@sap/cds-dk 9.1.3 → 9.2.1

package/CHANGELOG.md

@@ -6,8 +6,56 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 9.2.1 - 2025-08-22
+
+### Changed
+
+- `cds add github-actions` adds `if: always()` to the scripts retrieving Cloud Foundry logs.
+- `cds up` uses a default timeout of 10 minutes for Helm upgrades.
+- `cds bind` works out-of-the-box for PostgreSQL databases.
+- `cds bind -a` gives warning if no services are bound to the targeted app.
+
+### Fixed
+
+- `cds add github-actions` won't try to merge a `cf-info` action if there's an existing `mta.yaml`.
+- `cds add workzone` with missing `sap.app` config in `manifest.json` does not throw a `TypeError`.
+- `cds compile --to xsuaa` generates roles for `@requires` in bound actions.
+- `cds add lint` now adds proper configuration to enable linting of JavaScript and TypeScript files in VS Code.
+- `cds add mta` does no longer adds services in `mta.yaml` for plugins coming from `devDependencies`.
+
+## Version 9.2.0 - 2025-07-31
+
+### Added
+
+- `cds add xsuaa` now also creates a default `role-collections` field in the `mta.yaml`.
+- `cds add github-actions` (shortcut `gha`) adds pipeline configuration for GitHub Actions.
+- `cds add kyma` as a shortcut for `cds add helm,containerize`.
+- `cds add multitenancy` creates a `package-lock.json` in `mtx/sidecar` for Java projects if not existing.
+- `cds build` provides more defaults in its standard `.hdiconfig`.
+
+### Changed
+
+- `cds up` auto-creates `package-lock.json` if required for `app/router`, `app/portal`, and `app/html5-deployer`.
+- `cds up` does not do retries when not running in CI/CD (`CI` environment variable is not set).
+- `cds add html5-repo` uses a folder `app/html5-deployer` instead of `ui-resources` for Kyma.
+- `cds add http` now generates auth headers with `:` separators again, as this is the only separator supporting empty passwords with the RestClient extension in VS Code. (For use with IntelliJ, separate username and password with a blank.)
+- `cds add html5-repo` will add the destinations to the application content deployer instead of the service instance.
+- `cds add helm` exposes the `srv` module by default in Kyma scenarios.
+- `cds add multitenancy` with Helm exposes the sidecar URL for consumption by Java.
+- `cds add ias` will use the `production` profile by default, if no other profile is specified.
+- `cds add http` now uses the proper service name in the generated requests.
+- `cds build` error messages for build plugins are improved.
+
+### Fixed
+
+- `cds add multitenancy` for Kyma with IAS correctly adds the `subscription-manager` service.
+- `cds watch/run myapp/` now outputs correct error locations like `myapp/srv/broken.cds` instead of `srv/broken.cds`.  These locations can be opened from shells as they are relative to the working folder, not to the project folder.
+- `cds add data --records` now correctly generates decimals within the range of the specified precision and scale.
+
 ## Version 9.1.3 - 2025-07-24
 
+### Fixed
+
 - Fix installation issues with version 9.1.2.
 
 ## Version 9.1.2 - 2025-07-24

package/bin/bind.js

@@ -159,6 +159,8 @@ async function cds_bind(args, options) {
         const resolvedServices = [], unresolvedServices = {}
         const services = (await require('../lib/util/cf').services(app)).filter(s => Object.keys(s.credentials).length > 0)
 
