laneyard 0.6.0 → 0.6.1

package/README.md

@@ -120,6 +120,12 @@ Three kinds, by how sure the reading is:
   `api_key` or `url`. **Defaults to no**, value masked: it is the one kind where a false positive is
   likely, and patching a non-secret by default is a silent regression.
 
+The credential args of `app_store_connect_api_key` and Play — `key_id`, `issuer_id`, `key_filepath`,
+`json_key` — are also normalised when they already read a variable: `issuer_id: ENV["ASC_ISSUER_ID"]`
+becomes `ENV.fetch("APP_STORE_CONNECT_API_KEY_ISSUER_ID")`, the name a signing block exports. Store
+the `.p8`/JSON once as a block and the old `ASC_*` secrets can go. A value already reading the right
+name is left alone.
+
 The vault is written before the Fastfile: if lifting fails, nothing has been patched to read a
 missing variable. The patch is spliced by byte offset — everything outside the replaced range is
 byte-identical — and the file is re-parsed before the command returns; if it no longer parses, the

package/dist/src/cli/adopt.js

@@ -29,15 +29,16 @@ export async function runAdoption(options) {
         process.stdout.write("\n" + dim("Fastfile not analysed — no Ruby with Prism available. Nothing else changes.\n"));
         return { applied: 0 };
     }
-    // A literal pointing at nothing is dropped rather than reported: there is no
-    // file to lift into the vault, and patching to a variable nothing supplies
-    // would trade one broken build for another.
-    // Resolved once, here, so the prompt, the vault write and the git check all
-    // speak about the same file rather than each resolving the path again.
+    // A literal path is looked up on disk so its bytes can go in the vault; one
+    // pointing at nothing is dropped, since patching to a variable nothing supplies
+    // would trade one broken build for another. An `env` value names no file — it
+    // is already a variable, only its *name* changes — so it is kept without a
+    // lookup, a rewrite with nothing to store. Resolved once, here, so the prompt,
+    // the vault write and the git check all speak about the same file.
     const found = new Map();
     const proposals = [];
     for (const proposal of proposalsFor(literals)) {
-        if (proposal.tier === "file") {
+        if (proposal.tier === "file" && proposal.literal.kind === "literal") {
             const hit = await readCredential(cwd, fastlaneDir, proposal);
             if (hit === null)
                 continue;
@@ -51,7 +52,13 @@ export async function runAdoption(options) {
     const accepted = [];
     for (const proposal of proposals) {
         process.stdout.write(describe(fastlaneDir, proposal) + "\n");
-        if (!(await asker.confirm(`  Store it here and use ${bold(proposal.varName)}?`, proposal.checked))) {
+        // A rewrite-only proposal stores nothing — it renames a variable your lane
+        // already reads — so the question is not "store it here".
+        const rewriteOnly = proposal.tier === "file" && !found.has(proposal);
+        const question = rewriteOnly
+            ? `  Rewrite it to ${bold(proposal.varName)}?`
+            : `  Store it here and use ${bold(proposal.varName)}?`;
+        if (!(await asker.confirm(question, proposal.checked))) {
             continue;
         }
         accepted.push(proposal.tier === "secret" ? await named(asker, proposal) : proposal);
@@ -117,16 +124,20 @@ function describe(fastlaneDir, proposal) {
     // or a password, and setup's output is pasted into bug reports and kept in CI
     // transcripts — printing it there would be this feature leaking the very
     // thing it exists to put away. The file and line above say where to look.
-    const shown = proposal.tier === "file"
-        ? `"${literal.value}"`
-        : proposal.tier === "inline"
-            ? dim("(a key, inline in the file)")
-            : dim("(a literal value, masked)");
-    const why = proposal.tier === "inline"
-        ? "This key is in your repository in cleartext."
