DX | 02-11-2026 | Release by cs-raj · Pull Request #287 · contentstack/contentstack-utils-javascript

cs-raj · 2026-11-02T05:46:43Z

Summary

Release PR: promotes development to master. The main change is DX-27614 — release.yml publishes to npm with OIDC trusted publishing (no NPM_TOKEN). It has to be on master, where releases are cut from.

What's included

OIDC trusted publishing in release.yml (chore(release): publish to npm with trusted publishing #283): runs on release: published, id-token: write, Node 24 and latest npm
Release workflow checks that the tag matches package.json, and tags the GitHub Packages publish
Version-bump check gated to src paths, coverage report permissions, release workflow fixes
Release docs point at release.yml and trusted publishing; AGENTS.md cleanup
Lock file refreshed to resolve dependency vulnerabilities

Notes

package.json is still 1.9.1, so merging does not publish anything. Publishing needs a version bump and a GitHub release.
The npm trusted-publisher config is tracked in CLOUD-19945 / CLOUD-20184.

🤖 Generated with Claude Code

Back merge

… rules

…ules chore: Refactor documentation in AGENTS.md and remove redundant Cursor…

…rkflow

fix: Modified github workflows for release and remove check-branch workflow

Brings back-merge branch up to date with development so master can be back-merged cleanly (DX-20927). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

DX-20927 | Back-merge master into development

Publish on release:published from release.yml so the npm trusted publisher can be keyed on the filename, drop NODE_AUTH_TOKEN in favour of id-token: write (OIDC), run on Node 24 with npm@latest (trusted publishing needs npm >= 11.5.1), check out the release tag without persisted credentials. GitHub pre-releases go to the beta dist-tag. The existing guard that publishes only v-prefixed tags is kept. The GitHub Packages job gains the packages: write permission it was missing and publishes with the job's own token instead of a personal token. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

The build-test job runs with the default read-only token, so the coverage report, sticky comment and test reporter fail with "Missing checks: write" even though the tests pass (red on every pull request since 2026-09-24). Grant the job just what those steps need, pin the coverage action to the commit the v2 tag resolves to today, and exempt the pinned file from Talisman's hex-string check. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Refuse to publish when the release tag is not "v" + the package.json version, so a tag cut on the wrong commit cannot publish an older version under a newer tag. The GitHub Packages job now uses the same beta/latest dist-tag rule as the npm job, so a GitHub pre-release never becomes latest on either registry. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AGENTS.md and the dev-workflow skill still described npm-publish.yml on release: created with NPM_TOKEN / GIT_TOKEN. Publishing now runs from release.yml on release: published, npm through OIDC trusted publishing and GitHub Packages with the job token. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Snyk (dev, all-projects): critical 2 -> 0, high 76 -> 6, medium 33 -> 8, low 6 -> 1 npm audit: critical 4 -> 3, high 40 -> 33, moderate 9 -> 10, low 4 -> 0 .talismanrc: package-lock.json now ignores filecontent and base64content (sha512 integrity hashes; false positives). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…development chore: back-merge master into development

Lock file regenerated (fixed 1 on its own: fast-uri 3.1.8 -> 3.1.9). Direct upgrades: none (no patch or minor bump clears a finding). Overrides: none (library; remaining fixes are cross-major). Vuln count: snyk 0 -> 0, npm audit 6 -> 5. Build verified passing. Remaining (dev-only, need majors): jest-coverage-badges (minimist, mkdirp) and jest-junit 15 -> 17 (uuid). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chore(release): publish to npm with trusted publishing

snyk-io · 2026-11-02T05:46:55Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2026-11-02T05:47:21Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

github-actions · 2026-11-02T05:48:24Z

Coverage report

St.^❔	Category	Percentage	Covered / Total
🟢	Statements	99.17%	720/726
🟢	Branches	92.44%	538/582
🟢	Functions	100%	152/152
🟢	Lines	99.4%	666/670

Test suite run success

430 tests passing in 22 suites.

Report generated by 🧪jest coverage report action from 0d7297e

…ection Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

ci: pass GitHub context to run steps via env vars (script injection)

github-actions · 2026-11-02T12:37:04Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Threshold	Result
🔴 Critical Severity	10	✅ Passed
🟠 High Severity	25	✅ Passed
🟡 Medium Severity	500	✅ Passed
🔵 Low Severity	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	SLA Threshold (with/no fixes)	Status
🔴 Critical	15 / 30 days	✅ Passed
🟠 High	30 / 120 days	✅ Passed
🟡 Medium	90 / 365 days	✅ Passed
🔵 Low	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

github-actions · 2026-11-02T12:38:09Z

Coverage report

St.^❔	Category	Percentage	Covered / Total
🟢	Statements	99.17%	720/726
🟢	Branches	92.44%	538/582
🟢	Functions	100%	152/152
🟢	Lines	99.4%	666/670

Test suite run success

430 tests passing in 22 suites.

Report generated by 🧪jest coverage report action from 0d7297e

naman-contentstack and others added 21 commits April 13, 2026 15:06

Merge pull request #271 from contentstack/master

c4b5b5c

Back merge

chore:Refactor documentation in AGENTS.md and remove redundant Cursor…

fabef34

… rules

Merge pull request #272 from contentstack/fix/dx-6041-update-cursor-r…

69add46

…ules chore: Refactor documentation in AGENTS.md and remove redundant Cursor…

fix: Modified github workflows for release and remove check-branch wo…

6a703bf

…rkflow

Fixed: the release createion based on the tag

7710df0

fix: check-version bump triggered for all the PR

b5f65ea

ci: gate version-bump on src paths; validate semver vs latest tag only

b107131

Merge pull request #273 from contentstack/fix/DX-6182

72673f2

fix: Modified github workflows for release and remove check-branch workflow

Merge development into back-merge/DX-20927

01a2f61

Brings back-merge branch up to date with development so master can be back-merged cleanly (DX-20927). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request #282 from contentstack/back-merge/DX-20927

bbf734f

DX-20927 | Back-merge master into development

Add public access to npm publish command

2d2c96e

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

chore: back-merge master into development

cec9e31

Merge pull request #285 from contentstack/chore/back-merge-master-to-…

8c6c69c

…development chore: back-merge master into development

Merge remote-tracking branch 'origin/development' into feat/DX-27614

53bd73b

Merge pull request #283 from contentstack/feat/DX-27614

4bfc3f4

chore(release): publish to npm with trusted publishing

cs-raj requested review from a team as code owners November 2, 2026 05:46

reeshika-h previously approved these changes Nov 2, 2026

View reviewed changes

ci: pass GitHub context to run steps via env vars to avoid script inj…

aee97dd

…ection Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

reeshika-h mentioned this pull request Nov 2, 2026

ci: pass GitHub context to run steps via env vars (script injection) #289

Merged

dhaval-jain-cstk previously approved these changes Nov 2, 2026

View reviewed changes

Merge pull request #289 from contentstack/fix/workflow-script-injection

0d7297e

ci: pass GitHub context to run steps via env vars (script injection)

reeshika-h dismissed stale reviews from dhaval-jain-cstk and themself via 0d7297e November 2, 2026 12:36

reeshika-h approved these changes Nov 2, 2026

View reviewed changes

Aravind-Kumar-cstk approved these changes Nov 3, 2026

View reviewed changes

reeshika-h merged commit 453ebc8 into master Nov 3, 2026
13 of 14 checks passed

Navigation Menu

Repository navigation

DX | 02-11-2026 | Release - #287

DX | 02-11-2026 | Release#287
reeshika-h merged 23 commits into
masterfrom
development

cs-raj commented Nov 2, 2026

Uh oh!

snyk-io Bot commented Nov 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

github-actions Bot commented Nov 2, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

cs-raj commented Nov 2, 2026

Summary

What's included

Notes

Uh oh!

snyk-io Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions Bot commented Nov 2, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage report

Test suite run success

Uh oh!

github-actions Bot commented Nov 2, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

Uh oh!

github-actions Bot commented Nov 2, 2026

Coverage report

Test suite run success

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

snyk-io Bot commented Nov 2, 2026 •

edited

Loading

github-actions Bot commented Nov 2, 2026 •

edited

Loading