+        if (!services) console.warn(`no services bound to app ${app} - nothing to bind`)
+
         services.forEach(service => {
             const type = service.label || service.type;
             const requiredServiceEntry = Object.entries(cds.env.requires).find(([, requiredService]) => requiredService.kind === type && requiredService?.vcap?.name === service.name)

package/bin/cds.js

@@ -101,6 +101,8 @@ const cli = {
     } catch (e) {
       process.exitCode ??= 1
       if (cds.watched)  throw e  // bin/watched.js handles errors
+      if (e.messages?.length)
+        cds._log(e.messages, { 'log-level': cds.env.log.levels.cli }) // REVISIT: no special handling for compiler messages
       else return console.error(e)
     }
   },

package/bin/repl.js

@@ -56,8 +56,10 @@ async function repl (_, options={}) {
     ignoreUndefined: true,
     useGlobal: true,
     writer: o => {
+      const options = {}
       if (!o || typeof o !== 'object') return o
-      return inspect(o).replace(/\[Object: null prototype\] /g, '')
+      if ('init' in o && 'on' in o && 'run' in o) options.depth = 0
+      return inspect(o,options).replace(/\[Object: null prototype\] /g, '')
     }
   })
 
@@ -125,7 +127,7 @@ async function repl (_, options={}) {
   }
 
   async function _inspect (_args) {
-    const args = _args.split(' '), subjects={}, options = {}, defaults = inspect.defaultOptions
+    const args = _args.split(' '), subjects={}, options = { depth:0 }, defaults = inspect.defaultOptions
     for (let each of args) {
       // args of shape .<option>=<value> set inspect options
       if (each[0] === '.') each = eval(`options${each}`)

package/bin/up.js

@@ -79,6 +79,15 @@ async function up() {
   if (exists('mtx/sidecar') && !exists('mtx/sidecar/package-lock.json')) {
     run('npm i --package-lock-only --prefix mtx/sidecar')
   }
+  if (exists('app/router/package.json') && !exists('app/router/package-lock.json')) {
+    run('npm i --package-lock-only --prefix app/router')
+  }
+  if (exists('app/portal/package.json') && !exists('app/portal/package-lock.json')) {
+    run('npm i --package-lock-only --prefix app/portal')
+  }
+  if (exists('app/html5-deployer/package.json') && !exists('app/html5-deployer/package-lock.json')) {
+    run('npm i --package-lock-only --prefix app/html5-deployer')
+  }
 
   if (cds.cli.options.to === 'k8s') {
     if (!exists('chart')) run('cds add helm')
@@ -107,7 +116,7 @@ async function up() {
 
     run('npm i --package-lock')
     await runDetectingError('ctz containerize.yaml --log --push', /^\[?ERROR\]?.*/m)
-    let helmUpgrade = `helm upgrade --install ${appName} ./gen/chart ${nsHelm} --wait --wait-for-jobs`
+    let helmUpgrade = `helm upgrade --install ${appName} ./gen/chart ${nsHelm} --wait --wait-for-jobs --timeout=10m`
     if (hasXsuaa) helmUpgrade += ' --set-file xsuaa.jsonParameters=xs-security.json'
     run(helmUpgrade)
     run(`kubectl rollout status deployment ${appName}-srv ${nsKubectl} --timeout=8m`)
@@ -115,6 +124,7 @@ async function up() {
     if (exists('mtx/sidecar')) run(`kubectl rollout status deployment ${appName}-sidecar ${nsKubectl} --timeout=8m`)
   } else {
     run('mbt build -t gen --mtar mta.tar')
-    run('cf deploy gen/mta.tar -f')
+    const retries = process.env.CI ? '' : '--retries 0'
+    run(`cf deploy gen/mta.tar -f ${retries}`)
   }
 }

package/bin/util/log.js

@@ -1,5 +1,11 @@
-// sorts, filters, and writes compilation messages to console
+
+/**
+ * Sorts, filters, and writes compilation messages to console
+ * @param {import('@sap/cds-compiler').CompileMessage[]} messages
+ * @param {object} options
+ */
 module.exports = (messages, options={}) => {
+  const cds = require('../../lib')
   const { format } = require('../../lib/util/term')
   const logLevel = options && options['log-level'] || require('../../lib').env.log.levels.cli || ''
   const levels = {
@@ -17,6 +23,7 @@ module.exports = (messages, options={}) => {
     const internalError = m.name === 'EvalError' || m.name === 'InternalError' || m.name === 'RangeError'
     || m.name === 'ReferenceError' || m.name === 'SyntaxError' || m.name === 'TypeError'
     || m.name === 'URIError'
+    if (m.$location?.file) m.$location.file = cds.utils.local(m.$location.file) // recompute file locations based on original cwd
     const mf = format (m, m.severity, internalError, true)
     log (mf)
   }

