diff --git a/.claude/skills/bump-coana/SKILL.md b/.claude/skills/bump-coana/SKILL.md index 3a0c898fa..26d0f54b2 100644 --- a/.claude/skills/bump-coana/SKILL.md +++ b/.claude/skills/bump-coana/SKILL.md @@ -1,13 +1,13 @@ --- name: bump-coana -description: Bump @coana-tech/cli to a new version, update changelog, and create a PR. Use when user wants to upgrade Coana CLI, bump Coana version, or says "bump coana" with a version number. +description: Bump the pinned Coana CLI to a new version, update changelog, and create a PR. Use when user wants to upgrade Coana CLI, bump Coana version, or says "bump coana" with a version number. allowed-tools: Read, Edit, Write, Bash, Glob user-invocable: true --- # Bump Coana CLI Version -Automates the process of upgrading the @coana-tech/cli dependency to a new version, including package.json updates, changelog entry, and PR creation. +Automates the process of upgrading the pinned Coana CLI to a new version, including the pin, changelog entry, and PR creation. ## Input @@ -32,14 +32,13 @@ if [[ ! "$COANA_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then fi ``` -### Step 2: Update package.json +### Step 2: Update the pin -1. Read `package.json` in the repository root. -2. Find the current `@coana-tech/cli` version in `devDependencies` and note it as `CURRENT_VERSION`. -3. Update `@coana-tech/cli` to the new version. -4. Write the updated `package.json`. +1. Read `src/constants.mts`. +2. Find the line `const COANA_CLI_VERSION = ''` and note the version as `CURRENT_VERSION`. +3. Replace the version on that line with the new one. -🚨 **Do NOT touch the top-level `version` field.** The release workflow owns it: +🚨 **Do NOT touch `package.json`'s top-level `version` field.** The release workflow owns it: between releases the manifest holds the last released version, and `scripts/release/bump.mts` derives and writes the next one in-run. Hand-writing it invents a version that never releases and breaks the next release — a manifest @@ -47,7 +46,7 @@ already sitting on the version being released has no line for the bump to advance. **Values to extract**: -- `CURRENT_VERSION`: The old @coana-tech/cli version (for PR body) +- `CURRENT_VERSION`: The old Coana CLI version (for PR body) ### Step 3: Update CHANGELOG.md @@ -87,28 +86,20 @@ if it finds one; hand-editing is what puts one there.) - Updated the Coana CLI to v `COANA_VERSION`. ``` -### Step 4: Update Lock File - -```bash -pnpm install -``` - -This updates `pnpm-lock.yaml` with the new dependency version. - -### Step 5: Create Branch and Commit +### Step 4: Create Branch and Commit ```bash # Create branch git checkout -b "coana-$COANA_VERSION" # Stage changes -git add package.json CHANGELOG.md pnpm-lock.yaml +git add src/constants.mts CHANGELOG.md # Commit (skip pre-commit hooks with -n) git commit -n -m "upgrading coana to version $COANA_VERSION" ``` -### Step 6: Push and Create PR +### Step 5: Push and Create PR ```bash # Push branch @@ -117,7 +108,7 @@ git push -u origin "coana-$COANA_VERSION" # Create PR targeting v1.x branch gh pr create --base v1.x --title "upgrading coana to version $COANA_VERSION" --body "$(cat <<'EOF' ## Summary -- Upgrades @coana-tech/cli from CURRENT_VERSION to COANA_VERSION +- Upgrades the Coana CLI from CURRENT_VERSION to COANA_VERSION ## Coana Changelog For details on what's included in this Coana release, see the [Coana Changelogs](https://docs.coana.tech/changelogs). @@ -131,8 +122,8 @@ Replace `CURRENT_VERSION` and `COANA_VERSION` with actual values. - Branch: `coana-` pushed to origin - PR: Created targeting `v1.x` branch -- Files modified: `package.json` (the `@coana-tech/cli` devDependency only, never - the top-level `version`), `CHANGELOG.md` (under `## [Unreleased]`), `pnpm-lock.yaml` +- Files modified: `src/constants.mts` (the `COANA_CLI_VERSION` line only), + `CHANGELOG.md` (under `## [Unreleased]`) Report the PR URL to the user when complete. @@ -140,7 +131,6 @@ Report the PR URL to the user when complete. - **No version provided**: Ask user for the version number - **Invalid version format**: Report error with expected format -- **pnpm install fails**: Check network connectivity and npm registry access - **PR creation fails**: Verify `gh` CLI is authenticated ## Important Notes diff --git a/.config/rollup.base.config.mjs b/.config/rollup.base.config.mjs index f48a4f139..e551e2425 100644 --- a/.config/rollup.base.config.mjs +++ b/.config/rollup.base.config.mjs @@ -23,7 +23,6 @@ import { } from '../scripts/utils/packages.js' const { - INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION, INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION, INLINED_SOCKET_CLI_HOMEPAGE, INLINED_SOCKET_CLI_LEGACY_BUILD, @@ -192,13 +191,6 @@ export default function baseConfig(extendConfig = {}) { delimiters: ['(? - JSON.stringify( - getRootPkgJsonSync().devDependencies['@coana-tech/cli'], - ), - ], [ INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION, () => diff --git a/package.json b/package.json index bb5ea4324..dca2842d9 100644 --- a/package.json +++ b/package.json @@ -105,7 +105,6 @@ "@babel/preset-typescript": "7.27.1", "@babel/runtime": "7.28.4", "@biomejs/biome": "2.2.4", - "@coana-tech/cli": "15.12.9", "@cyclonedx/cdxgen": "12.1.2", "@dotenvx/dotenvx": "1.49.0", "@eslint/compat": "1.3.2", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 932c9f96a..ea16b3107 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -137,9 +137,6 @@ importers: '@biomejs/biome': specifier: 2.2.4 version: 2.2.4 - '@coana-tech/cli': - specifier: 15.12.9 - version: 15.12.9 '@cyclonedx/cdxgen': specifier: 12.1.2 version: 12.1.2 @@ -827,10 +824,6 @@ packages: resolution: {integrity: sha512-hAs5PPKPCQ3/Nha+1fo4A4/gL85fIfxZwHPehsjCJ+BhQH2/yw6/xReuaPA/RfNQr6iz1PcD7BZcE3ctyyl3EA==} cpu: [x64] - '@coana-tech/cli@15.12.9': - resolution: {integrity: sha512-WSoODot7QBwa31bXL91vy7KdRIrmrmOAQIl/IFNnAECFeSilOx6wJwT3yEh/6wcIHb9WFvveTpUq3VBaa2uTig==} - hasBin: true - '@colors/colors@1.5.0': resolution: {integrity: sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==} engines: {node: '>=0.1.90'} @@ -5702,8 +5695,6 @@ snapshots: '@cdxgen/cdxgen-plugins-bin@2.0.2': optional: true - '@coana-tech/cli@15.12.9': {} - '@colors/colors@1.5.0': optional: true diff --git a/scripts/constants.js b/scripts/constants.js index 738df74e9..c45abc767 100644 --- a/scripts/constants.js +++ b/scripts/constants.js @@ -13,8 +13,6 @@ const { } = registryConstants const CONSTANTS = 'constants' -const INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION = - 'INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION' const INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION = 'INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION' const INLINED_SOCKET_CLI_HOMEPAGE = 'INLINED_SOCKET_CLI_HOMEPAGE' @@ -99,7 +97,6 @@ const constants = createConstantsObject( ...registryConstantsAttribs.props, CONSTANTS, ENV: undefined, - INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION, INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION, INLINED_SOCKET_CLI_HOMEPAGE, INLINED_SOCKET_CLI_LEGACY_BUILD, diff --git a/src/commands/fix/cmd-fix.mts b/src/commands/fix/cmd-fix.mts index 6ff0a6f7e..8dea9da2f 100644 --- a/src/commands/fix/cmd-fix.mts +++ b/src/commands/fix/cmd-fix.mts @@ -12,6 +12,7 @@ import { logger } from '@socketsecurity/registry/lib/logger' import { handleFix } from './handle-fix.mts' import constants, { + COANA_CLI_VERSION, ERROR_UNABLE_RESOLVE_ORG, FLAG_ID, } from '../../constants.mts' @@ -73,7 +74,7 @@ const generalFlags: MeowFlags = { }, fixVersion: { type: 'string', - description: `Override the version of @coana-tech/cli used for fix analysis. Default: ${constants.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`, + description: `Override the version of @coana-tech/cli used for fix analysis. Default: ${COANA_CLI_VERSION}.`, }, applyFixes: { aliases: ['onlyCompute'], diff --git a/src/commands/scan/perform-reachability-analysis.mts b/src/commands/scan/perform-reachability-analysis.mts index 95d8c3b38..f0afb2a50 100644 --- a/src/commands/scan/perform-reachability-analysis.mts +++ b/src/commands/scan/perform-reachability-analysis.mts @@ -6,7 +6,7 @@ import path from 'node:path' import { logger } from '@socketsecurity/registry/lib/logger' import { isOmittedReachValue } from './reachability-units.mts' -import constants from '../../constants.mts' +import constants, { COANA_CLI_VERSION } from '../../constants.mts' import { handleApiCall } from '../../utils/api.mts' import { extractTier1ReachabilityScanId, @@ -303,9 +303,7 @@ export async function performReachabilityAnalysis( } if (!coanaResult.ok) { - const coanaVersion = - reachabilityOptions.reachVersion || - constants.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION + const coanaVersion = reachabilityOptions.reachVersion || COANA_CLI_VERSION logger.error( `Coana reachability analysis failed. Version: ${coanaVersion}, target: ${analysisTarget}, cwd: ${cwd}`, ) diff --git a/src/commands/scan/perform-reachability-analysis.test.mts b/src/commands/scan/perform-reachability-analysis.test.mts index d8dfd220d..0b18502f1 100644 --- a/src/commands/scan/perform-reachability-analysis.test.mts +++ b/src/commands/scan/perform-reachability-analysis.test.mts @@ -76,9 +76,9 @@ vi.mock('../../utils/terminal-link.mts', () => ({ })) vi.mock('../../constants.mts', () => ({ + COANA_CLI_VERSION: 'test', default: { DOT_SOCKET_DOT_FACTS_JSON: '.socket.facts.json', - ENV: { INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: 'test' }, HTTP_STATUS_UNAUTHORIZED: 401, SOCKET_DEFAULT_BRANCH: 'socket-default-branch', SOCKET_DEFAULT_REPOSITORY: 'socket-default-repository', diff --git a/src/commands/scan/reachability-flags.mts b/src/commands/scan/reachability-flags.mts index ffe3ca2a0..2b598e1ac 100644 --- a/src/commands/scan/reachability-flags.mts +++ b/src/commands/scan/reachability-flags.mts @@ -1,4 +1,4 @@ -import constants from '../../constants.mts' +import { COANA_CLI_VERSION } from '../../constants.mts' import { getReachabilityEcosystemChoices } from '../../utils/ecosystem.mts' import type { MeowFlags } from '../../flags.mts' @@ -12,7 +12,7 @@ export const DYNAMIC_SBOM_INFERENCE_DESCRIPTION = export const reachabilityFlags: MeowFlags = { reachVersion: { type: 'string', - description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`, + description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${COANA_CLI_VERSION}.