fix(audit): scope asset publish details audit to the exported stack by naman-contentstack · Pull Request #326 · contentstack/cli-plugins

naman-contentstack · 2026-08-01T09:37:39Z

Problem

An Asset Management asset lives in a space and can be published into multiple stacks, so its exported publish_details carry one entry per target stack, each tagged with that stack's api_key. The assets audit validated every entry against the exported stack's locales and environments, so entries belonging to other stacks were reported as missing locale/environment, stripped in fix mode, and raised the "proceed with implementing the fix" confirmation that blocks unattended cm:stacks:import.

Fix

Resolve the exported stack's api key from stack/stack.json and validate only publish details for that stack, plus legacy entries that carry no api_key. Entries owned by other stacks are left untouched and never reported. This matches the scoping the import publish step already applies.
When the api key cannot be resolved, entries tagged with an api_key are left unchanged instead of being stripped, with a single warning naming the missing file.
Audit warnings now state whether the locale, the environment, or both are missing, instead of "locale X or environment Y".
Fix mode writes a chunk file (and asks for confirmation) only when that chunk actually changed.

🤖 Generated with Claude Code

An Asset Management asset is shared across stacks and carries publish details for every stack it was published into, each tagged with that stack's api_key. The assets audit validated all of them against this export's locales and environments, so publish details belonging to other stacks were reported as missing environments/locales, stripped in fix mode, and triggered the fix confirmation prompt during import. The audit now resolves the exported stack's api key from stack/stack.json and validates only publish details for that stack, plus legacy ones without an api_key. Entries that cannot be attributed are left untouched and warned about once. Warning messages now name whether the locale, the environment, or both are missing, and fix mode writes a chunk only when it actually changed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

snyk-io · 2026-08-01T09:37:51Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Surface the cross-stack skip count at info level: it is the one number that tells an operator the scoping engaged, and at debug it never appears in a normal run. Add the cases the fix was missing: - an export whose assets are published only into other stacks reports nothing and prompts for nothing, which is the empty assets result cm:stacks:import reads as "no fix needed" — the actual ticket symptom, previously only asserted by proxy. - an AM export with no stack/stack.json exercises the unresolved-api-key path for real instead of poking the private field, and asserts fix mode leaves tagged publish details on disk rather than stripping them. All four fail when the api_key scoping is disabled. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

This PR updates the contentstack-audit assets module to correctly scope Asset Management publish_details validation to the exported stack (based on stack/stack.json), preventing cross-stack publish records from being incorrectly reported/stripped and from triggering unattended import fix confirmations.

Changes:

Scope asset publish_details auditing/fixing to entries matching the exported stack’s api_key (plus legacy entries with no api_key), and warn once when the source stack key can’t be resolved.
Improve audit warnings to explicitly state whether the locale, environment, or both are missing.
In fix mode, only write chunk files (and therefore prompt) when the chunk content actually changes; add unit tests + fixtures covering cross-stack scenarios.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/contentstack-audit/src/modules/assets.ts	Scopes publish-details validation by source stack api key; improves warnings; avoids writing unchanged chunks.
packages/contentstack-audit/src/messages/index.ts	Adds more specific asset warning message templates and an “unknown source stack” warning.
packages/contentstack-audit/test/unit/modules/assets.test.ts	Adds unit coverage for cross-stack publish details behavior, fix-mode writes, and warning wording.
packages/contentstack-audit/test/unit/mock/am-contents/stack/stack.json	Adds mock exported stack metadata for resolving `api_key` in tests.
packages/contentstack-audit/test/unit/mock/am-contents/spaces/space_one/assets/chunk0-assets.json	Adds fixtures for mixed/legacy/cross-stack publish detail scenarios.
packages/contentstack-audit/test/unit/mock/am-contents/spaces/space_one/assets/assets.json	Adds chunk index fixture for space_one assets.
packages/contentstack-audit/test/unit/mock/am-contents/spaces/space_cross_only/assets/chunk0-assets.json	Adds fixtures for assets published only to other stacks.
packages/contentstack-audit/test/unit/mock/am-contents/spaces/space_cross_only/assets/assets.json	Adds chunk index fixture for space_cross_only assets.
packages/contentstack-audit/test/unit/mock/am-contents/spaces/space_clean/assets/chunk0-assets.json	Adds fixture for a “no fixes needed” chunk.
packages/contentstack-audit/test/unit/mock/am-contents/spaces/space_clean/assets/assets.json	Adds chunk index fixture for space_clean assets.
packages/contentstack-audit/test/unit/mock/am-contents/locales/master-locale.json	Adds locales fixture for AM mock export.
packages/contentstack-audit/test/unit/mock/am-contents/environments/environments.json	Adds environments fixture for AM mock export.
packages/contentstack-audit/test/unit/mock/am-contents-no-stack/spaces/space_one/assets/chunk0-assets.json	Adds fixtures for missing `stack/stack.json` behavior.
packages/contentstack-audit/test/unit/mock/am-contents-no-stack/spaces/space_one/assets/assets.json	Adds chunk index fixture for am-contents-no-stack.
packages/contentstack-audit/test/unit/mock/am-contents-no-stack/locales/master-locale.json	Adds locales fixture for am-contents-no-stack.
packages/contentstack-audit/test/unit/mock/am-contents-no-stack/environments/environments.json	Adds environments fixture for am-contents-no-stack.
.talismanrc	Adds new file ignore entries/checksums for Talisman.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+- filename: packages/contentstack-audit/src/modules/assets.ts
+  checksum: 3a2f3d338ab7d417ad24fbf3d8f25e51e3098a440857ebbc2156e72e208a284e
+- filename: packages/contentstack-audit/test/unit/modules/assets.test.ts
+  checksum: ee776f2d485c89ecf67aec9e61e37350e5754988bfca4574bbaef3c732f014b1


+      if (skippedCrossStack) {
+        log.info(
+          `Skipped ${skippedCrossStack} publish detail(s) of other stacks in ${spaceId ?? spacePath}`,
+          this.config.auditContext,
+        );
+      }


github-actions · 2026-08-04T12:53:24Z

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Without fixes	Threshold	Result
🔴 Critical Severity	0	10	✅ Passed
🟠 High Severity	0	25	✅ Passed
🟡 Medium Severity	1	500	✅ Passed
🔵 Low Severity	0	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	15 / 30 days	✅ Passed
🟠 High	0	30 / 120 days	✅ Passed
🟡 Medium	1	90 / 365 days	⚠️ Warning
🔵 Low	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

Critical without fixes: 0
High without fixes: 0
Medium without fixes: 1
Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

naman-contentstack requested a review from a team as a code owner August 1, 2026 09:37

naman-contentstack self-assigned this Aug 1, 2026

netrajpatel requested a lite review from Copilot August 4, 2026 11:49

Copilot started reviewing on behalf of netrajpatel August 4, 2026 11:50 View session

Copilot AI reviewed Aug 4, 2026

View reviewed changes

shafeeqd959 approved these changes Aug 4, 2026

View reviewed changes

Merge branch 'v2-dev' into fix/DX-9739

a65f5b7

Navigation Menu

Uh oh!

fix(audit): scope asset publish details audit to the exported stack - #326

fix(audit): scope asset publish details audit to the exported stack#326
naman-contentstack wants to merge 3 commits into
v2-devfrom
fix/DX-9739

naman-contentstack commented Aug 1, 2026

Uh oh!

snyk-io Bot commented Aug 1, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

naman-contentstack commented Aug 1, 2026

Problem

Fix

Uh oh!

snyk-io Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented Aug 4, 2026

🔒 Security Scan Results

⏱️ SLA Breach Summary

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

snyk-io Bot commented Aug 1, 2026 •

edited

Loading