@gooddata/create-pluggable-module 11.41.0-alpha.3 → 11.41.0-alpha.4

package/dist/templates/harness/package.json

@@ -1,6 +1,6 @@
 {
     "name": "gdc-app-template-name-harness",
-    "version": "11.41.0-alpha.3",
+    "version": "11.41.0-alpha.4",
     "private": true,
     "description": "Standalone harness for gdc-app-template-name module",
     "license": "UNLICENSED",

package/dist/templates/module/package.json

@@ -1,6 +1,6 @@
 {
     "name": "gdc-app-template-name-module",
-    "version": "11.41.0-alpha.3",
+    "version": "11.41.0-alpha.4",
     "private": true,
     "description": "{applicationTemplateTitle} pluggable application module",
     "license": "UNLICENSED",

package/esm/engine/__tests__/copyTemplate.test.js

@@ -48,6 +48,17 @@ describe("copyTemplate", () => {
         const copied = readFileSync(join(dest, "image.png"));
         expect(copied.equals(binaryContent)).toBe(true);
     });
+    it("copies TLS cert fixtures (.crt/.key) verbatim — never token-substituted", () => {
+        // Self-signed e2e certs are cryptographic artifacts. Even though PEM is ASCII, a
+        // token match inside the body must not rewrite the cert, so they go through the
+        // verbatim (BINARY_EXTENSIONS) path.
+        const pem = "-----BEGIN CERTIFICATE-----\nTOKENISH-base64-payload\n-----END CERTIFICATE-----\n";
+        writeFileSync(join(src, "server.crt"), pem);
+        writeFileSync(join(src, "server.key"), pem);
+        copyTemplate(src, dest, [["TOKENISH", "REPLACED"]]);
+        expect(readFileSync(join(dest, "server.crt"), "utf-8")).toBe(pem);
+        expect(readFileSync(join(dest, "server.key"), "utf-8")).toBe(pem);
+    });
     it("token substitution ORDER matters — longer-first prevents partial overlap", () => {
         writeFileSync(join(src, "a.txt"), "foo-bar foo");
         const { written: _w } = copyTemplate(src, dest, [

package/esm/engine/__tests__/snapshot.test.js

@@ -5,6 +5,7 @@ import { tmpdir } from "os";
 import { dirname, join, relative } from "path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { clientProfile } from "../../profiles/client.js";
+import { BINARY_EXTENSIONS } from "../copyTemplate.js";
 import { runProfileWithAnswers } from "../runProfile.js";
 import { scrubPackageJsonVersions } from "./scrubPackageJsonVersions.js";
 // Resolve workspace template paths via pnpm's symlinks. The template packages
@@ -30,10 +31,11 @@ function treeToMap(root) {
                 continue;
             }
             const rel = relative(root, abs);
-            // Binary files (images, fonts) — record only their size so changes
-            // surface in the snapshot without including raw bytes.
+            // Binary files (images, fonts, cert fixtures) — record only their size so
+            // changes surface in the snapshot without including raw bytes. Reuses the
+            // engine's BINARY_EXTENSIONS so this list can never drift from copyTemplate.
             const ext = entry.name.slice(entry.name.lastIndexOf(".")).toLowerCase();
-            if ([".png", ".jpg", ".jpeg", ".gif", ".ico", ".woff", ".woff2", ".ttf", ".eot"].includes(ext)) {
+            if (BINARY_EXTENSIONS.has(ext)) {
                 out[rel] = `<binary, ${statSync(abs).size} bytes>`;
                 continue;
             }

package/esm/engine/copyTemplate.d.ts

@@ -1,4 +1,9 @@
 import type { TokenReplacements } from "../types.js";
+/**
+ * Files for which token-substitution-in-text would corrupt the byte stream.
+ * Binary files must be copied verbatim.
+ */
+export declare const BINARY_EXTENSIONS: Set<string>;
 export interface ICopyResult {
     /** Absolute paths of every file written. Used for the package.json transform pass. */
     written: string[];

package/esm/engine/copyTemplate.js

@@ -1,5 +1,5 @@
 // (C) 2026 GoodData Corporation
-import { cpSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "fs";
+import { chmodSync, cpSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
 import { join } from "path";
 /**
  * Directories that should never be copied. Tooling output (`node_modules`,
@@ -13,7 +13,7 @@ const SKIP_SUFFIXES = [".tsbuildinfo"];
  * Files for which token-substitution-in-text would corrupt the byte stream.
  * Binary files must be copied verbatim.
  */
-const BINARY_EXTENSIONS = new Set([
+export const BINARY_EXTENSIONS = new Set([
     ".ico",
     ".png",
     ".jpg",
@@ -23,6 +23,10 @@ const BINARY_EXTENSIONS = new Set([
     ".woff2",
     ".ttf",
     ".eot",
+    // TLS fixtures (self-signed e2e certs): cryptographic artifacts that must
+    // never be touched by token substitution, even though PEM is ASCII text.
+    ".crt",
+    ".key",
 ]);
 /**
  * Recursively copies srcDir → destDir applying ordered string replacement to
@@ -57,6 +61,7 @@ function copyRecursive(srcDir, destDir, replacements, written) {
 function copyFile(srcPath, destPath, name, replacements, written) {
     const ext = name.slice(name.lastIndexOf(".")).toLowerCase();
     if (BINARY_EXTENSIONS.has(ext)) {
+        // cpSync preserves the source mode (including the executable bit) by default.
         cpSync(srcPath, destPath);
         written.push(destPath);
         return;
@@ -66,5 +71,14 @@ function copyFile(srcPath, destPath, name, replacements, written) {
         content = content.replaceAll(token, value);
     }
     writeFileSync(destPath, content, "utf-8");
+    // writeFileSync creates with default perms (0o666 & ~umask), dropping the source's
+    // executable bit. Carry over ONLY the source's exec bits (never clearing write bits,
+    // so a read-only source can't make the copy read-only and break a later rewrite) so
+    // shell scripts stay runnable — both the package.json `./scripts/...sh` entries and the
+    // CI ref-workspace action invoke them directly (`./create-ref-workspace.sh`), needing +x.
+    const execBits = statSync(srcPath).mode & 0o111;
+    if (execBits) {
+        chmodSync(destPath, statSync(destPath).mode | execBits);
+    }
     written.push(destPath);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gooddata/create-pluggable-module",
-  "version": "11.41.0-alpha.3",
+  "version": "11.41.0-alpha.4",
   "description": "Scaffolder for GoodData pluggable applications. Invoked via `npm init @gooddata/pluggable-module`.",
   "license": "MIT",
   "author": "GoodData Corporation",
@@ -50,10 +50,10 @@
     "typescript": "5.9.3",
     "vite": "8.0.16",
     "vitest": "4.1.8",
-    "@gooddata/eslint-config": "11.41.0-alpha.3",
-    "gdc-app-template-name-harness": "11.41.0-alpha.3",
-    "@gooddata/oxlint-config": "11.41.0-alpha.3",
-    "gdc-app-template-name-module": "11.41.0-alpha.3"
+    "@gooddata/eslint-config": "11.41.0-alpha.4",
+    "@gooddata/oxlint-config": "11.41.0-alpha.4",
+    "gdc-app-template-name-module": "11.41.0-alpha.4",
+    "gdc-app-template-name-harness": "11.41.0-alpha.4"
   },
   "engines": {
     "node": ">=24.12.0"