From a2e765f5c994b0c05d258a0937dfb9da48461eea Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 11 Aug 2026 12:16:40 +0000 Subject: [PATCH] chore: version packages --- .changeset/repository-token-support.md | 29 ------------------------- CHANGELOG.md | 30 ++++++++++++++++++++++++++ package.json | 2 +- 3 files changed, 31 insertions(+), 30 deletions(-) delete mode 100644 .changeset/repository-token-support.md diff --git a/.changeset/repository-token-support.md b/.changeset/repository-token-support.md deleted file mode 100644 index abeb7bd..0000000 --- a/.changeset/repository-token-support.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -"@codacy/codacy-cloud-cli": minor ---- - -Add repository (project) token support - -You can now authenticate with a **repository token** — scoped to a single repository — instead of a personal account API token that reaches every organization and repository you can see. This is the right credential for CI and for the auto-configuration agent: if it leaks, the blast radius is one repository. - -```bash -codacy tools --repository-token -# or, for a whole CI job: -export CODACY_PROJECT_TOKEN= -``` - -Get one from **Codacy > Repository > Settings > Integrations > Project API token**. The new `--repository-token ` flag is accepted by every command, and `CODACY_PROJECT_TOKEN` is picked up automatically. - -**Token precedence** (identical to the Codacy Analysis CLI): `--repository-token` > `CODACY_PROJECT_TOKEN` > `CODACY_API_TOKEN` > stored `codacy login`. An explicit `--repository-token` wins outright, so a deliberately scoped run is never silently widened. Note that `CODACY_PROJECT_TOKEN` outranks `CODACY_API_TOKEN` — unset it if you want your account token used. - -**Not every command accepts a repository token**, because Codacy only honours them on a limited set of repository-scoped operations: - -- **Fully supported:** `tools`, `tool`, `patterns`, `pattern`, `issues` (including `--overview`), `tools --import`, `repository --reanalyze` / `--reanalyze-and-wait`. -- **Partially supported:** `repository` works but omits the pull request and coverage sections. In `--output json`, `pullRequests` stays an empty array and a new `unavailable: ["pullRequests"]` field marks what couldn't be fetched. Output under an account token is unchanged. -- **Account token required:** `info`, `repositories`, `ls`, `directories`, `pull-request`, `pull-requests`, `issue`, `findings`, `finding`, `issues --ignore`/`--ignored`, `tools --import --force`, and `repository`'s `--add`/`--remove`/`--follow`/`--unfollow`/`--link-standard`/`--unlink-standard`. - -Unsupported combinations now fail immediately with a message naming the operation, why a repository token can't perform it, and which token is in use — instead of sending a request that comes back as a bare `Unauthorized`. - -`codacy login` continues to store account tokens only; repository tokens are passed per command or via the environment. - -Also fixed: `codacy repository` no longer loses the entire dashboard when the pull request lookup fails, and `codacy login` no longer reports a repository token as "invalid" when it is rejected for being the wrong kind of token. diff --git a/CHANGELOG.md b/CHANGELOG.md index ed84967..8d1c6b1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,35 @@ # @codacy/codacy-cloud-cli +## 1.9.0 + +### Minor Changes + +- [#37](https://github.com/codacy/codacy-cloud-cli/pull/37) [`402edd8`](https://github.com/codacy/codacy-cloud-cli/commit/402edd8d7bc8260cce9951da357e7b410ec2b219) Thanks [@alerizzo](https://github.com/alerizzo)! - Add repository (project) token support + + You can now authenticate with a **repository token** — scoped to a single repository — instead of a personal account API token that reaches every organization and repository you can see. This is the right credential for CI and for the auto-configuration agent: if it leaks, the blast radius is one repository. + + ```bash + codacy tools --repository-token + # or, for a whole CI job: + export CODACY_PROJECT_TOKEN= + ``` + + Get one from **Codacy > Repository > Settings > Integrations > Project API token**. The new `--repository-token ` flag is accepted by every command, and `CODACY_PROJECT_TOKEN` is picked up automatically. + + **Token precedence** (identical to the Codacy Analysis CLI): `--repository-token` > `CODACY_PROJECT_TOKEN` > `CODACY_API_TOKEN` > stored `codacy login`. An explicit `--repository-token` wins outright, so a deliberately scoped run is never silently widened. Note that `CODACY_PROJECT_TOKEN` outranks `CODACY_API_TOKEN` — unset it if you want your account token used. + + **Not every command accepts a repository token**, because Codacy only honours them on a limited set of repository-scoped operations: + + - **Fully supported:** `tools`, `tool`, `patterns`, `pattern`, `issues` (including `--overview`), `tools --import`, `repository --reanalyze` / `--reanalyze-and-wait`. + - **Partially supported:** `repository` works but omits the pull request and coverage sections. In `--output json`, `pullRequests` stays an empty array and a new `unavailable: ["pullRequests"]` field marks what couldn't be fetched. Output under an account token is unchanged. + - **Account token required:** `info`, `repositories`, `ls`, `directories`, `pull-request`, `pull-requests`, `issue`, `findings`, `finding`, `issues --ignore`/`--ignored`, `tools --import --force`, and `repository`'s `--add`/`--remove`/`--follow`/`--unfollow`/`--link-standard`/`--unlink-standard`. + + Unsupported combinations now fail immediately with a message naming the operation, why a repository token can't perform it, and which token is in use — instead of sending a request that comes back as a bare `Unauthorized`. + + `codacy login` continues to store account tokens only; repository tokens are passed per command or via the environment. + + Also fixed: `codacy repository` no longer loses the entire dashboard when the pull request lookup fails, and `codacy login` no longer reports a repository token as "invalid" when it is rejected for being the wrong kind of token. + ## 1.8.0 ### Minor Changes diff --git a/package.json b/package.json index d438f16..6b46ec3 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@codacy/codacy-cloud-cli", - "version": "1.8.0", + "version": "1.9.0", "description": "A command-line tool to interact with Codacy Cloud from your terminal", "homepage": "https://www.codacy.com", "repository": {