+    const shown = literal.kind === "env"
+        ? `ENV["${literal.value}"]`
         : proposal.tier === "file"
-            ? "That path does not survive the clone: Laneyard builds from your remote."
-            : "A literal secret in a build file is a secret in your history.";
+            ? `"${literal.value}"`
+            : proposal.tier === "inline"
+                ? dim("(a key, inline in the file)")
+                : dim("(a literal value, masked)");
+    const why = literal.kind === "env"
+        ? "Renamed to the variable Laneyard's signing block exports."
+        : proposal.tier === "inline"
+            ? "This key is in your repository in cleartext."
+            : proposal.tier === "file"
+                ? "That path does not survive the clone: Laneyard builds from your remote."
+                : "A literal secret in a build file is a secret in your history.";
     return ("\n" +
         `  ${bold(`${fastlaneDir}/Fastfile:${literal.line}`)}   ${literal.action}(${literal.arg}:)\n` +
         `                        → ${shown}\n` +
@@ -160,6 +171,11 @@ async function store(vault, slug, asker, proposal, found) {
         await vault.set(slug, proposal.varName, proposal.literal.value, true);
         return;
     }
+    // A rewrite-only proposal — a `file` arg that was already a variable — lifts
+    // nothing: there is no file on disk, and the block it points at is the user's
+    // to upload. The report tells them so; here there is simply nothing to store.
+    if (proposal.tier === "file" && found === undefined)
+        return;
     const bytes = proposal.tier === "inline" ? Buffer.from(proposal.literal.value, "utf8") : found.bytes;
     // The original name is kept: some tools read meaning from it, and
     // `materialise.ts` already relies on `AuthKey_<KEY ID>.p8` surviving intact.
@@ -177,8 +193,15 @@ async function store(vault, slug, asker, proposal, found) {
 }
 /** What is left for the user to do, including the part Laneyard will not do. */
 async function report(cwd, fastlaneDir, accepted, found) {
+    // A rewrite-only proposal — an arg that was already a variable — stored
+    // nothing; counting it as stored would claim a credential is in the vault when
+    // it is the user's still to upload.
+    const stored = accepted.filter((p) => p.tier !== "file" || found.has(p));
+    const normalised = accepted.filter((p) => p.tier === "file" && !found.has(p));
     process.stdout.write("\n" +
-        ok(`Stored ${accepted.length} credential${accepted.length > 1 ? "s" : ""} in this machine's vault.\n`) +
+        (stored.length > 0
+            ? ok(`Stored ${stored.length} credential${stored.length > 1 ? "s" : ""} in this machine's vault.\n`)
+            : "") +
         ok(`Patched ${fastlaneDir}/Fastfile.\n`) +
         "\n" +
         // Said plainly because it is the trap `addProjectToConfig` already
@@ -186,6 +209,16 @@ async function report(cwd, fastlaneDir, accepted, found) {
         // the working copy reaches a run until it is pushed.
         warn("Commit and push it, or your runs still read the old file.\n") +
         dim("  git diff -- " + join(fastlaneDir, "Fastfile") + "\n"));
+    // The rewrites now read names a signing block exports. Nothing was stored for
+    // them, so the block is what makes them real — and the old variables the lane
+    // used to read are free to go.
+    if (normalised.length > 0) {
+        const names = [...new Set(normalised.map((p) => p.varName))].sort();
+        process.stdout.write("\n" +
+            warn(`Supply ${names.join(", ")} from a signing block.\n`) +
+            dim("  Upload the .p8 or service account there; the block exports these names,\n") +
+            dim("  and the variables you set as secrets for them can go.\n"));
+    }
     // Said, never done. Removing a file from someone's repository is not
     // setup's to decide, and `git rm --cached` does not take it out of the
     // history anyway — so the honest thing is to name it.