package/bin/version.js

@@ -33,7 +33,7 @@ module.exports = Object.assign(list_versions, {
 
 const MISSING = '-- missing --'
 
-function list_versions(args, options) {
+function list_versions (args, options) {
   const {colors} = require('../lib/util/term')
 
   if (options['npm-list'] || options['npm-tree']) {
@@ -60,40 +60,46 @@ function list_versions(args, options) {
   process.stdout.isTTY && console.log()
 }
 
-function info({ root:cwd=process.cwd() }) {
+function info({ root: cwd = process.cwd() }) {
+
   const cds = require('../lib')
   const env = cds.env.for('cds', cwd)
-  env.cli ??= {}; env.cli.version ??= {}
-  const javaInfo = !env.cli.version.skipjava && env['project-nature'] === 'java'
-  if (javaInfo && process.stderr.isTTY) {
-    console.error('\x1b[2m'+'This takes a while. Collecting Java versions...', '\x1b[0m')
-  }
 
+  // Fetch versions for all CAP Node packages in the current project
   const npmRoot = execSync('npm root -g').toString().trim()
-  let versions = {
+  const versions = {
     ..._versions_from(_pkg_path('@sap/cds-dk', npmRoot), '@sap/cds-dk (global)'), // linked in cap/dev or installed globally
     ..._versions_from(_pkg_path('@sap/cds-dk', cwd)), // local dk, important for Java projects
     ..._versions_from(_pkg_path('@sap/cds', __dirname)), // @sap/cds from here
     ..._versions_from(_pkg_path('@sap/cds', cds.home)),  // ... or local @sap/cds
     ..._versions_from(_pkg_path('@cap-js/db-service', cwd)), // only required transitively
-    ..._versions_from(cwd), // ... more from local app dependencies
+    ..._versions_from(cwd,false), // ... more from local app dependencies
     '@sap/cds-compiler': cds.compiler.version(),
     'Node.js': process.version,
     'home': cds.home, // effective cds home
   }
-  // sort Node entries
-  versions = Object.keys(versions).sort().reduce((all, key) => { all[key] = versions[key]; return all }, {})
 
+  // Sort entries, with @sap/cds packages on top, followed by @cap-js packages
+  const keys = Object.keys(versions).sort(), sorted={}
+  for (let k of ['@sap/cds','@sap/cds-dk']) if (!(k in sorted)) sorted[k] = versions[k]
+  for (let k of keys) if (!(k in sorted) && k.startsWith('@sap/cds')) sorted[k] = versions[k]
+  for (let k of keys) if (!(k in sorted) && k.startsWith('@cap-js')) sorted[k] = versions[k]
+  for (let k of keys) if (!(k in sorted)) sorted[k] = versions[k]
+
+  // For Java projects we also need to collect the Java SDK version
+  const javaInfo = !env.cli?.version?.skipjava && env['project-nature'] === 'java'
   if (javaInfo) {
-    Object.assign(versions, capJavaVersion(cwd))
+    if (process.stderr.isTTY) console.error('\x1b[2m'+'This takes a while. Collecting Java versions...', '\x1b[0m')
+    Object.assign(sorted, capJavaVersion(cwd))
   }
-  return versions
+
+  return sorted
 }
 
 function _versions_from(pkg_path, pkg_label) {
   let pkg; try { pkg = require(join(pkg_path, 'package.json')) } catch { return {} }
   let versions = {}
-  if (pkg.name)  versions[pkg_label || pkg.name] = pkg.version
+  if (pkg.name && pkg_label !== false)  versions[pkg_label || pkg.name] = pkg.version
 
   const deps = { ...pkg.dependencies, ...pkg.devDependencies }
   for (let dep in deps) {
@@ -121,7 +127,6 @@ function _markdown (versions) {
 
