Dx 9770 v2 dev#306
Merged
Merged
Conversation
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
fix: add global fields FVRs in export
…X-9770] Fix toolchain/config/stale-fixture drift (Node 24, ESLint 10, ts-node/mocha) that broke unit suites across several packages -- these were tooling issues, not product bugs: - import: add missing test/tsconfig.json (pretest TS5057) -- 1726 passing - branches: fix test/tsconfig (TS6059), auth-stub command tests, regenerate stale diff/merge fixtures, stub process.exit in collectMergeSettings -- 123 passing - seed: rewrite suite against current SDK/HttpClient impl + resolveJsonModule -- 33 passing - external-migrate: fix 16 lint errors (ignore lib/, idiomatic rule options, optional catch bindings) -- lint clean, 42 passing - variants: fix ESM/JSON toolchain, fancy/spy test harness, auth stubs, mock config -- 32/38 passing (6 known-remaining, see ticket) - root: add lint script consistent with cli No product/runtime source changed except 3 behavior-preserving catch bindings in external-migrate. The ESLint flat-config migration (~10 packages) and the 6 remaining variants integration failures are tracked as out-of-scope follow-ups. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
Resolve the high-severity Snyk SCA findings blocking CI (security-sca): - fast-uri 3.1.3 -> 3.1.4 (SNYK-JS-FASTURI-18021349, Interpretation Conflict) - ws 8.21.0 -> 8.21.1 (SNYK-JS-WS-17988732, resource allocation / CVE-2026-62389) Added scoped pnpm.overrides (range-limited so the unrelated ws@1.0.2 resolution is untouched) and refreshed the lockfile. Both are patch bumps of transitive deps. Note: inflight@1.0.6 (medium, SNYK-JS-INFLIGHT-6095116) has no published fix (package is abandoned); left as-is. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
The eslint.config.js files in these packages crashed under ESLint 10 (flat config): they imported the deprecated eslint-config-oclif-typescript (v3, eslintrc-style) or referenced removed @typescript-eslint rules (quotes/type-annotation-spacing/ban-ts-ignore) and unloaded plugins (node/*, unicorn/*), so `lint` never actually ran. Standardised all 10 on a valid flat config (typescript-eslint recommended + package rules; unicorn/node registered so pre-existing inline eslint-disable directives resolve). Packages: apps-cli, audit, branches, cli-tsgen, content-type, export, export-to-csv, import, import-setup, query-export. Because lint had been crashing, fixing the configs surfaced ~1000 pre-existing source lint issues (mostly prefer-const + no-unused-vars). These were never enforced before, so the debt-revealing rules are set to 'warn' (kept visible, non-blocking); a follow-up ticket tracks cleaning them. There is no lint gate in CI, so this changes no CI outcome. No product source changed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
…orkflow [DX-9770] Make cli-plugins consistent with cli-core (separate test and lint): - Decouple: remove the `posttest` lint hooks from all packages so `npm test` runs tests only (npm's posttest was auto-running lint after every test). - Uniform lint command `eslint "src/**/*.ts"` across all 18 TS packages (was three variants: `eslint .`, `eslint . --ext .ts`, `eslint src/**/*.ts`). - Add a `lint` script to the 5 TS packages that lacked one (bootstrap, cli-cm-regex-validate, migration, seed, variants) + a flat config for variants. - Drop `--fix` from cli-tsgen's lint script so lint checks rather than mutates. - Add .github/workflows/lint.yml (mirrors cli-core's) as a dedicated PR gate running `pnpm run lint`. All 18 TS packages now lint with 0 errors (warnings only; cleanup tracked in DX-9771). No product source changed. The two JS-only packages (bulk-publish, migrate-rte) still need a JS lint setup and are left for the test-runner normalization follow-up. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
…l [DX-9770] Address review feedback: keep all overrides in pnpm-workspace.yaml for consistency, instead of package.json `pnpm.overrides`. - Move the fast-uri and ws overrides into pnpm-workspace.yaml. - Bump the existing `fast-uri` override 3.1.3 -> 3.1.4: 3.1.3 is the vulnerable version (SNYK-JS-FASTURI-18021349) this PR is fixing, so the workspace pin is updated to the patched release. - Add `ws: 8.21.1` (SNYK-JS-WS-17988732). - Remove the now-redundant `pnpm.overrides` block from package.json. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
test(cli-plugins): repair failing unit test suites across packages [DX-9770]
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
… CI [DX-9770] Post-merge consistency pass over the plugin test suites and CI: - Scope every `test` to the unit suite (test/unit/**); stop the default run from pulling integration tests (import). Remove failure-masking that made suites always report green (branches `|| exit 0`, clone grep + `|| true`). - Decouple lint from test: drop asset-management `posttest: npm run lint` (lint runs via lint.yml, matching the cli-core convention). - Rewrite unit-test.yml into a package-wise matrix (one check per plugin, fail-fast: false) so a failure is attributed to its package at a glance. - Standardize the base test dir to `test/`: rename tests/ -> test/ for cli-tsgen and content-type (jest configs + scripts updated). - Add tsgen unit tests for helper.ts (22 tests, 100% line coverage) and fix tsgen-integration-test.yml to call `test:integration` (it was running unit). - Complete the external-migrate vitest -> mocha/chai migration cleanup: remove vitest.config.ts and the dead jest `test:integration` script. - Fix pre-existing v2 test bugs surfaced by the full run: import-setup login-handler `logStub` reference; seed importer jest.mock for @contentstack/cli-cm-import; variants .mocharc `--no-experimental-strip-types` so ts-node handles JSON imports under Node 24. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
Revert unit-test.yml from the package-wise matrix (one check per plugin) back to a single consolidated run, to avoid ~20 checks per PR. Keeps --no-bail so every package still runs even when one fails and pnpm prints a per-package summary, so failures stay easy to locate in the one log. No exclusions needed anymore (tsgen has unit tests; external-migrate is on mocha). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
…eed babel dep [DX-9770] - Remove dead `test:integration` scripts that pointed at nonexistent files (branches, query-export). - Remove orphaned integration harnesses not wired to any workflow: export/import `test:integration`(`:report`) scripts + `run.test.js` + `test/integration/**`. - bootstrap: drop the one real e2e test (live GitHub clone); fix the cross-test sinon stub leak (per-method `sandbox.stub(proto, 'method')` instead of whole-prototype stub + Object.assign, which left a phantom `getAllRepos` stub behind `restore()`); drop `nyc` (its spawn-wrap threw "expand is not a function" under Node 24 when tests stub `child_process.spawn`); make `test` invoke mocha directly (`pretest` compiles), removing the `test:e2e` indirection and the `|| exit 0` mask so the suite actually gates. 66 tests, all unit in nature. - seed: declare `@babel/preset-env` as a devDependency — its jest config uses it to transform `uuid`, but it was only resolving via another package's hoisted copy (removed during this cleanup). - Sync pnpm-lock.yaml with these package.json changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
…le [DX-9770] Update the pnpm-lock.yaml checksum and allowlist the migrated contentstack-cli-cm-regex-validate connect-stack.test.ts (fake `blt1234` test tokens) so the Talisman pre-commit scan passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
apps-cli's `test` ran `nyc --extension .ts mocha`, but nyc's spawn-wrap throws "expand is not a function" in CI (Node 22) for apps-cli's tests that stub process.exit — corrupting the run and cascading into spurious 401 / "session timed out" failures (the tests themselves pass; v2-dev's green nyc run proves it). Run plain mocha (coverage isn't needed for the PR gate), matching the bootstrap fix. 61 tests passing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
…nfigs [DX-9770]
Unit-test CI (apps-cli):
- deploy/update tests read region + developerHubBaseUrl from ambient configHandler
at module load and built their nock mocks from it, so they only passed when a
prior package (old CI order) or local config had seeded a region. My single-run
unit-test.yml runs apps-cli early -> no seeded region -> nock URLs mismatched ->
real 401 ("session timed out"). Seed a complete region at module load so the
mocks are deterministic regardless of execution order. (Temp nock 'no match'
logger added to surface any residual escaping request in CI; removed once green.)
Lint CI (new lint.yml, never gated on v2-dev):
- asset-management + regex-validate eslint.config.js used eslintrc-style configs
(eslint-config-oclif-typescript / strict semi+spacing) that ESLint 10 flat config
rejects or that their own src violates. Replaced with the standard flat template
(debt as warnings), matching the other packages. All packages now lint clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
…lib [DX-9770] Root cause of the 12 apps-cli deploy/update CI failures: apps-cli's tests stub the SRC command classes (BaseCommand/Update/initMarketplaceSDK). oclif only loads commands from src (via ts-node in dev) when NO oclif.manifest.json exists; when a manifest is present it loads the compiled lib, so the src stubs never apply and the command makes a real developer-hub HTTP call -> 401 'session timed out'. The build script had been changed to `pnpm compile && oclif manifest && oclif readme`, which created the manifest during the CI build step; v2-dev's build was `tsc -b` (no manifest), which is why v2-dev stayed green. Reproduced locally: no manifest -> tests pass; manifest present -> tests fail. Fix: build = `pnpm compile` only. The manifest is still generated by prepack for publishing. Reverts the exploratory hermetic/diagnostic edits to the test files (not needed once the manifest cause was found). apps-cli: 61 passing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
Backmerge latest v2-dev (PR #304: bulk-operations api_version 3.2 hardening, external-migrate create-stack, taxonomy NRP header). Only conflict was .talismanrc — resolved by taking the union of both sides' allowlist entries (version '1.0'; refreshed the merged pnpm-lock.yaml checksum). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
…st to mocha [DX-9770] The v2-dev backmerge (PR #304) added create-stack.test.ts written in vitest, but this branch converted external-migrate to mocha and removed the vitest dependency, so the file failed to compile ('Cannot find module vitest'). Rewrote its 6 scheduleEntryAction api_version:3.2 header tests using mocha/chai/sinon (stub axios.post + configHandler + authHandler), preserving PR #304's coverage. Refreshed the .talismanrc checksum for the rewritten file. external-migrate: 48 passing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
…) [DX-9770]
makeSpaceDir() used `am-test-${Date.now()}`, which collided when two tests ran within
the same millisecond, so one test's asset index leaked into another's space dir. That
intermittently made resolveAssetsChunkedLocation find an index in the 'empty space' test,
skipping the empty-space branch and flaking expect(tickStub.callCount).to.equal(1)
(seen as 'expected +0 to equal 1'). Use fsReal.mkdtempSync for a guaranteed-unique dir.
Verified: 8/8 consecutive runs now 242 passing.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NbgqgVDTDmh6c9LwDtMEf9
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
cs-raj
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.