laneyard 0.3.0 → 0.4.0

package/dist/src/heuristics/readiness.js

@@ -1,4 +1,19 @@
-import { findBlockingActions } from "./blocking-actions.js";
+import { argsGiven, findBlockingActions } from "./blocking-actions.js";
+export const READ_EVERYTHING = { imports: false, customActions: false };
+/** The sentence, once, so four checks cannot drift apart on how they say it. */
+function unreadReason(unread) {
+    if (!unread.ok)
+        return null;
+    const { imports, customActions } = unread.value;
+    if (imports && customActions) {
+        return "this Fastfile imports lanes from elsewhere and the project defines its own actions";
+    }
+    if (imports)
+        return "this Fastfile imports lanes from elsewhere";
+    if (customActions)
+        return "the project defines its own actions in fastlane/actions";
+    return null;
+}
 const ok = (detail) => ({ state: "ok", detail });
 const warn = (detail, fix, fixIn) => ({
     state: "warn",
@@ -6,10 +21,14 @@ const warn = (detail, fix, fixIn) => ({
     ...(fix === undefined ? {} : { fix }),
     ...(fixIn === undefined ? {} : { fixIn }),
 });
-const undetermined = (detail, fix) => ({
+// `fixIn` belongs here as much as on a warning: "could not tell" and "here is
+// the one setting that would settle it" are not in tension, and a link is worth
+// more on the line nobody knows what to do with than on the one that says so.
+const undetermined = (detail, fix, fixIn) => ({
     state: "unknown",
     detail,
     ...(fix === undefined ? {} : { fix }),
+    ...(fixIn === undefined ? {} : { fixIn }),
 });
 /** A rejection is not always an `Error`; a checklist saying "undefined" is worse than useless. */
 const reasonOf = (cause) => cause instanceof Error ? cause.message : String(cause);
@@ -23,6 +42,8 @@ const META = {
     androidKeystore: { id: "android-keystore", title: "keystore reachable without a prompt" },
     playStore: { id: "play-store", title: "Play Store service account" },
     platforms: { id: "platforms", title: "what this project builds for" },
+    environment: { id: "environment", title: "the variables the lanes read" },
+    releaseSigning: { id: "release-signing", title: "release signed with the release key" },
 };
 /**
  * Does the remote answer without asking anyone for credentials?
@@ -85,23 +106,180 @@ export async function checkDependencies(input) {
 }
 /** Any suffix: the key is split across several variables, and their names vary by lane. */
 const API_KEY = /^APP_STORE_CONNECT_API_KEY/;
-const STORE_API_KEY = "Store an App Store Connect API key — `APP_STORE_CONNECT_API_KEY_ID`, " +
-    "`APP_STORE_CONNECT_API_KEY_ISSUER_ID` and the `.p8` contents — from the secrets tab. " +
+/**
+ * The one name on this page that never worked.
+ *
+ * `APP_STORE_CONNECT_API_KEY_P8` appears nowhere in fastlane 2.237 — no action
+ * declares it, so no lane can read it. Laneyard's own screen invented it and
+ * asked people to store their `.p8` under it, and `API_KEY` above prefix-matches
+ * it, so the result was a green tick for a value that reached nothing.
+ *
+ * Excluded rather than merely un-ticked: the value is still in the vault, and
+ * someone who put it there is entitled to be told it does nothing instead of
+ * being left with a checklist that has quietly gone silent about it.
+ */
+const DEAD_API_KEY = /^APP_STORE_CONNECT_API_KEY_P8$/;
+const STORE_API_KEY = "Upload the `.p8` as an App Store Connect key block from the signing tab, with its key id and " +
+    "issuer id. Laneyard writes the file for the length of a run and exports the three of them under " +
+    "the names the block carries, so nothing in the project has to change. " +
     "An API key does not expire on its own.";
-export function checkAppStoreConnect(secretKeys) {
-    if (secretKeys.some((key) => API_KEY.test(key))) {
+/** The action whose whole job is to load a `.p8`, under both of its names. */
+const ASC_KEY_ACTIONS = new Set(["app_store_connect_api_key", "asc_api_key"]);
+/**
+ * The actions that sign in to Apple, and therefore the ones that decide whether
+ * this project needs a key at all.
+ *
+ * Deliberately wider than "uploads": `match` fetches from a certificates
+ * repository but authenticates with App Store Connect to do it, and
+ * `latest_testflight_build_number` is the version-numbering call half the
+ * Fastfiles in existence make before they build anything. A lane that only
+ * builds, tests or screenshots is in none of them, and that lane's project is
+ * told it needs nothing — which is the whole point of asking.
