fix: exempt bundled dist artifacts from no-cloud self-scan (0.4.2)#14
Open
andrei-hasna wants to merge 1 commit into
Open
fix: exempt bundled dist artifacts from no-cloud self-scan (0.4.2)#14andrei-hasna wants to merge 1 commit into
andrei-hasna wants to merge 1 commit into
Conversation
The no-cloud scanner whitelisted a hardcoded set of dist/ files that carry the forbidden-runtime pattern strings as bundled declaration literals. When service-contract, mode, and conformance were added as build entrypoints, the bundler inlined those declarations into their dist outputs, but the whitelist was not updated, so the package failed its own no_cloud_guard conformance check. Match the two declaration source modules explicitly and treat any dist/ build artifact generically, still gated by the >=2 declaration-marker check and the @hasna/contracts package guard so downstream packages cannot bypass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
@hasna/contractsfailed its ownno_cloud_guardconformance check (andbun testhad 3 failures). The no-cloud scanner whitelisted a hardcoded set ofdist/files carrying the forbidden-runtime pattern strings as bundled declaration literals. Whenservice-contract,mode, andconformancewere added as build entrypoints, the bundler inlined those declarations into their dist outputs, but the whitelist was not updated — so the package flagged itself.Fix
Match the two declaration source modules (
src/no-cloud.ts,src/schemas.ts) explicitly and treat anydist/build artifact generically. Still gated by the >=2 declaration-marker check and the@hasna/contractspackage guard, so downstream packages cannot bypass the scan.Also bumped
CONTRACTS_PACKAGE_VERSIONto 0.4.2 to match package.json (caught by the dist smoke test).Verification
bun run verify:releasegreen: typecheck, 142 tests (0 fail), conformance, build, dist smoke, pack.@hasna/contracts@0.4.2; freshbun addresolves and the published CLI self-scan returnsverdict: passed.