Skip to content

Certify pm-jira on PM CLI 2026.10.4 and consolidate pending dependency updates - #126

Merged
unbraind merged 2 commits into
mainfrom
chore/pm-jira-pm-cli-2026-10-4
Oct 4, 2026
Merged

unbraind merged 2 commits into
mainfrom
chore/pm-jira-pm-cli-2026-10-4

Conversation

@unbraind

@unbraind unbraind commented Oct 4, 2026 •

Copy link
Copy Markdown
Owner

Pins PM CLI/SDK, pm-ops, pm-changelog and managed pm-github to 2026.10.4, with exact development dependency versions and the unchanged SDK floor. Consolidates Dependabot #118, #121, #122 and #123, including the exact CodeQL SHA/comment bump. Copies the published merge-driver launcher unchanged and adds a real malformed-lookup regression.

Packed real-tracker acceptance exposed unregistered native Jira importer/exporter flags. A new activation-contract test failed before the repair; existing pull/export definitions are now registered through the supported SDK, so documented CLI options reach their handlers without a parser bypass or new floor.

Validation (heavy commands serialized with the shared flock):

  • npm run release:check through linked pm test pm-jira-gdlw --run --progress, using env -u PM_PATH for the CI child: 195/195 pass, zero skips.
  • Coverage: 100% lines / branches / functions across two application TS files. Existing operational-script exclusion remains visible; statements unmeasured. No thresholds or ignores changed.
  • Launcher: 8/8 pass. New importer/exporter flag contract: 1/1 pass after a demonstrated failure.
  • npm audit and npm audit --omit=dev: zero vulnerabilities; no open Dependabot security alerts.
  • npx pm health --strict-exit --require-merge-drivers: exit 0, one advisory stale-item finding.
  • bun install --no-save: exit 0; no existing Bun lockfile is changed.
  • npm pack installed into the copied real project tracker. npm/npx and native Bun (bunx --bun @unbrained/pm-cli@2026.10.4): pass for validate, sync/import dry runs, ordinary export and rich/update-existing export. All nine real items exported, independently confirmed against a complete unbounded list, with the owner present and complete JSON parity; scratch deleted. Live Jira authentication/network calls are outside this acceptance.
  • Managed pm-github read-only dry-run: zero linked provenance cases, synced/skipped/planned all 0. No issue writes or scheduling changes.
  • Changelog regenerated after PM mutations; check passes.

Exact commands and scope. PM owner pm-jira-gdlw stays open for orchestrator verification, merge and closure.


Summary by cubic

Certifies pm-jira on PM CLI/SDK 2026.10.4, consolidates the pending Dependabot updates into one branch, and records verified CI and reviewer evidence at the final head. This also fixes a regression where native Jira import/export flags were rejected by CLI 2026.10.4 because the package never registered them.

Bug Fixes

  • Registers the existing PULL_FLAGS and EXPORT_FLAGS through the SDK schema API, so pm jira import and pm jira export advertise their documented flags without a parser bypass or floor increase.
  • Replaces the merge-driver launcher with the published canonical version and adds a regression for non-directory node_modules lookup paths.

Dependencies

  • Pins @unbrained/pm-cli, pm-ops, and pm-changelog to 2026.10.4, @types/node to 26.6.4, and TypeScript to 7.0.2 without changing the existing CLI peer floor.
  • Updates the managed pm-github extension and CI restore pin to 2026.10.4, and adopts the exact CodeQL SHA from Dependabot; scheduled sync stays disabled.

No migration steps are required. Full validation passes 195/195 tests with zero skips and unchanged 100% coverage thresholds. CI and reviewer evidence was verified at the exact head, with the certification item left open for orchestrator verification.

Written for commit e2feba4. Summary will update on new commits.

Review in cubic

Summary by Sourcery

Certify pm-jira on PM CLI/SDK 2026.10.4 while consolidating dependency updates and repairing native Jira flag registration.

Bug Fixes:

  • Register the documented Jira import and export flags so native CLI commands can reach their existing handlers.
  • Preserve the original module-resolution error when merge-driver discovery encounters malformed lookup paths.

