laneyard 0.6.0 → 0.7.0

package/dist/src/heuristics/readiness.js

@@ -56,14 +56,12 @@ const META = {
 export async function checkRepository(probe) {
     try {
         await probe();
-        return { ...META.repository, ...ok("the remote answers without asking for credentials.") };
+        return { ...META.repository, ...ok("the remote answers without a password.") };
     }
     catch (cause) {
         return {
             ...META.repository,
-            ...warn(reasonOf(cause), "Give the project a key it can use without a passphrase — " +
-                "`git_auth: {kind: ssh_key, ref: /path/to/key}` in config.yml — or a URL that needs no password. " +
-                "A run that meets a credentials prompt does not fail: it waits."),
+            ...warn(reasonOf(cause), "Point `git_auth` at a passphrase-less SSH key in config.yml. A run that meets a prompt waits."),
         };
     }
 }
@@ -75,12 +73,12 @@ export async function checkDependencies(input) {
     if (workspace.value.hasGemfile) {
         try {
             await input.bundleCheck();
-            return { ...META.dependencies, ...ok("the Gemfile's bundle is installed.") };
+            return { ...META.dependencies, ...ok("the bundle is installed.") };
         }
         catch (cause) {
             return {
                 ...META.dependencies,
-                ...warn(reasonOf(cause), "Run `bundle install` in the project's workspace."),
+                ...warn(reasonOf(cause), "Run `bundle install` in the workspace."),
             };
         }
     }
@@ -94,14 +92,11 @@ export async function checkDependencies(input) {
     if (fastlane !== null) {
         // Not a failure, but a fact worth stating: a system fastlane can be
         // upgraded underneath a project that was working yesterday.
-        return {
-            ...META.dependencies,
-            ...ok(`no Gemfile — runs use ${fastlane}, whose version nothing pins.`),
-        };
+        return { ...META.dependencies, ...ok(`no Gemfile — runs use ${fastlane}, unpinned.`) };
     }
     return {
         ...META.dependencies,
-        ...warn("no Gemfile, and no fastlane on the PATH: a run has nothing to execute.", 'Add a Gemfile with `gem "fastlane"` and run `bundle install`, or install fastlane system-wide.'),
+        ...warn("no Gemfile and no fastlane on the PATH: a run has nothing to execute.", 'Add a Gemfile with `gem "fastlane"`, or install fastlane system-wide.'),
     };
 }
 /** Any suffix: the key is split across several variables, and their names vary by lane. */
@@ -119,10 +114,8 @@ const API_KEY = /^APP_STORE_CONNECT_API_KEY/;
  * being left with a checklist that has quietly gone silent about it.
  */
 const DEAD_API_KEY = /^APP_STORE_CONNECT_API_KEY_P8$/;
-const STORE_API_KEY = "Upload the `.p8` as an App Store Connect key block from the signing tab, with its key id and " +
-    "issuer id. Laneyard writes the file for the length of a run and exports the three of them under " +
-    "the names the block carries, so nothing in the project has to change. " +
-    "An API key does not expire on its own.";
+const STORE_API_KEY = "Upload the `.p8` as an App Store Connect key block on the signing tab, with its key id and " +
+    "issuer id. Nothing in the project has to change.";
 /** The action whose whole job is to load a `.p8`, under both of its names. */
 const ASC_KEY_ACTIONS = new Set(["app_store_connect_api_key", "asc_api_key"]);
 /**
@@ -188,23 +181,18 @@ export function checkAppStoreConnect(input) {
     const { secretKeys, uses, keyFilesInRepo, appfile } = input;
     const blocks = input.blocks ?? [];
     if (blocks.includes("apple_asc")) {
-        return {
-            ...META.appStoreConnect,
-            ...ok("an App Store Connect key block is in the vault: the `.p8` is written for the length of a " +
-                "run, with its key id and issuer id exported beside it."),
-        };
+        return { ...META.appStoreConnect, ...ok("a key block is in the vault.") };
     }
     if (secretKeys.some((key) => API_KEY.test(key) && !DEAD_API_KEY.test(key))) {
-        return { ...META.appStoreConnect, ...ok("an App Store Connect API key is in the vault.") };
+        return { ...META.appStoreConnect, ...ok("an API key is in the vault.") };
     }
     // The one place on this checklist where somebody is asked to redo work — and
     // it is work that never did anything. See `DEAD_API_KEY`.