   Object.keys(versions)
     .filter(mod => mod != pkg.name)
-    .sort()
     .forEach(id => console.log ('|', $(id, versions[id]), '|'))
 
   function $ (key, val=MISSING) {

package/lib/bind/shared.js

@@ -4,6 +4,7 @@ const { exists, read, fs, path } = cds.utils
 const git = require('../util/git')
 const { bold } = require('../util/term')
 
+// REVISIT: We should get rid of this...
 const KindToRequiresNameMap = {
     xsuaa: 'auth',
     'xsuaa-auth': 'auth',
@@ -21,7 +22,9 @@ const KindToRequiresNameMap = {
     'enterprise-messaging-http': 'messaging',
     'enterprise-messaging-shared': 'messaging',
     'redis-messaging': 'messaging',
-    'multitenancy': 'multitenancy'
+    'multitenancy': 'multitenancy',
+    'portal': 'portal',
+    'postgres': 'db'
 }
 
 const PreferredKinds = {
@@ -75,7 +78,8 @@ async function bind(options = { on: 'cf' }) {
             resolved.name = options.serviceArg
         } else if (kind) {
             const requiresName = KindToRequiresNameMap[kind]
-            if (!requiresName) throw new Error(`Unknown CDS service name for service ${bold(instance)}. Please specify as argument for ${bold('cds bind')}.`)
+
+            if (!requiresName) throw `unknown CDS service name for service ${bold(instance)} of kind ${bold(kind)} – please specify as argument for ${bold('cds bind')}`
             resolved.name = requiresName
         }
         resolved.name ??= `custom-service:${instance || secret}`

package/lib/build/plugins/helm/files/subcharts/web-application/Chart.yaml

@@ -5,4 +5,4 @@ name: web-application
 sources:
 - https://github.tools.sap/unified-runtime/web-application
 type: application
-version: 1.27.0
+version: 2.1.0

package/lib/build/plugins/helm/files/subcharts/web-application/templates/_helpers.tpl

@@ -34,7 +34,7 @@ Define Hosts for the APIRule (since v2alpha1)
 */}}
 {{- define "web-application.internal.exposeHosts" -}}
 {{- if .Values.expose.hosts }}
-{{ .Values.expose.hosts | toYaml }}
+{{ tpl (.Values.expose.hosts | toYaml) . }}
 {{- else }}
 {{- $name := (include "web-application.fullname" .) }}
 {{- if hasPrefix $name .Release.Namespace }}

package/lib/build/plugins/helm/files/subcharts/web-application/templates/deployment.yaml

@@ -68,6 +68,10 @@ spec:
         - name: OTEL_EXPORTER_OTLP_METRICS_ENDPOINT
           value: {{ .Values.otlp.metrics.endpoint }}
         {{- end }}
+        {{- if .Values.otlp.logs.enabled }}
+        - name: OTEL_EXPORTER_OTLP_LOGS_ENDPOINT
+          value: {{ .Values.otlp.logs.endpoint }}
+        {{- end }}
         {{- $envVars := (include "web-application.internal.processEnv" (dict "env" .Values.env "context" $) | fromJson) }}
         {{- if not $envVars.appName}}
         - name: APPLICATION_NAME
@@ -142,6 +146,10 @@ spec:
         - name: OTEL_EXPORTER_OTLP_METRICS_ENDPOINT
           value: {{ $.Values.otlp.metrics.endpoint }}
         {{- end }}
+        {{- if $.Values.otlp.logs.enabled }}
+        - name: OTEL_EXPORTER_OTLP_LOGS_ENDPOINT
+          value: {{ $.Values.otlp.logs.endpoint }}
+        {{- end }}
         {{- $envVars := (include "web-application.internal.processEnv" (dict "env" $sidecar.env "context" $) | fromJson) }}
         {{- if not (eq (len $envVars.vars) 0) }}
         {{- $envVars.vars | toYaml | nindent 8}}

package/lib/build/plugins/helm/files/subcharts/web-application/templates/virtual-service.yaml