Enhancements:

  • Certify pm-jira against PM CLI and SDK 2026.10.4, including packed npm and native Bun real-tracker acceptance.
  • Consolidate and pin the pending development and managed-extension dependency updates without changing the existing CLI compatibility floor.

CI:

  • Update the managed pm-github CI restoration version and pin CodeQL actions to the Dependabot-provided revision.

Documentation:

  • Add certification documentation covering validation scope, packed acceptance, and observed results.

Tests:

  • Add regression coverage for malformed node_modules lookup paths and the native Jira importer/exporter flag activation contract.

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @unbraind, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 19 hours by commenting @sourcery-ai review. Upgrade to get a review now.

@coderabbitai

coderabbitai Bot commented Oct 4, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 31 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 075af854-d024-4194-b0a1-97c47773d6b6
📥 Commits

Reviewing files that changed from the base of the PR and between a889967 and e2feba4.

📒 Files selected for processing (3)
  • .agents/pm/chores/pm-jira-gdlw.toon
  • .agents/pm/history/pm-jira-gdlw.jsonl
  • docs/certification-2026.10.4.md

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 1a2148f4-9e3a-4d8a-8db5-01ad2f38be04
📥 Commits

Reviewing files that changed from the base of the PR and between 21d52ae and a889967.

⛔ Files ignored due to path filters (3)
  • dist/index.js is excluded by !**/dist/**
  • dist/index.js.map is excluded by !**/dist/**, !**/*.map
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (11)
  • .agents/pm/chores/pm-jira-gdlw.toon
  • .agents/pm/extensions/.managed-extensions.json
  • .agents/pm/history/pm-jira-gdlw.jsonl
  • .github/workflows/ci.yml
  • .github/workflows/codeql.yml
  • docs/certification-2026.10.4.md
  • index.ts
  • package.json
  • scripts/prepare-merge-driver.ts
  • test/prepare-merge-driver.test.ts
  • test/smoke.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.


Summary by CodeRabbit

  • New Features
    • Jira import and export commands now advertise their supported options, including project aliases, dry-run and mapping controls, and export-specific settings.
  • Bug Fixes
    • The merge-driver setup now handles an invalid node_modules path more reliably, preserving the underlying installation error instead of reporting a misleading path error.

Walkthrough

This change updates dependency and workflow versions, adjusts the merge-driver package probe, registers Jira import and export flags, and adds tests and certification records for PM CLI/SDK 2026.10.4.

Changes

Jira CLI certification

Layer / File(s) Summary
Dependency and workflow versions
package.json, .agents/pm/extensions/.managed-extensions.json, .github/workflows/ci.yml, .github/workflows/codeql.yml
Development dependencies and the managed pm-github version change. CI uses pm-github@2026.10.4, and both CodeQL action pins change.
Merge-driver package probe
scripts/prepare-merge-driver.ts, test/prepare-merge-driver.test.ts
The pm-ops presence probe treats uncertain filesystem lookup results as present. A test covers a regular-file node_modules path and checks the reported error and merge-driver registration.
Jira command flag registration
index.ts, test/smoke.test.ts
The entry point registers pull and export flags for jira import and jira export. The smoke test checks the supported parser flags.
Certification results and tracking
docs/certification-2026.10.4.md, .agents/pm/chores/pm-jira-gdlw.toon, .agents/pm/history/pm-jira-gdlw.jsonl
Certification and work-tracking records report test, audit, coverage, and packed-package results. They state that no live Jira test ran.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to a8899

The dependency updates, Jira flag registrations, and merge-driver probe have no identified merge-blocking issue. Live Jira connectivity remains outside the reported certification scope.

Architecture Summary

Architecture risk: 🔵 Low · up to a8899

The change affects 5 systems.