+ */
+const APPLE_AUTH_ACTIONS = new Set([
+    ...ASC_KEY_ACTIONS,
+    "upload_to_testflight",
+    "pilot",
+    "upload_to_app_store",
+    "deliver",
+    "latest_testflight_build_number",
+    "app_store_build_number",
+    "download_dsyms",
+    "precheck",
+    "check_app_store_metadata",
+    "produce",
+    "create_app_online",
+    "register_devices",
+    "match",
+    "sync_code_signing",
+    "get_certificates",
+    "cert",
+    "get_provisioning_profile",
+    "sigh",
+]);
+/**
+ * Arguments that name the key somewhere other than the vault.
+ *
+ * `key_filepath` and `api_key_path` are paths to a `.p8`; `key_content` and
+ * `api_key` are the thing itself, or a hash built earlier in the lane.
+ */
+const ASC_KEY_ARGS = ["key_filepath", "key_content", "api_key_path", "api_key", "key_id"];
+/**
+ * Is there an App Store Connect credential, wherever it lives?
+ *
+ * Four places, and the vault is only the first. A project that configured
+ * fastlane years before it met Laneyard has its key in the Fastfile or beside
+ * it, and telling that project it has "no App Store Connect credential" is
+ * false — the run works. So the Fastfile, the repository and the Appfile are
+ * all read before anything is claimed.
+ *
+ * Only the vault earns a tick. Everything else earns `unknown`, and the reason
+ * is the same every time: a path in a Fastfile, or a `.p8` in a repository, says
+ * a credential was arranged — it does not say the file is on *this* machine,
+ * with the passphrase and permissions a run needs. A green tick that means "it
+ * looks arranged" is the tick nobody can trust afterwards.
+ *
+ * The vault holds two routes and both are answers: a block, which Laneyard
+ * writes to disk for the run, and the loose variables a project stored before
+ * blocks existed. Neither is preferred over the other here — a recommendation is
+ * only made when there is nothing at all.
+ */
+export function checkAppStoreConnect(input) {
+    const { secretKeys, uses, keyFilesInRepo, appfile } = input;
+    const blocks = input.blocks ?? [];
+    if (blocks.includes("apple_asc")) {
+        return {
+            ...META.appStoreConnect,
+            ...ok("an App Store Connect key block is in the vault: the `.p8` is written for the length of a " +
+                "run, with its key id and issuer id exported beside it."),
+        };
+    }
+    if (secretKeys.some((key) => API_KEY.test(key) && !DEAD_API_KEY.test(key))) {
         return { ...META.appStoreConnect, ...ok("an App Store Connect API key is in the vault.") };
     }
+    // The one place on this checklist where somebody is asked to redo work — and
+    // it is work that never did anything. See `DEAD_API_KEY`.
+    if (secretKeys.some((key) => DEAD_API_KEY.test(key))) {
+        return {
+            ...META.appStoreConnect,
+            ...warn("`APP_STORE_CONNECT_API_KEY_P8` is in the vault, and no action in fastlane reads a variable " +
+                "of that name: the value is stored, and no lane can see it. An earlier version of this " +
+                "interface asked for it.", STORE_API_KEY, "signing"),
+        };
+    }
+    // Named in a lane: the commonest way a pre-existing project holds its key,
+    // and the one the vault-only check used to report as nothing at all.
+    const inLanes = uses.ok
+        ? uses.value.filter((lane) => lane.actions.some((a) => ASC_KEY_ACTIONS.has(a.name) ||
+            ASC_KEY_ARGS.some((arg) => argsGiven(a).includes(arg))))
+        : [];
+    if (inLanes.length > 0) {
+        return {
+            ...META.appStoreConnect,
+            ...undetermined(`${nameList(inLanes.map((l) => l.lane))} supplies its own API key: whether the \`.p8\` it ` +
+                "names is on this machine is not something a Fastfile says.", STORE_API_KEY),
+        };
+    }
+    // Nothing in the vault, and nothing named in a lane. Before reporting an
+    // absence, ask whether the absence matters here: a key is wanted by a lane
+    // that signs in to Apple, not by a project that happens to build for iOS.
+    if (!uses.ok) {
+        return { ...META.appStoreConnect, ...undetermined(`could not read the lanes: ${uses.reason}`) };
+    }
+    // Read once: three of the outcomes below turn on the same blindness.