     if (secretKeys.some((key) => DEAD_API_KEY.test(key))) {
         return {
             ...META.appStoreConnect,
-            ...warn("`APP_STORE_CONNECT_API_KEY_P8` is in the vault, and no action in fastlane reads a variable " +
-                "of that name: the value is stored, and no lane can see it. An earlier version of this " +
-                "interface asked for it.", STORE_API_KEY, "signing"),
+            ...warn("`APP_STORE_CONNECT_API_KEY_P8` is stored, and no fastlane action reads that name: no lane " +
+                "can see it.", STORE_API_KEY, "signing"),
         };
     }
     // Named in a lane: the commonest way a pre-existing project holds its key,
@@ -216,8 +204,8 @@ export function checkAppStoreConnect(input) {
     if (inLanes.length > 0) {
         return {
             ...META.appStoreConnect,
-            ...undetermined(`${nameList(inLanes.map((l) => l.lane))} supplies its own API key: whether the \`.p8\` it ` +
-                "names is on this machine is not something a Fastfile says.", STORE_API_KEY),
+            ...undetermined(`${nameList(inLanes.map((l) => l.lane))} supplies its own key — whether the \`.p8\` it names ` +
+                "is on this machine is not something a Fastfile says.", STORE_API_KEY),
         };
     }
     // Nothing in the vault, and nothing named in a lane. Before reporting an
@@ -233,27 +221,22 @@ export function checkAppStoreConnect(input) {
         if (blind) {
             return {
                 ...META.appStoreConnect,
-                ...undetermined(`no lane seen to sign in to App Store Connect — but ${blind}.`, STORE_API_KEY),
+                ...undetermined(`no lane seen signing in to App Store Connect — but ${blind}.`, STORE_API_KEY),
             };
         }
-        return {
-            ...META.appStoreConnect,
-            ...ok("no lane signs in to App Store Connect: nothing here needs a key."),
-        };
+        return { ...META.appStoreConnect, ...ok("no lane signs in to App Store Connect.") };
     }
     const p8 = keyFilesInRepo.ok ? keyFilesInRepo.value : [];
     if (p8.length > 0) {
         return {
             ...META.appStoreConnect,
-            ...undetermined(`the repository carries ${nameList(p8)}: a key is arranged, but nothing here says a lane ` +
-                "loads it, or that it is the one App Store Connect expects.", STORE_API_KEY),
+            ...undetermined(`the repository carries ${nameList(p8)}: arranged, but nothing here says a lane loads it.`, STORE_API_KEY),
         };
     }
     if (secretKeys.includes("FASTLANE_SESSION")) {
         return {
             ...META.appStoreConnect,
-            ...warn("only a FASTLANE_SESSION: Apple sessions expire, and the run that finds it expired " +
-                "stops and asks for a verification code.", STORE_API_KEY, "signing"),
+            ...warn("only a FASTLANE_SESSION: it expires, and the run that finds it expired asks for a code.", STORE_API_KEY, "signing"),
         };
     }
     // An Apple ID in the Appfile is not a credential — it is the thing that makes
@@ -262,8 +245,7 @@ export function checkAppStoreConnect(input) {
     if (appfile.ok && appfile.value.appleId.kind !== "absent") {
         return {
             ...META.appStoreConnect,
-            ...warn("the Appfile names an Apple ID and nothing else: a lane that uploads signs in as that " +
-                "account, and two-factor authentication stops the run to ask for a code.", STORE_API_KEY, "signing"),
+            ...warn("the Appfile names an Apple ID and nothing else: two-factor stops the run to ask for a code.", STORE_API_KEY, "signing"),
         };
     }
     // This one is a warning rather than a tick, so being wrong costs less — but
@@ -272,14 +254,13 @@ export function checkAppStoreConnect(input) {
     if (blind) {
         return {
             ...META.appStoreConnect,
-            ...undetermined(`no App Store Connect credential in the vault or in the repository, and none seen in the ` +
-                `lanes — but ${blind}.`, STORE_API_KEY),
+            ...undetermined(`no credential in the vault, the lanes or the repository — but ${blind}.`, STORE_API_KEY),
         };
     }
     return {
