@databricks-solutions/lakebase-scm-utils 0.2.43 → 0.2.44

package/scripts/lakebase/secret-auth.ts

@@ -100,10 +100,17 @@ export async function ensureLakebaseSecretAuth(
     throw new Error("databricks tokens create returned no token_value");
   }
 
-  // 3. Store the PAT
-  await runDatabricks(["secrets", "put-secret", scopeName, keyName, "--string-value", pat], {
+  // 3. Store the PAT. Feed the secret in a `--json @/dev/stdin` body (via opts.input)
+  //    rather than a `--string-value <pat>` argv element, so the 90-day user PAT never
+  //    appears in the process table / `ps`. The JSON MUST use `string_value`
+  //    (not bytes_value): bare stdin would flip the CLI to a base64 `bytes_value` field,
+  //    which the app then cannot read back as its Lakebase password at runtime. `pat` is
+  //    already validated non-empty above, so the empty-stdin "silent success on no value"
+  //    trap cannot occur here.
+  await runDatabricks(["secrets", "put-secret", "--json", "@/dev/stdin"], {
     profile,
     timeout: timeoutMs,
+    input: JSON.stringify({ scope: scopeName, key: keyName, string_value: pat }),
   });
 
   // 4. ACL (best-effort)

package/templates/project/common/scripts/run-tests.sh

@@ -176,6 +176,16 @@ if [ "$#" -eq 0 ] && [ -f "$REPO_ROOT/client/package.json" ]; then
       ( cd "$REPO_ROOT/client" && npm install --include=dev )
     fi
   fi
+  # Strict typecheck BEFORE the tests, matching CI. CI builds the client with
+  # `tsc --noEmit && vite build` (strict), but the local test lanes run vitest +
+  # Playwright against the Vite dev server, which does NOT strict-typecheck the whole
+  # app — so a cross-story type regression (a later story making a field REQUIRED,
+  # breaking an earlier story's construction of that type) passed the local honest-GREEN
+  # + deploy feature-verify and was caught ONLY by CI, after promote. Run the SAME strict
+  # typecheck here so local GREEN matches CI. `--if-present` no-ops on an older scaffold
+  # with no `typecheck` script; a type error fails the run (set -e), exactly like a test.
+  echo "Running client strict typecheck (tsc --noEmit, matching CI's build)..."
+  ( cd "$REPO_ROOT/client" && npm run typecheck --if-present )
   echo "Running client unit tests (Vitest)..."
   ( cd "$REPO_ROOT/client" && npm test )
 fi