it
+ * withholds at run time.
+ *
+ * A block that will not decrypt throws, and the run never starts. That is the
+ * same trade `Vault.resolveCredential` makes and for the same reason: an
+ * absent signing key is not a missing variable fastlane will name for you, it
+ * is an artifact that builds, uploads, and is rejected by the store days later.
+ */
+export async function materialiseCredentials(vault, projectSlug, runSecretsDir) {
+    const env = {};
+    let keystore;
+    const cleanup = async () => {
+        await rm(runSecretsDir, { recursive: true, force: true });
+        // And the `runs/<run id>` folder that held it, so a server does not
+        // accumulate one empty directory per build it has ever run. `rmdir` rather
+        // than `rm -r`: it refuses a folder that still has something in it, which
+        // is exactly the protection wanted for a path this function did not create.
+        await rmdir(dirname(runSecretsDir)).catch(() => { });
+    };
+    // The mode is applied explicitly rather than trusted to `mkdir`: the mode
+    // argument is masked by the process umask, and a server started from a shell
+    // with a lax umask would otherwise hand out a world-readable key directory.
+    await mkdir(runSecretsDir, { recursive: true });
+    await chmod(runSecretsDir, 0o700);
+    try {
+        for (const summary of vault.listCredentials(projectSlug)) {
+            const block = vault.resolveCredential(projectSlug, summary.kind);
+            if (!block)
+                continue;
+            const defaults = defaultVarNames(summary.kind);
+            const names = { ...defaults, ...block.varNames };
+            // One directory per kind, so the original file name survives intact.
+            // Some tools read meaning from it — `AuthKey_<KEY ID>.p8` is a convention
+            // fastlane's own docs use — and flattening two blocks into one directory
+            // would let a `.p8` and a service account JSON that happen to share a name
+            // overwrite each other, silently, on the run that used both.
+            const dir = join(runSecretsDir, summary.kind);
+            await mkdir(dir, { recursive: true });
+            await chmod(dir, 0o700);
+            // `basename` because the name came from an upload and has never been
+            // constrained: a stored `../../id_rsa` must land in this directory, not
+            // over something in the user's home.
+            const path = join(dir, basename(block.fileName) || summary.kind);
+            await writeFile(path, block.fileBytes, { mode: 0o600 });
+            await chmod(path, 0o600);
+            if (summary.kind === "android_keystore")
+                keystore = { storeFile: path, fields: block.fields };
+            env[names["path"] ?? defaults["path"]] = path;
+            for (const [field, value] of Object.entries(block.fields)) {
+                const name = names[field];
+                // A field with no name is a block stored before that field existed;
+                // dropping it beats exporting it under a name nobody agreed on.
+                if (name && value)
+                    env[name] = value;
+            }
+        }
+    }
+    catch (cause) {
+        // Nothing may survive a partial materialisation: the blocks that did get
+        // written are as sensitive as the one that failed, and the caller's
+        // `cleanup` is never reached when this function throws.
+        await cleanup();
+        throw cause;
+    }
+    return { env, keystore, cleanup };
+}

package/dist/src/runner/orchestrate.js

@@ -1,9 +1,11 @@
 import { rm } from "node:fs/promises";
 import { join } from "node:path";
-import { Workspace } from "../git/workspace.js";
+import { gitEnvFor, Workspace } from "../git/workspace.js";
 import { summarizeFailure } from "../heuristics/error-summary.js";
+import { appRootOf, searchDir } from "../heuristics/platforms.js";
 import { Redactor, scrub } from "../logs/redact.js";
 import { collectArtifacts } from "./artifacts.js";
+import { removeGradleProperties, sweepGradleProperties, writeGradleProperties, } from "./gradle-properties.js";
 import { LiveStepTracker } from "./live-steps.js";
 import { startPty } from "./pty.js";
 import { readReport } from "./report.js";
@@ -13,8 +15,37 @@ import { readReport } from "./report.js";
  * Never throws: every error is converted into a documented `failed` run,
  * because a run that disappears without a trace is the worst possible
  * behaviour for a build server.
+ *
+ * The whole of it is wrapped so the signing blocks written for this run are
+ * removed on every way out — the successful return, the four early exits, the
+ * cancellations, and the exception this function promises not to raise but
+ * cannot rule out. A private key left on disk because a clone failed is a leak
+ * with no expiry date, and the only moment at which it is certainly safe to
+ * delete is the moment fastlane has stopped running.
+ *
+ * The gradle properties file is removed here too, and it is the one written
+ * somewhere this run does not own: the clone is kept between runs, so passwords
+ * left in it would sit in a working tree until someone noticed. The path is
+ * carried out through a holder rather than returned, because it is decided deep
+ * inside the run and has to be visible to a `finally` wrapped around all of it.
  */
 export async function executeRun(opts) {
+    const wrote = { properties: null };
+    try {
+        return await execute(opts, wrote);
+    }
+    finally {
+        // Guarded by the marker, so a file the user replaced mid-run survives.
+        await removeGradleProperties(wrote.properties).catch(() => { });
+        // Deliberately swallowed: by now the log writer is closed and the run's
+        // verdict is recorded, so there is nowhere left to report this without
+        // rewriting a finished run's outcome as a failure it did not have. A
+        // directory that resists `rm -rf` is a broken disk, not a broken build.