package/dist/src/fastfile/adoption.js

@@ -50,23 +50,34 @@ export function proposalsFor(literals) {
         const file = FILE_ARGS.find((r) => r.action.test(literal.action) && r.arg === literal.arg);
         if (file) {
             const name = defaultVarNames(file.kind)["path"];
+            const main = rewriteTo(literal, name);
             const identifiers = file.kind === "apple_asc" ? appleIdentifierRewrites(appleIdentifiers) : EMPTY;
+            const edits = [...(main ? [main] : []), ...identifiers.edits];
+            // Every edit was a no-op — the value already reads its Laneyard name, and
+            // so did each identifier. Nothing to propose.
+            if (edits.length === 0)
+                continue;
             out.push({
                 tier: "file",
                 kind: file.kind,
                 varName: name,
-                // The explicit literal wins over the Key ID read from the filename.
-                suggestedFields: { ...suggestedFields(file.kind, literal.value), ...identifiers.fields },
+                // The filename gives a Key ID only for a literal path; an env name is not
+                // one. The explicit literal identifier wins over the filename either way.
+                suggestedFields: {
+                    ...(literal.kind === "literal" ? suggestedFields(file.kind, literal.value) : {}),
+                    ...identifiers.fields,
+                },
                 literal,
-                edits: [
-                    { start: literal.valueStart, length: literal.valueLength, replacement: `ENV.fetch("${name}")` },
-                    ...identifiers.edits,
-                ],
+                edits,
                 checked: true,
             });
             continue;
         }
-        const inline = INLINE_ARGS.find((r) => r.action.test(literal.action) && r.arg === literal.arg);
+        // Inline contents and a literal secret are, by definition, literals: an
+        // `ENV[...]` here is a variable, handled by the file pass above or left alone.
+        const inline = literal.kind === "literal"
+            ? INLINE_ARGS.find((r) => r.action.test(literal.action) && r.arg === literal.arg)
+            : undefined;
         if (inline) {
             const name = defaultVarNames(inline.kind)["path"];
             const identifiers = inline.kind === "apple_asc" ? appleIdentifierRewrites(appleIdentifiers) : EMPTY;
@@ -89,7 +100,7 @@ export function proposalsFor(literals) {
             });
             continue;
         }
-        if (SECRET_ARG.test(literal.arg)) {
+        if (literal.kind === "literal" && SECRET_ARG.test(literal.arg)) {
             const name = `${literal.action}_${literal.arg}`.toUpperCase();
             out.push({
                 tier: "secret",
@@ -124,15 +135,32 @@ function appleIdentifierRewrites(identifiers) {
     const edits = [];
     const fields = {};
     for (const id of identifiers) {
-        edits.push({
-            start: id.valueStart,
-            length: id.valueLength,
-            replacement: `ENV.fetch("${defaults[id.arg]}")`,
-        });
-        fields[id.arg] = id.value;
+        const edit = rewriteTo(id, defaults[id.arg]);
+        if (edit)
+            edits.push(edit);
+        // Only a literal is the identifier's value; an env name is the *variable* it
+        // was read from, not the id itself, so it pre-fills nothing.
+        if (id.kind === "literal")
+            fields[id.arg] = id.value;
     }
     return { edits, fields };
 }
+/**
+ * The edit that makes one argument read `varName`, or null when it already does.
+ *
+ * A literal is always rewritten — a path or a value is never the variable name.
+ * An `ENV[...]` already reading that exact name is left alone: the point is to
+ * reach Laneyard's name, and it is already there.
+ */
+function rewriteTo(literal, varName) {
+    if (literal.kind === "env" && literal.value === varName)
+        return null;
+    return {
+        start: literal.valueStart,
+        length: literal.valueLength,
+        replacement: `ENV.fetch("${varName}")`,
+    };
+}
 /** What the credential's filename gives away, so the prompt starts filled in. */
 function suggestedFields(kind, path) {
     if (kind !== "apple_asc")

package/dist/src/main.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { realpathSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
 import { mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { bold, dim, field, heading } from "./cli/style.js";
 import { fileURLToPath } from "node:url";
 import { PromptAborted } from "./cli/prompt.js";
@@ -22,7 +22,28 @@ import { Vault } from "./secrets/vault.js";
 import { makeInvoke } from "./sidecar/bridge.js";
 import { LaneReader } from "./sidecar/lanes.js";
 import { UsesReader } from "./sidecar/uses.js";
-export const version = "0.5.0";
+/**
+ * The version, from `package.json` rather than a constant beside it. The
+ * constant this replaced was bumped by hand and drifted: a release moved
+ * `package.json` to 0.6.0 and left `laneyard --version` still saying 0.5.0.
+ *
+ * Walked up from this module so it resolves both from `dist/src` (installed) and
+ * `src` (dev under tsx), and finds the package's own `package.json` — the nearest
+ * ancestor — never a host project's when Laneyard is a dependency.
+ */
+function readVersion() {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (let up = 0; up < 6; up += 1, dir = dirname(dir)) {
+        try {
+            return JSON.parse(readFileSync(join(dir, "package.json"), "utf8")).version;
+        }
+        catch {
+            // Not this directory — try its parent.
+        }
+    }
+    return "0.0.0";
+}
+export const version = readVersion();
 /** Assembles the server from a data folder. */
 export async function createServerFromConfig(root) {
     const config = new ConfigStore(join(root, "config.yml"));

package/dist/src/sidecar/scan.js

@@ -30,6 +30,7 @@ export async function scanFastfile(cwd, fastlaneDir) {
         return res.literals.map((l) => ({
             action: String(l["action"]),
             arg: String(l["arg"]),
+            kind: l["kind"] === "env" ? "env" : "literal",
             value: String(l["value"]),
             valueStart: Number(l["value_start"]),
             valueLength: Number(l["value_length"]),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "laneyard",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "type": "module",
   "bin": {
     "laneyard": "dist/src/main.js"

package/ruby/scan.rb

@@ -76,6 +76,22 @@ rescue LoadError => e
   fail_with("prism is not available in this Ruby (#{e.message})")
 end
 
+# The name in `ENV["X"]` or `ENV.fetch("X")`, or nil for anything else.
+#
+# Both spellings read the environment, and both are how a Fastfile that already
+# uses variables writes a credential — the caller rewrites either to the name a
+# signing block exports. Only a literal string argument is resolved: `ENV[key]`
+# with a computed key names nothing this can report.
+def env_lookup_name(node)
+  return nil unless node.is_a?(Prism::CallNode)
+  receiver = node.receiver
+  return nil unless receiver.is_a?(Prism::ConstantReadNode) && receiver.name == :ENV
+  return nil unless node.name == :[] || node.name == :fetch
+
+  first = node.arguments&.arguments&.first
+  first.is_a?(Prism::StringNode) ? first.unescaped : nil
+end
+
 # Every `key: "literal"` inside a call, wherever the call sits.
 #
 # Descends through everything: a call inside an `if`, inside a `def`, inside a
@@ -99,16 +115,30 @@ def literals_in(node, out = [])
       hashes.flat_map(&:elements).each do |el|
         next unless el.is_a?(Prism::AssocNode)
         next unless el.key.is_a?(Prism::SymbolNode)
-        next unless el.value.is_a?(Prism::StringNode)
-        # A heredoc's location covers its *marker* — `<<~P` is four bytes —
-        # while its value lives on the lines below. Reporting that range would
-        # have the caller splice `ENV.fetch("...")` over the marker and leave
-        # the body stranded after the call: a Fastfile that no longer parses,
-        # written silently into someone's repository. Dropping heredocs costs
-        # nothing real, because a credential path is never written as one while
-        # `changelog:` and `message:` routinely are. Only Ruby can tell a
-        # heredoc from a quoted string, so the decision has to be made here.
-        next if el.value.opening&.start_with?("<<")
+
+        # A literal string, or an environment lookup — the two ways a credential
+        # is written into a call. `adoption.ts` decides which arguments matter;
+        # this stays ignorant of credentials and reports both shapes, tagged so
+        # the caller can tell "a path to lift" from "a variable to rename". A
+        # value that is neither — a computed expression — has nothing the caller
+        # can act on and is skipped.
+        value = el.value
+        if value.is_a?(Prism::StringNode)
+          # A heredoc's location covers its *marker* — `<<~P` is four bytes —
+          # while its value lives on the lines below. Reporting that range would
+          # have the caller splice `ENV.fetch("...")` over the marker and leave
+          # the body stranded after the call: a Fastfile that no longer parses,
+          # written silently into someone's repository. Only Ruby can tell a
+          # heredoc from a quoted string, so the decision has to be made here.
+          next if value.opening&.start_with?("<<")
+          kind = "literal"
+          reported = value.unescaped
+        else
+          name = env_lookup_name(value)
+          next if name.nil?
+          kind = "env"
+          reported = name
+        end
 
         # `start_offset` and `length` are byte offsets, and must stay that way:
         # the caller splices them into a Buffer. Prism also offers
@@ -118,9 +148,10 @@ def literals_in(node, out = [])
         out << {
           action: child.name.to_s,
           arg: el.key.unescaped,
-          value: el.value.unescaped,
-          value_start: el.value.location.start_offset,
-          value_length: el.value.location.length,
+          kind: kind,
+          value: reported,
+          value_start: value.location.start_offset,
+          value_length: value.location.length,
           pair_start: el.location.start_offset,
           pair_length: el.location.length,
           line: el.location.start_line