+    const blind = unreadReason(input.unread ?? { ok: true, value: READ_EVERYTHING });
+    const signsIn = uses.value.some((lane) => lane.actions.some((action) => APPLE_AUTH_ACTIONS.has(action.name)));
+    if (!signsIn) {
+        if (blind) {
+            return {
+                ...META.appStoreConnect,
+                ...undetermined(`no lane seen to sign in to App Store Connect — but ${blind}.`, STORE_API_KEY),
+            };
+        }
+        return {
+            ...META.appStoreConnect,
+            ...ok("no lane signs in to App Store Connect: nothing here needs a key."),
+        };
+    }
+    const p8 = keyFilesInRepo.ok ? keyFilesInRepo.value : [];
+    if (p8.length > 0) {
+        return {
+            ...META.appStoreConnect,
+            ...undetermined(`the repository carries ${nameList(p8)}: a key is arranged, but nothing here says a lane ` +
+                "loads it, or that it is the one App Store Connect expects.", STORE_API_KEY),
+        };
+    }
     if (secretKeys.includes("FASTLANE_SESSION")) {
         return {
             ...META.appStoreConnect,
             ...warn("only a FASTLANE_SESSION: Apple sessions expire, and the run that finds it expired " +
-                "stops and asks for a verification code.", STORE_API_KEY, "secrets"),
+                "stops and asks for a verification code.", STORE_API_KEY, "signing"),
+        };
+    }
+    // An Apple ID in the Appfile is not a credential — it is the thing that makes
+    // a run stop and ask for a verification code — but saying so is more use than
+    // "no credential", which reads as though the Appfile had not been looked at.
+    if (appfile.ok && appfile.value.appleId.kind !== "absent") {
+        return {
+            ...META.appStoreConnect,
+            ...warn("the Appfile names an Apple ID and nothing else: a lane that uploads signs in as that " +
+                "account, and two-factor authentication stops the run to ask for a code.", STORE_API_KEY, "signing"),
+        };
+    }
+    // This one is a warning rather than a tick, so being wrong costs less — but
+    // "in the lanes" is a claim about lanes that were read, and saying it about
+    // lanes that could not be is still saying something untrue.
+    if (blind) {
+        return {
+            ...META.appStoreConnect,
+            ...undetermined(`no App Store Connect credential in the vault or in the repository, and none seen in the ` +
+                `lanes — but ${blind}.`, STORE_API_KEY),
         };
     }
     return {
         ...META.appStoreConnect,
-        ...warn("no App Store Connect credential in the vault: a lane that uploads will ask for an Apple ID.", STORE_API_KEY, "secrets"),
+        ...warn("no App Store Connect credential in the vault, in the lanes, or in the repository: " +
+            "a lane that uploads will ask for an Apple ID.", STORE_API_KEY, "signing"),
     };
 }
 /** The two names for the same action. `match` is the older one, still the common one. */
@@ -149,12 +327,20 @@ export function checkMatch(uses, secretKeys) {
     }
     return { ...META.match, ...ok("MATCH_PASSWORD is stored, and every match call is readonly.") };
 }
-export function checkBlockingActions(uses) {
+export function checkBlockingActions(uses, unread = { ok: true, value: READ_EVERYTHING }) {
     if (!uses.ok) {
         return { ...META.blockingActions, ...undetermined(`could not read the lanes: ${uses.reason}`) };
     }
     const findings = uses.value.flatMap((lane) => findBlockingActions(lane.actions).map((finding) => ({ lane: lane.lane, finding })));
     if (findings.length === 0) {
+        const blind = unreadReason(unread);
+        if (blind) {
+            return {
+                ...META.blockingActions,
+                ...undetermined(`no lane seen to call an action known to stop and ask — but ${blind}, so a lane that ` +
+                    "waits could be out of sight from here."),
+            };
+        }
         return { ...META.blockingActions, ...ok("no lane calls an action known to stop and ask.") };
     }
     return {
@@ -176,17 +362,55 @@ const GRADLE_ACTIONS = new Set(["gradle", "build_android_app"]);
 const KEYSTORE_ARGS = ["storeFile", "storePassword"];
 /** `ANDROID_KEYSTORE_PASSWORD`, `KEYSTORE_PASSWORD`, `STORE_PASSWORD`. */
 const KEYSTORE_PASSWORD = /(^|_)(KEYSTORE|STORE)_PASSWORD$/;
-const STORE_KEYSTORE_PASSWORD = "Store the keystore passphrase as `ANDROID_KEYSTORE_PASSWORD` from the secrets tab, " +
-    "and read it in the lane with `storePassword: ENV[\"ANDROID_KEYSTORE_PASSWORD\"]`.";
-export function checkAndroidKeystore(uses, secretKeys) {
+/**
+ * What to do about a keystore, said once.
