fix: parse the status JSON, pass superseded runs, derive GitHub context

[finalerock44]

Summary

Four fixes to step.sh, from the 23 Sep docs-vs-production audit (plan section E1).

1. Status outputs were always empty. dcd status --json prints pretty JSON (JSON.stringify(obj, null, 2)), and the compact-JSON greps ('"status":"..."') never matched it. So DEVICE_CLOUD_UPLOAD_STATUS, DEVICE_CLOUD_FLOW_RESULTS and DEVICE_CLOUD_APP_BINARY_ID were empty on every run. The step now reads the document with node, which is always there because the step runs the CLI through npx.

2. Superseded runs pass. With cancel_previous, the older run's queued tests are cancelled, and /uploads/status rolls them up to FAILED. The status now carries supersededBy: <uploadId> (dcd C2, not live yet). When that field is present the step:

   • logs Superseded by <id> and the newer run's console link;
   • sets DEVICE_CLOUD_UPLOAD_STATUS=SUPERSEDED;
   • exits 0, whatever dcd exited with.

   This mirrors dcd cloud 5.6.0. Nothing changes when the field is absent.

3. The API key is no longer printed. Both the variables dump and the echoed command line printed it; they now show [REDACTED].

4. GitHub context is derived from Bitrise env vars. GitHub checks need gh_repo + gh_sha, and cancel_previous needs gh_repo + a PR or branch. Until now the step only sent gh_check_name, so neither worked on Bitrise. For github.com repositories it now attaches:

   • gh_repo from GIT_REPOSITORY_URL (https, ssh and scp-style remotes);
   • gh_sha from BITRISE_GIT_COMMIT, else GIT_CLONE_COMMIT_HASH;
   • gh_branch from BITRISE_GIT_BRANCH;
   • gh_pr_number and gh_pr_url from BITRISE_PULL_REQUEST.

   For any repository it also attaches gh_run_id, from BITRISEIO_PIPELINE_ID (the "ID of the running Pipeline build", which every workflow in the pipeline shares), else BITRISE_BUILD_SLUG. The server treats uploads with the same run id as siblings, so parallel workflows of one pipeline don't cancel each other.

   • Keys set in metadata win.
   • A new include_github_context input (default true) turns it all off.

Behaviour changes to note

• json_file: true now fails failed runs. dcd cloud --json-file exits 0 on a failed run, so while the status was unparsed, those builds went green on failures. They now fail on a FAILED status.
  • A json_file run whose status can't be read now fails too, instead of passing. Async runs are the exception.
  • A superseded run still passes.
• Checks may start appearing. Orgs that have the DeviceCloud GitHub App installed will start getting checks from Bitrise builds of GitHub repos. check_name names those checks, and include_github_context: "false" opts out.
• ERROR is a new status value, reported when the status call returns no JSON at all. The verdict then comes from dcd's exit code, as before.
• DEVICE_CLOUD_FLOW_RESULTS has a fixed shape: [{name, status, failReason?}].

Tests

bats test/test.bats: 38 tests pass, under bash 5.2 and under macOS bash 3.2.

• The two skipped [known bug] tests are unskipped.
• New fixture tests (test/fixtures/*.json, pretty-printed like the real CLI) cover passing, failed and superseded runs.
• The json_file cases are FAILED → fails, PASSED → passes, superseded → passes, and unreadable status → fails.
• Also covered: an older CLI exiting 2 on a superseded run, compact and noisy output, no JSON at all, the API key never appearing in the step's own output, and GitHub context derivation (remote formats, other hosts, metadata overrides, opt-out).

The npx stub mimics --json-file (exit 2 → 0). I checked the new tests against the old step.sh and they fail there. shellcheck --shell=bash step.sh reports only the 47 existing advisory findings.

Not run: the bitrise.yml test workflow (it needs a real API key and a sample app), and stepman audit (the bitrise CLI isn't installed). step.yml parses, and all 46 inputs have a title and summary.

Release

Don't release yet. The plan is 1.4.0, including cancel_previous, once the steplib approves 1.3.0 (bitrise-io/bitrise-steplib#5260). The supersededBy branch only takes effect once dcd returns the field.

🤖 Generated with Claude Code