Merge branch 'development' into fix/snyk-issues-24-06-26

Brings in the 27 commits development gained after the previous merge
(PR #217 Asset-Scanning-v1, #322, #323 and others), clearing the conflict
that was blocking PR #243 and preventing GitHub Actions from producing a
merge ref.

Only .talismanrc conflicted. Resolved to the checksum for the merged
pnpm-lock.yaml (95ad8483..., confirmed via `talisman --checksum`) and moved
`version` back to the top level, where talisman expects it — development's
side had it indented under the fileignoreconfig entry.

Verified before push:
  - `pnpm install --frozen-lockfile` passes (the auto-merged lockfile is
    self-consistent; this is the check that caught the broken lockfile in
    PR #324 and the dropped `open` dependency in the previous merge)
  - dependency sweep against both merge parents: nothing lost
  - undeclared-import sweep unchanged from baseline: no new hybrids
  - test suites for all six packages this merge touched:
      contentstack-audit             160 passing
      contentstack-export            485 passing
      contentstack-external-migrate   42 passing
      contentstack-import           1736 passing
      contentstack-query-export      139 passing
      contentstack-bulk-publish      (no test script)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: netrajpatel

packages/contentstack-audit/src/audit-base-command.ts

@@ -94,6 +94,8 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       missingFieldRules,
       missingMultipleFields,
       missingRefsInComposableStudio,
+      missingScanStatusAssets,
+      missingAssetRefsInEntries,
     } = await this.scanAndFix();
 
     if (this.flags['show-console-output']) {
@@ -125,6 +127,12 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
         { module: 'Entries Changed Multiple Fields', missingRefs: missingMultipleFields },
       ]);
       this.showOutputOnScreenWorkflowsAndExtension([{ module: 'Studio', missingRefs: missingRefsInComposableStudio }]);
+      this.showOutputOnScreenWorkflowsAndExtension([
+        { module: 'Assets Scan Status', missingRefs: missingScanStatusAssets },
+      ]);
+      this.showOutputOnScreenWorkflowsAndExtension([
+        { module: 'Entries Asset Field', missingRefs: missingAssetRefsInEntries },
+      ]);
     }
     this.showOutputOnScreenWorkflowsAndExtension([{ module: 'Summary', missingRefs: this.summaryDataToPrint }]);
 
@@ -141,7 +149,9 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       !isEmpty(missingEnvLocalesInEntries) ||
       !isEmpty(missingFieldRules) ||
       !isEmpty(missingMultipleFields) ||
-      !isEmpty(missingRefsInComposableStudio)
+      !isEmpty(missingRefsInComposableStudio) ||
+      !isEmpty(missingScanStatusAssets) ||
+      !isEmpty(missingAssetRefsInEntries)
     ) {
       if (this.currentCommand === 'cm:stacks:audit') {
         log.warn(this.$t(auditMsg.FINAL_REPORT_PATH, { path: this.sharedConfig.reportPath }), this.auditContext);
@@ -176,7 +186,9 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       !isEmpty(missingEnvLocalesInAssets) ||
       !isEmpty(missingEnvLocalesInEntries) ||
       !isEmpty(missingFieldRules) ||
-      !isEmpty(missingRefsInComposableStudio)
+      !isEmpty(missingRefsInComposableStudio) ||
+      !isEmpty(missingScanStatusAssets) ||
+      !isEmpty(missingAssetRefsInEntries)
     );
   }
 
@@ -207,6 +219,7 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
         missingTitleFields?: Record<string, any>;
         missingEnvLocale?: Record<string, any>;
         missingMultipleFields?: Record<string, any>;
+        missingAssetRefs?: Record<string, any>;
       } = {},
       missingMandatoryFields,
       missingTitleFields,
@@ -215,6 +228,8 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       missingEnvLocalesInEntries,
       missingFieldRules,
       missingMultipleFields,
+      missingAssetRefsInEntries,
+      missingScanStatusAssets,
       missingRefsInComposableStudio;
 
     const constructorParam: ModuleConstructorParam & CtConstructorParam = {
@@ -246,16 +261,21 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       constructorParam['moduleName'] = module;
 
