fix(audit): scope asset publish details audit to the exported stack - #326
Conversation
An Asset Management asset is shared across stacks and carries publish details for every stack it was published into, each tagged with that stack's api_key. The assets audit validated all of them against this export's locales and environments, so publish details belonging to other stacks were reported as missing environments/locales, stripped in fix mode, and triggered the fix confirmation prompt during import. The audit now resolves the exported stack's api key from stack/stack.json and validates only publish details for that stack, plus legacy ones without an api_key. Entries that cannot be attributed are left untouched and warned about once. Warning messages now name whether the locale, the environment, or both are missing, and fix mode writes a chunk only when it actually changed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Surface the cross-stack skip count at info level: it is the one number that tells an operator the scoping engaged, and at debug it never appears in a normal run. Add the cases the fix was missing: - an export whose assets are published only into other stacks reports nothing and prompts for nothing, which is the empty assets result cm:stacks:import reads as "no fix needed" — the actual ticket symptom, previously only asserted by proxy. - an AM export with no stack/stack.json exercises the unresolved-api-key path for real instead of poking the private field, and asserts fix mode leaves tagged publish details on disk rather than stripping them. All four fail when the api_key scoping is disabled. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the contentstack-audit assets module to correctly scope Asset Management publish_details validation to the exported stack (based on stack/stack.json), preventing cross-stack publish records from being incorrectly reported/stripped and from triggering unattended import fix confirmations.
Changes:
- Scope asset
publish_detailsauditing/fixing to entries matching the exported stack’sapi_key(plus legacy entries with noapi_key), and warn once when the source stack key can’t be resolved. - Improve audit warnings to explicitly state whether the locale, environment, or both are missing.
- In fix mode, only write chunk files (and therefore prompt) when the chunk content actually changes; add unit tests + fixtures covering cross-stack scenarios.
Reviewed changes
Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/contentstack-audit/src/modules/assets.ts | Scopes publish-details validation by source stack api key; improves warnings; avoids writing unchanged chunks. |
| packages/contentstack-audit/src/messages/index.ts | Adds more specific asset warning message templates and an “unknown source stack” warning. |
| packages/contentstack-audit/test/unit/modules/assets.test.ts | Adds unit coverage for cross-stack publish details behavior, fix-mode writes, and warning wording. |
| packages/contentstack-audit/test/unit/mock/am-contents/stack/stack.json | Adds mock exported stack metadata for resolving api_key in tests. |
| packages/contentstack-audit/test/unit/mock/am-contents/spaces/space_one/assets/chunk0-assets.json | Adds fixtures for mixed/legacy/cross-stack publish detail scenarios. |
| packages/contentstack-audit/test/unit/mock/am-contents/spaces/space_one/assets/assets.json | Adds chunk index fixture for space_one assets. |
| packages/contentstack-audit/test/unit/mock/am-contents/spaces/space_cross_only/assets/chunk0-assets.json | Adds fixtures for assets published only to other stacks. |
| packages/contentstack-audit/test/unit/mock/am-contents/spaces/space_cross_only/assets/assets.json | Adds chunk index fixture for space_cross_only assets. |
| packages/contentstack-audit/test/unit/mock/am-contents/spaces/space_clean/assets/chunk0-assets.json | Adds fixture for a “no fixes needed” chunk. |
| packages/contentstack-audit/test/unit/mock/am-contents/spaces/space_clean/assets/assets.json | Adds chunk index fixture for space_clean assets. |
| packages/contentstack-audit/test/unit/mock/am-contents/locales/master-locale.json | Adds locales fixture for AM mock export. |
| packages/contentstack-audit/test/unit/mock/am-contents/environments/environments.json | Adds environments fixture for AM mock export. |
| packages/contentstack-audit/test/unit/mock/am-contents-no-stack/spaces/space_one/assets/chunk0-assets.json | Adds fixtures for missing stack/stack.json behavior. |
| packages/contentstack-audit/test/unit/mock/am-contents-no-stack/spaces/space_one/assets/assets.json | Adds chunk index fixture for am-contents-no-stack. |
| packages/contentstack-audit/test/unit/mock/am-contents-no-stack/locales/master-locale.json | Adds locales fixture for am-contents-no-stack. |
| packages/contentstack-audit/test/unit/mock/am-contents-no-stack/environments/environments.json | Adds environments fixture for am-contents-no-stack. |
| .talismanrc | Adds new file ignore entries/checksums for Talisman. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
… stack is unknown When the exported stack's api key cannot be resolved, every publish detail that carries an api_key is skipped, not only the ones belonging to other stacks, so the summary log now states which case it is. The counter is renamed to match. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
f2b7c30
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 16 out of 16 changed files in this pull request and generated no new comments.
Suppressed comments (1)
packages/contentstack-audit/src/modules/assets.ts:456
- With the new
if (this.fix && chunkChanged)guard, chunks may skip writing/confirmation when nothing changed, but the per-asset fix logging (auditFixMsg.ASSET_FIX) still runs unconditionally inside the asset loop. This can produce "Fixed publish details…" logs even when no publish_details were modified and no file was written, which is misleading for users and automation.
Consider logging fix messages only when an individual asset’s publish_details actually changed (e.g., track an assetChanged flag alongside chunkChanged), or move the fix log to a chunk-level message that’s emitted only when chunkChanged is true.
if (this.fix && chunkChanged) {
await this.writeFixContent(`${spacePath}/${indexer[fileIndex]}`, this.assets);
} else if (this.fix) {
log.debug(
`No changes for ${indexer[fileIndex]} - skipping write and fix confirmation`,
Problem
An Asset Management asset lives in a space and can be published into multiple stacks, so its exported
publish_detailscarry one entry per target stack, each tagged with that stack'sapi_key. The assets audit validated every entry against the exported stack's locales and environments, so entries belonging to other stacks were reported as missing locale/environment, stripped in fix mode, and raised the "proceed with implementing the fix" confirmation that blocks unattendedcm:stacks:import.Fix
stack/stack.jsonand validate only publish details for that stack, plus legacy entries that carry noapi_key. Entries owned by other stacks are left untouched and never reported. This matches the scoping the import publish step already applies.api_keyare left unchanged instead of being stripped, with a single warning naming the missing file.🤖 Generated with Claude Code