Sanity tests: dynamic stack setup, report context, fixes, security cleanup

.eslintrc.js

@@ -20,5 +20,14 @@ module.exports = {
     'promise'
   ],
   rules: {
-  }
+  },
+  overrides: [
+    {
+      files: ['test/**/*.js'],
+      rules: {
+        'no-unused-expressions': 'off',
+        'no-useless-escape': 'off'
+      }
+    }
+  ]
 }

.github/workflows/check-version-bump.yml

@@ -1,11 +1,10 @@
-# Ensures package.json and CHANGELOG.md are bumped compared to the latest tag when relevant files change.
+# Catches when developers forget to add a version bump for their changes.
+# Code changes (lib/, webpack/, dist/) require package.json + CHANGELOG.md.
+# Skips for: test-only, docs, .github (workflows/config).
 name: Check Version Bump
 
 on:
   pull_request:
-    paths:
-      - 'package.json'
-      - 'CHANGELOG.md'
 
 jobs:
   version-bump:
@@ -17,12 +16,44 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Detect changed files and version bump
+        id: detect
+        run: |
+          if git rev-parse HEAD^2 >/dev/null 2>&1; then
+            FILES=$(git diff --name-only HEAD^1 HEAD^2)
+          else
+            FILES=$(git diff --name-only HEAD~1 HEAD)
+          fi
+          VERSION_FILES_CHANGED=false
+          echo "$FILES" | grep -qx 'package.json' && VERSION_FILES_CHANGED=true
+          echo "$FILES" | grep -qx 'CHANGELOG.md' && VERSION_FILES_CHANGED=true
+          echo "version_files_changed=$VERSION_FILES_CHANGED" >> $GITHUB_OUTPUT
+          # Only lib/, webpack/, dist/, package.json count as release-affecting; .github/ and test/ do not
+          CODE_CHANGED=false
+          echo "$FILES" | grep -qE '^lib/|^webpack/|^dist/' && CODE_CHANGED=true
+          echo "$FILES" | grep -qx 'package.json' && CODE_CHANGED=true
+          echo "code_changed=$CODE_CHANGED" >> $GITHUB_OUTPUT
+
+      - name: Skip when only test/docs/.github changed
+        if: steps.detect.outputs.code_changed != 'true'
+        run: |
+          echo "No release-affecting files changed (e.g. only test/docs/.github). Skipping version-bump check."
+          exit 0
+
+      - name: Fail when version bump was missed
+        if: steps.detect.outputs.code_changed == 'true' && steps.detect.outputs.version_files_changed != 'true'
+        run: |
+          echo "::error::This PR has code changes but no version bump. Please bump the version in package.json and add an entry in CHANGELOG.md."
+          exit 1
+
       - name: Setup Node
+        if: steps.detect.outputs.code_changed == 'true' && steps.detect.outputs.version_files_changed == 'true'
         uses: actions/setup-node@v4
         with:
           node-version: '22.x'
 
       - name: Check version bump
+        if: steps.detect.outputs.code_changed == 'true' && steps.detect.outputs.version_files_changed == 'true'
         run: |
           set -e
           PKG_VERSION=$(node -p "require('./package.json').version.replace(/^v/, '')")

.github/workflows/sca-scan.yml

@@ -13,3 +13,6 @@ jobs:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
           args: --all-projects --fail-on=all
+          json: true
+        continue-on-error: true
+      - uses: contentstack/sca-policy@main

.gitignore

@@ -41,6 +41,8 @@ coverage/
 test/utility/dataFiles/
 test/sanity-check/utility/dataFiles/
 report.json
+sanity-check-backup/
+.vscode/
 
 # TypeScript v1 declaration files
 typings/
@@ -62,13 +64,15 @@ tsconfig.json
 
 # dotenv environment variables file
 .env
+test-curls.txt
 
 # next.js build output
 .next
 .dccache
 dist
 jsdocs
 .early.coverage
+docs/
 # Snyk Security Extension - AI Rules (auto-generated)
 .cursor/rules/snyk_rules.mdc
-.vscode/settings.json
+.vscode/settings.json