`, }, reachAnalysisMemoryLimit: { type: 'string', diff --git a/src/constants.mts b/src/constants.mts index 553de604c..d11ecc976 100644 --- a/src/constants.mts +++ b/src/constants.mts @@ -137,7 +137,6 @@ export type ENV = Remap< GITHUB_REPOSITORY: string GITHUB_SERVER_URL: string GITHUB_TOKEN: string - INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: string INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: string INLINED_SOCKET_CLI_HOMEPAGE: string INLINED_SOCKET_CLI_LEGACY_BUILD: string @@ -193,6 +192,9 @@ const ALERT_TYPE_CVE = 'cve' const ALERT_TYPE_MEDIUM_CVE = 'mediumCVE' const ALERT_TYPE_MILD_CVE = 'mildCVE' const API_V0_URL = 'https://api.socket.dev/v0/' +// The Coana CLI version Socket CLI runs by default. Coana's release workflow +// rewrites this line in its bump PRs. +const COANA_CLI_VERSION = '15.12.9' const CONFIG_KEY_API_BASE_URL = 'apiBaseUrl' const CONFIG_KEY_API_PROXY = 'apiProxy' const CONFIG_KEY_API_TOKEN = 'apiToken' @@ -493,11 +495,6 @@ const LAZY_ENV = () => { // workflow. // https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#about-the-github_token-secret GITHUB_TOKEN, - // Comp-time inlined @coana-tech/cli package version. - // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION']". - INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: envAsString( - process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION'], - ), // Comp-time inlined @cyclonedx/cdxgen package version. // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION']". INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: envAsString( @@ -1145,6 +1142,7 @@ export { ALERT_TYPE_MEDIUM_CVE, ALERT_TYPE_MILD_CVE, API_V0_URL, + COANA_CLI_VERSION, CONFIG_KEY_API_BASE_URL, CONFIG_KEY_API_PROXY, CONFIG_KEY_API_TOKEN, diff --git a/src/utils/dlx.mts b/src/utils/dlx.mts index 639bad848..90ad13f40 100644 --- a/src/utils/dlx.mts +++ b/src/utils/dlx.mts @@ -29,6 +29,7 @@ import { spawn } from '@socketsecurity/registry/lib/spawn' import { getDefaultOrgSlug } from '../commands/ci/fetch-default-org-slug.mts' import constants, { + COANA_CLI_VERSION, FLAG_QUIET, FLAG_SILENT, NPM, @@ -470,8 +471,7 @@ export async function spawnCoanaDlx( ...spawnEnv, } - const resolvedVersion = - coanaVersion || constants.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION + const resolvedVersion = coanaVersion || COANA_CLI_VERSION // `shadowNpmBase` (the dlx launcher) configures the child's stdio from its // `options` arg, NOT from the registry-spawn `extra` arg — the latter only diff --git a/test/utils.mts b/test/utils.mts index 8c814c653..d8a961119 100644 --- a/test/utils.mts +++ b/test/utils.mts @@ -1,4 +1,3 @@ -import { readFileSync } from 'node:fs' import path from 'node:path' import { fileURLToPath } from 'node:url' @@ -7,19 +6,15 @@ import { it } from 'vitest' import { SpawnOptions, spawn } from '@socketsecurity/registry/lib/spawn' import { stripAnsi } from '@socketsecurity/registry/lib/strings' -import constants, { FLAG_HELP, FLAG_VERSION } from '../src/constants.mts' +import constants, { + COANA_CLI_VERSION, + FLAG_HELP, + FLAG_VERSION, +} from '../src/constants.mts' const __filename = fileURLToPath(import.meta.url) const __dirname = path.dirname(__filename) -// Read Coana version from package.json for test normalization. -// This is needed because constants.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION -// is a compile-time value that's empty in the test environment. -const rootPackageJson = JSON.parse( - readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'), -) as { devDependencies: Record } -const coanaVersion = rootPackageJson.devDependencies['@coana-tech/cli'] ?? '' - // The asciiUnsafeRegexp match characters that are: // * Control characters in the Unicode range: // - \u0000 to \u0007 (e.g., NUL, BEL) @@ -57,10 +52,7 @@ function stripZeroWidthSpace(str: string): string { // Normalize Coana version to a placeholder for stable snapshots. function normalizeCoanaVersion(str: string): string { - if (!coanaVersion) { - return str - } - return str.replaceAll(coanaVersion, '') + return str.replaceAll(COANA_CLI_VERSION, '') } // Normalize CLI banner output for stable snapshots.