+ *
+ * It used to say to store the passphrase loose and read it in the lane with
+ * `storePassword: ENV["ANDROID_KEYSTORE_PASSWORD"]` — which is a Fastfile edit,
+ * and so not Laneyard's to ask for. A block carries the file and the passphrases
+ * together, and a run gets both without the project knowing anything about it.
+ */
+const STORE_KEYSTORE = "Upload the keystore as an android keystore block from the signing tab, with its alias and its " +
+    "two passphrases. Laneyard writes the file for the length of a run and exports the names the " +
+    "block carries, so no lane has to be changed to find it.";
+export function checkAndroidKeystore(uses, secretKeys, unread = { ok: true, value: READ_EVERYTHING }, blocks = []) {
+    // Answered before the lanes are read, and on purpose: the question is whether
+    // anything will stop and ask for a passphrase, and a block means nothing can —
+    // whichever lane, and whether or not gradle is called by name.
+    if (blocks.includes("android_keystore")) {
+        return {
+            ...META.androidKeystore,
+            ...ok("an android keystore block is in the vault: the keystore is written for the length of a " +
+                "run and its passphrases exported with it, so nothing stops to ask for one."),
+        };
+    }
     if (!uses.ok) {
         return { ...META.androidKeystore, ...undetermined(`could not read the lanes: ${uses.reason}`) };
     }
     const calls = uses.value.flatMap((lane) => lane.actions.filter((a) => GRADLE_ACTIONS.has(a.name)).map((action) => ({ lane: lane.lane, action })));
     if (calls.length === 0) {
-        return { ...META.androidKeystore, ...ok("no lane builds with gradle.") };
+        // This check only runs in the Android section, so reaching here means the
+        // project builds for Android and no lane was seen calling gradle. That is
+        // not "nothing needs a keystore" — it is a build driven by something else.
+        // `flutter build appbundle` and `react-native build-android` both run
+        // gradle underneath, and the signing configuration then lives in
+        // `build.gradle` or `key.properties`, where no reading of a Fastfile
+        // reaches it. Ticking that was the same mistake as the Play Store one: a
+        // confident green for a question nobody answered.
+        const blind = unreadReason(unread);
+        return {
+            ...META.androidKeystore,
+            ...undetermined("no lane seen handing gradle a keystore" +
+                (blind ? ` — and ${blind}` : "") +
+                ". This project builds for Android, so signing is configured somewhere a Fastfile does " +
+                "not show: `build.gradle`, `key.properties`, or a build driven through flutter or " +
+                "react-native.", STORE_KEYSTORE),
+        };
     }
-    const signing = calls.filter((c) => KEYSTORE_ARGS.some((arg) => arg in c.action.args));
+    // `given`, not `args`, for the same reason as the two credential checks:
+    // `storePassword: ENV["KS_PASS"]` is a keystore that needs unlocking just as
+    // much as a literal one, and it leaves no literal behind.