.talismanrc

@@ -5,39 +5,119 @@ fileignoreconfig:
     checksum: 25185e3400a12e10a043dc47502d8f30b7e1c4f2b6b4d3b8b55cdc19850c48bf
   - filename: lib/stack/index.js
     checksum: 6aab5edf85efb17951418b4dc4402889cd24c8d786c671185074aeb4d50f0242
-  - filename: test/sanity-check/api/stack-test.js
-    checksum: 198d5cf7ead33b079249dc3ecdee61a9c57453e93f1073ed0341400983e5aa53
   - filename: .github/workflows/secrets-scan.yml
     ignore_detectors:
       - filecontent
   - filename: package-lock.json
-    checksum: 4a58eb4ee1f54d68387bd005fb76e83a02461441c647d94017743d3442c0f476
+    checksum: ff309d2a910e885853fb25faa6aa3d2bd2cfc2d316c84a0e984bbda79c596ae9
   - filename: test/unit/ContentstackClient-test.js
     checksum: 5d8519b5b93c715e911a62b4033614cc4fb3596eabf31c7216ecb4cc08604a73
   - filename: .husky/pre-commit
     checksum: 52a664f536cf5d1be0bea19cb6031ca6e8107b45b6314fe7d47b7fad7d800632
-  - filename: test/sanity-check/api/user-test.js
-    checksum: 6bb8251aad584e09f4d963a913bd0007e5f6e089357a44c3fb1529e3fda5509d
   - filename: lib/stack/asset/index.js
     checksum: b3358310e9cb2fb493d70890b7219db71e2202360be764465d505ef71907eefe
-  - filename: test/sanity-check/api/previewToken-test.js
-    checksum: 9a42e079b7c71f76932896a0d2390d86ac626678ab20d36821dcf962820a886c
   - filename: lib/stack/deliveryToken/index.js
     checksum: 51ae00f07f4cc75c1cd832b311c2e2482f04a8467a0139da6013ceb88fbdda2f
   - filename: lib/stack/deliveryToken/previewToken/index.js
     checksum: b506f33bffdd20dfc701f964370707f5d7b28a2c05c70665f0edb7b3c53c165b
   - filename: examples/robust-error-handling.js
     checksum: e8a32ffbbbdba2a15f3d327273f0a5b4eb33cf84cd346562596ab697125bbbc6
-  - filename: test/sanity-check/api/bulkOperation-test.js
-    checksum: f40a14c84ab9a194aaf830ca68e14afde2ef83496a07d4a6393d7e0bed15fb0e
   - filename: test/unit/ContentstackHTTPClient-test.js
     checksum: 4043efd843e24da9afd0272c55ef4b0432e3374b2ca12b913f1a6654df3f62be
   - filename: test/unit/contentstack-test.js
     checksum: 2597efae3c1ab8cc173d5bf205f1c76932211f8e0eb2a16444e055d83481976c
+  # Sanity check test files - use process.env for all secrets (no hardcoded values)
+  - filename: test/sanity-check/api/environment-test.js
+    checksum: 8fe733679cd4d116509a42c3d4daaf431220732acd86869dbe49236f42990b2a
+  - filename: test/sanity-check/env.example.txt
+    checksum: 3339944cd20d6d72f70a92e54af3de96736250b4b7117a29577575f9b52ed611
+  - filename: test/sanity-check/api/token-test.js
+    checksum: 951d45bde20704529b38f628ba839a3c4f7a81ffe9d0a0593ff75b42632772db
+  - filename: test/sanity-check/api/webhook-test.js
+    checksum: 4928ae0eb72a47bced3b1a1eb18bc436141280bd41b74c54f03c1164911fd776
+  - filename: test/sanity-check/mock/configurations.js
+    checksum: 1506d750a9344843b3f8370aa322a814cfc0b3ac60fc94e55b691d2246335b5e
+  - filename: test/sanity-check/api/ungroupedVariants-test.js
+    checksum: 16a1460702efd0f9146687a2a1750768f55798bb31e0259f90a6810bcc4ab60a
+  - filename: test/sanity-check/mock/global-fields.js
+    checksum: fb89a4a5028066689de774ca2f990c25c8a3acc46c0c6b97fee410f491853cc1
+  - filename: test/sanity-check/utility/ContentstackClient.js
+    checksum: 96ff5412eed26f5a27621dd307c9463f793a3e8dd977fe1e5453da78507ac2f6
+  - filename: test/sanity-check/api/variantGroup-test.js
+    checksum: 3fc26eca704bc9ce4650056c81be45f3586d3c947a18dfec58fee4447de56360
+  - filename: test/sanity-check/api/workflow-test.js
+    checksum: 032a2b92eb0a7cc72976b597d53aee0beb04f965e36c056b3c7e3c60ad187108
+  - filename: test/sanity-check/api/variants-test.js
+    checksum: 6e1c1b0bada5799bf38443db537673f586c0c3dfd7800a8aec9d5a7fb966c58c
+  - filename: test/sanity-check/mock/content-types/index.js
+    checksum: ff47f74037e22f791e2d7c6afbaccf7857b26b51dd2e2361b5b4b70d36057b7f
+  - filename: test/sanity-check/sanity.js
+    checksum: 523725a12c93abdc1b89a1e7ef38021184e7d710f8719290923f835f8d615693
+  - filename: test/sanity-check/api/user-test.js
+    checksum: 01a2224a02f6a0e1cd5fb10e289a349a32a5cf3eb39b9e06787031fde5aa8aca
+  - filename: test/sanity-check/api/locale-test.js
+    checksum: 91f8db01791a57c18e925c5896cc1960cdb951e6787fff886c008e17c25d5dea
+  - filename: test/sanity-check/api/asset-test.js
