fix: exempt bundled dist artifacts from no-cloud self-scan (0.4.2)#14
fix: exempt bundled dist artifacts from no-cloud self-scan (0.4.2)#14andrei-hasna wants to merge 1 commit into
Conversation
The no-cloud scanner whitelisted a hardcoded set of dist/ files that carry the forbidden-runtime pattern strings as bundled declaration literals. When service-contract, mode, and conformance were added as build entrypoints, the bundler inlined those declarations into their dist outputs, but the whitelist was not updated, so the package failed its own no_cloud_guard conformance check. Match the two declaration source modules explicitly and treat any dist/ build artifact generically, still gated by the >=2 declaration-marker check and the @hasna/contracts package guard so downstream packages cannot bypass.
|
Closing as superseded / already fixed on main. The self-scan failure this PR fixes (0.4.2) is already resolved on Verified locally on origin/main: This branch is also 3 minor versions behind (bumps to 0.4.2 vs main 0.5.3) and is in a CONFLICTING/DIRTY state; merging would regress the version. The generic dist/ approach is a reasonable robustness improvement but is not required for correctness and can be re-proposed cleanly against current main if desired. |
1 participant
Problem
@hasna/contractsfailed its ownno_cloud_guardconformance check (andbun testhad 3 failures). The no-cloud scanner whitelisted a hardcoded set ofdist/files carrying the forbidden-runtime pattern strings as bundled declaration literals. Whenservice-contract,mode, andconformancewere added as build entrypoints, the bundler inlined those declarations into their dist outputs, but the whitelist was not updated — so the package flagged itself.Fix
Match the two declaration source modules (
src/no-cloud.ts,src/schemas.ts) explicitly and treat anydist/build artifact generically. Still gated by the >=2 declaration-marker check and the@hasna/contractspackage guard, so downstream packages cannot bypass the scan.Also bumped
CONTRACTS_PACKAGE_VERSIONto 0.4.2 to match package.json (caught by the dist smoke test).Verification
bun run verify:releasegreen: typecheck, 142 tests (0 fail), conformance, build, dist smoke, pack.@hasna/contracts@0.4.2; freshbun addresolves and the published CLI self-scan returnsverdict: passed.