Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cli/src/build/onboarding/android/ui/app.tsx`:
- Around line 120-159: Extract normalizePackageManager and
buildScriptPickerOptions into a shared module (e.g., workflow-ui-helpers.ts),
export them, and replace the local implementations in this file with imports
from that module so both Android and iOS use the same helpers; also replace the
Object.prototype.hasOwnProperty.call(scripts, recommended) usage in
buildScriptPickerOptions with Object.hasOwn(scripts, recommended) before
importing/using the shared helper to ensure modern shorthand is used everywhere.
- Around line 30-34: Imports for the utility functions are duplicated and out of
order; remove the separate import listing findBuildCommandForProjectType,
findProjectType, getPackageScripts, and getPMAndCommand and instead add those
symbols to the existing utils import so all utilities are consolidated in one
import, then reorder imports to satisfy ESLint grouping (external modules,
project utils, relative files) and eliminate the duplicate import. Ensure you
keep defaultExportPath, exportCredentialsToEnv, writeWorkflowFile,
WORKFLOW_PATH, and BuildScriptChoice/PackageManager imports unchanged while
consolidating the four utility functions into the single utilities import.
- Around line 1036-1040: The current block assigns capgoKey and then
conditionally calls findSavedKey(true) in a try/catch on the same line; split
the statements so each statement is on its own line and avoid inline try/catch.
Replace the try/catch + findSavedKey(true) with a silent lookup by calling
findSavedKeySilent() (to match the iOS pattern) when apikey is falsy, or if you
must keep findSavedKey use it on its own line inside a try/catch block; update
references to capgoKey, apikey, findSavedKey(true) accordingly so the code
conforms to max-statements-per-line and uses findSavedKeySilent for consistency.

In `@cli/src/build/onboarding/ci-secrets.ts`:
- Around line 125-135: The code currently treats whitespace-only apiKey as
valid; update the check around the CAPGO_TOKEN creation to use a trimmed value
(e.g., const trimmed = apiKey?.trim()) and only call entries.push for
CAPGO_TOKEN when trimmed is non-empty; when pushing, use the trimmed value for
the value field and keep masked: true to avoid storing a whitespace-only secret
(refer to apiKey, 'CAPGO_TOKEN', and the entries.push call).

In `@cli/src/build/onboarding/env-export.ts`:
- Line 15: Extract renderEnvFile and its helper escapeDotenvValue into a new
shared module (cli/src/build/env-render.ts) that exports both functions, then
update both cli/src/build/onboarding/env-export.ts and
cli/src/build/credentials-manage.ts to import renderEnvFile (and
escapeDotenvValue if needed) from that new module instead of
credentials-manage.ts; remove the original renderEnvFile implementation from
credentials-manage.ts so the only source of truth is the new env-render module.

In `@cli/src/build/onboarding/ui/app.tsx`:
- Line 211: Remove the unused local state pendingCustomCommand and its setter
setPendingCustomCommand: locate the useState declaration for
pendingCustomCommand and any references to setPendingCustomCommand (they are
redundant because the custom command is already stored in
buildScriptChoice.command) and delete those lines; ensure no other code reads
pendingCustomCommand and that buildScriptChoice.command continues to be used for
the custom command flow.
- Line 126: Replace the old hasOwnProperty call with the modern Object.hasOwn
usage: anywhere you currently use Object.prototype.hasOwnProperty.call(scripts,
recommended) (e.g., the conditional checking recommended against scripts and the
other occurrence around the symbol referenced at the lower occurrence) change it
to Object.hasOwn(scripts, recommended); update both occurrences so the checks
use Object.hasOwn and refer to the same variables (scripts and recommended).
- Around line 31-35: Reorder and consolidate the imports to satisfy the ESLint
rules: remove the duplicate import of findBuildCommandForProjectType,
findProjectType, getPackageScripts and merge those symbols into the existing
getPMAndCommand import (the earlier import on line ~20), then re-sort imports so
grouped builtin/third-party/local imports follow the configured
perfectionist/sort-imports order and no duplicate import specifiers remain;
ensure defaultExportPath, exportCredentialsToEnv, writeWorkflowFile,
WORKFLOW_PATH, BuildScriptChoice, PackageManager, and BuildCredentials remain
imported exactly once with consistent ordering.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cli/src/build/onboarding/android/ui/app.tsx`:
- Around line 1147-1167: The code advances to setStep('confirm-secrets-push')
even when getCiSecretRepoLabelAsync fails (repoLabel is null), allowing a GitHub
upload without a resolved owner/repo; change the flow so that after awaiting
getCiSecretRepoLabelAsync(ciSecretTarget) you treat a null/failed repoLabel as a
hard stop: set an error/needs-retry state (e.g., update a ciSecretRepoError or
keep cancelled handling) and return early instead of calling
setCiSecretRepoLabel or continuing to listExistingCiSecretKeysAsync and
setStep('confirm-secrets-push'); apply the same guard/update to the similar
block referenced at lines 2658-2717 so unresolved owner/repo always forces
retry/cancel and never reaches confirm-secrets-push.

In `@cli/src/build/onboarding/ui/app.tsx`:
- Around line 1174-1197: The code currently allows proceeding to
setStep('confirm-secrets-push') even when getCiSecretRepoLabelAsync failed and
repoLabel is null; change the GitHub path to fail-closed by verifying repoLabel
is non-null before enabling the upload flow: after awaiting
getCiSecretRepoLabelAsync (and before any setStep('confirm-secrets-push') for
provider === 'github'), detect a null/undefined repoLabel and instead set an
error/blocked UI state (e.g. setCiSecretCheckPhase to an error message and abort
or setStep to a safe fallback) and do not call setStep('confirm-secrets-push');
ensure the same null-check behavior is applied to the duplicate block around
lines 2918-2973 so uploads cannot proceed without a resolved owner/repo.

In `@cli/src/build/onboarding/ui/components.tsx`:
- Around line 5-6: The import order in components.tsx is reversed for the lint
rule; move the type-only import for DiffLine (import type { DiffLine } from
'../diff-utils.js') above the value import of React (import React, { useEffect,
useState } from 'react') so the type import precedes the value import,
satisfying perfectionist/sort-imports; update the two import lines accordingly
and run the linter to confirm no other grouping/order issues.

In `@cli/test/test-diff-utils.mjs`:
- Around line 24-27: Remove the unused helper function "assert" from the file by
deleting the function declaration function assert(condition, message) { if
(!condition) throw new Error(message || 'Assertion failed') }, ensuring no other
code references "assert" before removal; if references exist, replace them with
standard test assertions or throw new Error directly.
- Around line 103-105: The test file is using the global process
(process.exit(1)); import the Node process module and use that instead: add
"import process from 'node:process';" at the top of cli/test/test-diff-utils.mjs
and leave the call to process.exit(1) as-is (or alternatively import { exit }
from 'node:process' and call exit(1)); ensure any other uses of process in this
file refer to the imported symbol (process or exit) to satisfy
node/prefer-global/process.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@cli/src/build/onboarding/android/ui/app.tsx`:
- Around line 3147-3181: The UI block guarded by step ===
'confirm-workflow-overwrite' is unreachable and should be removed along with any
related unused state; delete the JSX block that renders the
confirm-workflow-overwrite step (the Box containing WORKFLOW_PATH, the lines
count using workflowExistingContent and workflowProposedContent, and the Select
that calls setStep) and also remove the associated state variables (e.g.,
workflowExistingContent) and any imports or constants only used by that block to
avoid dead code; ensure no remaining references to 'confirm-workflow-overwrite'
or those state variables remain in the file.