@@ -1,4 +1,5 @@
 {{- if and .Values.expose.enabled (include "web-application.internal.TENANT_HOST_PATTERN" .) -}}
+---
 apiVersion: networking.istio.io/v1beta1
 kind: VirtualService
 metadata:
@@ -13,7 +14,15 @@ spec:
   {{- range $httpRule := .Values.expose.rules }}
     - match:
         - uri:
+          {{- if or $.Values.expose.APIRule.experimental (not $.Values.expose.APIRule.legacy)}}
+            {{- if eq $httpRule.path "/*" }}
+            prefix: "/"
+            {{- else }}
+            regex: "^{{ $httpRule.path | replace "{*}" "([A-Za-z0-9-._~!$&'()*+,;=:@]|%[0-9a-fA-F]{2})+" | replace "{**}" "([A-Za-z0-9-._~!$&'()*+,;=:@/]|%[0-9a-fA-F]{2})*" }}$"
+            {{- end }}
+          {{- else }}
             regex: {{ $httpRule.path }}
+          {{- end }}
           {{- if $httpRule.methods }}
           method:
             regex: ^({{ join "|" $httpRule.methods }})$
@@ -44,4 +53,33 @@ spec:
           - regex: .*
     {{- end }}
   {{- end }}
+{{ if not .Values.expose.APIRule.legacy }}
+---
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: {{ include "web-application.fullname" . }}-multitenancy
+  labels: {{- include "web-application.labels" . | nindent 4 }}
+spec:
+  rules:
+  - from:
+    - source:
+        principals:
+        - cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account
+    to:
+    {{- range $httpRule := .Values.expose.rules }}
+    - operation:
+        hosts:
+        - '*'
+        methods: {{ $httpRule.methods | toYaml | nindent 10 }}
+        paths:
+        {{- if eq $httpRule.path "/*" }}
+        - "/{**}"
+        {{- else }}
+        - {{ $httpRule.path }}
+        {{- end }}
+    {{- end }}
+  selector:
+    matchLabels: {{- include "web-application.selectorLabels" . | nindent 6 }}
+{{- end }}
 {{- end }}

package/lib/build/plugins/helm/files/subcharts/web-application/values.schema.json

@@ -1281,6 +1281,21 @@
                             "default": "http://telemetry-otlp-metrics.kyma-system.svc.cluster.local:4317"
                         }
                     }
+                },
+                "logs": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean",
+                            "title": "Add env variables",
+                            "default": false
+                        },
+                        "endpoint": {
+                            "type": "string",
+                            "default": "http://telemetry-otlp-logs.kyma-system.svc.cluster.local:4317"
+                        }
+                    }
                 }
             }
         },

package/lib/build/plugins/helm/files/subcharts/web-application/values.yaml

@@ -14,7 +14,7 @@ global:
     _internal:
       web-application:
         versions:
-          1.27.0: true
+          2.1.0: true
 ## Will be used instead of the `.Chart.Name`, e.g. when generating the Deployment name.
 # nameOverride: name
 
@@ -75,9 +75,9 @@ additionalVolumes: []
 #     memory: 1G
 
 ## Enable or disable istio sidecars for this workload (other default is taken, e.g. namespace)
-# istio:
-#   enabled: true
-
+## The default value is `true`, since the APIRule v2 requires an app to be part of the mesh.
+istio:
+  enabled: true
 # Availability related configuration
 availability:
   # The max disruption to the pods, see https://kubernetes.io/docs/tasks/run-application/configure-pdb/ for details
@@ -160,7 +160,7 @@ envFrom: []
 
 expose:
   APIRule:
-    legacy: true
+    legacy: false
   #   experimental: true
   ## Specifies the service's dns name for inbound external traffic. If it doesn't contain a dot, the default cluster domain will be appended.
   # host: ""
@@ -177,8 +177,7 @@ expose:
 
   # Rules represents collection of Rule to apply.
   rules:
-    - accessStrategies:
-        - handler: no_auth
+    - noAuth: true
       methods:
         - GET
         - POST
@@ -187,7 +186,7 @@ expose:
         - DELETE
         - HEAD
         - OPTIONS
-      path: /.*
+      path: /*
       ## APIRule CORS policy configuration
       ## https://kyma-project.io/#/api-gateway/user/custom-resources/apirule/04-10-apirule-custom-resource
       # corsPolicy:
@@ -221,8 +220,12 @@ otlp:
     endpoint: http://telemetry-otlp-metrics.kyma-system.svc.cluster.local:4317
   traces:
     enabled: true
-    # Trace endpoint
+    # Traces endpoint
     endpoint: http://telemetry-otlp-traces.kyma-system.svc.cluster.local:4317
+  logs:
+    enabled: true
+    # Logs endpoint
+    endpoint: http://telemetry-otlp-logs.kyma-system.svc.cluster.local:4317
 networkSecurity:
   enabled: true
   # allowNamespaceInternal: true

package/lib/build/plugins/helm/index.js

@@ -1,7 +1,7 @@
 const cds = require('../../../cds')
 const yaml = require('yaml')
 const { exists, path, readFileSync } = cds.utils
-const { Plugin, BuildError } = require('../../../build')
+const { Plugin, BuildError } = require('../..')
 const { join } = path
 const { readProject } = require('../../../init/projectReader')
 

package/lib/build/provider/hana/index.js

@@ -39,7 +39,7 @@ class HanaBuildPlugin extends InternalBuildPlugin {
             return
         }
         let wsPaths = []
-        if(getJournalEntities(model).length || cds.cli.options?.[OPTION_WS] || hasOptionValue(this.task.options[OPTION_WS], true)) {
+        if (getJournalEntities(model).length || cds.cli.options?.[OPTION_WS] || hasOptionValue(this.task.options[OPTION_WS], true)) {
             // workspace paths don't include the current project root
             wsPaths = await getWorkspacePaths()
         }
@@ -248,7 +248,7 @@ class HanaBuildPlugin extends InternalBuildPlugin {
             const options = { ...this.options(), messages: this.messages, dirs: csvDirs, baseDir: this.task.options.compileDest }
 
             const toHdbtabledata = cds.compile.to.hdbtabledata
-            if (!toHdbtabledata)  throw `hdbtabledata plugin not found – make sure to install package '@cap-js/hana'`
+            if (!toHdbtabledata) throw `hdbtabledata plugin not found – make sure to install package '@cap-js/hana'`
             const tableDataResult = await toHdbtabledata(model, options)
 
             for (let [tableData, { file, csvFolder }] of tableDataResult) {
@@ -472,8 +472,9 @@ class HanaBuildPlugin extends InternalBuildPlugin {
                 content['file_suffixes'][key] = template['file_suffixes'][key]
             }
         }
-        if (Object.keys(content['file_suffixes']).length !== hdiPlugins.size) {
-            this.pushMessage(`'HANA database plugin not found for file suffix [${Array.from(hdiPlugins).join(',')}]`)
+        if (Object.keys(content['file_suffixes']).length < hdiPlugins.size) {
+            const missingPlugins = Array.from(hdiPlugins).filter(key => !content['file_suffixes'][key.slice(1)])
+            this.pushMessage(`'HANA database plugin not found for following file suffix [${missingPlugins.join(', ')}]`)
         }
         await this.write(content).to(hdiConfigPath)
     }