Changed systems: index.ts, test, docs, package.json, scripts

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

  • observed — index.ts (service) was modified; 1 changed file maps to changed impact.
  • observed — test (service) was modified; 2 changed files map to changed impact.
  • observed — docs (service) was modified; 1 changed file maps to changed impact.
  • observed — package.json (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

  • observed — Modified behavior in docs/certification-2026.10.4.md: Adds the certification title and owner, records consolidated dependency and CI updates, and reports that the canonical merge-driver launcher passes all eight tests, including a malformed-filesystem fixture.
  • observed — Modified behavior in docs/certification-2026.10.4.md: Documents the commands run and their reported outcomes, including zero audit vulnerabilities, no planned GitHub sync changes, and unchanged coverage thresholds and source inventory.
  • observed — Modified behavior in docs/certification-2026.10.4.md: Describes packed-package acceptance in a scratch workspace, the Jira commands run through npm and native Bun, and checks for matching JSON, a nonempty export plan, and no Jira writes. Live authentication, tenancy, and network reachability are excluded.
  • observed — Modified behavior in docs/certification-2026.10.4.md: Records the initial gate result and the missing importer/exporter flag registrations found during acceptance, then reports the final 195-test gate and matching npm/Bun results for all nine tracker items and export plans.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the certification on PM CLI 2026.10.4 and the consolidated dependency updates.
Description check ✅ Passed The description covers the dependency updates, Jira flag registration, regression tests, and reported validation results in the changeset.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 4…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sourcery-ai

sourcery-ai Bot commented Oct 4, 2026

Copy link
Copy Markdown

Reviewer's Guide

This PR certifies pm-jira against PM CLI/SDK 2026.10.4 by consolidating exact dependency and automation pins, wiring native Jira importer/exporter flags through the supported SDK contract, hardening merge-driver lookup handling, and documenting the passing release, packed-package, and cross-runtime acceptance results.

Sequence diagram for native Jira flag registration and execution

sequenceDiagram
    participant CLI as PM_CLI
    participant SDK as PM_SDK
    participant Extension as pm_jira
    participant Jira as Jira_Pipeline

    CLI->>SDK: registerFlags(jira import, PULL_FLAGS)
    CLI->>SDK: registerFlags(jira export, EXPORT_FLAGS)
    CLI->>Extension: jira import or jira export
    SDK->>Extension: invoke registered handler
    Extension->>Jira: runImport or runExport
    Jira-->>CLI: command result
Loading

Flow diagram for packed cross-runtime acceptance

flowchart LR
    Source["pm-jira source"] --> Pack["npm pack"]
    Pack --> Workspace["Copied real tracker workspace"]
    Workspace --> Npm["PM CLI 2026.10.4 via npx"]
    Workspace --> Bun["PM CLI 2026.10.4 via native bunx"]
    Npm --> Compare["Compare JSON results"]
    Bun --> Compare
    Compare --> Verify["Verify nine items and pushed:false"]
Loading

File-Level Changes

Change Details Files
Certify the extension against PM CLI/SDK 2026.10.4 while consolidating dependency and workflow updates.
  • Pin development dependencies to exact 2026.10.4 and related package versions while preserving the existing peer and manifest floors.
  • Update the managed pm-github version used by CI and record the consolidated Dependabot and CodeQL SHA updates.
  • Regenerate the npm lockfile and add certification documentation covering commands, scope, and acceptance results.
package.json
package-lock.json
.github/workflows/ci.yml
.github/workflows/codeql.yml
.agents/pm/extensions/.managed-extensions.json
docs/certification-2026.10.4.md
Register Jira importer and exporter flags through the supported SDK activation contract.
  • Register the existing pull and export flag definitions for native Jira import and export commands.
  • Add a regression test asserting the documented parser flags are advertised by both command handlers.
  • Update the built distribution and source map to include the activation change.
index.ts
dist/index.js
dist/index.js.map
test/smoke.test.ts
Harden the merge-driver launcher against malformed module-resolution paths.
  • Treat filesystem lookup errors as inconclusive package presence so the original installer resolution error is preserved.
  • Copy/update the launcher behavior and add a malformed node_modules fixture regression without changing successful or failure status semantics.
scripts/prepare-merge-driver.ts
test/prepare-merge-driver.test.ts
Record PM orchestration ownership and history for the certification work.
  • Add the open certification owner item and execution history records used by the PM workflow.
.agents/pm/chores/pm-jira-gdlw.toon
.agents/pm/history/pm-jira-gdlw.jsonl

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@greptile-apps

greptile-apps Bot commented Oct 4, 2026 •

Copy link
Copy Markdown

RetriggerConfidence Score: 5/5

[High risk] Updates build dependencies and adds command-line flags to the extension.

The changes since the previous review appear safe to merge.

Summary

Certifies the package on PM CLI/SDK 2026.10.4, pins development dependencies, and registers the existing Jira import/export flags.

  • Adds regression tests for flag registration and malformed merge-driver lookup paths.
  • Updates the managed GitHub extension and CodeQL pins.
  • Changes since the previous review only add review receipts to the tracker and certification document. No new actionable issues were found.

Reviews (4) · Last reviewed commit: "Record green candidate CI and bounded re..."

@unbraind

unbraind commented Oct 4, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review
@greptileai
/gemini review

@coderabbitai

coderabbitai Bot commented Oct 4, 2026 •

Copy link
Copy Markdown
✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@unbraind

unbraind commented Oct 4, 2026

Copy link
Copy Markdown
Owner Author

Re this comment: This is an automatic-review eligibility skip for a repository below the star threshold, not a code review. A manual review request is being posted. No repository policy or gate was weakened to suppress it.

@unbraind

unbraind commented Oct 4, 2026

Copy link
Copy Markdown
Owner Author

Re this comment: Useful summary acknowledged. At a889967 both Node CI jobs pass, with the test-first native import/export flag repair and 195/195 local tests. Packed npm/native Bun exports all nine copied tracker items. Live Jira calls remain outside acceptance; no new actionable finding was supplied.

@unbraind

unbraind commented Oct 4, 2026

Copy link
Copy Markdown
Owner Author

Re this comment: Useful summary acknowledged. At a889967 both Node CI jobs pass, with the test-first native import/export flag repair and 195/195 local tests. Packed npm/native Bun exports all nine copied tracker items. Live Jira calls remain outside acceptance; no new actionable finding was supplied.

@unbraind

unbraind commented Oct 4, 2026

Copy link
Copy Markdown
Owner Author

Re this comment: This review body reports an exhausted review quota and supplies no source findings. It remains unavailable evidence, rather than approval; the reported tests and remaining blockers are independent.

@unbraind

unbraind commented Oct 4, 2026

Copy link
Copy Markdown
Owner Author

The edited review now covers a889967 with no actionable findings; acknowledged. Node 22 and 26 CI and both npm audits pass. The packed npm/native Bun receipt covers the copied tracker without live Jira authentication. This replaces the earlier automatic-skip assessment. Other unavailable reviewer evidence remains pending.

@unbraind

unbraind commented Oct 4, 2026

Copy link
Copy Markdown
Owner Author

Review command completion acknowledged; the substantive summary explicitly covers a889967 and reports no actionable findings. Node 22 and 26 CI and both npm audits pass. The packed npm/native Bun receipt covers the copied tracker without live Jira authentication.

@unbraind

unbraind commented Oct 4, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai review
@greptileai
/gemini review

@unbraind

unbraind commented Oct 4, 2026

Copy link
Copy Markdown
Owner Author

The newly edited summary skips automatic review of e2feba4 (fewer than10stars) while retaining its earlier source-candidate review. This skip is not approval of the final metadata head. Greptile independently reviewed the latest head; unchanged source receipts and earlier manual review remain scoped to their recorded SHAs.

@unbraind

unbraind commented Oct 4, 2026

Copy link
Copy Markdown
Owner Author

Acknowledged the updated substantive review explicitly covering e2feba4, with no new actionable findings. Known certification blockers remain documented; zero unresolved threads and green configured checks do not replace missing reviewer evidence.

@coderabbitai

coderabbitai Bot commented Oct 4, 2026 •

Copy link
Copy Markdown
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@unbraind

unbraind commented Oct 4, 2026

Copy link
Copy Markdown
Owner Author

The re-review command was rate limited. This is unavailable review evidence, not approval. The earlier substantive source review remains scoped to its recorded commit; the final metadata head is independently covered by current CI and Greptile.

@unbraind

unbraind commented Oct 4, 2026

Copy link
Copy Markdown
Owner Author

The edited comment now explicitly rate-limits review of the final metadata diff. The retained no-actionable summary describes the earlier source candidate. This does not constitute exact-final-head review clearance; quota and missing reviewer responses remain open in the handoff.

@unbraind
unbraind merged commit 2d14a8d into main Oct 4, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant