From 976c0733d4b3cb59d1955e10cc7faa47054c326e Mon Sep 17 00:00:00 2001 From: peternhale Date: Thu, 12 Nov 2026 07:47:50 -0700 Subject: [PATCH 1/6] fix(ci): create pnpm store before cache save - W-24887043 --- .github/workflows/automerge.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml index 48c2a67..2697872 100644 --- a/.github/workflows/automerge.yml +++ b/.github/workflows/automerge.yml @@ -94,6 +94,10 @@ jobs: cache: ${{ steps.detect.outputs.package-manager }} cache-dependency-path: ${{ steps.detect.outputs.cache-dependency-path }} + - name: Ensure pnpm store exists + if: steps.detect.outputs.package-manager == 'pnpm' + run: mkdir -p "$(pnpm store path --silent)" + - run: npm install -g @salesforce/plugin-release-management --omit=dev - name: run automerge command From 1f3de4d9159c3f2653b8a8b58e831d9d9b553ea0 Mon Sep 17 00:00:00 2001 From: peternhale Date: Thu, 12 Nov 2026 07:52:13 -0700 Subject: [PATCH 2/6] fix(ci): create package-manager cache before save - W-24887043 --- .github/workflows/automerge.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml index 2697872..d88487e 100644 --- a/.github/workflows/automerge.yml +++ b/.github/workflows/automerge.yml @@ -94,9 +94,16 @@ jobs: cache: ${{ steps.detect.outputs.package-manager }} cache-dependency-path: ${{ steps.detect.outputs.cache-dependency-path }} - - name: Ensure pnpm store exists - if: steps.detect.outputs.package-manager == 'pnpm' - run: mkdir -p "$(pnpm store path --silent)" + - name: Ensure package-manager cache exists + env: + PACKAGE_MANAGER: ${{ steps.detect.outputs.package-manager }} + run: | + case "$PACKAGE_MANAGER" in + npm) cache_path="$(npm config get cache)" ;; + pnpm) cache_path="$(pnpm store path --silent)" ;; + yarn) cache_path="$(yarn cache dir)" ;; + esac + mkdir -p "$cache_path" - run: npm install -g @salesforce/plugin-release-management --omit=dev From 97d81bbad27321e9679034bb3719dd7a41f5a15a Mon Sep 17 00:00:00 2001 From: peternhale Date: Thu, 12 Nov 2026 08:01:43 -0700 Subject: [PATCH 3/6] fix(ci): reuse package-manager cache guard - W-24887043 --- .github/actions/ctcOpen/action.yml | 6 ++++ .../ensurePackageManagerCache/action.yml | 32 +++++++++++++++++++ .github/workflows/automerge.yml | 13 +++----- 3 files changed, 42 insertions(+), 9 deletions(-) create mode 100644 .github/actions/ensurePackageManagerCache/action.yml diff --git a/.github/actions/ctcOpen/action.yml b/.github/actions/ctcOpen/action.yml index 2c918bf..51cd974 100644 --- a/.github/actions/ctcOpen/action.yml +++ b/.github/actions/ctcOpen/action.yml @@ -56,6 +56,12 @@ runs: cache: ${{ inputs.package-manager }} cache-dependency-path: ${{ inputs.cache-dependency-path }} + - name: Ensure package-manager cache exists + uses: salesforcecli/github-workflows/.github/actions/ensurePackageManagerCache@main + with: + package-manager: ${{ inputs.package-manager }} + cache-dependency-path: ${{ inputs.cache-dependency-path }} + - run: npm install -g @salesforce/change-case-management --omit=dev shell: bash diff --git a/.github/actions/ensurePackageManagerCache/action.yml b/.github/actions/ensurePackageManagerCache/action.yml new file mode 100644 index 0000000..69cc726 --- /dev/null +++ b/.github/actions/ensurePackageManagerCache/action.yml @@ -0,0 +1,32 @@ +name: Ensure package-manager cache +description: Creates the npm, pnpm, or Yarn cache directory before setup-node saves it. +inputs: + package-manager: + description: Package manager whose cache directory should exist. + required: true + cache-dependency-path: + description: Path to the package manager lockfile. + required: false +runs: + using: composite + steps: + - shell: bash + env: + PACKAGE_MANAGER: ${{ inputs.package-manager }} + CACHE_DEPENDENCY_PATH: ${{ inputs.cache-dependency-path }} + run: | + case "$PACKAGE_MANAGER" in + npm) cache_path="$(npm config get cache)" ;; + pnpm) cache_path="$(pnpm store path --silent)" ;; + yarn) + cache_directory="$(dirname "$CACHE_DEPENDENCY_PATH")" + yarn_version="$(cd "$cache_directory" && yarn --version)" + if [ "$(printf '%s' "$yarn_version" | cut -d. -f1)" -lt 2 ]; then + cache_path="$(cd "$cache_directory" && yarn cache dir)" + else + cache_path="$(cd "$cache_directory" && yarn config get cacheFolder)" + fi + ;; + *) echo "Unsupported package manager: $PACKAGE_MANAGER"; exit 1 ;; + esac + mkdir -p "$cache_path" diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml index d88487e..a396a29 100644 --- a/.github/workflows/automerge.yml +++ b/.github/workflows/automerge.yml @@ -95,15 +95,10 @@ jobs: cache-dependency-path: ${{ steps.detect.outputs.cache-dependency-path }} - name: Ensure package-manager cache exists - env: - PACKAGE_MANAGER: ${{ steps.detect.outputs.package-manager }} - run: | - case "$PACKAGE_MANAGER" in - npm) cache_path="$(npm config get cache)" ;; - pnpm) cache_path="$(pnpm store path --silent)" ;; - yarn) cache_path="$(yarn cache dir)" ;; - esac - mkdir -p "$cache_path" + uses: salesforcecli/github-workflows/.github/actions/ensurePackageManagerCache@main + with: + package-manager: ${{ steps.detect.outputs.package-manager }} + cache-dependency-path: ${{ steps.detect.outputs.cache-dependency-path }} - run: npm install -g @salesforce/plugin-release-management --omit=dev From 3ae2f4927d35369f28492a720d4795a3b2214952 Mon Sep 17 00:00:00 2001 From: peternhale Date: Thu, 12 Nov 2026 08:02:06 -0700 Subject: [PATCH 4/6] fix(ci): pin package-manager cache guard - W-24887043 --- .github/actions/ctcOpen/action.yml | 2 +- .github/workflows/automerge.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/actions/ctcOpen/action.yml b/.github/actions/ctcOpen/action.yml index 51cd974..75dc8b5 100644 --- a/.github/actions/ctcOpen/action.yml +++ b/.github/actions/ctcOpen/action.yml @@ -57,7 +57,7 @@ runs: cache-dependency-path: ${{ inputs.cache-dependency-path }} - name: Ensure package-manager cache exists - uses: salesforcecli/github-workflows/.github/actions/ensurePackageManagerCache@main + uses: salesforcecli/github-workflows/.github/actions/ensurePackageManagerCache@97d81bbad27321e9679034bb3719dd7a41f5a15a with: package-manager: ${{ inputs.package-manager }} cache-dependency-path: ${{ inputs.cache-dependency-path }} diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml index a396a29..c94f446 100644 --- a/.github/workflows/automerge.yml +++ b/.github/workflows/automerge.yml @@ -95,7 +95,7 @@ jobs: cache-dependency-path: ${{ steps.detect.outputs.cache-dependency-path }} - name: Ensure package-manager cache exists - uses: salesforcecli/github-workflows/.github/actions/ensurePackageManagerCache@main + uses: salesforcecli/github-workflows/.github/actions/ensurePackageManagerCache@97d81bbad27321e9679034bb3719dd7a41f5a15a with: package-manager: ${{ steps.detect.outputs.package-manager }} cache-dependency-path: ${{ steps.detect.outputs.cache-dependency-path }} From 0a70525f378d0493c2f4ffc3b0c5da1c145a380c Mon Sep 17 00:00:00 2001 From: peternhale Date: Thu, 12 Nov 2026 10:33:09 -0700 Subject: [PATCH 5/6] fix(ci): reference package-manager cache guard from main - W-24887043 --- .github/actions/ctcOpen/action.yml | 2 +- .github/workflows/automerge.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/actions/ctcOpen/action.yml b/.github/actions/ctcOpen/action.yml index 75dc8b5..51cd974 100644 --- a/.github/actions/ctcOpen/action.yml +++ b/.github/actions/ctcOpen/action.yml @@ -57,7 +57,7 @@ runs: cache-dependency-path: ${{ inputs.cache-dependency-path }} - name: Ensure package-manager cache exists - uses: salesforcecli/github-workflows/.github/actions/ensurePackageManagerCache@97d81bbad27321e9679034bb3719dd7a41f5a15a + uses: salesforcecli/github-workflows/.github/actions/ensurePackageManagerCache@main with: package-manager: ${{ inputs.package-manager }} cache-dependency-path: ${{ inputs.cache-dependency-path }} diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml index c94f446..a396a29 100644 --- a/.github/workflows/automerge.yml +++ b/.github/workflows/automerge.yml @@ -95,7 +95,7 @@ jobs: cache-dependency-path: ${{ steps.detect.outputs.cache-dependency-path }} - name: Ensure package-manager cache exists - uses: salesforcecli/github-workflows/.github/actions/ensurePackageManagerCache@97d81bbad27321e9679034bb3719dd7a41f5a15a + uses: salesforcecli/github-workflows/.github/actions/ensurePackageManagerCache@main with: package-manager: ${{ steps.detect.outputs.package-manager }} cache-dependency-path: ${{ steps.detect.outputs.cache-dependency-path }} From 9b7ac2b6273b9b097b57b42bf67c3701bd38a981 Mon Sep 17 00:00:00 2001 From: Eric Willhoit Date: Thu, 12 Nov 2026 12:45:38 -0600 Subject: [PATCH 6/6] chore: false positives triage file --- sfdc_metadata/sast_scan_triage/triage.yaml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 sfdc_metadata/sast_scan_triage/triage.yaml diff --git a/sfdc_metadata/sast_scan_triage/triage.yaml b/sfdc_metadata/sast_scan_triage/triage.yaml new file mode 100644 index 0000000..79c82a3 --- /dev/null +++ b/sfdc_metadata/sast_scan_triage/triage.yaml @@ -0,0 +1,6 @@ +false_positive: + - id: .github/actions/ctcOpen/action.yml:6d2f59ad38437368cc1daa3e3bf88db529650c7832c0989857f96b050a280283 + justification: Same-repo action reference (salesforcecli/github-workflows), not a third-party action. The full owner/repo ref is required because callers run these as reusable workflows, so ./ paths would resolve to the caller's repo. + - id: .github/workflows/automerge.yml:6d2f59ad38437368cc1daa3e3bf88db529650c7832c0989857f96b050a280283 + justification: Same-repo action reference (salesforcecli/github-workflows), not a third-party action. The full owner/repo ref is required because callers run these as reusable workflows, so ./ paths would resolve to the caller's repo. +not_exploitable: []