+    const signing = calls.filter((c) => KEYSTORE_ARGS.some((arg) => argsGiven(c.action).includes(arg)));
     if (signing.length === 0) {
         // Deliberately a statement about what was read, not about the build: a
         // keystore configured in `build.gradle` or through the environment is
@@ -210,7 +434,7 @@ export function checkAndroidKeystore(uses, secretKeys) {
     return {
         ...META.androidKeystore,
         ...warn(`${nameList(withoutPassphrase.map((c) => c.lane))} hands gradle a keystore, but no keystore ` +
-            "passphrase is in the vault: gradle asks for it and waits.", STORE_KEYSTORE_PASSWORD, "secrets"),
+            "passphrase is in the vault: gradle asks for it and waits.", STORE_KEYSTORE, "signing"),
     };
 }
 /** The two names for the same action. `supply` is the older one. */
@@ -219,9 +443,15 @@ const PLAY_UPLOAD_ACTIONS = new Set(["upload_to_play_store", "supply"]);
 const PLAY_JSON_KEY = /^SUPPLY_JSON_KEY/;
 /** The same credential, named in the call instead of in the vault. */
 const PLAY_KEY_ARGS = ["json_key", "json_key_data"];
-const STORE_PLAY_KEY = "Store the service account JSON as `SUPPLY_JSON_KEY_DATA` from the secrets tab. " +
+/** Named once: three outcomes of the environment check point at the same thing. */
+const DECLARE_SECRETS = "A variable read by a tool the lane shells out to — `sentry-cli` and its " +
+    "`SENTRY_AUTH_TOKEN`, say — is not something a Fastfile mentions. List those under " +
+    "`required_secrets` in laneyard.yml and they are checked like the rest.";
+const STORE_PLAY_KEY = "Upload the service account JSON as a Play Store service account block from the signing tab. " +
+    "Laneyard writes the file for the length of a run and exports its path under the name the block " +
+    "carries — `SUPPLY_JSON_KEY`, which supply reads by itself, unless the block says otherwise. " +
     "A service account does not expire on its own.";
-export function checkPlayStore(uses, secretKeys) {
+export function checkPlayStore(uses, secretKeys, appfile, unread = { ok: true, value: READ_EVERYTHING }, blocks = []) {
     if (!uses.ok) {
         return { ...META.playStore, ...undetermined(`could not read the lanes: ${uses.reason}`) };
     }
@@ -229,25 +459,75 @@ export function checkPlayStore(uses, secretKeys) {
         .filter((a) => PLAY_UPLOAD_ACTIONS.has(a.name))
         .map((action) => ({ lane: lane.lane, action })));
     if (calls.length === 0) {
+        // The one conclusion drawn purely from absence, and the one that was wrong
+        // for every project whose upload sits behind an import or a custom action.
+        const blind = unreadReason(unread);
+        if (blind) {
+            return {
+                ...META.playStore,
+                ...undetermined(`no lane seen to upload to the Play Store — but ${blind}, so this is not the same ` +
+                    "as no lane uploading.", STORE_PLAY_KEY),
+            };
+        }
         return { ...META.playStore, ...ok("no lane uploads to the Play Store.") };
     }
+    // Either route answers: the block, or the loose variable a project stored
+    // before blocks existed and which fastlane still reads exactly as it did.
+    if (blocks.includes("play_service_account")) {
+        return {
+            ...META.playStore,
+            ...ok("a Play Store service account block is in the vault: the JSON is written for the length of " +
+                "a run and its path exported."),
+        };
+    }
     if (secretKeys.some((key) => PLAY_JSON_KEY.test(key))) {
         return { ...META.playStore, ...ok("a Play Store service account is in the vault.") };
     }
-    const named = calls.filter((c) => PLAY_KEY_ARGS.some((arg) => arg in c.action.args));
+    // Named in the call, whether or not the value could be read. `json_key:
+    // ENV.fetch("…")` is a credential the lane supplies itself just as much as a
+    // literal path is — and reading only literals is what used to make this check
+    // and the App Store Connect one disagree about the same situation.
+    const named = calls.filter((c) => PLAY_KEY_ARGS.some((arg) => argsGiven(c.action).includes(arg)));
     if (named.length > 0) {
         // A path in a Fastfile says nothing about whether that file exists on this
         // machine. Neither a tick nor a warning would be honest.
         return {
             ...META.playStore,
-            ...undetermined(`${nameList(named.map((c) => c.lane))} passes \`json_key\` in the call: whether that file is ` +
-                "on this machine is not something a Fastfile says.", STORE_PLAY_KEY),
+            ...undetermined(`${nameList(named.map((c) => c.lane))} supplies its own service account: whether the file ` +
+                "it names is on this machine is not something a Fastfile says.", STORE_PLAY_KEY),
         };
     }
+    // The Appfile, which is where a project that predates Laneyard almost always
+    // keeps this — and which the check used to be blind to, so a project with a
+    // working service account was told it had none.
