From f6f6b25110b30482126229b22c1df1c3a209a28a Mon Sep 17 00:00:00 2001 From: alok-cstk Date: Thu, 15 Oct 2026 02:13:37 +0530 Subject: [PATCH 1/4] Add GitGuardian secret scan on publish (postpack hook, blocking); install ggshield in release workflows (IS-7341) --- .github/workflows/release-production-core.yml | 7 ++++++- .../release-production-platform-plugins.yml | 13 ++++++++++++- .gitignore | 2 +- package.json | 2 +- packages/contentstack-auth/package.json | 2 +- packages/contentstack-command/package.json | 3 ++- packages/contentstack-config/package.json | 2 +- packages/contentstack-utilities/package.json | 3 ++- packages/contentstack/package.json | 2 +- 9 files changed, 27 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release-production-core.yml b/.github/workflows/release-production-core.yml index e6e45eeb15..a8b3daaf7a 100644 --- a/.github/workflows/release-production-core.yml +++ b/.github/workflows/release-production-core.yml @@ -30,6 +30,9 @@ jobs: - name: Build all packages run: pnpm -r --sort run build + - name: Install ggshield + run: pipx install ggshield + - name: Reading Configuration id: release_config uses: rgarcia-phi/json-to-variables@v1.1.0 @@ -40,6 +43,8 @@ jobs: - name: Publishing core (Production) id: publish-core uses: JS-DevTools/npm-publish@v3 + env: + GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }} with: token: ${{ secrets.NPM_TOKEN }} package: ./packages/contentstack/package.json @@ -58,4 +63,4 @@ jobs: gh release create "$TAG" \ --title "Core Production $VERSION" \ --generate-notes - fi + fi \ No newline at end of file diff --git a/.github/workflows/release-production-platform-plugins.yml b/.github/workflows/release-production-platform-plugins.yml index 69a180c3fb..746e67e757 100644 --- a/.github/workflows/release-production-platform-plugins.yml +++ b/.github/workflows/release-production-platform-plugins.yml @@ -30,6 +30,9 @@ jobs: - name: Build all plugins run: pnpm -r --sort run build + - name: Install ggshield + run: pipx install ggshield + - name: Reading Configuration id: release_config uses: rgarcia-phi/json-to-variables@v1.1.0 @@ -40,6 +43,8 @@ jobs: # Utilities - name: Publishing utilities (Production) uses: JS-DevTools/npm-publish@v3 + env: + GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }} with: token: ${{ secrets.NPM_TOKEN }} package: ./packages/contentstack-utilities/package.json @@ -48,6 +53,8 @@ jobs: # Command - name: Publishing command (Production) uses: JS-DevTools/npm-publish@v3 + env: + GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }} with: token: ${{ secrets.NPM_TOKEN }} package: ./packages/contentstack-command/package.json @@ -56,6 +63,8 @@ jobs: # Config - name: Publishing config (Production) uses: JS-DevTools/npm-publish@v3 + env: + GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }} with: token: ${{ secrets.NPM_TOKEN }} package: ./packages/contentstack-config/package.json @@ -64,7 +73,9 @@ jobs: # Auth - name: Publishing auth (Production) uses: JS-DevTools/npm-publish@v3 + env: + GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }} with: token: ${{ secrets.NPM_TOKEN }} package: ./packages/contentstack-auth/package.json - tag: latest + tag: latest \ No newline at end of file diff --git a/.gitignore b/.gitignore index 0e1ca7354a..8b03eed97b 100644 --- a/.gitignore +++ b/.gitignore @@ -26,4 +26,4 @@ snyk_output.log **/migration-logs **/migration-logs/** *.logs -tsconfig.tsbuildinfo \ No newline at end of file +tsconfig.tsbuildinfo.cache_ggshield diff --git a/package.json b/package.json index bc08ea27c5..0eb53ffdc9 100644 --- a/package.json +++ b/package.json @@ -16,7 +16,7 @@ "lint": "pnpm -r --filter './packages/*' run lint", "prepack": "pnpm -r --filter './packages/*' run prepack", "bootstrap": "pnpm install", - "clean:modules": "rm -rf node_modules packages/**/node_modules", + "clean:modules": "rm -rf node_modulesgit branch packages/**/node_modules", "clean:lock": "rm -f pnpm-lock.yaml", "clean:all": "pnpm store prune && rm -rf node_modules && pnpm run clean:packages", "setup": "pnpm run clean:all && pnpm run bootstrap && pnpm run build", diff --git a/packages/contentstack-auth/package.json b/packages/contentstack-auth/package.json index c6f4c077db..3a8aae1ea9 100644 --- a/packages/contentstack-auth/package.json +++ b/packages/contentstack-auth/package.json @@ -8,7 +8,7 @@ "build": "pnpm compile && oclif manifest && oclif readme", "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo", "compile": "tsc -b tsconfig.json", - "postpack": "rm -f oclif.manifest.json", + "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json", "prepack": "pnpm compile && oclif manifest && oclif readme", "version": "oclif readme && git add README.md", "test": "mocha \"test/unit/**/*.test.ts\"", diff --git a/packages/contentstack-command/package.json b/packages/contentstack-command/package.json index 576ff41f4e..d0364e0315 100644 --- a/packages/contentstack-command/package.json +++ b/packages/contentstack-command/package.json @@ -8,6 +8,7 @@ "scripts": { "build": "pnpm compile", "prepack": "pnpm compile", + "postpack": "ggshield secret scan archive ./*.tgz", "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo", "compile": "tsc -b tsconfig.json", "test": "mocha \"test/unit/**/*.test.ts\"", @@ -67,4 +68,4 @@ "url": "git+https://github.com/contentstack/cli.git", "directory": "packages/contentstack-command" } -} +} \ No newline at end of file diff --git a/packages/contentstack-config/package.json b/packages/contentstack-config/package.json index f8fa0c3589..d76f73d02f 100644 --- a/packages/contentstack-config/package.json +++ b/packages/contentstack-config/package.json @@ -7,7 +7,7 @@ "build": "pnpm compile && oclif manifest && oclif readme", "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo", "compile": "tsc -b tsconfig.json", - "postpack": "rm -f oclif.manifest.json", + "postpack": "pnpm -w run gg:scan-tarball && rm -f oclif.manifest.json", "prepack": "pnpm compile && oclif manifest && oclif readme", "version": "oclif readme && git add README.md", "test": "mocha \"test/unit/**/*.test.ts\"", diff --git a/packages/contentstack-utilities/package.json b/packages/contentstack-utilities/package.json index 771047e732..9fafa7de68 100644 --- a/packages/contentstack-utilities/package.json +++ b/packages/contentstack-utilities/package.json @@ -6,6 +6,7 @@ "types": "lib/index.d.ts", "scripts": { "prepack": "pnpm compile", + "postpack": "ggshield secret scan archive ./*.tgz", "build": "pnpm compile", "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo", "compile": "tsc -b tsconfig.json", @@ -85,4 +86,4 @@ "ts-node": "^10.9.2", "typescript": "^5.9.3" } -} +} \ No newline at end of file diff --git a/packages/contentstack/package.json b/packages/contentstack/package.json index 140694e139..c8ee5ad9e8 100755 --- a/packages/contentstack/package.json +++ b/packages/contentstack/package.json @@ -12,7 +12,7 @@ "build": "pnpm compile && oclif manifest && oclif readme", "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo", "compile": "tsc -b tsconfig.json", - "postpack": "rm -f oclif.manifest.json", + "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json", "version": "oclif readme && git add README.md", "test": "mocha \"test/unit/**/*.test.ts\"", "lint": "eslint src/**/*.ts", From 57aac1caafa388618f06c1360793be81a94f38c3 Mon Sep 17 00:00:00 2001 From: alok-cstk Date: Thu, 15 Oct 2026 12:16:47 +0530 Subject: [PATCH 2/4] Fix: split .cache_ggshield gitignore line; correct contentstack-config postpack to scan tarball --- .gitignore | 3 ++- packages/contentstack-config/package.json | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 8b03eed97b..3b211961ae 100644 --- a/.gitignore +++ b/.gitignore @@ -26,4 +26,5 @@ snyk_output.log **/migration-logs **/migration-logs/** *.logs -tsconfig.tsbuildinfo.cache_ggshield +tsconfig.tsbuildinfo +.cache_ggshield diff --git a/packages/contentstack-config/package.json b/packages/contentstack-config/package.json index d76f73d02f..c6d2554a92 100644 --- a/packages/contentstack-config/package.json +++ b/packages/contentstack-config/package.json @@ -7,7 +7,7 @@ "build": "pnpm compile && oclif manifest && oclif readme", "clean": "rm -rf ./lib ./node_modules tsconfig.tsbuildinfo", "compile": "tsc -b tsconfig.json", - "postpack": "pnpm -w run gg:scan-tarball && rm -f oclif.manifest.json", + "postpack": "ggshield secret scan archive ./*.tgz && rm -f oclif.manifest.json", "prepack": "pnpm compile && oclif manifest && oclif readme", "version": "oclif readme && git add README.md", "test": "mocha \"test/unit/**/*.test.ts\"", From ee8d568d13bfc17a1acaa0b4f316b9b582f45445 Mon Sep 17 00:00:00 2001 From: alok-cstk Date: Thu, 15 Oct 2026 13:37:23 +0530 Subject: [PATCH 3/4] Fix: remove stray 'git branch' text accidentally inserted into clean:modules script --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 0eb53ffdc9..bc08ea27c5 100644 --- a/package.json +++ b/package.json @@ -16,7 +16,7 @@ "lint": "pnpm -r --filter './packages/*' run lint", "prepack": "pnpm -r --filter './packages/*' run prepack", "bootstrap": "pnpm install", - "clean:modules": "rm -rf node_modulesgit branch packages/**/node_modules", + "clean:modules": "rm -rf node_modules packages/**/node_modules", "clean:lock": "rm -f pnpm-lock.yaml", "clean:all": "pnpm store prune && rm -rf node_modules && pnpm run clean:packages", "setup": "pnpm run clean:all && pnpm run bootstrap && pnpm run build", From eaa0211c7d86d8f8b0ce9bca18ddecf5b3518501 Mon Sep 17 00:00:00 2001 From: raj pandey Date: Thu, 15 Oct 2026 23:10:04 +0530 Subject: [PATCH 4/4] fix(deps): bump qs and traverse overrides qs 6.16.1 clears SNYK-JS-QS-20943482 (High), which the security-sca policy counted once per vulnerable path (39) against a limit of 25. traverse 0.6.14 clears SNYK-JS-TRAVERSE-20570510 (Medium) so the pre-commit Snyk scan passes; 0.6.12 is deprecated upstream. Co-Authored-By: Claude Sonnet 5.5 --- pnpm-lock.yaml | 74 +++++++++++++++++++++++++++++++-------------- pnpm-workspace.yaml | 3 +- 2 files changed, 54 insertions(+), 23 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 86050e69a9..f68e01892b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -11,7 +11,8 @@ overrides: brace-expansion: 5.0.12 js-yaml: 5.4.3 fast-uri: 4.2.1 - qs: 6.16.0 + qs: 6.16.1 + traverse: 0.6.14 importers: @@ -448,8 +449,8 @@ importers: specifier: ^6.0.3 version: 6.0.3 traverse: - specifier: ^0.6.11 - version: 0.6.11 + specifier: 0.6.14 + version: 0.6.14 tslib: specifier: ^2.8.1 version: 2.8.1 @@ -4052,8 +4053,8 @@ packages: resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==} engines: {node: '>=6'} - qs@6.16.0: - resolution: {integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==} + qs@6.16.1: + resolution: {integrity: sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==} engines: {node: '>=0.6'} queue-microtask@1.2.3: @@ -4570,8 +4571,8 @@ packages: resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==} engines: {node: '>=8.0'} - traverse@0.6.11: - resolution: {integrity: sha512-vxXDZg8/+p3gblxB6BhhG5yWVn1kGRlaL8O78UDXc3wRnPizB5g83dcvWV1jpDMIPnjZjOFuxlMmE82XJ4407w==} + traverse@0.6.14: + resolution: {integrity: sha512-CYRAVGfnSSe+4Wlof62oUH6y9fGwo0NNS84hMq76MTZtwXQU7Oqna9SgWfrCGj5JPUtHQudnIEt1BP7PInPkPQ==} engines: {node: '>= 0.4'} triple-beam@1.4.1: @@ -4673,6 +4674,10 @@ packages: resolution: {integrity: sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ==} engines: {node: '>= 0.4'} + typed-array-byte-offset@1.0.5: + resolution: {integrity: sha512-0FHJvLPqZ7KJzp17O13jfsAjsqazgrxBu2zEK95PmUz8lv2+GjRuxUInCr2Rk9Dms3ihN21zJ929ZO43yJ95QQ==} + engines: {node: '>= 0.4'} + typed-array-length@1.0.8: resolution: {integrity: sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g==} engines: {node: '>= 0.4'} @@ -4680,8 +4685,8 @@ packages: typedarray-to-buffer@3.1.5: resolution: {integrity: sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==} - typedarray.prototype.slice@1.0.5: - resolution: {integrity: sha512-q7QNVDGTdl702bVFiI5eY4l/HkgCM6at9KhcFbgUAzezHFbOVy4+0O/lCjsABEQwbZPravVfBIiBVGo89yzHFg==} + typedarray.prototype.slice@1.0.6: + resolution: {integrity: sha512-r+7YvGfM5TkTiDQ5EqWi/Z4L4KP3jUI+YCmTtWg1tmTHUw6xladLJqzR2heMaHBIM0TTFLZmn/EkIaEHYs/bIA==} engines: {node: '>= 0.4'} typedarray@0.0.6: @@ -4786,6 +4791,10 @@ packages: resolution: {integrity: sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==} engines: {node: '>= 0.4'} + which-typed-array@1.1.24: + resolution: {integrity: sha512-wk4Mf4pR5mRP7eYuuTBCIQ9d0ud2Fv2jRLQpfgnRjbOxAFHmjKFValgTpitVKzJJS8ajnYQV2Du1SZ8j6b/EUQ==} + engines: {node: '>= 0.4'} + which@2.0.2: resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==} engines: {node: '>= 8'} @@ -5484,7 +5493,7 @@ snapshots: recheck: 4.5.0 rxjs: 6.6.7 short-uuid: 6.0.3 - traverse: 0.6.11 + traverse: 0.6.14 tty-table: 4.2.3 unique-string: 2.0.0 uuid: 14.0.2 @@ -5522,7 +5531,7 @@ snapshots: recheck: 4.5.0 rxjs: 6.6.7 short-uuid: 6.0.3 - traverse: 0.6.11 + traverse: 0.6.14 tslib: 2.8.1 tty-table: 4.2.3 unique-string: 2.0.0 @@ -5551,7 +5560,7 @@ snapshots: axios: 1.20.0(debug@4.4.3) axios-mock-adapter: 2.1.0(axios@1.20.0(debug@4.4.3)) lodash: 4.18.1 - qs: 6.16.0 + qs: 6.16.1 tslib: 2.8.1 transitivePeerDependencies: - debug @@ -5577,7 +5586,7 @@ snapshots: husky: 9.1.7 lodash: 4.18.1 otplib: 12.0.1 - qs: 6.16.0 + qs: 6.16.1 stream-browserify: 3.0.0 transitivePeerDependencies: - debug @@ -7640,7 +7649,7 @@ snapshots: typed-array-byte-offset: 1.0.4 typed-array-length: 1.0.8 unbox-primitive: 1.1.0 - which-typed-array: 1.1.22 + which-typed-array: 1.1.24 es-define-property@1.0.1: {} @@ -8913,7 +8922,7 @@ snapshots: is-typed-array@1.1.15: dependencies: - which-typed-array: 1.1.22 + which-typed-array: 1.1.24 is-typedarray@1.0.0: {} @@ -9756,7 +9765,7 @@ snapshots: punycode@2.3.1: {} - qs@6.16.0: + qs@6.16.1: dependencies: es-define-property: 1.0.1 side-channel: 1.1.1 @@ -10325,11 +10334,13 @@ snapshots: dependencies: is-number: 7.0.0 - traverse@0.6.11: + traverse@0.6.14: dependencies: + define-data-property: 1.1.4 + es-to-primitive: 1.3.4 gopd: 1.2.0 - typedarray.prototype.slice: 1.0.5 - which-typed-array: 1.1.22 + typedarray.prototype.slice: 1.0.6 + which-typed-array: 1.1.24 triple-beam@1.4.1: {} @@ -10469,6 +10480,15 @@ snapshots: is-typed-array: 1.1.15 reflect.getprototypeof: 1.0.10 + typed-array-byte-offset@1.0.5: + dependencies: + available-typed-arrays: 1.0.7 + call-bind: 1.0.9 + for-each: 0.3.5 + gopd: 1.2.0 + is-typed-array: 1.1.15 + reflect.getprototypeof: 1.0.10 + typed-array-length@1.0.8: dependencies: call-bind: 1.0.9 @@ -10482,7 +10502,7 @@ snapshots: dependencies: is-typedarray: 1.0.0 - typedarray.prototype.slice@1.0.5: + typedarray.prototype.slice@1.0.6: dependencies: call-bind: 1.0.9 define-properties: 1.2.1 @@ -10491,7 +10511,7 @@ snapshots: get-proto: 1.0.1 math-intrinsics: 1.1.0 typed-array-buffer: 1.0.3 - typed-array-byte-offset: 1.0.4 + typed-array-byte-offset: 1.0.5 typedarray@0.0.6: {} @@ -10632,7 +10652,7 @@ snapshots: isarray: 2.0.5 which-boxed-primitive: 1.1.1 which-collection: 1.0.2 - which-typed-array: 1.1.22 + which-typed-array: 1.1.24 which-collection@1.0.2: dependencies: @@ -10653,6 +10673,16 @@ snapshots: gopd: 1.2.0 has-tostringtag: 1.0.2 + which-typed-array@1.1.24: + dependencies: + available-typed-arrays: 1.0.7 + call-bind: 1.0.9 + call-bound: 1.0.4 + for-each: 0.3.5 + get-proto: 1.0.1 + gopd: 1.2.0 + has-tostringtag: 1.0.2 + which@2.0.2: dependencies: isexe: 2.0.0 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 97571023df..2d5676d743 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -7,4 +7,5 @@ overrides: brace-expansion: 5.0.12 js-yaml: 5.4.3 fast-uri: 4.2.1 - qs: 6.16.0 \ No newline at end of file + qs: 6.16.1 + traverse: 0.6.14 \ No newline at end of file