       switch (module) {
-        case 'assets':
+        case 'assets': {
           log.info('Executing assets audit', this.auditContext);
-          missingEnvLocalesInAssets = await new Assets(cloneDeep(constructorParam)).run();
+          const assetsModule = new Assets(cloneDeep(constructorParam));
+          missingEnvLocalesInAssets = await assetsModule.run();
+          missingScanStatusAssets = assetsModule.missingScanStatusAssets ?? {};
           await this.prepareReport(module, missingEnvLocalesInAssets);
+          await this.prepareReport('asset-scan-status', missingScanStatusAssets);
           this.getAffectedData('assets', dataModuleWise['assets'], missingEnvLocalesInAssets);
+          this.getAffectedData('asset-scan-status', dataModuleWise['assets'], missingScanStatusAssets);
           log.success(
-            `Assets audit completed. Found ${Object.keys(missingEnvLocalesInAssets || {}).length} issues`,
+            `Assets audit completed. Found ${Object.keys(missingEnvLocalesInAssets || {}).length} issues, ${Object.keys(missingScanStatusAssets).length} non-clean scan status assets`,
             this.auditContext,
           );
           break;
+        }
         case 'content-types':
           log.info('Executing content-types audit', this.auditContext);
           missingCtRefs = await new ContentType(cloneDeep(constructorParam)).run();
@@ -285,6 +305,7 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
           missingTitleFields = missingEntry.missingTitleFields ?? {};
           missingEnvLocalesInEntries = missingEntry.missingEnvLocale ?? {};
           missingMultipleFields = missingEntry.missingMultipleFields ?? {};
+          missingAssetRefsInEntries = missingEntry.missingAssetRefs ?? {};
           await this.prepareReport(module, missingEntryRefs);
 
           await this.prepareReport(`Entries_Select_field`, missingSelectFeild);
@@ -296,6 +317,8 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
           await this.prepareReport('Entry_Missing_Locale_and_Env_in_Publish_Details', missingEnvLocalesInEntries);
 
           await this.prepareReport('Entry_Multiple_Fields', missingMultipleFields);
+
+          await this.prepareReport('Entries_Asset_field', missingAssetRefsInEntries);
           this.getAffectedData('entries', dataModuleWise['entries'], missingEntry);
           log.success(
             `Entries audit completed. Found ${Object.keys(missingEntryRefs || {}).length} reference issues`,
@@ -421,6 +444,8 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       missingFieldRules,
       missingMultipleFields,
       missingRefsInComposableStudio,
+      missingScanStatusAssets,
+      missingAssetRefsInEntries,
     };
   }
 
@@ -612,7 +637,8 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       | keyof typeof config.moduleConfig
       | keyof typeof config.ReportTitleForEntries
       | 'field-rules'
-      | 'Summary',
+      | 'Summary'
+      | 'asset-scan-status',
     listOfMissingRefs: Record<string, any>,
   ): Promise<void> {
     log.debug(`Preparing report for module: ${moduleName}`, this.auditContext);
@@ -656,7 +682,8 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       | keyof typeof config.moduleConfig
       | keyof typeof config.ReportTitleForEntries
       | 'field-rules'
-      | 'Summary',
+      | 'Summary'
+      | 'asset-scan-status',
     listOfMissingRefs: Record<string, any>,
   ): Promise<void> {
     if (Object.keys(config.moduleConfig).includes(moduleName) || config.feild_level_modules.includes(moduleName)) {

packages/contentstack-audit/src/config/index.ts

@@ -55,6 +55,9 @@ const config = {
       name: 'assets',
       dirName: 'assets',
       fileName: 'assets.json',
+      // Asset scan statuses that must block import/reference; any other value (including
+      // 'not_scanned', 'clean', or the field being absent) is treated as safe.
+      blockingScanStatuses: ['pending', 'quarantined'],
     },
     environments: {
       name: 'environments',
@@ -110,6 +113,8 @@ const config = {
     'publish_locale',
     'publish_environment',
     'asset_uid',
+    'scan_status',
+    'mandatory',
     'selectedValue',
     'ct_uid',
     'action',
@@ -129,6 +134,7 @@ const config = {
     Entry_Missing_Locale_and_Env: 'Entry_Missing_Locale_and_Env',
     Entry_Missing_Locale_and_Env_in_Publish_Details: 'Entry_Missing_Locale_and_Env_in_Publish_Details',
     Entry_Multiple_Fields: 'Entry_Multiple_Fields',
+    Entries_Asset_field: 'Entries_Asset_field',
   },
   feild_level_modules: [
     'Entries_Title_field',
@@ -137,6 +143,8 @@ const config = {
     'Entry_Missing_Locale_and_Env_in_Publish_Details',
     'field-rules',
     'Entry_Multiple_Fields',
+    'Entries_Asset_field',
+    'asset-scan-status',
     'Summary',
   ],
   fixSelectField: false,

packages/contentstack-audit/src/messages/index.ts

@@ -49,6 +49,8 @@ const auditMsg = {
   FIELD_RULE_TARGET_ABSENT: `The target field '{target_field}' is not present in the schema of the content-type {ctUid}`,
   FIELD_RULE_CONDITION_SCAN_MESSAGE: `Completed Scanning of Field Rule '{num}' condition of Content-type '{ctUid}'`,
   FIELD_RULE_TARGET_SCAN_MESSAGE: `Completed Scanning of Field Rule '{num}' target of Content-type '{ctUid}'`,
+  SCAN_ASSET_QUARANTINE_MSG: `Asset with UID '{uid}' has a non-clean scan status ('{status}') and will be excluded from import.`,
+  ENTRY_ASSET_REF_WARN_MSG: `Entry '{uid}' field '{field}' references asset '{asset_uid}' with scan status '{status}'; it will be removed on fix.`,
 };
 
 const auditFixMsg = {
@@ -63,6 +65,8 @@ const auditFixMsg = {
   ENTRY_SELECT_FIELD_FIX: `Adding the value '{value}' in the select field of entry UID '{uid}'...`,
   ASSET_FIX: `Fixed publish detials for Asset with UID '{uid}'`,
   FIELD_RULE_FIX_MESSAGE: `Fixed Field Rule '{num}' target of Content-type '{ctUid}`,
+  ASSET_SCAN_STATUS_FIX: `Removed asset with UID '{uid}' (scan status: '{status}') from assets.json.`,
+  ENTRY_ASSET_REF_FIX: `Removed reference to asset '{asset_uid}' from entry '{uid}' field '{field}'.`,
 };
 
 const messages: typeof errors &

packages/contentstack-audit/src/modules/assets.ts

@@ -27,6 +27,7 @@ export default class Assets {
   public environments: string[] = [];
   protected schema: ContentTypeStruct[] = [];
   protected missingEnvLocales: Record<string, any> = {};
+  public missingScanStatusAssets: Record<string, any> = {};
   public moduleName: keyof typeof auditConfig.moduleConfig;
 
   constructor({ fix, config, moduleName }: ModuleConstructorParam & CtConstructorParam) {
@@ -184,7 +185,24 @@ export default class Assets {
 
       for (const assetUid in assets) {
         log.debug(`Processing asset: ${assetUid}`, this.config.auditContext);
-        
+
+        const scanStatus = this.assets[assetUid]?._asset_scan_status;
+        if (this.config.moduleConfig.assets.blockingScanStatuses.includes(scanStatus)) {
+          log.debug(`Asset ${assetUid} has a non-clean scan status: ${scanStatus}`, this.config.auditContext);
+          cliux.print($t(auditMsg.SCAN_ASSET_QUARANTINE_MSG, { uid: assetUid, status: scanStatus }), {
+            color: 'yellow',
+          });
+          this.missingScanStatusAssets[assetUid] = [
+            { asset_uid: assetUid, filename: this.assets[assetUid].filename, scan_status: scanStatus },
+          ];
+
+          if (this.fix) {
+            log.info($t(auditFixMsg.ASSET_SCAN_STATUS_FIX, { uid: assetUid, status: scanStatus }), this.config.auditContext);
+            delete this.assets[assetUid];
+            continue;
+          }
+        }
+
         if (this.assets[assetUid]?.publish_details && !Array.isArray(this.assets[assetUid].publish_details)) {
           log.debug(`Asset ${assetUid} has invalid publish_details format`, this.config.auditContext);
           cliux.print($t(auditMsg.ASSET_NOT_EXIST, { uid: assetUid }), { color: 'red' });
@@ -226,15 +244,19 @@ export default class Assets {
 
         const remainingPublishDetails = this.assets[assetUid].publish_details?.length || 0;
         log.debug(`Asset ${assetUid} now has ${remainingPublishDetails} valid publish details`, this.config.auditContext);
-        
+
         if (this.fix) {
           log.debug(`Fixing asset ${assetUid}`, this.config.auditContext);
           log.info($t(auditFixMsg.ASSET_FIX, { uid: assetUid }), this.config.auditContext);
-          await this.writeFixContent(`${basePath}/${indexer[fileIndex]}`, this.assets);
         }
       }
+
+      if (this.fix) {
+        log.debug(`Writing fixed assets chunk to: ${basePath}/${indexer[fileIndex]}`, this.config.auditContext);
+        await this.writeFixContent(`${basePath}/${indexer[fileIndex]}`, this.assets);
+      }
     }
-    
+
     log.debug(`Asset reference validation completed. Processed ${Object.keys(this.missingEnvLocales).length} assets with issues`, this.config.auditContext);
   }
 }