         ...META.appStoreConnect,
-        ...warn("no App Store Connect credential in the vault, in the lanes, or in the repository: " +
-            "a lane that uploads will ask for an Apple ID.", STORE_API_KEY, "signing"),
+        ...warn("no credential in the vault, the lanes or the repository: a lane that uploads will ask for " +
+            "an Apple ID.", STORE_API_KEY, "signing"),
     };
 }
 /** The two names for the same action. `match` is the older one, still the common one. */
@@ -302,16 +283,16 @@ export function checkMatch(uses, secretKeys) {
     if (!secretKeys.includes("MATCH_PASSWORD")) {
         return {
             ...META.match,
-            ...warn(`${nameList(calls.map((c) => c.lane))} calls match, but MATCH_PASSWORD is not in the vault: ` +
-                "match asks for the passphrase and waits for it.", "Store `MATCH_PASSWORD` from the secrets tab.", "secrets"),
+            ...warn(`${nameList(calls.map((c) => c.lane))} calls match, and MATCH_PASSWORD is not in the vault: ` +
+                "match asks for the passphrase and waits.", "Store `MATCH_PASSWORD` on the secrets tab.", "secrets"),
         };
     }
     const writable = calls.filter((c) => c.action.args["readonly"] === false);
     if (writable.length > 0) {
         return {
             ...META.match,
-            ...warn(`${nameList(writable.map((c) => c.lane))} calls match with \`readonly: false\`: it may try to ` +
-                "create certificates, which needs an Apple account interactively.", "Pass `readonly: true` so it only fetches what already exists."),
+            ...warn(`${nameList(writable.map((c) => c.lane))} calls match with \`readonly: false\`: creating a ` +
+                "certificate needs an Apple account interactively.", "Pass `readonly: true`."),
         };
     }
     // `match(readonly: ENV["RO"])` arrives with no `readonly` at all: the sidecar
@@ -322,7 +303,7 @@ export function checkMatch(uses, secretKeys) {
         return {
             ...META.match,
             ...undetermined(`MATCH_PASSWORD is stored, but \`readonly\` is not a literal in ` +
-                `${nameList(undecided.map((c) => c.lane))}: Laneyard reads literal arguments only, and will not guess.`, "Pass `readonly: true` in the call itself if that is what you mean."),
+                `${nameList(undecided.map((c) => c.lane))}: Laneyard reads literals only, and will not guess.`, "Pass `readonly: true` in the call itself."),
         };
     }
     return { ...META.match, ...ok("MATCH_PASSWORD is stored, and every match call is readonly.") };
@@ -337,8 +318,7 @@ export function checkBlockingActions(uses, unread = { ok: true, value: READ_EVER
         if (blind) {
             return {
                 ...META.blockingActions,
-                ...undetermined(`no lane seen to call an action known to stop and ask — but ${blind}, so a lane that ` +
-                    "waits could be out of sight from here."),
+                ...undetermined(`no lane seen calling an action known to stop and ask — but ${blind}.`),
             };
         }
         return { ...META.blockingActions, ...ok("no lane calls an action known to stop and ask.") };
@@ -370,19 +350,14 @@ const KEYSTORE_PASSWORD = /(^|_)(KEYSTORE|STORE)_PASSWORD$/;
  * and so not Laneyard's to ask for. A block carries the file and the passphrases
  * together, and a run gets both without the project knowing anything about it.
  */
-const STORE_KEYSTORE = "Upload the keystore as an android keystore block from the signing tab, with its alias and its " +
-    "two passphrases. Laneyard writes the file for the length of a run and exports the names the " +
-    "block carries, so no lane has to be changed to find it.";
+const STORE_KEYSTORE = "Upload the keystore as an android keystore block on the signing tab, with its alias and its two " +
+    "passphrases. No lane has to change.";
 export function checkAndroidKeystore(uses, secretKeys, unread = { ok: true, value: READ_EVERYTHING }, blocks = []) {
     // Answered before the lanes are read, and on purpose: the question is whether
     // anything will stop and ask for a passphrase, and a block means nothing can —
     // whichever lane, and whether or not gradle is called by name.
     if (blocks.includes("android_keystore")) {
-        return {
-            ...META.androidKeystore,
-            ...ok("an android keystore block is in the vault: the keystore is written for the length of a " +
-                "run and its passphrases exported with it, so nothing stops to ask for one."),
-        };
+        return { ...META.androidKeystore, ...ok("a keystore block is in the vault.") };
     }
     if (!uses.ok) {
         return { ...META.androidKeystore, ...undetermined(`could not read the lanes: ${uses.reason}`) };
@@ -402,9 +377,8 @@ export function checkAndroidKeystore(uses, secretKeys, unread = { ok: true, valu
             ...META.androidKeystore,
             ...undetermined("no lane seen handing gradle a keystore" +
                 (blind ? ` — and ${blind}` : "") +
-                ". This project builds for Android, so signing is configured somewhere a Fastfile does " +
-                "not show: `build.gradle`, `key.properties`, or a build driven through flutter or " +
-                "react-native.", STORE_KEYSTORE),
+                ". Signing is configured somewhere a Fastfile does not show: `build.gradle`, " +
+                "`key.properties`, or a build driven through flutter or react-native.", STORE_KEYSTORE),
         };
     }
     // `given`, not `args`, for the same reason as the two credential checks:
@@ -417,15 +391,14 @@ export function checkAndroidKeystore(uses, secretKeys, unread = { ok: true, valu
         // invisible from here, and claiming it is absent would be a guess.
         return {
             ...META.androidKeystore,
-            ...ok("no lane passes `storeFile` or `storePassword` to gradle: nothing here needs unlocking."),
+            ...ok("no lane passes `storeFile` or `storePassword` to gradle."),
         };
     }
     const withoutPassphrase = signing.filter((c) => !("storePassword" in c.action.args));
     if (withoutPassphrase.length === 0) {
         return {
             ...META.androidKeystore,
-            ...ok(`${nameList(signing.map((c) => c.lane))} passes \`storePassword\` in the call itself: ` +
-                "gradle has what it needs."),
+            ...ok(`${nameList(signing.map((c) => c.lane))} passes \`storePassword\` in the call itself.`),
         };
     }
     if (secretKeys.some((key) => KEYSTORE_PASSWORD.test(key))) {
@@ -433,8 +406,8 @@ export function checkAndroidKeystore(uses, secretKeys, unread = { ok: true, valu
     }
     return {
         ...META.androidKeystore,
-        ...warn(`${nameList(withoutPassphrase.map((c) => c.lane))} hands gradle a keystore, but no keystore ` +
-            "passphrase is in the vault: gradle asks for it and waits.", STORE_KEYSTORE, "signing"),
+        ...warn(`${nameList(withoutPassphrase.map((c) => c.lane))} hands gradle a keystore, and no passphrase ` +
+            "is in the vault: gradle asks for it and waits.", STORE_KEYSTORE, "signing"),
     };
 }
 /** The two names for the same action. `supply` is the older one. */
@@ -444,13 +417,9 @@ const PLAY_JSON_KEY = /^SUPPLY_JSON_KEY/;
 /** The same credential, named in the call instead of in the vault. */
 const PLAY_KEY_ARGS = ["json_key", "json_key_data"];
 /** Named once: three outcomes of the environment check point at the same thing. */
-const DECLARE_SECRETS = "A variable read by a tool the lane shells out to — `sentry-cli` and its " +
-    "`SENTRY_AUTH_TOKEN`, say — is not something a Fastfile mentions. List those under " +
-    "`required_secrets` in laneyard.yml and they are checked like the rest.";
-const STORE_PLAY_KEY = "Upload the service account JSON as a Play Store service account block from the signing tab. " +
-    "Laneyard writes the file for the length of a run and exports its path under the name the block " +
-    "carries — `SUPPLY_JSON_KEY`, which supply reads by itself, unless the block says otherwise. " +
-    "A service account does not expire on its own.";
+const DECLARE_SECRETS = "A variable a shelled-out tool reads — `sentry-cli` and its `SENTRY_AUTH_TOKEN` — is not in the " +
+    "Fastfile. List those under `required_secrets` in laneyard.yml.";
+const STORE_PLAY_KEY = "Upload the service account JSON as a Play Store block on the signing tab.";
 export function checkPlayStore(uses, secretKeys, appfile, unread = { ok: true, value: READ_EVERYTHING }, blocks = []) {
     if (!uses.ok) {
         return { ...META.playStore, ...undetermined(`could not read the lanes: ${uses.reason}`) };
@@ -465,8 +434,7 @@ export function checkPlayStore(uses, secretKeys, appfile, unread = { ok: true, v
         if (blind) {
             return {
                 ...META.playStore,
-                ...undetermined(`no lane seen to upload to the Play Store — but ${blind}, so this is not the same ` +
-                    "as no lane uploading.", STORE_PLAY_KEY),
+                ...undetermined(`no lane seen uploading to the Play Store — but ${blind}.`, STORE_PLAY_KEY),
             };
         }
         return { ...META.playStore, ...ok("no lane uploads to the Play Store.") };
@@ -474,14 +442,10 @@ export function checkPlayStore(uses, secretKeys, appfile, unread = { ok: true, v
     // Either route answers: the block, or the loose variable a project stored
     // before blocks existed and which fastlane still reads exactly as it did.
     if (blocks.includes("play_service_account")) {
-        return {
-            ...META.playStore,
-            ...ok("a Play Store service account block is in the vault: the JSON is written for the length of " +
-                "a run and its path exported."),
-        };
+        return { ...META.playStore, ...ok("a service account block is in the vault.") };
     }
     if (secretKeys.some((key) => PLAY_JSON_KEY.test(key))) {
-        return { ...META.playStore, ...ok("a Play Store service account is in the vault.") };
+        return { ...META.playStore, ...ok("a service account is in the vault.") };
     }
     // Named in the call, whether or not the value could be read. `json_key:
     // ENV.fetch("…")` is a credential the lane supplies itself just as much as a
@@ -493,7 +457,7 @@ export function checkPlayStore(uses, secretKeys, appfile, unread = { ok: true, v
         // machine. Neither a tick nor a warning would be honest.
         return {
             ...META.playStore,
-            ...undetermined(`${nameList(named.map((c) => c.lane))} supplies its own service account: whether the file ` +
+            ...undetermined(`${nameList(named.map((c) => c.lane))} supplies its own service account — whether the file ` +
                 "it names is on this machine is not something a Fastfile says.", STORE_PLAY_KEY),
         };
     }
@@ -506,28 +470,27 @@ export function checkPlayStore(uses, secretKeys, appfile, unread = { ok: true, v
             return {
                 ...META.playStore,
                 ...undetermined("the Appfile sets `json_key_data`: the credential travels with the repository, and " +
-                    "whether it is still valid is not something a file says.", STORE_PLAY_KEY),
+                    "nothing says it is still valid.", STORE_PLAY_KEY),
             };
         }
         if (jsonKeyFile.kind === "literal") {
             return {
                 ...META.playStore,
-                ...undetermined(`the Appfile points \`json_key_file\` at ${jsonKeyFile.value}: whether that file is on ` +
-                    "this machine is not something an Appfile says.", STORE_PLAY_KEY),
+                ...undetermined(`the Appfile points \`json_key_file\` at ${jsonKeyFile.value} — whether that file is on ` +
+                    "this machine is another matter.", STORE_PLAY_KEY),
             };
         }
         if (jsonKeyFile.kind === "computed") {
             return {
                 ...META.playStore,
-                ...undetermined("the Appfile sets `json_key_file` to something it computes — an environment variable, " +
-                    "most likely — which a run only resolves once it is running.", STORE_PLAY_KEY),
+                ...undetermined("the Appfile computes `json_key_file`: only a run resolves it.", STORE_PLAY_KEY),
             };
         }
     }
     return {
         ...META.playStore,
-        ...warn(`${nameList(calls.map((c) => c.lane))} uploads to the Play Store, but no service account is in ` +
-            "the vault: supply stops and asks which credentials to use.", STORE_PLAY_KEY, "signing"),
+        ...warn(`${nameList(calls.map((c) => c.lane))} uploads to the Play Store, and no service account is ` +
+            "in the vault: supply stops and asks which credentials to use.", STORE_PLAY_KEY, "signing"),
     };
 }
 /**
@@ -541,18 +504,16 @@ function platformNote(platforms) {
     return {
         ...META.platforms,
         ...undetermined(platforms.ok
-            ? "no platform detected: no Xcode project and no Gradle build in the repository, " +
-                "and laneyard.yml names none. Only the checks above apply."