package/lib/build/provider/hana/template/.hdiconfig-all

@@ -161,6 +161,12 @@
         },
         "hdbeshconfig": {
            "plugin_name": "com.sap.hana.di.eshconfig"
+        },
+        "hdbfabricvirtualtable" : {
+            "plugin_name" : "com.sap.hana.di.sharedreplica"
+        },
+        "hdbschedulerjob" : {
+            "plugin_name" : "com.sap.hana.di.schedulerjob"
         }
     }
 }

package/lib/compile/to-xsuaa.js

@@ -60,8 +60,10 @@ module.exports = function compile_to_xsuaa (model, options) {
     return findUserAttrInExpression(expr)
   }
 
-  cds.reflect(model).foreach(def => {
-    var reqAnnotations = def['@requires']
+  const authAnnotations = def => {
+    if (!def) return
+
+    let reqAnnotations = def['@requires']
     if(!Array.isArray(reqAnnotations)) reqAnnotations=[reqAnnotations]
 
     reqAnnotations.forEach(scope => {
@@ -73,7 +75,7 @@ module.exports = function compile_to_xsuaa (model, options) {
     const annotationRes = def['@restrict']
     if (annotationRes) {
       annotationRes.forEach(restriction => {
-        var restrTo = restriction.to
+        let restrTo = restriction.to
         if(!Array.isArray(restrTo)) restrTo=[restrTo]
         restrTo.forEach(scope =>{
           if (scope && !hardcoded.Scopes.includes(scope)) {
@@ -84,8 +86,15 @@ module.exports = function compile_to_xsuaa (model, options) {
         lattributes.forEach(attr => attributes[attr] = true)
       })
     }
+  }
+
+  cds.reflect(model).foreach(def => {
+    authAnnotations(def)
+    if (def.actions)   Object.values(def.actions).forEach(authAnnotations)
+    if (def.functions) Object.values(def.functions).forEach(authAnnotations)
   })
-  var roleTemplates = Object.keys(scopes).map((s) => {
+
+  const roleTemplates = Object.keys(scopes).map((s) => {
     return {
       name: s,
       description: 'generated',
@@ -140,6 +149,7 @@ function mergeConfig(base, generated) {
   mergeByName('scopes')
   mergeByName('attributes')
   mergeByName('role-templates')
+  mergeByName('role-collections')
 
   return result
 }

package/lib/deploy/to-hana/hana.js

@@ -250,7 +250,7 @@ spec:
     if (/[^\w-_]+/g.exec(cfServiceInstanceName)) {
       throw `Service name ${cfServiceInstanceName} must only contain alpha-numeric, hyphens, and underscores.`;
     }
-    console.log(`Using container ${bold(cfServiceInstanceName)}`);
+    console.log(`using container ${bold(cfServiceInstanceName)}`);
 
     const cfConfig = cfServiceInstanceMta?.parameters?.config;
     const serviceInstance = await cfUtil.getOrCreateService('hana', 'hdi-shared', cfServiceInstanceName, cfConfig);

package/lib/deploy/to-hana/hdiDeployUtil.js

@@ -6,7 +6,7 @@ const HDI_DEPLOY_LIB = '@sap/hdi-deploy';
 module.exports = new class HdiDeployUtil {
 
     async deploy(dbDir, vcapEnv = {}, { autoUndeploy, parameter={} } = {}) {
-        console.log(`Deploying to HANA from ${dbDir}`);
+        console.log(`deploying to HANA from ${dbDir}`);
 
         const { clean_env, deploy } = this._loadHdiDeployLib(dbDir);
 