+        if (opts.cleanup)
+            await opts.cleanup().catch(() => { });
+    }
+}
+async function execute(opts, wrote) {
     const { runId, runs, logs } = opts;
     const writer = await logs.open(runId);
     const tracker = new LiveStepTracker();
@@ -79,6 +110,29 @@ export async function executeRun(opts) {
     catch (cause) {
         return fail(`Unreadable project settings: ${cause.message}`);
     }
+    // The properties file gradle may be waiting for, in the clone rather than in
+    // this run's own directory — `gradle-properties.ts` says why, and why it is
+    // hedged about with a marker. It happens here, after the settings, because
+    // the app root it is written under is derived from `fastlane_dir`, and before
+    // the cancellation checkpoint, so that a run cancelled in this exact instant
+    // still leaves the workspace as it found it.
+    //
+    // The sweep first, and whether or not this project still has a keystore: a
+    // run killed mid-build leaves a file nothing was left running to remove, and
+    // the next run is the first moment anything can. Its failure is not reported
+    // — a leftover that resists removal is a broken disk, not a broken build, and
+    // saying so here would fail a run for a file it has not needed yet.
+    const androidRoot = searchDir(opts.workspacePath, appRootOf(settings.fastlane_dir));
+    await sweepGradleProperties(androidRoot, opts.androidKeystore).catch(() => { });
+    try {
+        wrote.properties = await writeGradleProperties(androidRoot, opts.androidKeystore);
+    }
+    catch (cause) {
+        // Failing the run rather than carrying on. Carrying on is what produces the
+        // artifact this whole module exists to prevent: a release build that
+        // succeeds, signed with the debug key, rejected by the store days later.
+        return fail(`Could not write the signing properties file: ${cause.message}`);
+    }
     // Cancelled during preparation: fastlane never gets to start.
     if (opts.signal?.aborted) {
         return finishAs("cancelled", "Cancelled");
@@ -90,6 +144,19 @@ export async function executeRun(opts) {
     // didn't have time to overwrite. Without this cleanup, a run that fails
     // before even reaching fastlane would adopt the previous run's timeline.
     await rm(reportPath, { force: true });
+    // The identity fallback is only set when the workspace has none of its own:
+    // a clone Laneyard made carries no `user.email`, so a lane running `git
+    // commit` fails with "Please tell me who you are" on any server whose global
+    // git configuration is empty. Where an identity does exist — the server's own,
+    // or one set on the repository — it is left to win, because these variables
+    // override configuration rather than backing it up.
+    const gitEnv = gitEnvFor(opts.gitAuth ?? { kind: "none" });
+    if ((await workspace.identity().catch(() => null)) === null) {
+        gitEnv["GIT_AUTHOR_NAME"] = "Laneyard";
+        gitEnv["GIT_AUTHOR_EMAIL"] = "laneyard@localhost";
+        gitEnv["GIT_COMMITTER_NAME"] = "Laneyard";
+        gitEnv["GIT_COMMITTER_EMAIL"] = "laneyard@localhost";
+    }
     const { done } = startPty({
         command: useBundle ? "bundle" : "fastlane",
         args: useBundle
@@ -99,12 +166,27 @@ export async function executeRun(opts) {
         env: {
             ...opts.env,
             ...(opts.secrets ?? {}),
+            // After the secrets: a block is the more deliberate of the two, and it is
+            // the only one whose path variable points at a file that actually exists
+            // right now. A stray secret of the same name would otherwise send gradle
+            // looking for a keystore at a path from a previous machine.
+            ...(opts.credentialEnv ?? {}),
             // Order matters: secrets come after opts.env so a stored secret wins over
             // a variable that happens to exist in the server's own environment, and
-            // before these three fixed variables so no secret can override CI.
+            // before these fixed variables so no secret can override CI.
             CI: "true",
             FASTLANE_SKIP_UPDATE_CHECK: "1",
             FORCE_COLOR: "1",
+            // A lane may run git itself — bumping and pushing a build number is a
+            // reasonable thing for a Fastfile to do — and until now that `sh("git
+            // push")` inherited none of the care Laneyard takes with its own git
+            // calls. It got the worst failure available: a push needing a credential
+            // did not fail, it waited, and the run sat there until its timeout with
+            // nothing in the log to say what for.
+            //
+            // After the secrets, deliberately. These are not preferences: a stored
+            // `GIT_TERMINAL_PROMPT=1` would restore exactly the hang this removes.
+            ...gitEnv,
         },
         onData: (chunk) => void emit(chunk),
         timeoutMs: settings.timeout_minutes * 60_000,
@@ -112,6 +194,13 @@ export async function executeRun(opts) {
     });
     const outcome = await done;
     await emitRest();
+    // The moment gradle has certainly stopped reading it, which is earlier than
+    // the `finally` and worth taking: the artifact collection below globs the
+    // workspace, and a project whose globs are broad enough would otherwise be
+    // offered its own signing passwords as a downloadable artifact. The `finally`
+    // still runs — this is a narrowing, not a replacement, and removing a file
+    // that is already gone costs nothing.
+    await removeGradleProperties(wrote.properties).catch(() => { });
     // --- Timeline -------------------------------------------------------------
     // Everything that follows is after-sales service: the timeline and the
     // artifacts embellish a run that's already finished. A database that