-            : `could not tell: ${platforms.reason}. Only the checks above apply.`, "Add `platforms: [ios]`, `[android]` or both to laneyard.yml in the repository, " +
-            "and the checks for that platform appear here."),
+            ? "no Xcode project and no Gradle build in the repository, and laneyard.yml names none. " +
+                "Only the checks above apply."
+            : `could not tell: ${platforms.reason}. Only the checks above apply.`, "Add `platforms: [ios]`, `[android]` or both to laneyard.yml."),
     };
 }
 /**
  * The one question the block's form can settle that nothing else can. Asked
  * here, answered there, and no file in the repository is touched either way.
  */
-const SET_PROPERTIES_PATH = "Set the properties file path on the keystore block, relative to the app, and Laneyard writes " +
-    "the file there for the length of a run.";
+const SET_PROPERTIES_PATH = "Set the properties file path on the keystore block, relative to the app.";
 /**
  * Where the build resolves the properties file, as a clause a sentence can take.
  *
@@ -612,10 +573,7 @@ export function checkReleaseSigning(input) {
         };
     }
     if (!gradle.value.releaseCanUseDebugKey) {
-        return {
-            ...META.releaseSigning,
-            ...ok("the release build type never takes the debug signing config."),
-        };
+        return { ...META.releaseSigning, ...ok("the release build never takes the debug config.") };
     }
     const { conditionalOn } = gradle.value;
     if (conditionalOn) {
@@ -626,23 +584,18 @@ export function checkReleaseSigning(input) {
         // convention — the Flutter documentation's — and the one thing between a
         // signed artifact and a debug-signed one that nobody read out of the script.
         if (writes !== null && keystore !== null) {
-            const keys = nameList(keystore.propertyNames);
-            const supplied = `Laneyard writes ${name}${writes} for the length of a run, from the keystore block, with ` +
-                `the keys ${keys}. Those names come from the block's settings rather than something the ` +
-                "build script states — what a script reads out of that file is not written anywhere this " +
-                "can see — so the setting starts from the Flutter documentation's four, and a build that " +
-                "reads others is corrected there.";
+            const supplied = `Laneyard writes ${name}${writes} for each run, with the keys ` +
+                `${nameList(keystore.propertyNames)}.`;
             if (!conditionalFilePresent) {
                 return {
                     ...META.releaseSigning,
-                    ...ok(`the release build falls back to the debug signing config when ${name} is missing, and ` +
-                        `${name} is not in the clone. ${supplied}`),
+                    ...ok(`${name} is not in the clone, so the debug config would apply. ${supplied}`),
                 };
             }
             return {
                 ...META.releaseSigning,
-                ...ok(`${name} is present${where(conditionalOn)}, so the release key is used — and that file is ` +
-                    `the project's own, which Laneyard leaves alone. Were it ever to go missing, ${supplied}`),
+                ...ok(`${name} is present${where(conditionalOn)}, so the release key is used. Were it to go ` +
+                    `missing: ${supplied}`),
             };
         }
         // A block, and nowhere to put the file: the script names it on a receiver
@@ -653,37 +606,33 @@ export function checkReleaseSigning(input) {
         if (keystore !== null && !conditionalFilePresent) {
             return {
                 ...META.releaseSigning,
-                ...undetermined(`the release build falls back to the debug signing config when ${name} is missing, and ` +
-                    `${name} is not in the clone. A keystore block is in the vault, but the build script ` +
-                    `names ${name} without saying which directory it resolves against, so Laneyard will ` +
-                    "not guess where to write it.", SET_PROPERTIES_PATH, "signing"),
+                ...undetermined(`${name} is not in the clone, so the debug config would apply. A keystore block is in ` +
+                    `the vault, but the build script names ${name} without saying which directory it ` +
+                    "resolves against.", SET_PROPERTIES_PATH, "signing"),
             };
         }
         if (!conditionalFilePresent) {
             const looksIn = where(conditionalOn);
             return {
                 ...META.releaseSigning,
-                ...warn(`the release build falls back to the debug signing config when ${name} is missing, and ` +