+    checksum: 97f19206080fcd5042e3eaa25429e92eac697530de8825cb66533164b73d9164
+  - filename: test/sanity-check/api/label-test.js
+    checksum: bf11c1ec13e66d9251380ac8fe028d51a809ffa174afa9518dfb1f599372381d
+  - filename: test/sanity-check/mock/webhook-import.json
+    checksum: 3fb331e842d640a29663fcbd4feee8284f46600869b39ac45c1fedaa7cde4969
+  - filename: test/sanity-check/api/taxonomy-test.js
+    checksum: accd5b96fff87b6a9aaec7ca053e5546402b5d084417fdc70f7f2bc7a2b8a353
+  - filename: test/sanity-check/api/release-test.js
+    checksum: 863c0ef7d65cfd33f245deb636d537c131ad29233ebafd88c223e555c4f80b82
+  - filename: test/sanity-check/utility/testHelpers.js
+    checksum: 204d11d739947259a3303fbe1d92c296dd82975fa8dff67a438853a3828c27a3
+  - filename: test/sanity-check/api/auditlog-test.js
+    checksum: 9d325aaf73760359dd4194c52ad01203ed7f078230e45282e84aab2b53613095
+  - filename: test/sanity-check/api/team-test.js
+    checksum: e4b7a6824b89e634981651ad29161901377f23bb37d3653a389ac3dc4e7653c7
+  - filename: test/sanity-check/api/oauth-test.js
+    checksum: fd8a4fe7a644955ea6609813c655d8fca6bb3c7eeea4ae2c5ba99d30b1950172
+  - filename: test/sanity-check/api/branchAlias-test.js
+    checksum: 0b6cacee74d7636e84ce095198f0234d491b79ea20d3978a742a5495692bd61d
+  - filename: test/sanity-check/utility/testSetup.js
+    checksum: e906e6a93953826857fa701db7094330ef88e342e719f3446e17c823576c3377
+  - filename: test/sanity-check/api/branch-test.js
+    checksum: 49c8fd18c59d45e4335f766591711849722206bce34860efa8eced7172f44efa
+  - filename: test/sanity-check/api/stack-test.js
+    checksum: abcc3b1a7a6e52a553645bd7a7a38b287402604f6b61df51a69745cd2aa8a187
+  - filename: test/sanity-check/api/previewToken-test.js
+    checksum: 9efe3852336f1c5f961682ca21673514b2bd1334a040c5d56983074f41c6b8e0
+  - filename: test/sanity-check/api/role-test.js
+    checksum: cdfa2ae59443ed02f5463c0e84314a3d94c72f395694de883bc873cd6708cf87
+  - filename: test/sanity-check/api/terms-test.js
+    checksum: 8a54b4b6e27f03a461a7b6c12cec2b9fd4b931ccb6e41959a6cfedb3a2482ee8
+  - filename: test/sanity-check/utility/requestLogger.js
+    checksum: 2b5282cfff084765312e1543bad3f890bc5b47ef27456f0a4c2e50d098292e32
+  - filename: test/sanity-check/api/contentType-test.js
+    checksum: 4d5178998f9f3c27550c5bd21540e254e08f79616e8615e7256ba2175cb4c8e1
+  - filename: test/sanity-check/api/bulkOperation-test.js
+    checksum: 9b67a8691cf7aeea448dacf2dbfb131d3d00b27be09dfa18c30684103fae2ba7
+  - filename: test/sanity-check/api/entry-test.js
+    checksum: 9dc16b404a98ff9fa2c164fad0182b291b9c338dd58558dc5ef8dd75cf18bc1f
+  - filename: test/sanity-check/api/entryVariants-test.js
+    checksum: 2089e9134dece33179b88747c6e82377f1fb4eb74583281df05dd0816a907782
+  - filename: test/sanity-check/api/extension-test.js
+    checksum: 5083af9c4009cc969f7949ce97f97ab2e5b5f40366ecfdd402f491a6246c5e6f
+  - filename: test/sanity-check/api/globalfield-test.js
+    checksum: 1ba486167f2485853d9574322c233d28fc566e02db44bb9831b70fb9afaf7631
+  - filename: test/sanity-check/mock/index.js
+    checksum: 6c0d8f6e7c85cd2fa5f0a20e8a49e94df0dde1b2c1d7e9c39e8c9c6c8b8d5e2f1
   - filename: test/unit/concurrency-Queue-test.js
-    checksum: 186438f9eb9ba4e7fd7f335dbea2afbae9ae969b7ae3ab1b517ec7a1633d255e
+    checksum: fd5c327f4fa1b334fdb1a2d903ac0213752e7829f31f19667215aa186c3efbbf
+  # From merge / Talisman allowlist (no secrets - env vars, test patterns, lockfile hashes)
+  - filename: lib/core/pkceStorage.js
+    checksum: e060690c5ed348a6914df7ecc36de5b6b45f9a7c3a9c164c88bd2c7fad2bea08
+  - filename: lib/stack/bulkOperation/index.js
+    checksum: c2eb400c6617a860bd5c519ace03c06cde169135e1c258106cfc3263dfcfc4d1
+  - filename: test/unit/pkceStorage-test.js
+    checksum: 567f557d37e8119c22cd4c5c4014c16dd660c03be35f65e803fb340cfd4b2136
+  - filename: test/unit/oauthHandler-test.js
+    checksum: 95a968c0d72d5bbe9e1acb30ea17ab505938f6174e917d7a25dda8facfda5a49
+  - filename: types/stack/bulkOperation/index.d.ts
+    checksum: d6771a51a021977ce9f428afc289c80aee3d2fca211f4102cf782afded354ce7
+  - filename: .github/workflows/check-version-bump.yml
+    checksum: c4aff7ca93f40213f67534e5c490d7a633cbebb21bbebd4517ff9b9db37ab52a
 version: "1.0"
-
-
-
-

