Skip to content

feat(deployments): add the deployments resource (list, get, create, rollback, cancel) - #256

Merged
SakshiKoli-CS merged 15 commits into
v2-devfrom
CL-7170
Oct 30, 2026
Merged

SakshiKoli-CS merged 15 commits into
v2-devfrom
CL-7170

Conversation

@SakshiKoli-CS

@SakshiKoli-CS SakshiKoli-CS commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

🤖 This PR was written by an AI agent (Claude Code) on behalf of Sakshi Koli; Harshi Shah is credited as co-author.

Jira: https://contentstack.atlassian.net/browse/CL-7170

What

Adds the V2 Deployments resource to launch-cli:

  • launch:deployments:list / :get — DEPLOYMENT UID label, all 8 statuses, env vars as a count, no git fields for FileUpload, generic not-found wording (exit 2).
  • launch:deployments:create — full TRD §4.8.2 redeploy matrix (exact body or exact error per cell), --last-upload makes no signed-URL call, wait/stream to LIVE/FAILED, Ctrl-C leaves the deployment running (exit 3). With no files to upload, the error names both --data-dir and --last-upload.
  • Bare --commit picker over GET .../environments/:e/commits; no TTY → exit 2 naming --commit <sha>.
  • launch:deployments:rollback / :cancel — confirm-gated (--yes, decline exit 3, no TTY exit 2); the mutation is never sent on a refusal. Rollback prints "started", then waits until the target deployment is LIVE before reporting success (the API is asynchronous). Pickers show #deploymentNumber.
  • Dependency bumps (express, body-parser, csv-parse) so the Snyk pre-commit gate passes.

Decisions

  • The server reports a non-cancellable deployment as HTTP 400 with a message, not CANCEL_NOT_ALLOWED; the CLI words both the code and that message.
  • Build-log read failures are silent in the create flows (also projects:create and env:create); launch:logs:get ships with CL-7171.
  • A deployment that ended in a failed status points to launch:logs:get (CL-7171 follows this story; not in production yet).
  • Shared output changes to existing commands: the Deployment URL: label in projects:create/env:create, and the reworded upload size/readability messages.
  • The csv-parse override (4 → 7) is outside the range declared by csv@5.5.3; that module is not loaded by the CLI at runtime (only the tty-table bin requires it).
  • Rollback UX differs from V1: no interactive reason and no review step (live vs. target); the picker now shows #deploymentNumber as V1 did.
  • History: four linear commits on top of v2-dev (list/get, create + picker, rollback, cancel), followed by review-fix commits.

Known gaps

  • Not yet run live on dev11 for both project types (docs/launch-cli-manual-tests).
  • Snyk still lists 3 findings with no fix available (adm-zip, deepmerge, picomatch).
  • CI on this PR runs only the security scans; unit and integration tests were run locally.

QA: the Launch QA agent tests CL-7170 in the repos once it is in QA; GoCD sanity covers dev11.

🤖 Generated with Claude Code

https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr

@SakshiKoli-CS
SakshiKoli-CS requested review from a team as code owners October 28, 2026 10:16
@snyk-io

snyk-io Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

✅ Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
✅ Open Source Security 0 0 0 0 0 issues
✅ Licenses 0 0 0 0 0 issues
✅ Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 9 25 ✅ Passed
🟡 Medium Severity 0 2 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 9
  • Medium without fixes: 2
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

claude and others added 4 commits October 28, 2026 10:20
Adds the DEPLOYMENT UID label, git fields hidden for FileUpload, an
environment variable count, generic not-found wording and --deployment.
Also bumps express and overrides body-parser and csv-parse so the
pre-commit Snyk gate passes.

#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
…d commit picker

Covers the GitHub and FileUpload redeploy matrix, --commit [hash] with a
picker over the environment commits, --last-upload and --data-dir, and
waits on the deployment with a Ctrl-C stop that leaves it running.

#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
Fetches the deployment first, then goes through the shared confirm gate
before sending the rollback. --reason is sent only when it is not blank.

#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
Cancel is a bodyless POST behind the shared confirm gate. Its
not-allowed refusal, by code or by the raw 400 message, gets readable
wording.

#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 9 25 ✅ Passed
🟡 Medium Severity 0 2 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 9
  • Medium without fixes: 2
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

claude and others added 4 commits October 28, 2026 15:30
…get output and add deployment pickers

Create and rollback bodies no longer carry environment (the server DTOs reject it), --deployment is validated as 24 hex, get shows one-line commit messages without BUILD LOGS, a null deployment reads as not found, and rollback and cancel offer a picker.

#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
The merged flag refuses a malformed uid at parse time so no request is sent; blank values still read as absent and surrounding spaces are trimmed.

#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 6 9 25 ✅ Passed
🟡 Medium Severity 0 2 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 9
  • Medium without fixes: 2
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

claude and others added 3 commits October 28, 2026 18:31
…ormal tone

Reword every user-facing message of the deployments commands and the
shared upload and deployment-failure wording, drop the log-read notice,
and report a malformed --deployment without oclif's parse prefix.