-                    `${name} is not in the clone` +
-                    (looksIn === "" ? "" : ` — the build looks for it${looksIn}`) +
-                    ". The build will not fail: it will produce an artifact signed with the debug key, and " +
-                    "the store will reject it.", `${name} is gitignored by the same documentation that recommends it, so it never reaches ` +
-                    "a clone. Upload the keystore as an android keystore block from the signing tab: " +
-                    `Laneyard then writes ${name} itself for the length of a run, and removes it ` +
-                    "afterwards. Nothing in the build script changes.", "signing"),
+                ...warn(`${name} is not in the clone` +
+                    (looksIn === "" ? "" : `, and the build looks for it${looksIn}`) +
+                    ". The build will not fail: it produces an artifact signed with the debug key, and the " +
+                    "store rejects it.", `${name} is gitignored, so it never reaches a clone. Upload the keystore as an android ` +
+                    `keystore block and Laneyard writes ${name} for each run. Nothing in the build script ` +
+                    "changes.", "signing"),
             };
         }
         return {
             ...META.releaseSigning,
-            ...undetermined(`${conditionalOn.name} is present${where(conditionalOn)}, so the release key is ` +
-                "used — but the build falls back to the debug signing config if it ever goes missing, " +
-                "and does so without failing.", keystore === null ? STORE_KEYSTORE : SET_PROPERTIES_PATH),
+            ...undetermined(`${conditionalOn.name} is present${where(conditionalOn)}, so the release key is used — but ` +
+                "the build falls back to the debug config if it goes missing, without failing.", keystore === null ? STORE_KEYSTORE : SET_PROPERTIES_PATH),
         };
     }
     return {
         ...META.releaseSigning,
-        ...undetermined("the release build type can take the debug signing config; whether it does is decided by " +
-            "something this cannot read."),
+        ...undetermined("the release build can take the debug config; whether it does is decided somewhere this " +
+            "cannot read."),
     };
 }
 /**
@@ -727,7 +676,7 @@ export function checkEnvironment(input) {
         if (blind) {
             return {
                 ...META.environment,
-                ...undetermined(`no lane seen to read an environment variable — but ${blind}.`, DECLARE_SECRETS),
+                ...undetermined(`no lane seen reading an environment variable — but ${blind}.`, DECLARE_SECRETS),
             };
         }
         return { ...META.environment, ...ok("no lane reads an environment variable.") };
@@ -742,24 +691,20 @@ export function checkEnvironment(input) {
         return {
             ...META.environment,
             ...warn(`${nameList(missing)} ${missing.length === 1 ? "is" : "are"} needed by a lane and in ` +
-                "neither the vault nor this server's environment: a run stops at the first one, or " +
-                "builds with it empty.", "Store them from the secrets tab. A `fastlane/.env` does not travel — it is almost " +
-                "always gitignored, so it never reaches the clone a build runs from.", "secrets"),
+                "neither the vault nor this server's environment: a run stops at the first one.", "Store them on the secrets tab. A `fastlane/.env` is gitignored, so it never reaches the clone.", "secrets"),
         };
     }
     const borrowed = required.filter((name) => !inVault.has(name));
     if (borrowed.length > 0) {
         return {
             ...META.environment,
-            ...ok(`every variable the lanes need is available — though ${nameList(borrowed)} ` +
-                `${borrowed.length === 1 ? "comes" : "come"} from this server's own environment rather ` +
-                `than the vault, so another machine would not find ${borrowed.length === 1 ? "it" : "them"}.`),
+            ...ok(`every variable is available — though ${nameList(borrowed)} ` +
+                `${borrowed.length === 1 ? "comes" : "come"} from this server's environment, not the ` +
+                "vault, so another machine would not find " +
+                `${borrowed.length === 1 ? "it" : "them"}.`),
         };
     }
-    return {
-        ...META.environment,
-        ...ok(`every variable the lanes need is in the vault: ${nameList(required)}.`),
-    };
+    return { ...META.environment, ...ok(`every variable is in the vault: ${nameList(required)}.`) };
 }
 /**
  * The checklist itself: a table, so that adding a check is adding a row.

