Repository navigation
feat(app): let review --suppress name a superseded deterministic finding - #9091
Draft
isaacroldan wants to merge 4 commits into
Draft
isaacroldan wants to merge 4 commits into
isaacroldan wants to merge 4 commits into
Conversation
Contributor
Differences in type declarationsWe detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:
New type declarationsWe found no new type declarations in this PR Existing type declarationspackages/cli-kit/dist/public/node/upgrade.d.ts@@ -5,11 +5,9 @@ export { getAutoUpgradeEnabled, setAutoUpgradeEnabled };
* Utility function for generating an install command for the user to run
* to install an updated version of Shopify CLI.
*
- * @param version - The version or dist-tag to install. Homebrew can't
- * install a specific version, so it always upgrades to the formula's current version.
* @returns A string with the command to run, or undefined if the package manager cannot be determined.
*/
-export declare function cliInstallCommand(version: string): string | undefined;
+export declare function cliInstallCommand(): string | undefined;
/**
* Options for {@link runCLIUpgrade}.
*/
@@ -21,13 +19,6 @@ export interface RunCLIUpgradeOptions {
* their `package.json` / lockfile in the background.
*/
autoupgrade?: boolean;
- /**
- * The exact version to install. The auto-upgrade hook passes the version it already
- * vetted, such as one that isn't a major version change, so the install can't drift to
- * whatever `latest` points at by the time the package manager runs. When omitted, the
- * CLI installs `latest`.
- */
- version?: string;
}
/**
* Runs the CLI upgrade using the appropriate package manager.
|
4 tasks
isaacroldan
force-pushed
the
clisec/CLISEC-15
branch
2 times, most recently
from
November 6, 2026 12:46
747c67a to
71b6ce5
Compare
A prefer-agent check whose agent result has no finding in a file supersedes the deterministic findings there, so review doesn't count them. check --blocking reads no agent results and still counts them, so a CI gate fails. review --suppress refused superseded findings, and --include-superseded needs an agent finding in the same file, so the only way to make the gate pass was to write the entry by hand. - review --suppress <n> now accepts a superseded deterministic finding that no entry matches. It saves one deterministic entry for it with planSuppression and saveAppSecuritySuppressions, so the entry names that finding alone. The saved-entry box says that the agent result supersedes the finding in the review, but check --blocking counts it. - A superseded finding that an entry already matches is refused as already suppressed, with the message of the other suppressed findings. - review --interactive offers, after the active findings and only when there are any, the superseded deterministic findings that check --blocking still counts, with the same Suppress, Continue or Quit, and an intro box that says why. It skips the ones that the session saved or declined as companions. - The review help, the --interactive flag and the agent instructions say so. README, manifest, embedded instructions and the shopify.dev docs data are regenerated. Co-authored-by: Isaac Roldan <[email protected]>
isaacroldan
force-pushed
the
clisec/CLISEC-15
branch
from
November 6, 2026 14:49
71b6ce5 to
4fa5dde
Compare
Co-authored-by: Claude Code <[email protected]>
Co-authored-by: Claude Code <[email protected]>
Co-authored-by: Claude Code <[email protected]>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WHY are these changes introduced?
An agent result can supersede a deterministic finding in
reviewwhilecheck --blockingstill counts it. If the agent reports no finding in that file, users cannot suppress it through the existing companion flow.Builds on #9090.
WHAT is this pull request doing?
Allow
review --suppress <number>to save a suppression for a superseded deterministic finding. Keep the existing kind, reason, unique-match, and--results-digestchecks. A finding that already has a matching entry is refused.Interactive review offers these findings after active findings. It skips companions already saved or declined. The finding stays
supersededin review, with its matching suppression attached. JSON fields do not change.How to manually test your changes?
Use an app with saved results where a current
prefer-agentresult supersedes a deterministic finding.shopify app security review --verbose. Note the finding number and results digest.shopify app security review --suppress <number> --kind accepted-risk --reason "Local test decision" --results-digest <digest>.shopify.app-security.json, then runshopify app security check --blocking highto confirm that finding no longer blocks.shopify app security review --interactiveand inspect the second round.Checklist