#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 6 9 25 ✅ Passed
🟡 Medium Severity 0 2 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 9
  • Medium without fixes: 2
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

Add the colon to the Deployment URL line, word a refused cancel with
the deployment uid, and use the approved create and rollback failure
sentences.

#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 6 9 25 ✅ Passed
🟡 Medium Severity 0 2 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 9
  • Medium without fixes: 2
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

@siddharth-kulkarni-cs siddharth-kulkarni-cs left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review summary

Overall this is a careful, well-layered addition. The five commands follow the resource pattern in AGENTS.md, the confirm gate is applied correctly, the request-body guard is a good class test, and table-cell sanitising in renderTable is a welcome hardening. On 6cd6ff0, tsc --noEmit and npm run lint are clean.

Inline comments, highest priority first:

  1. Should fix: the no-directory error lost its --last-upload hint. It was dropped by 0354f13. NoUploadDirectoryError is now never caught, and the T27 title still claims the hint is there. This goes against TRD §4.8.2 rule 2.
  2. Should fix: every failure message for a failed deployment points only at launch:logs:get. That command is still planned (CL-7171) and not registered. This affects projects:create and env:create too, and the retry hint and the "do not start another deployment yet" guidance were removed.
  3. Question: rollback prints success right after an async API call. Per the API reference, the call only creates a PENDING rollback event.
  4. Commit messages go into the --commit picker unsanitised. This allows terminal escape injection from the repository's commit history.
  5. Ctrl-C can be missed during the wait. An abort that lands during a poll goes unnoticed until the next sleep ends, and a second Ctrl-C is swallowed.
  6. Log-read failures are now silent in all three create flows.
  7. The csv-parse override (4 → 7) leaves csv@5.5.3 unable to load. It is latent today.
  8. Optional checks before confirming a cancel, plus two nits.

Not inline:

  • CI on this PR runs only the security scans. No unit or integration test job ran on this head. I couldn't run the jest suite in my environment either, so the green suite in this PR rests on local runs only. Please paste a npm run test:coverage result from the current head, or wire a test job.
  • The PR description is stale in one place. It says "get prints a launch:logs:get hint", but src/commands/launch/deployments/get.test.ts:112 asserts that it doesn't.
  • Existing commands change output. The Deployment URL label (now Deployment URL:) in projects:create, and the upload size and readability messages, are reworded. These are fine, but worth listing under Decisions, since they change existing commands.
  • Rollback UX differs from V1. TRD §4.7.5 says rollback is a "transport-only swap … same prompts, flags, confirm UX, output". V1 asked for reason interactively, showed a review step of current live vs. target, and labelled deployments by #deploymentNumber. V2 drops all three, and its picker shows uid/status/short sha. That may be a deliberate simplification. If so, please record it, because users identify deployments by number in the Launch UI.
  • Not yet run live on dev11. The PR body says so, and I'd hold the merge until it has been, especially for rollback and cancel against the real error shapes. The cancel-not-allowed detection depends on an exact English server message, and the TRD marks those cancel codes as [NEEDS RESEARCH].

Generated by Claude Code

Comment thread src/deployments/deployment.create.ts Resolved
Comment thread src/deployments/deployment.presenter.ts Resolved
Comment thread src/deployments/deployment.presenter.ts Resolved
Comment thread src/deployments/commit.prompt.ts Resolved
Comment thread src/deployments/deployment.watcher.ts Resolved
Comment thread src/deployments/deployment.watcher.ts Resolved
Comment thread package.json Resolved
Comment thread package.json Resolved
…cancel

Stop the wait loop at once when Ctrl-C lands during a poll, strip control
characters from picker labels, and refuse cancelling a finished deployment
before any question. Also name the scope in the variables hint and the topic.

#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 6 9 25 ✅ Passed
🟡 Medium Severity 0 2 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 9
  • Medium without fixes: 2
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

claude and others added 2 commits October 30, 2026 06:04
…its, number pickers

deployments:rollback now reports the started rollback and waits until the
target deployment is LIVE before printing success, or says how to check it.
deployments:create words an empty upload directory with --data-dir and
--last-upload, and the rollback and cancel pickers show the deployment number.

#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Harshi Shah <harshi.shah@contentstack.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7MQaPSfh5ua9RABfHr
@github-actions

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 6 9 25 ✅ Passed
🟡 Medium Severity 0 2 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 9
  • Medium without fixes: 2
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

@SakshiKoli-CS
SakshiKoli-CS merged commit 653415c into v2-dev Oct 30, 2026
7 checks passed
@SakshiKoli-CS
SakshiKoli-CS deleted the CL-7170 branch October 30, 2026 06:26
SakshiKoli-CS pushed a commit that referenced this pull request Oct 30, 2026
Brings CL-7170 (merged in #256) into this branch. The deployment
watcher keeps one stop mechanism (v2-dev's, plus the abortable sleep and
the terminal drain). The logs tests follow v2-dev's silent failed log
read, and logs.presenter owns its scope hint now that the deployments
presenter dropped it.

#claude_code#
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7Va7GuYHHbwwLbN1JUzkG
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants