V1-legacy - #333
Open
harshitha-cstk wants to merge 60 commits into
Open
Conversation
feat: add asset scanning support in import
…Each Assets loaded from --data-dir backup may not have a publish_details field if they were never published. The optional chain only guarded `asset`, not `publish_details`, causing a TypeError in displayAssetsDetails().
…sets.js setConfig() assigned to `config` at module scope but the variable was never declared, causing a ReferenceError on any cm:assets:publish run that goes through the data-dir flow.
…portCommand for asset publishing
…nd update related logic
fix: Update flags in AssetsPublishCommand and add user reminder in ImportCommand for asset publishing
publish() flattened each asset's publish_details into independent environments[] and locales[] arrays, so the CMA republished the cartesian product. For a ragged publish state (different locales on different environments) this over-published to env-locale pairs that never existed on the source stack. Add buildPublishGroups: group publish_details by environment, coalesce environments with an identical locale set, and emit one publish call per group so each call is a single rectangle the CMA reproduces exactly. A rectangular asset still collapses to one call (unchanged behavior). The DX-1656 invalid-environment guard is preserved (envs absent from the destination are still skipped). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps [adm-zip](https://github.com/cthackers/adm-zip) from 0.5.18 to 0.6.0. - [Release notes](https://github.com/cthackers/adm-zip/releases) - [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md) - [Commits](cthackers/adm-zip@v0.5.18...v0.6.0) --- updated-dependencies: - dependency-name: adm-zip dependency-version: 0.6.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
back merge
git-diff@2.0.7 is unmaintained (last published 2018) and pulls in chalk@2, diff@3, loglevel, shelljs and shelljs.exec. Snyk flagged the only vulnerable path in the monorepo through that tree: Missing Release of Resource after Effective Lifetime [Medium] SNYK-JS-INFLIGHT-6095116 git-diff@2.0.7 > shelljs@0.8.5 > glob@7.2.3 > inflight@1.0.6 Snyk reports no direct upgrade or patch, since git-diff is abandoned. Replace it with diff@^9 (jsdiff): zero runtime dependencies, bundled TypeScript types, dual CJS/ESM. It also removes the dependency on a `git` binary and the temp-file/subprocess round trip git-diff used to shell out through shelljs. buildDiffString now calls createTwoFilesPatch, which emits the `---` and `+++` file headers itself, so the hand-rolled header concatenation is gone. Output was verified equivalent: both patch strings were run through Diff2html.parse and compared on file names, added/deleted line counts, hunk headers and every line type plus content - identical. Identical inputs are also handled better. git-diff returned undefined when both sides matched, which interpolated the literal string "undefined" into the patch; createTwoFilesPatch returns a well-formed patch with no hunks. Drop @types/git-diff, since diff ships its own types. Tests: the existing spec mocked diff2html, so the generated patch was never asserted. Add two cases covering the string handed to Diff2html.parse - one for headers, hunk and changed lines, one for the identical-input case. Both were mutation-checked against a corrupted buildDiffString. Suite: 78 passed, 16 suites, tsc clean, Snyk reports no vulnerable paths across the monorepo. Bump the pinned pnpm-lock.yaml checksum in .talismanrc, which the lockfile change invalidates. The finding is the usual sha512 integrity hashes, not a secret. Note: this commit also carries a pre-existing, uncommitted version bump to 1.5.4 that was already present in package.json. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
added audit check and fix for assets in pending or quarantined state
The merge of development into this branch left pnpm-lock.yaml internally inconsistent: an eslint-import-resolver-typescript@3.10.1 snapshot still referenced get-tsconfig@4.14.0 while the packages section had advanced to 4.14.1, and several peer-dependency snapshots (ts-node, @tsconfig/*, jest, eslint resolver permutations) had been dropped. This made `pnpm install --frozen-lockfile` fail with ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY, breaking the run-tests and tsgen-integration jobs at the install step before any test could run. Regenerated with `pnpm install --no-frozen-lockfile` using pnpm 10.28.0, matching the pinned packageManager. Lockfile-only change: no package.json or dependency versions altered. Refreshed the pnpm-lock.yaml checksum in .talismanrc to match, per existing repo practice. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…gan types Addresses Copilot review feedback on #324. contentstack-content-type was the only package of 20 declaring @types/* under dependencies; the other 19 keep them in devDependencies. Type packages are compile-time only and nothing here re-exports their types publicly, so shipping them as runtime deps only inflated the production install. Moved @types/diff2html, @types/table and @types/tmp to devDependencies. The runtime packages they describe (diff2html, table, tmp) stay in dependencies. Dropped @types/hogan.js entirely rather than moving it: hogan is referenced nowhere in this package's src or tests, and hogan.js is not a runtime dependency of any package in the repo, so the types were dead weight. Verified with `tsc -b --force` (clean, emits lib/) and the package suite (16 suites, 78 tests passing). Talisman checksum for pnpm-lock.yaml refreshed via `talisman --checksum`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
fix(import): preserve env-locale pairing for asset publish (DX-9772)
…ith-jsdiff fix(content-type): replace git-diff with jsdiff to clear Snyk issue
feat: v1 asset scanning support in bulk publish and import
netrajpatel
previously approved these changes
Aug 5, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the SCA GitHub Actions workflow for the v1-legacy branch by explicitly setting GITHUB_TOKEN permissions for the security-sca job.
Changes:
- Adds an explicit
permissionsblock to thesecurity-scaworkflow job (includingpull-requests: write). - Keeps the existing Snyk scan and
contentstack/sca-policyaction execution flow.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+8
to
+10
| permissions: | ||
| contents: read | ||
| pull-requests: write |
Comment on lines
+10
to
12
| pull-requests: write | ||
| steps: | ||
| - uses: actions/checkout@master |
…ull-guard fix(bulk-publish): add null guard on asset.publish_details before forEach
…-zip-0.6.0 chore(deps): bump adm-zip from 0.5.18 to 0.6.0
bumped versions
…o updated-lock-file
…ns into updated-lock-file
updated lock file
Development
🔒 Security Scan Results
⏱️ SLA Breach Summary
✅ BUILD PASSED - All security checks passed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.