lib/organization/teams/index.js

@@ -38,7 +38,7 @@ export function Teams (http, data) {
      *          email: 'abc@abc.com'
      *      }
      *    ],
-     *    organizationRole: 'blt09e5dfced326aaea',
+     *    organizationRole: 'blt0000000000000000',
      *    stackRoleMapping: []
      *   }
      * client.organization('organizationUid').teams('teamUid').update(updateData)

package.json

@@ -30,7 +30,8 @@
     "buildnativescript": "webpack --config webpack/webpack.nativescript.js --mode production",
     "buildweb": "webpack --config webpack/webpack.web.js --mode production",
     "test": "npm run test:api && npm run test:unit",
-    "test:sanity-test": "BABEL_ENV=test nyc --reporter=html mocha --require @babel/register ./test/sanity-check/sanity.js -t 30000 --reporter mochawesome --require babel-polyfill --reporter-options reportDir=mochawesome-report,reportFilename=mochawesome.json",
+    "test:sanity-test": "BABEL_ENV=test nyc --reporter=html mocha --require @babel/register ./test/sanity-check/sanity.js -t 30000 --reporter mochawesome --require babel-polyfill --reporter-options reportDir=mochawesome-report,reportFilename=mochawesome.json,code=false",
+    "test:sanity-nocov": "BABEL_ENV=test mocha --require @babel/register ./test/sanity-check/sanity.js -t 30000 --reporter mochawesome --require babel-polyfill --reporter-options reportDir=mochawesome-report,reportFilename=mochawesome.json,code=false",
     "test:sanity": "npm run test:sanity-test || true",
     "test:sanity-report": "marge mochawesome-report/mochawesome.json -f sanity-report.html --inline && node sanity-report.mjs",
     "test:unit": "BABEL_ENV=test nyc --reporter=html --reporter=text mocha --require @babel/register ./test/unit/index.js -t 30000 --reporter mochawesome --require babel-polyfill",