V1-legacy

.github/workflows/sca-scan.yml

@@ -5,6 +5,9 @@ on:
 jobs:
   security-sca:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@master
       - name: Run Snyk to check for vulnerabilities

.talismanrc

@@ -1,4 +1,5 @@
 fileignoreconfig:
+
 - filename: pnpm-lock.yaml
-  checksum: 31e333d6769adbaae042c92ea0930fab168a0e06fc1bda406d49fd1042a7a9c7
-version: '1.0'
+  checksum: 90ca97ef1a06fb5b7d8071f1317e079de6a34fce91559f70f80d9d958b5a834e
+  version: '1.0'

packages/contentstack-apps-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contentstack/apps-cli",
-  "version": "1.7.3",
+  "version": "1.7.4",
   "description": "App ClI",
   "author": "Contentstack CLI",
   "homepage": "https://github.com/contentstack/cli-plugins/tree/main/packages/contentstack-apps-cli",
@@ -24,8 +24,8 @@
     "@apollo/client": "^3.14.1",
     "@contentstack/cli-command": "~1.8.5",
     "@contentstack/cli-launch": "^1.11.1",
-    "@contentstack/cli-utilities": "~1.19.0",
-    "adm-zip": "^0.5.17",
+    "@contentstack/cli-utilities": "~1.19.1",
+    "adm-zip": "^0.6.0",
     "chalk": "^4.1.2",
     "lodash": "^4.18.1",
     "shelljs": "^0.10.0",
@@ -106,4 +106,4 @@
       "app:deploy": "APDP"
     }
   }
-}
+}

packages/contentstack-audit/README.md

@@ -16,7 +16,7 @@ $ npm install -g @contentstack/cli-audit
 $ csdx COMMAND
 running command...
 $ csdx (--version|-v)
-@contentstack/cli-audit/1.19.5 darwin-arm64 node-v22.21.1
+@contentstack/cli-audit/1.21.0 darwin-arm64 node-v24.18.0
 $ csdx --help [COMMAND]
 USAGE
   $ csdx COMMAND

packages/contentstack-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contentstack/cli-audit",
-  "version": "1.20.0",
+  "version": "1.21.0",
   "description": "Contentstack audit plugin",
   "author": "Contentstack CLI",
   "homepage": "https://github.com/contentstack/cli",
@@ -19,7 +19,7 @@
   ],
   "dependencies": {
     "@contentstack/cli-command": "~1.8.5",
-    "@contentstack/cli-utilities": "~1.19.0",
+    "@contentstack/cli-utilities": "~1.19.1",
     "@oclif/core": "^4.11.4",
     "chalk": "^4.1.2",
     "fast-csv": "^4.3.6",

packages/contentstack-audit/src/audit-base-command.ts

@@ -94,6 +94,8 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       missingFieldRules,
       missingMultipleFields,
       missingRefsInComposableStudio,
+      missingScanStatusAssets,
+      missingAssetRefsInEntries,
     } = await this.scanAndFix();
 
     if (this.flags['show-console-output']) {
@@ -125,6 +127,12 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
         { module: 'Entries Changed Multiple Fields', missingRefs: missingMultipleFields },
       ]);
       this.showOutputOnScreenWorkflowsAndExtension([{ module: 'Studio', missingRefs: missingRefsInComposableStudio }]);
+      this.showOutputOnScreenWorkflowsAndExtension([
+        { module: 'Assets Scan Status', missingRefs: missingScanStatusAssets },
+      ]);
+      this.showOutputOnScreenWorkflowsAndExtension([
+        { module: 'Entries Asset Field', missingRefs: missingAssetRefsInEntries },
+      ]);
     }
     this.showOutputOnScreenWorkflowsAndExtension([{ module: 'Summary', missingRefs: this.summaryDataToPrint }]);
 
@@ -141,7 +149,9 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       !isEmpty(missingEnvLocalesInEntries) ||
       !isEmpty(missingFieldRules) ||
       !isEmpty(missingMultipleFields) ||
-      !isEmpty(missingRefsInComposableStudio)
+      !isEmpty(missingRefsInComposableStudio) ||
+      !isEmpty(missingScanStatusAssets) ||
+      !isEmpty(missingAssetRefsInEntries)
     ) {
       if (this.currentCommand === 'cm:stacks:audit') {
         log.warn(this.$t(auditMsg.FINAL_REPORT_PATH, { path: this.sharedConfig.reportPath }), this.auditContext);
@@ -176,7 +186,9 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       !isEmpty(missingEnvLocalesInAssets) ||
       !isEmpty(missingEnvLocalesInEntries) ||
       !isEmpty(missingFieldRules) ||
-      !isEmpty(missingRefsInComposableStudio)
+      !isEmpty(missingRefsInComposableStudio) ||
+      !isEmpty(missingScanStatusAssets) ||
+      !isEmpty(missingAssetRefsInEntries)
     );
   }
 
@@ -207,6 +219,7 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
         missingTitleFields?: Record<string, any>;
         missingEnvLocale?: Record<string, any>;
         missingMultipleFields?: Record<string, any>;
+        missingAssetRefs?: Record<string, any>;
       } = {},
       missingMandatoryFields,
       missingTitleFields,
@@ -215,6 +228,8 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       missingEnvLocalesInEntries,
       missingFieldRules,
       missingMultipleFields,
+      missingAssetRefsInEntries,
+      missingScanStatusAssets,
       missingRefsInComposableStudio;
 
     const constructorParam: ModuleConstructorParam & CtConstructorParam = {
@@ -246,16 +261,21 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       constructorParam['moduleName'] = module;
 
       switch (module) {
-        case 'assets':
+        case 'assets': {
           log.info('Executing assets audit', this.auditContext);
-          missingEnvLocalesInAssets = await new Assets(cloneDeep(constructorParam)).run();
+          const assetsModule = new Assets(cloneDeep(constructorParam));
+          missingEnvLocalesInAssets = await assetsModule.run();
+          missingScanStatusAssets = assetsModule.missingScanStatusAssets ?? {};
           await this.prepareReport(module, missingEnvLocalesInAssets);
+          await this.prepareReport('asset-scan-status', missingScanStatusAssets);
           this.getAffectedData('assets', dataModuleWise['assets'], missingEnvLocalesInAssets);
+          this.getAffectedData('asset-scan-status', dataModuleWise['assets'], missingScanStatusAssets);
           log.success(
-            `Assets audit completed. Found ${Object.keys(missingEnvLocalesInAssets || {}).length} issues`,
+            `Assets audit completed. Found ${Object.keys(missingEnvLocalesInAssets || {}).length} issues, ${Object.keys(missingScanStatusAssets).length} non-clean scan status assets`,
             this.auditContext,
           );
           break;
+        }
         case 'content-types':
           log.info('Executing content-types audit', this.auditContext);
           missingCtRefs = await new ContentType(cloneDeep(constructorParam)).run();
@@ -285,6 +305,7 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
           missingTitleFields = missingEntry.missingTitleFields ?? {};
           missingEnvLocalesInEntries = missingEntry.missingEnvLocale ?? {};
           missingMultipleFields = missingEntry.missingMultipleFields ?? {};
+          missingAssetRefsInEntries = missingEntry.missingAssetRefs ?? {};
           await this.prepareReport(module, missingEntryRefs);
 
           await this.prepareReport(`Entries_Select_field`, missingSelectFeild);
@@ -296,6 +317,8 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
           await this.prepareReport('Entry_Missing_Locale_and_Env_in_Publish_Details', missingEnvLocalesInEntries);
 
           await this.prepareReport('Entry_Multiple_Fields', missingMultipleFields);
+
+          await this.prepareReport('Entries_Asset_field', missingAssetRefsInEntries);
           this.getAffectedData('entries', dataModuleWise['entries'], missingEntry);
           log.success(
             `Entries audit completed. Found ${Object.keys(missingEntryRefs || {}).length} reference issues`,
@@ -421,6 +444,8 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       missingFieldRules,
       missingMultipleFields,
       missingRefsInComposableStudio,
+      missingScanStatusAssets,
+      missingAssetRefsInEntries,
     };
   }
 
@@ -612,7 +637,8 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       | keyof typeof config.moduleConfig
       | keyof typeof config.ReportTitleForEntries
       | 'field-rules'
-      | 'Summary',
+      | 'Summary'
+      | 'asset-scan-status',
     listOfMissingRefs: Record<string, any>,
   ): Promise<void> {
     log.debug(`Preparing report for module: ${moduleName}`, this.auditContext);
@@ -656,7 +682,8 @@ export abstract class AuditBaseCommand extends BaseCommand<typeof AuditBaseComma
       | keyof typeof config.moduleConfig
       | keyof typeof config.ReportTitleForEntries
       | 'field-rules'
-      | 'Summary',
+      | 'Summary'
+      | 'asset-scan-status',
     listOfMissingRefs: Record<string, any>,
   ): Promise<void> {
     if (Object.keys(config.moduleConfig).includes(moduleName) || config.feild_level_modules.includes(moduleName)) {

packages/contentstack-audit/src/config/index.ts

@@ -55,6 +55,9 @@ const config = {
       name: 'assets',
       dirName: 'assets',
       fileName: 'assets.json',
+      // Asset scan statuses that must block import/reference; any other value (including
+      // 'not_scanned', 'clean', or the field being absent) is treated as safe.
+      blockingScanStatuses: ['pending', 'quarantined'],
     },
     environments: {
       name: 'environments',
@@ -110,6 +113,8 @@ const config = {
     'publish_locale',
     'publish_environment',
     'asset_uid',
+    'scan_status',
+    'mandatory',
     'selectedValue',
     'ct_uid',
     'action',
@@ -129,6 +134,7 @@ const config = {
     Entry_Missing_Locale_and_Env: 'Entry_Missing_Locale_and_Env',
     Entry_Missing_Locale_and_Env_in_Publish_Details: 'Entry_Missing_Locale_and_Env_in_Publish_Details',
     Entry_Multiple_Fields: 'Entry_Multiple_Fields',
+    Entries_Asset_field: 'Entries_Asset_field',
   },
   feild_level_modules: [
     'Entries_Title_field',
@@ -137,6 +143,8 @@ const config = {
     'Entry_Missing_Locale_and_Env_in_Publish_Details',
     'field-rules',
     'Entry_Multiple_Fields',
+    'Entries_Asset_field',
+    'asset-scan-status',
     'Summary',
   ],
   fixSelectField: false,

