chore: promote the grouped deps bump into 5.3.1 (#123)

* chore: promote the grouped deps bump into 5.3.1

Promote from dev to stable, picking up the one change that landed after the
5.3.1 promotion (#119) and so missed the pending release PR (#120):

* deps: bump the minor-and-patch group with 6 updates (#121) —
  @supabase/supabase-js 2.112.2 -> 2.112.3, js-yaml 5.2.3 -> 5.3.0,
  @types/node 26.1.2 -> 26.2.0, eslint 10.8.0 -> 10.8.1, tsx 4.23.11 ->
  4.23.12, typescript-eslint 8.66.0 -> 8.67.0.

Carries only `pnpm-lock.yaml`. Dependabot left `package.json` untouched — every
range already admitted the new versions — so this changes nothing for npm
consumers, who resolve from those ranges. It matters only for the bun-compiled
standalone binaries, which bake in the locked versions.

`Release-As: 5.3.1` keeps the pending release PR (#120) on 5.3.1 rather than
rolling it to 5.3.2. Release-please regenerates the 5.3.1 section from this
commit's bullet alongside #119's three, so the changelog ends up carrying all
four entries.

Verified locally, because CI cannot check this branch: `pnpm install
--frozen-lockfile` (the lockfile agrees with production's package.json), `pnpm
lint` (0 errors, the same 32 pre-existing warnings — the eslint 10.8.1 and
typescript-eslint 8.67.0 bumps add no findings), `pnpm typecheck`, `pnpm build`,
and `pnpm audit --audit-level moderate` (no known vulnerabilities). The
integration tests did NOT run: dcd#1036 deleted `mock-api/`, which is also what
fails CI's `lint-and-test`, at a step that runs before the linter.

Release-As: 5.3.1

* ci: stop reaching into the private dcd repo for the mock-api

`lint-and-test` has failed on every same-repo PR since dcd#1036 deleted
`mock-api/` from the private devicecloud-dev/dcd repo this morning. CI checked
that directory out over an SSH deploy key and ran `pnpm install` in it; the
sparse-checkout now matches nothing, so the job dies at that step — before the
linter — and takes #120, #122 and #123 down with it.

Rather than re-point at a mock, this removes the linkage. dcd-cli is PUBLIC and
was holding `DCD_SSH_DEPLOY_KEY`, a credential granting read access to the
private repo, and pulling the API's `swagger.json` onto the runner on every
same-repo PR. Deleting the checkout drops both.

* The `Checkout dcd (mock-api)` and `Install Mock API dependencies` steps are
  gone, along with the `HAS_PRIVATE_ACCESS` gate that existed only to keep them
  off fork and Dependabot PRs. Every PR now takes the same path, so forks stop
  being second-class.
* CI runs `pnpm test:unit` — a new script that is the existing runner with
  `--unit`. `test/unit/*` is pure and needs no backend, so unit coverage is kept
  rather than dropped along with the integration suite.
* `scripts/test-runner.mjs` no longer defaults `MOCK_API_DIR` to
  `../../dcd/mock-api`. With no mock available it degrades to the unit suite and
  says so, instead of the bare ENOENT it throws today. Set `MOCK_API_DIR` and
  the integration specs run exactly as before.

`DCD_SSH_DEPLOY_KEY` can now be deleted from the repo's secrets — nothing reads
it. That is a separate manual step, not something this commit can do.

Two things are genuinely lost, both worth stating plainly rather than
discovering later:

* `test/integration/*` no longer runs anywhere automatically.
* With it goes the CLI<->swagger contract-drift check. Drift used to surface as
  a Prism 422 — that is how the `googlePlay` multipart break and the `tempPath`
  missing-example break were both caught. Nothing replaces it yet.

Verified locally: `pnpm test:unit` and a bare `pnpm test` both run the unit
suite only and print the notice; 81 pass and the 7 `flow-paths` failures are
Windows-only, asserting POSIX paths against win32 `path`. The same specs ran
green on ubuntu in the last full CI run (job 94750122384, 2026-08-14), which is
the platform CI uses. `pnpm lint`, `pnpm typecheck`, `pnpm build` and `pnpm
audit --audit-level moderate` are all clean.

Author: finalerock44

.github/workflows/cli-ci.yml

@@ -45,37 +45,23 @@ jobs:
   lint-and-test:
     runs-on: ubuntu-latest
 
-    # The mock-api lives in the private devicecloud-dev/dcd repo, checked out via an
-    # SSH deploy key. GitHub does NOT expose secrets to pull_request workflows
-    # triggered from forks, so that checkout (and the integration tests that need
-    # it) can only run for same-repo events. Fork PRs still run lint/typecheck/build.
+    # This repo is PUBLIC and runs no step that reaches into the private
+    # devicecloud-dev/dcd repo. It used to check out that repo's mock-api over an
+    # SSH deploy key to run test/integration/*, which meant a private-repo
+    # credential lived in a public repo's secrets and the API's OpenAPI spec was
+    # pulled onto the runner on every same-repo PR. dcd#1036 deleted that mock-api;
+    # rather than re-point at it, the linkage is gone.
     #
-    # Dependabot PRs branch from this repo (so the fork check passes) but ALSO run
-    # without secrets — treat them like forks and skip the private checkout, or
-    # the mock-api clone fails with an empty DCD_SSH_DEPLOY_KEY.
-    env:
-      HAS_PRIVATE_ACCESS: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && github.actor != 'dependabot[bot]' }}
-
+    # The consequence is deliberate: test/integration/* does NOT run here, and
+    # neither does the swagger contract-drift check it provided (spec drift used to
+    # surface as a Prism 422). Only test/unit/* runs — pure, no backend. To run the
+    # integration suite locally, point MOCK_API_DIR at a mock; see CLAUDE.md.
     steps:
     - name: Checkout CLI
       uses: actions/checkout@v7
       with:
         path: cli
 
-    - name: Checkout dcd (mock-api)
-      if: env.HAS_PRIVATE_ACCESS == 'true'
-      uses: actions/checkout@v7
-      with:
-        repository: devicecloud-dev/dcd
-        path: dcd
-        ssh-key: ${{ secrets.DCD_SSH_DEPLOY_KEY }}
-        # api/swagger.json is a file, which cone-mode sparse checkout rejects
-        # as of git 2.51 ("is not a directory") — use non-cone patterns.
-        sparse-checkout-cone-mode: false
-        sparse-checkout: |
-          /mock-api/
-          /api/swagger.json
-
     - name: Setup pnpm
       uses: pnpm/action-setup@v6.0.10
       with:
@@ -93,11 +79,6 @@ jobs:
       working-directory: ./cli
       run: pnpm install --frozen-lockfile
 
-    - name: Install Mock API dependencies
-      if: env.HAS_PRIVATE_ACCESS == 'true'
-      working-directory: ./dcd/mock-api
-      run: pnpm install --frozen-lockfile
-
     - name: Run CLI linter
       working-directory: ./cli
       run: pnpm lint
@@ -106,16 +87,12 @@ jobs:
       working-directory: ./cli
       run: pnpm typecheck
 
-    - name: Run CLI tests
-      if: env.HAS_PRIVATE_ACCESS == 'true'
+    - name: Run CLI unit tests
       working-directory: ./cli
-      env:
-        MOCK_API_DIR: ${{ github.workspace }}/dcd/mock-api
-      run: pnpm test
+      run: pnpm test:unit
 
-    - name: Skip integration tests (fork PR — no mock-api access)
-      if: env.HAS_PRIVATE_ACCESS != 'true'
-      run: echo "::notice::Integration tests skipped — the mock-api (private devicecloud-dev/dcd) is not accessible from fork PRs. Lint, typecheck, and build still ran."
+    - name: Note skipped integration tests
+      run: echo "::notice::Integration tests are not run in CI — they need a mock of the dcd API, and this public repo does not reach into the private one. Lint, typecheck, unit tests, build and audit all ran."
 
     - name: Build CLI
       working-directory: ./cli

CLAUDE.md

@@ -9,8 +9,12 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - `pnpm build:binaries` — `scripts/build-binaries.mjs` produces the bun-compiled, self-contained `dcd-<platform>-<arch>` binaries published to GitHub Releases (the install `dcd upgrade` self-updates). The platform/arch keys must stay in sync with `ASSET_BY_PLATFORM` in `src/commands/upgrade.ts`.
 - `pnpm lint` — ESLint over `src/` and `test/`.
 - `pnpm typecheck` — `tsc --noEmit -p tsconfig.test.json` over `src/` and `test/` (strict mode; `pnpm build` only compiles `src/`). Requires Node `>=22`.
-- `pnpm test` — runs `scripts/test-runner.mjs`: builds the CLI, boots the mock API, then runs all `test/**/*.test.ts` via mocha. TypeScript is loaded by **tsx** (`.mocharc.json`'s `node-option: ["import=tsx"]`), *not* ts-node — Mocha 11 imports specs as ESM, which bypasses the `require: ts-node/register` hook. The mock API lives in the **sibling `dcd/` repo** (`../dcd/mock-api`, started via `npm run start:auth` on port 3001). Override its location with `MOCK_API_DIR=/path/to/mock-api`. The runner isolates `DCD_CONFIG_DIR` to a temp dir so tests never touch your real `dcd login` session.
-- Tests split into `test/unit/*` (pure, no backend) and `test/integration/*` (drive the built CLI against the mock API). Run a single test: `pnpm mocha test/integration/cloud.integration.test.ts --timeout 60000` (picks up `.mocharc.json` which wires tsx; integration specs require the mock API already running on port 3001).
+- `pnpm test` — runs `scripts/test-runner.mjs`: builds the CLI, boots the mock API if one is available, then runs mocha. TypeScript is loaded by **tsx** (`.mocharc.json`'s `node-option: ["import=tsx"]`), *not* ts-node — Mocha 11 imports specs as ESM, which bypasses the `require: ts-node/register` hook. The runner isolates `DCD_CONFIG_DIR` to a temp dir so tests never touch your real `dcd login` session.
+- `pnpm test:unit` — the same runner with `--unit`: unit specs only, no mock API. **This is what CI runs.**
+- Tests split into `test/unit/*` (pure, no backend) and `test/integration/*` (drive the built CLI against a Prism mock of the dcd API on port 3001).
+- **There is no default mock API any more.** It used to live in the sibling private `dcd/` repo; dcd#1036 deleted it, and this repo — which is public — deliberately no longer reaches into that one (no deploy key, no `swagger.json` pull). So `pnpm test` with no `MOCK_API_DIR` set **silently degrades to the unit suite** and prints a notice. To run `test/integration/*`, stand up a Prism mock over the API's `swagger.json` and point `MOCK_API_DIR=/path/to/mock-api` at it (it needs a `start:auth` npm script serving port 3001).
+- Consequence worth knowing: CI no longer catches **CLI↔swagger contract drift**, which used to surface as a Prism 422 from the integration specs. Nothing replaces that check yet.
+- Run a single test: `pnpm mocha test/integration/cloud.integration.test.ts --timeout 60000` (picks up `.mocharc.json` which wires tsx; integration specs require the mock API already running on port 3001).
 
 ## Entry point
 

package.json

@@ -66,6 +66,7 @@
     "lint": "eslint src test --ext .ts",
     "prepare": "pnpm build && husky",
     "test": "node scripts/test-runner.mjs",
+    "test:unit": "node scripts/test-runner.mjs --unit",
     "typecheck": "tsc --noEmit -p tsconfig.test.json"
   },
   "version": "5.3.0",