package/dist/src/main.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { realpathSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
 import { mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { bold, dim, field, heading } from "./cli/style.js";
 import { fileURLToPath } from "node:url";
 import { PromptAborted } from "./cli/prompt.js";
@@ -22,7 +22,28 @@ import { Vault } from "./secrets/vault.js";
 import { makeInvoke } from "./sidecar/bridge.js";
 import { LaneReader } from "./sidecar/lanes.js";
 import { UsesReader } from "./sidecar/uses.js";
-export const version = "0.5.0";
+/**
+ * The version, from `package.json` rather than a constant beside it. The
+ * constant this replaced was bumped by hand and drifted: a release moved
+ * `package.json` to 0.6.0 and left `laneyard --version` still saying 0.5.0.
+ *
+ * Walked up from this module so it resolves both from `dist/src` (installed) and
+ * `src` (dev under tsx), and finds the package's own `package.json` — the nearest
+ * ancestor — never a host project's when Laneyard is a dependency.
+ */
+function readVersion() {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (let up = 0; up < 6; up += 1, dir = dirname(dir)) {
+        try {
+            return JSON.parse(readFileSync(join(dir, "package.json"), "utf8")).version;
+        }
+        catch {
+            // Not this directory — try its parent.
+        }
+    }
+    return "0.0.0";
+}
+export const version = readVersion();
 /** Assembles the server from a data folder. */
 export async function createServerFromConfig(root) {
     const config = new ConfigStore(join(root, "config.yml"));

package/dist/src/runner/orchestrate.js

@@ -4,6 +4,7 @@ import { gitEnvFor, Workspace } from "../git/workspace.js";
 import { summarizeFailure } from "../heuristics/error-summary.js";
 import { appRootOf, searchDir } from "../heuristics/platforms.js";
 import { Redactor, scrub } from "../logs/redact.js";
+import { assertFastlaneDir } from "../sidecar/fastlane-dir.js";
 import { collectArtifacts } from "./artifacts.js";
 import { removeGradleProperties, sweepGradleProperties, writeGradleProperties, } from "./gradle-properties.js";
 import { LiveStepTracker } from "./live-steps.js";
@@ -122,10 +123,24 @@ async function execute(opts, wrote) {
     // the next run is the first moment anything can. Its failure is not reported
     // — a leftover that resists removal is a broken disk, not a broken build, and
     // saying so here would fail a run for a file it has not needed yet.
-    const androidRoot = searchDir(opts.workspacePath, appRootOf(settings.fastlane_dir));
-    await sweepGradleProperties(androidRoot, opts.androidKeystore).catch(() => { });
+    //
+    // The app's own directory, which is the parent of the configured fastlane
+    // folder: the repository root for a plain app, `app/` for one in a monorepo.
+    // It is where the properties file goes and, below, where fastlane is started.
+    const appRoot = searchDir(opts.workspacePath, appRootOf(settings.fastlane_dir));
+    // Before any of that, and before fastlane: a clone without the folder is the
+    // one failure fastlane reports worst. It asks whether to set a project up,
+    // finds nobody to answer, and prints a Ruby backtrace and a list of GitHub
+    // issues over the sentence that mattered. This says it in one line instead.
+    try {
+        await assertFastlaneDir(opts.workspacePath, settings.fastlane_dir);
+    }
+    catch (cause) {
+        return fail(cause.message);
+    }
+    await sweepGradleProperties(appRoot, opts.androidKeystore).catch(() => { });
     try {
-        wrote.properties = await writeGradleProperties(androidRoot, opts.androidKeystore);
+        wrote.properties = await writeGradleProperties(appRoot, opts.androidKeystore);
     }
     catch (cause) {
         // Failing the run rather than carrying on. Carrying on is what produces the
@@ -162,7 +177,13 @@ async function execute(opts, wrote) {
         args: useBundle
             ? ["exec", "fastlane", ...laneArgs(opts)]
             : laneArgs(opts),
-        cwd: opts.workspacePath,
+        // The app's directory, not the repository root. fastlane looks for
+        // `fastlane/` in the directory it was started from and nowhere else — no
+        // walking up, no looking down — so a project whose Fastfile sits in
+        // `app/fastlane` has to be started from `app`. Started from the root it
+        // finds nothing and offers to set fastlane up, which on a build server
+        // means a crash: there is nobody there to answer the question.
+        cwd: appRoot,
         env: {
             ...opts.env,
             ...(opts.secrets ?? {}),