Initial setup add changesets, versioning commented out github action - #7
Merged
Conversation
🔍 Denylist Analysis ResultsDiscovered 100 packages. These include both those that are net-new and those that have been explicitly approved or denied for use. pnpm-lock.yaml🔄 New Packages Entering the Supply Chain (2)
✅ Known Packages - Approved for Use (98)
For any questions or to provide feedback, please reach out to #help-bumperbot. Generated by Bumperbot. |
PawanP1808
commented
Jun 2, 2026
| @@ -0,0 +1,8 @@ | |||
| Copyright Shopify Inc. All rights reserved. | |||
Collaborator
Author
There was a problem hiding this comment.
@joerj123 This is AI generated will need your/legal review. Flagging so we can get ahead of it.
joerj123
approved these changes
Jun 3, 2026
PawanP1808
marked this pull request as ready for review
June 3, 2026 18:10
PawanP1808
commented
Jun 4, 2026
| @@ -0,0 +1,48 @@ | |||
| # name: Release | |||
Collaborator
Author
There was a problem hiding this comment.
Commented out until we are ready to publish it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Prepares
@shopify/shop-clito be published publicly to npm and restructures the repository to match the layout/conventions ofShopify/ucp-cli. No runtime behavior of the CLI changes for end users beyond a small hardening fix to image URL rendering and the version now being sourced frompackage.json.This is setup-only groundwork: the release workflow is included but intentionally disabled (commented out) so nothing publishes until we deliberately enable it.
What changed
Repo restructure to match
ucp-clipackage/to the repository root (src/,tests/,tsconfig*.json,package.json,pnpm-lock.yaml).package/directory and its duplicate lockfile.npm publishing setup
package.json: setlicense: MIT, addedrepository,bugs,homepage,sideEffects: false,exports,publishConfig.access: public,files(dist,README.md,LICENSE,src), andpnpm.onlyBuiltDependencies: ["keytar"]..changeset/config.json,.changeset/README.md) withchangeset/version-packages/releasescripts..npmrc(matchingucp-cli:minimum-release-age,package-manager-strict, peer-dep settings).LICENSE(MIT, copied fromShopify/ucp-cli).README.mdoriented at public install/usage..github/workflows/release.yml— aucp-cli-style Changesets + npm OIDC (Trusted Publishing) release workflow. Committed commented-out so it is inert until we enable publishing.CLI / source changes
src/cli.ts:--versionnow reads frompackage.jsonviacreateRequireinstead of a hardcoded string, so the CLI version always matches the published package. Test script copiespackage.jsoninto the test build to support this.src/render.ts: image URLs from (untrusted) merchant catalog content are now filtered to HTTPS only before being rendered asImg:.http:,file:,data:,javascript:, and malformed URLs are skipped, falling through to the next safe media URL (enforces the rule inreferences/safety.md).Docs
SKILL.md: fixed install/uninstall instructions for the new root layout (removedcd package), corrected the uninstall package name (@shopify/shop→@shopify/shop-cli), aligned frontmatter version to0.1.0, removed an empty section.Tests
render.test.tscases covering HTTPS image rendering, rejection of non-HTTPS schemes with fall-through, and omission ofImg:when no media URL is HTTPS.Why
We want to distribute the Shop CLI as a public npm package while keeping a clean, conventional repo that mirrors
ucp-cli, so release tooling and contributor experience are consistent across our CLIs. Sourcing the version frompackage.jsonand adding Changesets makes releases reproducible. The image-URL hardening closes a gap betweenreferences/safety.md(which requires HTTPS-only image URLs) and the actual render code.Testing
pnpm typecheck— passespnpm test— 62/62 pass (3 new render tests)pnpm build— passespnpm pack:dry— verified tarball contents (dist,src,README.md,LICENSE,package.json); no source maps, no secretsWhat could go wrong?
Shopify/shop-cli) and workflow filename, and the first@shopify/shop-clipublish must be bootstrapped via AI Ops (#help-eng-infrastructure). Enabling without that setup will fail the publish step (not a silent/bad publish).package.json: relies onsrcbeing shipped relative topackage.json(filesincludes both);createRequire('../package.json')resolves correctly fromdist/. Covered by the existing CLI version test.Img:line. This is intended (security) but is a visible behavior change for any such listings.package/path will need updating.Follow-ups (not in this PR)
Shopifyorg and enable the release workflow.CLIENT_IDis a registered public OAuth client (no secret) before publishing.