[PR #644] [MERGED] fix(workflow): enterprise hardening for run JSON #677

New issue

Closed

opened 2026-02-26 22:32:04 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 22:32:04 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/rudrankriyam/App-Store-Connect-CLI/pull/644
Author: @rudrankriyam
Created: 2/18/2026
Status: ✅ Merged
Merged: 2/18/2026
Merged by: @rudrankriyam

Base: main ← Head: fix/workflow-enterprise-hardening

📝 Commits (10+)

6c2c41f fix(workflow): include error + hooks in run JSON
54a2801 fix(workflow): harden shell selection and step parsing
2d42797 docs(workflow): add full example to help and README
59a27e4 docs(workflow): fix jq quoting example
ab8d2cb refactor(workflow): centralize error hook recording
489484e docs(workflow): document trust model and conditional env fallback
83044ca docs(workflow): add trust model note to help
4871da5 docs(workflow): surface trust model in run help
4b34c3a docs(workflow): strengthen trust model warnings
7aa615d docs(workflow): remove lane-style wording

📊 Changes

10 files changed (+734 additions, -40 deletions)

View changed files

📝 README.md (+30 -1)
➕ docs/WORKFLOWS.md (+140 -0)
📝 internal/auth/doctor_test.go (+1 -1)
📝 internal/cli/cmdtest/workflow_test.go (+241 -14)
📝 internal/cli/workflow/workflow.go (+90 -2)
📝 internal/workflow/env.go (+10 -2)
📝 internal/workflow/env_test.go (+36 -2)
📝 internal/workflow/execute.go (+95 -16)
📝 internal/workflow/execute_test.go (+89 -1)
📝 internal/workflow/workflow.go (+2 -1)

📄 Description

Why

asc workflow run keeps stdout JSON-only and returns a ReportedError on failures.
That meant failures in before_all / after_all hooks could produce status=error with no actionable detail in the JSON payload.

Enterprises migrating lane-style automation need day-1 debuggability and deterministic structured output.

What changed

Add error to workflow run JSON on failures.
Add hooks results to workflow run JSON (before_all, after_all, error) with status/duration/error.
Keep step/hook command output on stderr; stdout remains JSON-only.
Harden shell selection: require bash or sh in PATH with a clear error when neither exists.
Make null step element detection whitespace-safe.
Deduplicate error-hook recording to reduce drift risk.
Add/extend tests:
- after_all does not run on step failure
- dry-run records before_all/after_all hook results
Expand asc workflow --help to include a full .asc/workflow.json example (agent-friendly).
Add docs/WORKFLOWS.md and a README section with usage guidance.
Document workflow trust model and conditional env fallback.

Tests

make format
make lint
ASC_BYPASS_KEYCHAIN=1 make test

Notes

JSON changes are additive (error, hooks) to avoid breaking existing consumers.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/rudrankriyam/App-Store-Connect-CLI/pull/644 **Author:** [@rudrankriyam](https://github.com/rudrankriyam) **Created:** 2/18/2026 **Status:** ✅ Merged **Merged:** 2/18/2026 **Merged by:** [@rudrankriyam](https://github.com/rudrankriyam) **Base:** `main` ← **Head:** `fix/workflow-enterprise-hardening` --- ### 📝 Commits (10+) - [`6c2c41f`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/6c2c41ff038294a5e32d135c2e79060f572885a3) fix(workflow): include error + hooks in run JSON - [`54a2801`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/54a2801cd133f4b20865df30eaad815265e735f7) fix(workflow): harden shell selection and step parsing - [`2d42797`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/2d4279799d265898f8fae0f11af2c550e68995f9) docs(workflow): add full example to help and README - [`59a27e4`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/59a27e45d9272388fed340b355154390aa56ae86) docs(workflow): fix jq quoting example - [`ab8d2cb`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/ab8d2cbd32b0ef9bcc2e52b8b6f1b1a432f91f6c) refactor(workflow): centralize error hook recording - [`489484e`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/489484ef2527c3c87683ed77623919715854b6fe) docs(workflow): document trust model and conditional env fallback - [`83044ca`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/83044cad5471e418727c37437b84170bb42a1b5f) docs(workflow): add trust model note to help - [`4871da5`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/4871da5c7cd49fe9a243ea3836f4427195ae37ce) docs(workflow): surface trust model in run help - [`4b34c3a`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/4b34c3a0921db05a835a33dab4f8e9e4fdf6d3b6) docs(workflow): strengthen trust model warnings - [`7aa615d`](https://github.com/rudrankriyam/App-Store-Connect-CLI/commit/7aa615d0ba1330bb735de23095afd1ee323f82d5) docs(workflow): remove lane-style wording ### 📊 Changes **10 files changed** (+734 additions, -40 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+30 -1) ➕ `docs/WORKFLOWS.md` (+140 -0) 📝 `internal/auth/doctor_test.go` (+1 -1) 📝 `internal/cli/cmdtest/workflow_test.go` (+241 -14) 📝 `internal/cli/workflow/workflow.go` (+90 -2) 📝 `internal/workflow/env.go` (+10 -2) 📝 `internal/workflow/env_test.go` (+36 -2) 📝 `internal/workflow/execute.go` (+95 -16) 📝 `internal/workflow/execute_test.go` (+89 -1) 📝 `internal/workflow/workflow.go` (+2 -1) </details> ### 📄 Description ## Why `asc workflow run` keeps stdout JSON-only and returns a ReportedError on failures. That meant failures in `before_all` / `after_all` hooks could produce `status=error` with no actionable detail in the JSON payload. Enterprises migrating lane-style automation need day-1 debuggability and deterministic structured output. ## What changed - Add `error` to workflow run JSON on failures. - Add `hooks` results to workflow run JSON (`before_all`, `after_all`, `error`) with status/duration/error. - Keep step/hook command output on stderr; stdout remains JSON-only. - Harden shell selection: require `bash` or `sh` in PATH with a clear error when neither exists. - Make `null` step element detection whitespace-safe. - Deduplicate error-hook recording to reduce drift risk. - Add/extend tests: - after_all does not run on step failure - dry-run records before_all/after_all hook results - Expand `asc workflow --help` to include a full `.asc/workflow.json` example (agent-friendly). - Add `docs/WORKFLOWS.md` and a README section with usage guidance. - Document workflow trust model and conditional env fallback. ## Tests - `make format` - `make lint` - `ASC_BYPASS_KEYCHAIN=1 make test` ## Notes - JSON changes are additive (`error`, `hooks`) to avoid breaking existing consumers. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>