[cs-raj]

Problem

release-production-plugins.yml publishes the 20 cli-plugins packages to npm with a long-lived NPM_TOKEN on every push to main.

The SE1 publishing policy requires OIDC trusted publishing instead: no token, one release.yml that runs when a release is published, Node 24.

Fix

release-production-plugins.yml and .github/config/release.json are replaced by one release.yml.

	Before	After
Trigger	push to main, manual run	release: published
npm auth	NPM_TOKEN	OIDC: id-token: write, no token
Publish	20 × JS-DevTools/npm-publish@v3 steps, access: public on 5 of them	one step per package in the same order, each running npm publish --access public unless that version is already on npm
Node / npm	22.x / npm 10	24 / latest npm
Install	clean:all, then pnpm install --no-frozen-lockfile	pnpm install --frozen-lockfile
Checkout	branch head, credentials persisted	the release tag, persist-credentials: false
Actions	checkout, setup-node, pnpm/action-setup @v4	checkout @v7, setup-node @v7, pnpm/action-setup pinned to its v6.1.0 commit
Removed	json-to-variables + release.json (unused), corepack steps	—
.talismanrc	—	checksum exemption for release.yml: Talisman flags the pinned action SHA (false positive)

Deviations from the policy's sample workflow, all because this is a pnpm monorepo with 20 packages:

1. pnpm/action-setup step: the repo uses pnpm.
2. cache: 'pnpm' instead of 'npm': there is no package-lock.json.
3. pnpm install --frozen-lockfile instead of npm ci: the same lockfile-strict install, for pnpm.
4. Explicit pnpm -r --sort run build: plugins depend on each other (import on audit and variants, clone on export and import, …), and a package skipped as already published never runs its prepack, so its dependents need its lib/ built up front.
5. One publish step per package, in the old workflow's order, skipping versions already on npm: one release publishes only what was bumped, and a failed step names its package and stops the job.
6. Latest action majors instead of @v4 (v4 runs on Node 20, which is end-of-life); the third-party pnpm/action-setup is pinned to a commit SHA, as SRE recommended.

Verification

Node 22 and Node 24: frozen-lockfile install, build and unit tests pass (5,333 passing). The 20 publish steps, run with npm publish stubbed, go in the old order, skip the versions already on npm, pick up bumped ones, and a failed step stops the job.

Snyk

main's lock file scans at 221 Snyk issues and 14 pnpm audit findings. This PR raises the pnpm-workspace.yaml overrides for follow-redirects (1.16.1), fast-uri (4.2.3) and qs (6.16.1), and regenerates pnpm-lock.yaml so every range resolves to its newest allowed version. That regeneration also clears body-parser (1.20.9), proxy-addr (2.0.8) and traverse (0.6.14). No package.json changes.

	main	this PR
Snyk test	221 (1 critical, 68 high, 152 medium)	51 (0 critical, 27 high, 24 medium)
pnpm audit	14	5

Direct dependencies move only within their declared ranges, with no major bumps. Runtime: @oclif/core 4.13.3 → 4.14.0, @oclif/plugin-help 6.3.0, @contentstack/management 1.31.2, @contentstack/delivery-sdk 5.6.1 and fs-extra 11.4.1. Tooling: eslint 10.13 and oclif 4.24.

Still open:

• adm-zip 0.5.18 (9 issues): comes from @contentstack/cli-launch 1.11.3, which declares adm-zip ^0.5.18. The fix has to land in cli-launch.
• csv-parse 4.16.3: comes via @contentstack/cli-utilities → tty-table 4 → csv 5. The fix (7.0.2) needs a major.
• braces 3.0.3, picomatch 2.3.2, deepmerge 4.3.1: no fixed version exists yet.
• pnpm audit, test and lint tooling only: diff, minimatch 9.0.3 and serialize-javascript 6.0.2. Each fix needs a major.

pnpm run build passes for all 20 packages.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	1	10	✅ Passed
🟠 High Severity	0	294	25	✅ Passed
🟡 Medium Severity	0	450	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	1	15 / 30 days	⚠️ Warning
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 1
• High without fixes: 294
• Medium without fixes: 450
• Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	1	10	✅ Passed
🟠 High Severity	0	159	25	✅ Passed
🟡 Medium Severity	0	123	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	1	15 / 30 days	⚠️ Warning
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 1
• High without fixes: 159
• Medium without fixes: 123
• Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	158	25	✅ Passed
🟡 Medium Severity	0	65	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 158
• Medium without fixes: 65
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed