Merge branch 'main' into renovate-external-fixes

Author: solaris007

packages/spacecat-shared-cloud-manager-client/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [@adobe/spacecat-shared-cloud-manager-client-v1.1.4](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-cloud-manager-client-v1.1.3...@adobe/spacecat-shared-cloud-manager-client-v1.1.4) (2026-04-18)
+
+### Bug Fixes
+
+* clone functionality to include submodules ([#1413](https://github.com/adobe/spacecat-shared/issues/1413)) ([a5c0016](https://github.com/adobe/spacecat-shared/commit/a5c0016987f6ebb8235493f877f1a681326192ec))
+
 ## [@adobe/spacecat-shared-cloud-manager-client-v1.1.3](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-cloud-manager-client-v1.1.2...@adobe/spacecat-shared-cloud-manager-client-v1.1.3) (2026-04-15)
 
 ### Bug Fixes

packages/spacecat-shared-cloud-manager-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/spacecat-shared-cloud-manager-client",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "description": "Shared modules of the Spacecat Services - Cloud Manager Client",
   "type": "module",
   "engines": {

packages/spacecat-shared-cloud-manager-client/src/index.js

@@ -260,7 +260,9 @@ export default class CloudManagerClient {
    * Builds authenticated git arguments for a remote command (clone, push, or pull).
    *
    * Both repo types use http.extraheader for authentication:
-   * - Standard repos: Basic auth header via extraheader on the repo URL
+   * - Standard repos: Basic auth header via extraheader scoped to the org prefix
+   *   (scheme + host + '/' + orgName + '/'), so the header covers all repos and submodules
+   *   belonging to that customer org without granting access to other orgs on the same host
    * - BYOG repos: Bearer token + API key + IMS org ID via extraheader on the CM Repo URL
    *
    * @param {string} command - The git command ('clone', 'push', or 'pull')
@@ -276,8 +278,11 @@ export default class CloudManagerClient {
     if (repoType === CM_REPO_TYPE.STANDARD) {
       const credentials = this.#getStandardRepoCredentials(programId);
       const basicAuth = Buffer.from(credentials).toString('base64');
+      const parsedUrl = new URL(repoUrl);
+      const orgName = parsedUrl.pathname.split('/')[1];
+      const repoOrgPrefix = `${parsedUrl.origin}/${orgName}/`;
       return [
-        '-c', `http.${repoUrl}.extraheader=Authorization: Basic ${basicAuth}`,
+        '-c', `http.${repoOrgPrefix}.extraheader=Authorization: Basic ${basicAuth}`,
         command, repoUrl,
       ];
     }
@@ -316,7 +321,7 @@ export default class CloudManagerClient {
       this.log.info(`Cloning CM repository: program=${programId}, repo=${repositoryId}, type=${repoType}`);
 
       const args = await this.#buildAuthGitArgs('clone', programId, repositoryId, { imsOrgId, repoType, repoUrl });
-      this.#execGit([...args, clonePath]);
+      this.#execGit([...args, '--recurse-submodules', clonePath]);
       this.log.info(`Repository cloned to ${clonePath}`);
       this.#logTmpDiskUsage('clone');
 

packages/spacecat-shared-cloud-manager-client/test/cloud-manager-client.test.js

@@ -278,14 +278,27 @@ describe('CloudManagerClient', () => {
       const cloneArgs = getGitArgs(execFileSyncStub.firstCall);
       const cloneArgsStr = getGitArgsStr(execFileSyncStub.firstCall);
       expect(cloneArgs).to.include('clone');
-      expect(cloneArgsStr).to.include(`http.${TEST_STANDARD_REPO_URL}.extraheader=Authorization: Basic c3RkdXNlcjpzdGR0b2tlbjEyMw==`);
+      expect(cloneArgsStr).to.include('http.https://git.cloudmanager.adobe.com/myorg/.extraheader=Authorization: Basic c3RkdXNlcjpzdGR0b2tlbjEyMw==');
       expect(cloneArgsStr).to.include(TEST_STANDARD_REPO_URL);
       expect(cloneArgs).to.include(EXPECTED_CLONE_PATH);
       // No credentials in the URL itself
       expect(cloneArgsStr).to.not.include('stduser:stdtoken123@');
       expect(cloneArgsStr).to.not.include('Bearer');
     });
 
+    it('includes --recurse-submodules in the clone arguments', async () => {
+      const client = CloudManagerClient.createFrom(createContext());
+
+      await client.clone(
+        TEST_PROGRAM_ID,
+        TEST_REPO_ID,
+        { imsOrgId: TEST_IMS_ORG_ID },
+      );
+
+      const gitArgs = getGitArgs(execFileSyncStub.firstCall);
+      expect(gitArgs).to.include('--recurse-submodules');
+    });
+
     it('throws when standard credentials not found for programId', async () => {
       const client = CloudManagerClient.createFrom(
         createContext({ CM_STANDARD_REPO_CREDENTIALS: TEST_STANDARD_CREDENTIALS }),
@@ -784,7 +797,7 @@ describe('CloudManagerClient', () => {
       const pushArgs = getGitArgs(execFileSyncStub.firstCall);
       const pushArgStr = getGitArgsStr(execFileSyncStub.firstCall);
       expect(pushArgStr).to.include('push');
-      expect(pushArgStr).to.include(`http.${TEST_STANDARD_REPO_URL}.extraheader=Authorization: Basic c3RkdXNlcjpzdGR0b2tlbjEyMw==`);
+      expect(pushArgStr).to.include('http.https://git.cloudmanager.adobe.com/myorg/.extraheader=Authorization: Basic c3RkdXNlcjpzdGR0b2tlbjEyMw==');
       expect(pushArgStr).to.include(TEST_STANDARD_REPO_URL);
       expect(pushArgStr).to.not.include('stduser:stdtoken123@');
       expect(pushArgStr).to.not.include('Bearer');
@@ -846,7 +859,7 @@ describe('CloudManagerClient', () => {
 
       const pullArgStr = getGitArgsStr(execFileSyncStub.firstCall);
       expect(pullArgStr).to.include('pull');
-      expect(pullArgStr).to.include(`http.${TEST_STANDARD_REPO_URL}.extraheader=Authorization: Basic c3RkdXNlcjpzdGR0b2tlbjEyMw==`);
+      expect(pullArgStr).to.include('http.https://git.cloudmanager.adobe.com/myorg/.extraheader=Authorization: Basic c3RkdXNlcjpzdGR0b2tlbjEyMw==');
       expect(pullArgStr).to.include(TEST_STANDARD_REPO_URL);
       expect(pullArgStr).to.not.include('stduser:stdtoken123@');
       expect(pullArgStr).to.not.include('Bearer');

packages/spacecat-shared-vault-secrets/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [@adobe/spacecat-shared-vault-secrets-v1.3.4](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-vault-secrets-v1.3.3...@adobe/spacecat-shared-vault-secrets-v1.3.4) (2026-04-15)
+
+### Bug Fixes
+
+* **vault-secrets:** revert to dedicated noCache() fetch context ([#1543](https://github.com/adobe/spacecat-shared/issues/1543)) ([ca25526](https://github.com/adobe/spacecat-shared/commit/ca255260a513109fcbf2284e613eaa48bc57a789)), closes [#1538](https://github.com/adobe/spacecat-shared/issues/1538) [#1538](https://github.com/adobe/spacecat-shared/issues/1538)
+
 ## [@adobe/spacecat-shared-vault-secrets-v1.3.3](https://github.com/adobe/spacecat-shared/compare/@adobe/spacecat-shared-vault-secrets-v1.3.2...@adobe/spacecat-shared-vault-secrets-v1.3.3) (2026-04-15)
 
 ### Bug Fixes

packages/spacecat-shared-vault-secrets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/spacecat-shared-vault-secrets",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "description": "Shared modules of the Spacecat Services - Vault secrets wrapper",
   "type": "module",
   "engines": {
@@ -33,7 +33,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@adobe/spacecat-shared-utils": "1.112.5",
+    "@adobe/fetch": "4.3.0",
     "aws4": "1.13.2"
   },
   "devDependencies": {

packages/spacecat-shared-vault-secrets/src/bootstrap.js

@@ -10,9 +10,11 @@
  * governing permissions and limitations under the License.
  */
 
-import { tracingFetch as fetch } from '@adobe/spacecat-shared-utils';
+import { noCache, h1NoCache } from '@adobe/fetch';
 import aws4 from 'aws4';
 
+const { fetch } = process.env.HELIX_FETCH_FORCE_HTTP1 ? h1NoCache() : noCache();
+
 /**
  * Loads Vault AppRole bootstrap credentials from AWS Secrets Manager.
  * This is the only AWS call in the entire package.

packages/spacecat-shared-vault-secrets/src/vault-client.js

@@ -10,7 +10,9 @@
  * governing permissions and limitations under the License.
  */
 
-import { tracingFetch as fetch } from '@adobe/spacecat-shared-utils';
+import { noCache, h1NoCache } from '@adobe/fetch';
+
+const { fetch } = process.env.HELIX_FETCH_FORCE_HTTP1 ? h1NoCache() : noCache();
 
 const TOKEN_RENEW_BUFFER = 5 * 60 * 1000;
 

packages/spacecat-shared-vault-secrets/test/fetch-context.test.js

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+import { expect } from 'chai';
+
+/**
+ * Covers the noCache() branch of the HELIX_FETCH_FORCE_HTTP1 ternary
+ * in vault-client.js and bootstrap.js. The default test setup forces
+ * HTTP/1 for nock compatibility, so this test re-imports the modules
+ * with the env var unset to exercise the HTTP/2 noCache() path.
+ */
+describe('fetch context selection', () => {
+  const originalValue = process.env.HELIX_FETCH_FORCE_HTTP1;
+
+  after(() => {
+    process.env.HELIX_FETCH_FORCE_HTTP1 = originalValue;
+  });
+
+  it('vault-client uses noCache() when HELIX_FETCH_FORCE_HTTP1 is unset', async () => {
+    delete process.env.HELIX_FETCH_FORCE_HTTP1;
+    const mod = await import(`../src/vault-client.js?ctx=${Date.now()}`);
+    expect(mod.default).to.be.a('function');
+  });
+
+  it('bootstrap uses noCache() when HELIX_FETCH_FORCE_HTTP1 is unset', async () => {
+    delete process.env.HELIX_FETCH_FORCE_HTTP1;
+    const mod = await import(`../src/bootstrap.js?ctx=${Date.now()}`);
+    expect(mod.loadBootstrapConfig).to.be.a('function');
+  });
+});

packages/spacecat-shared-vault-secrets/test/vault-secrets-wrapper.test.js

@@ -14,7 +14,6 @@ import { expect, use } from 'chai';
 import chaiAsPromised from 'chai-as-promised';
 import nock from 'nock';
 import sinon from 'sinon';
-import { clearFetchCache } from '@adobe/spacecat-shared-utils';
 import vaultSecrets, { loadSecrets, reset } from '../src/vault-secrets-wrapper.js';
 
 use(chaiAsPromised);
@@ -109,7 +108,6 @@ describe('vaultSecrets wrapper', () => {
 
   afterEach(() => {
     reset();
-    clearFetchCache();
     sinon.restore();
     nock.cleanAll();