+    if (appfile.ok) {
+        const { jsonKeyFile, jsonKeyData } = appfile.value;
+        if (jsonKeyData.kind !== "absent") {
+            return {
+                ...META.playStore,
+                ...undetermined("the Appfile sets `json_key_data`: the credential travels with the repository, and " +
+                    "whether it is still valid is not something a file says.", STORE_PLAY_KEY),
+            };
+        }
+        if (jsonKeyFile.kind === "literal") {
+            return {
+                ...META.playStore,
+                ...undetermined(`the Appfile points \`json_key_file\` at ${jsonKeyFile.value}: whether that file is on ` +
+                    "this machine is not something an Appfile says.", STORE_PLAY_KEY),
+            };
+        }
+        if (jsonKeyFile.kind === "computed") {
+            return {
+                ...META.playStore,
+                ...undetermined("the Appfile sets `json_key_file` to something it computes — an environment variable, " +
+                    "most likely — which a run only resolves once it is running.", STORE_PLAY_KEY),
+            };
+        }
+    }
     return {
         ...META.playStore,
         ...warn(`${nameList(calls.map((c) => c.lane))} uploads to the Play Store, but no service account is in ` +
-            "the vault: supply stops and asks which credentials to use.", STORE_PLAY_KEY, "secrets"),
+            "the vault: supply stops and asks which credentials to use.", STORE_PLAY_KEY, "signing"),
     };
 }
 /**
@@ -267,6 +547,220 @@ function platformNote(platforms) {
             "and the checks for that platform appear here."),
     };
 }
+/**
+ * The one question the block's form can settle that nothing else can. Asked
+ * here, answered there, and no file in the repository is touched either way.
+ */
+const SET_PROPERTIES_PATH = "Set the properties file path on the keystore block, relative to the app, and Laneyard writes " +
+    "the file there for the length of a run.";
+/**
+ * Where the build resolves the properties file, as a clause a sentence can take.
+ *
+ * A directory rather than a path: `android/` for one project and the repository
+ * root for another, and the parser deliberately reports the scope Gradle uses
+ * rather than a path it would have had to invent. An unresolved scope adds
+ * nothing to the sentence — naming the wrong directory sends someone to look in
+ * a place the build never reads, which is worse than leaving them to look.
+ */
+function where(file) {
+    if (file.scope === "root")
+        return " in the Gradle root directory";
+    if (file.scope === "module")
+        return " in the app module directory";
+    return "";
+}
+/**
+ * Where Laneyard would write that file, or null when it would write nothing.
+ *
+ * The same three answers `runner/gradle-properties.ts` arrives at, in the same
+ * order, and that is not a coincidence to be maintained by hand: a check that
+ * promised a file the runner then declined to write would be the worst line on
+ * this page, because it would be reassuring and wrong. The configured path wins
+ * outright, an unresolved scope with no configured path means nothing is
+ * written, and everything else follows the scope the parser read.
+ */
+function writesAt(block, file) {
+    if (block === null)
+        return null;
+    if (block.propertiesPath !== null && block.propertiesPath !== "") {
+        return ` at ${block.propertiesPath}, the path the block names`;
+    }
+    if (file.scope === "unknown")
+        return null;
+    return where(file);
+}
+/**
+ * Will a release build actually be signed with the release key?
+ *
+ * The one check here whose failure is silent. Everything else fails loudly — a
+ * run stops, a credential is missing, a lane waits. This one *succeeds*: the
+ * build finishes, produces an artifact signed with the debug key, and the error
+ * arrives from the store minutes later saying nothing about signing.
+ *
+ * The pattern is in the Flutter documentation, so it is everywhere: sign with
+ * the release config when `key.properties` exists, and with the debug config
+ * when it does not. The same documentation gitignores `key.properties` — so it
+ * is absent from every clone, including the one a build server works from.
+ */
+export function checkReleaseSigning(input) {
+    const { gradle, conditionalFilePresent } = input;
+    const keystore = input.keystore ?? null;
+    if (!gradle.ok) {
+        return {
+            ...META.releaseSigning,
+            ...undetermined(`could not read the android build script: ${gradle.reason}`),
+        };
+    }
+    if (!gradle.value.releaseCanUseDebugKey) {
+        return {
+            ...META.releaseSigning,
+            ...ok("the release build type never takes the debug signing config."),
+        };
+    }
+    const { conditionalOn } = gradle.value;
+    if (conditionalOn) {
+        const { name } = conditionalOn;
+        const writes = writesAt(keystore, conditionalOn);
+        // What Laneyard will do, in the words of the file the build already asks
+        // for. The keys are named rather than assumed silently: they are a
+        // convention — the Flutter documentation's — and the one thing between a
+        // signed artifact and a debug-signed one that nobody read out of the script.
+        if (writes !== null && keystore !== null) {
+            const keys = nameList(keystore.propertyNames);
+            const supplied = `Laneyard writes ${name}${writes} for the length of a run, from the keystore block, with ` +
+                `the keys ${keys}. Those names come from the block's settings rather than something the ` +
+                "build script states — what a script reads out of that file is not written anywhere this " +
+                "can see — so the setting starts from the Flutter documentation's four, and a build that " +
+                "reads others is corrected there.";
+            if (!conditionalFilePresent) {
+                return {
+                    ...META.releaseSigning,
+                    ...ok(`the release build falls back to the debug signing config when ${name} is missing, and ` +
+                        `${name} is not in the clone. ${supplied}`),
+                };
+            }
+            return {
+                ...META.releaseSigning,
+                ...ok(`${name} is present${where(conditionalOn)}, so the release key is used — and that file is ` +
+                    `the project's own, which Laneyard leaves alone. Were it ever to go missing, ${supplied}`),
+            };
+        }
+        // A block, and nowhere to put the file: the script names it on a receiver
+        // the parser could not follow, so the directory is genuinely unknown. Two
+        // directories, one right, and writing into the wrong one would leave the
+        // build signing with the debug key next to a file that looked like the
+        // answer. The block's own form settles it — a question, not a commit.
+        if (keystore !== null && !conditionalFilePresent) {
+            return {
+                ...META.releaseSigning,
+                ...undetermined(`the release build falls back to the debug signing config when ${name} is missing, and ` +
+                    `${name} is not in the clone. A keystore block is in the vault, but the build script ` +
+                    `names ${name} without saying which directory it resolves against, so Laneyard will ` +
+                    "not guess where to write it.", SET_PROPERTIES_PATH, "signing"),
+            };
+        }
+        if (!conditionalFilePresent) {
+            const looksIn = where(conditionalOn);
+            return {
+                ...META.releaseSigning,
+                ...warn(`the release build falls back to the debug signing config when ${name} is missing, and ` +
+                    `${name} is not in the clone` +
+                    (looksIn === "" ? "" : ` — the build looks for it${looksIn}`) +
+                    ". The build will not fail: it will produce an artifact signed with the debug key, and " +
+                    "the store will reject it.", `${name} is gitignored by the same documentation that recommends it, so it never reaches ` +
+                    "a clone. Upload the keystore as an android keystore block from the signing tab: " +
+                    `Laneyard then writes ${name} itself for the length of a run, and removes it ` +
+                    "afterwards. Nothing in the build script changes.", "signing"),
+            };
+        }
+        return {
+            ...META.releaseSigning,
+            ...undetermined(`${conditionalOn.name} is present${where(conditionalOn)}, so the release key is ` +
+                "used — but the build falls back to the debug signing config if it ever goes missing, " +
+                "and does so without failing.", keystore === null ? STORE_KEYSTORE : SET_PROPERTIES_PATH),
+        };
+    }
+    return {
+        ...META.releaseSigning,
+        ...undetermined("the release build type can take the debug signing config; whether it does is decided by " +
+            "something this cannot read."),
+    };
+}
+/**
+ * Does the project have the variables its lanes need?
+ *
+ * This is the one credential question a Fastfile can actually answer. The other
+ * checks ask "is there a key somewhere" and end up reasoning about absence;
+ * this one reads `ENV.fetch("ASC_KEY_ID")` out of the lane and asks whether that
+ * name exists — which has a real answer.
+ *
+ * It matters most for a project that keeps its variables in `fastlane/.env`.
+ * That file is almost always gitignored, so it never reaches the clone a build
+ * runs from: everything works on the machine it was written on, nothing works
+ * on the build server, and nothing on screen says why. Naming the variables is
+ * saying why.
+ *
+ * Two things it cannot see, and one answer to both. A variable read by a tool
+ * the lane shells out to — `sentry-cli` wants `SENTRY_AUTH_TOKEN`, and the
+ * Fastfile never mentions it — is invisible to any amount of parsing. So is one
+ * fastlane reads for itself. `required_secrets` in laneyard.yml is where those
+ * are declared, and they are treated exactly like the ones that were found.
+ *
+ * A name a signing block exports counts as supplied. Laneyard writes that file
+ * and sets that variable itself for the length of a run, so asking someone to
+ * store it by hand would be asking them for the thing just uploaded.
+ *
+ * A variable present only in the server's own environment is reported rather
+ * than quietly ticked: it works, but it works because of how this particular
+ * server happened to be started, which is not something the project carries.
+ */
+export function checkEnvironment(input) {
+    const { uses, secretKeys, serverEnv, declared, unread } = input;
+    const blockNames = input.blockNames ?? [];
+    if (!uses.ok) {
+        return { ...META.environment, ...undetermined(`could not read the lanes: ${uses.reason}`) };
+    }
+    const read = uses.value.flatMap((lane) => lane.env ?? []);
+    const required = [...new Set([...read, ...declared])].sort();
+    if (required.length === 0) {
+        const blind = unreadReason(unread);
+        if (blind) {
+            return {
+                ...META.environment,
+                ...undetermined(`no lane seen to read an environment variable — but ${blind}.`, DECLARE_SECRETS),
+            };
+        }
+        return { ...META.environment, ...ok("no lane reads an environment variable.") };
+    }
+    // A block's exported names sit with the vault keys rather than beside them: a
+    // signing block *is* in the vault, and a name it exports reaches the run from
+    // the same place, so nothing below has to distinguish the two.
+    const inVault = new Set([...secretKeys, ...blockNames]);
+    const inServer = new Set(serverEnv);
+    const missing = required.filter((name) => !inVault.has(name) && !inServer.has(name));
+    if (missing.length > 0) {
+        return {
+            ...META.environment,
+            ...warn(`${nameList(missing)} ${missing.length === 1 ? "is" : "are"} needed by a lane and in ` +
+                "neither the vault nor this server's environment: a run stops at the first one, or " +
+                "builds with it empty.", "Store them from the secrets tab. A `fastlane/.env` does not travel — it is almost " +
+                "always gitignored, so it never reaches the clone a build runs from.", "secrets"),
+        };
+    }
+    const borrowed = required.filter((name) => !inVault.has(name));
+    if (borrowed.length > 0) {
+        return {
+            ...META.environment,
+            ...ok(`every variable the lanes need is available — though ${nameList(borrowed)} ` +
+                `${borrowed.length === 1 ? "comes" : "come"} from this server's own environment rather ` +
+                `than the vault, so another machine would not find ${borrowed.length === 1 ? "it" : "them"}.`),
+        };
+    }
+    return {
+        ...META.environment,
+        ...ok(`every variable the lanes need is in the vault: ${nameList(required)}.`),
+    };
+}
 /**
  * The checklist itself: a table, so that adding a check is adding a row.
  *
@@ -279,21 +773,56 @@ export const SECTIONS = [
         checks: [
             { ...META.repository, run: (i) => checkRepository(i.probeRepository) },
             { ...META.dependencies, run: (i) => checkDependencies(i.dependencies) },
-            { ...META.blockingActions, run: (i) => checkBlockingActions(i.uses) },
+            { ...META.blockingActions, run: (i) => checkBlockingActions(i.uses, i.unread) },
+            {
+                ...META.environment,
+                run: (i) => checkEnvironment({
+                    uses: i.uses,
+                    secretKeys: i.secretKeys,
+                    serverEnv: i.serverEnv,
+                    blockNames: i.blockNames ?? [],
+                    declared: i.declaredSecrets,
+                    unread: i.unread,
+                }),
+            },
         ],
     },
     {
         platform: "ios",
         checks: [
-            { ...META.appStoreConnect, run: (i) => checkAppStoreConnect(i.secretKeys) },
+            {
+                ...META.appStoreConnect,
+                run: (i) => checkAppStoreConnect({
+                    secretKeys: i.secretKeys,
+                    uses: i.uses,
+                    keyFilesInRepo: i.keyFilesInRepo,
+                    appfile: i.appfile,
+                    unread: i.unread,
+                    blocks: i.blocks ?? [],
+                }),
+            },
             { ...META.match, run: (i) => checkMatch(i.uses, i.secretKeys) },
         ],
     },
     {
         platform: "android",
         checks: [
-            { ...META.androidKeystore, run: (i) => checkAndroidKeystore(i.uses, i.secretKeys) },
-            { ...META.playStore, run: (i) => checkPlayStore(i.uses, i.secretKeys) },
+            {
+                ...META.androidKeystore,
+                run: (i) => checkAndroidKeystore(i.uses, i.secretKeys, i.unread, i.blocks ?? []),
+            },
+            {
+                ...META.playStore,
+                run: (i) => checkPlayStore(i.uses, i.secretKeys, i.appfile, i.unread, i.blocks ?? []),
+            },
+            {
+                ...META.releaseSigning,
+                run: (i) => checkReleaseSigning({
+                    gradle: i.androidSigning,
+                    conditionalFilePresent: i.signingFilePresent,
+                    keystore: i.keystore ?? null,
+                }),
+            },
         ],
     },
 ];