package/lib/init/constants.js

@@ -22,6 +22,7 @@ module.exports = {
         HELM: 'helm',
         HELM_UNIFIED_RUNTIME: 'helm-unified-runtime',
         CONTAINERIZE: 'containerize',
+        KYMA: 'kyma',
         SAMPLES: 'samples', // deprecated
         TINY_SAMPLE: 'tiny-sample',
         SAMPLE: 'sample',
@@ -41,15 +42,15 @@ module.exports = {
         EXTENSIBILITY: 'extensibility',
         SIDE_BY_SIDE_EXTENSIBILITY: 'side-by-side-extensibility',
         MTX: 'mtx',
-        ATTACHMENTS: 'attachments',
-        MALWARE_SCANNER: 'malware-scanner',
+        APPROUTER: 'approuter',
         LOCAL_MESSAGING: 'local-messaging',
         FILE_BASED_MESSAGING: 'file-based-messaging',
         ENTERPRISE_MESSAGING: 'enterprise-messaging',
         ENTERPRISE_MESSAGING_SHARED: 'enterprise-messaging-shared',
         REDIS_MESSAGING: 'redis-messaging',
         KAFKA: 'kafka',
-        APPROUTER: 'approuter',
+        ATTACHMENTS: 'attachments',
+        MALWARE_SCANNER: 'malware-scanner',
         CONNECTIVITY: 'connectivity',
         DESTINATION: 'destination',
         HTML5_REPO: 'html5-repo',
@@ -64,6 +65,7 @@ module.exports = {
         LINT: 'lint',
         LINT_DEV: 'lint:dev',
         PIPELINE: 'pipeline',
+        GITHUB_ACTIONS: 'github-actions',
     }),
 
     REGEX_JAVA_PACKAGE: /^[a-z_][a-z0-9_]*(\.[a-z_][a-z0-9_]*)*$/g,

package/lib/init/index.js

@@ -139,7 +139,7 @@ module.exports = class CDSGenerator {
             throw 'the --for argument must not be empty'
         }
         if (cds.cli.options.force && !cds.cli.options.dry) {
-            console.log(`using '--force' ... existing files will be overwritten`)
+            console.log(`using '--force' ... existing files will be overwritten\n`)
         }
     }
 
@@ -190,6 +190,10 @@ module.exports = class CDSGenerator {
         if (cds.env['project-nature'] === 'java') {
             console.log('updating frozen dependencies in package-lock.json…')
             await cmd.spawnCommand('npm' , ['i', '--package-lock-only'], { cwd:cds.root })
+            if (exists('mtx/sidecar/package.json') && !exists('mtx/sidecar/package-lock.json')) {
+                console.log('updating frozen dependencies in mtx/sidecar/package-lock.json…')
+                await cmd.spawnCommand('npm', ['i', '--package-lock-only'], { cwd: path.join(cds.root, 'mtx/sidecar') })
+            }
         }
 
         if (cds.cli.command === COMMAND_INIT) {
@@ -237,6 +241,7 @@ module.exports = class CDSGenerator {
             if (plugin === 'sample-tiny') plugin = 'tiny-sample'
             if (plugin in { 'kibana-logging': 1, 'kibana': 1 }) plugin = 'application-logging'
             if (plugin === 'postgresql') plugin = 'postgres'
+            if (plugin === 'gha') plugin = 'github-actions'
 
             if (!templates.has(plugin)) {
                 const template = await this._createTemplate(plugin)

package/lib/init/merge.js

@@ -143,9 +143,13 @@ async function _mergeYAML(into, from, project, semantics = {}) {
         }).forEach(item => {
             if (Array.isArray(item)) item = item[0]
             const json = JSON.parse(String(node))
-            const whereFulfilled = Object.entries(item.where).every(([key, value]) =>
-                _getProperty(json, key) === value
-            )
+            const whereFulfilled = Object.entries(item.where).every(([key, value]) => {
+                if (Array.isArray(value)) {
+                    return value.every(v => _getProperty(json, key) === v)
+                } else {
+                    return _getProperty(json, key) === value
+                }
+            })
             if (whereFulfilled) {
                 const [collection] = collectionStack
                 dict.set(item, { json, node, index, collection })