packages/contentstack-audit/src/messages/index.ts

@@ -49,6 +49,8 @@ const auditMsg = {
   FIELD_RULE_TARGET_ABSENT: `The target field '{target_field}' is not present in the schema of the content-type {ctUid}`,
   FIELD_RULE_CONDITION_SCAN_MESSAGE: `Completed Scanning of Field Rule '{num}' condition of Content-type '{ctUid}'`,
   FIELD_RULE_TARGET_SCAN_MESSAGE: `Completed Scanning of Field Rule '{num}' target of Content-type '{ctUid}'`,
+  SCAN_ASSET_QUARANTINE_MSG: `Asset with UID '{uid}' has a non-clean scan status ('{status}') and will be excluded from import.`,
+  ENTRY_ASSET_REF_WARN_MSG: `Entry '{uid}' field '{field}' references asset '{asset_uid}' with scan status '{status}'; it will be removed on fix.`,
 };
 
 const auditFixMsg = {
@@ -63,6 +65,8 @@ const auditFixMsg = {
   ENTRY_SELECT_FIELD_FIX: `Adding the value '{value}' in the select field of entry UID '{uid}'...`,
   ASSET_FIX: `Fixed publish detials for Asset with UID '{uid}'`,
   FIELD_RULE_FIX_MESSAGE: `Fixed Field Rule '{num}' target of Content-type '{ctUid}`,
+  ASSET_SCAN_STATUS_FIX: `Removed asset with UID '{uid}' (scan status: '{status}') from assets.json.`,
+  ENTRY_ASSET_REF_FIX: `Removed reference to asset '{asset_uid}' from entry '{uid}' field '{field}'.`,
 };
 
 const messages: typeof errors &

packages/contentstack-audit/src/modules/assets.ts

@@ -27,6 +27,7 @@ export default class Assets {
   public environments: string[] = [];
   protected schema: ContentTypeStruct[] = [];
   protected missingEnvLocales: Record<string, any> = {};
+  public missingScanStatusAssets: Record<string, any> = {};
   public moduleName: keyof typeof auditConfig.moduleConfig;
 
   constructor({ fix, config, moduleName }: ModuleConstructorParam & CtConstructorParam) {
@@ -184,7 +185,24 @@ export default class Assets {
 
       for (const assetUid in assets) {
         log.debug(`Processing asset: ${assetUid}`, this.config.auditContext);
-
+
+        const scanStatus = this.assets[assetUid]?._asset_scan_status;
+        if (this.config.moduleConfig.assets.blockingScanStatuses.includes(scanStatus)) {
+          log.debug(`Asset ${assetUid} has a non-clean scan status: ${scanStatus}`, this.config.auditContext);
+          cliux.print($t(auditMsg.SCAN_ASSET_QUARANTINE_MSG, { uid: assetUid, status: scanStatus }), {
+            color: 'yellow',
+          });
+          this.missingScanStatusAssets[assetUid] = [
+            { asset_uid: assetUid, filename: this.assets[assetUid].filename, scan_status: scanStatus },
+          ];
+
+          if (this.fix) {
+            log.info($t(auditFixMsg.ASSET_SCAN_STATUS_FIX, { uid: assetUid, status: scanStatus }), this.config.auditContext);
+            delete this.assets[assetUid];
+            continue;
+          }
+        }
+
         if (this.assets[assetUid]?.publish_details && !Array.isArray(this.assets[assetUid].publish_details)) {
           log.debug(`Asset ${assetUid} has invalid publish_details format`, this.config.auditContext);
           cliux.print($t(auditMsg.ASSET_NOT_EXIST, { uid: assetUid }), { color: 'red' });
@@ -226,15 +244,19 @@ export default class Assets {
 
         const remainingPublishDetails = this.assets[assetUid].publish_details?.length || 0;
         log.debug(`Asset ${assetUid} now has ${remainingPublishDetails} valid publish details`, this.config.auditContext);
-        
+
         if (this.fix) {
           log.debug(`Fixing asset ${assetUid}`, this.config.auditContext);
           log.info($t(auditFixMsg.ASSET_FIX, { uid: assetUid }), this.config.auditContext);
-          await this.writeFixContent(`${basePath}/${indexer[fileIndex]}`, this.assets);
         }
       }
+
+      if (this.fix) {
+        log.debug(`Writing fixed assets chunk to: ${basePath}/${indexer[fileIndex]}`, this.config.auditContext);
+        await this.writeFixContent(`${basePath}/${indexer[fileIndex]}`, this.assets);
+      }
     }
-    
+
     log.debug(`Asset reference validation completed. Processed ${Object.keys(this.missingEnvLocales).length} assets with issues`, this.config.auditContext);
   }
 }