@sap/cds-dk 9.2.1 → 9.3.0

package/CHANGELOG.md

@@ -6,6 +6,25 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 9.3.0 - 2025-09-01
+
+### Added
+
+- `cds bind -a` is now also supported for Kyma, where the app prefix can be passed for `-a`, e.g. `bookshop-srv`.
+- `cds build --for hana` now trims leading and trailing whitespaces in csv-Files if build option `trimCsvWhitespaces` is set.
+- `cds add github-actions` sets required `permissions`.
+- `cds up` supports a deployment layout where approuter or portal service configuration is in a top-level `.deploy` folder.
+- `cds add ias` sets the `access-token-format` to `jwt` by default.
+
+### Changed
+
+- `cds add sample` provides more i18n translations.
+- `cds add ias` sets the `xsuaa-cross-consumption` field to `true` by default.
+
+### Fixed
+
+- `cds add ias` adds a subdomain-less application URL in `redirect_uris`.
+
 ## Version 9.2.1 - 2025-08-22
 
 ### Changed

package/bin/bind.js

@@ -46,7 +46,7 @@ module.exports = Object.assign(cds_bind, {
 
     *-a | --to-app-services* <app>
 
-        Bind services of a given application (Cloud Foundry only).
+        Bind services of a given application.
 
     *--no-create-service-key*
 
@@ -83,7 +83,7 @@ const { bind, storeBindings } = require('../lib/bind/shared');
 
 
 async function cds_bind(args, options) {
-    const { on, 'to-app-services': app, to, out, 'output-file': outputFile, exec, credentials } = options
+    const { on = 'cf', 'to-app-services': app, to, out, 'output-file': outputFile, exec, credentials } = options
 
     if (exec) {
         process.env.CDS_ENV ??= 'hybrid'
@@ -103,10 +103,6 @@ async function cds_bind(args, options) {
         options.out ??= outputFile
     }
 
-    if (on === 'k8s' && app) {
-        throw `Option ${term.bold('--to-app-services')} is only supported for Cloud Foundry.`;
-    }
-
     if (credentials === true) {
         throw `Option ${term.bold('--credentials')} requires a JSON object or a file path.`;
     }
@@ -155,9 +151,10 @@ async function cds_bind(args, options) {
     options.for ??= 'hybrid';
 
     if (app) {
-        const cds = require('../lib/cds');
+        const cds = require('../lib/cds')
         const resolvedServices = [], unresolvedServices = {}
-        const services = (await require('../lib/util/cf').services(app)).filter(s => Object.keys(s.credentials).length > 0)
+        const plugin = require(`../lib/bind/${on}`)
+        const services = await plugin.services4(app)
 
         if (!services) console.warn(`no services bound to app ${app} - nothing to bind`)
 

package/bin/up.js

@@ -30,7 +30,7 @@ module.exports = Object.assign(up, {
 const { execSync, spawn } = require('node:child_process')
 const cds = require('../lib/cds')
 const { highlight, bold } = require('../lib/util/term')
-const { exists, fs, path } = cds.utils
+const { exists, fs, path, path: { join } } = cds.utils
 const { readProject } = require('../lib/init/projectReader')
 
 const run = cmd => {
@@ -79,14 +79,18 @@ async function up() {
   if (exists('mtx/sidecar') && !exists('mtx/sidecar/package-lock.json')) {
     run('npm i --package-lock-only --prefix mtx/sidecar')
   }
-  if (exists('app/router/package.json') && !exists('app/router/package-lock.json')) {
-    run('npm i --package-lock-only --prefix app/router')
-  }
-  if (exists('app/portal/package.json') && !exists('app/portal/package-lock.json')) {
-    run('npm i --package-lock-only --prefix app/portal')
+
+  const app = cds.env.folders.app
+  const legacyToPreferred = {
+    [join(app, 'router')]: '.deploy/app-router',
+    [join(app, 'portal')]: '.deploy/portal',
+    [join(app, 'html5-deployer')]: '.deploy/html5-deployer'
   }
-  if (exists('app/html5-deployer/package.json') && !exists('app/html5-deployer/package-lock.json')) {
-    run('npm i --package-lock-only --prefix app/html5-deployer')
+  for (const [legacy, preferred] of Object.entries(legacyToPreferred)) {
+    const root = exists(preferred) ? preferred : legacy
+    if (exists(join(root, 'package.json')) && !exists(join(root, 'package-lock.json'))) {
+      run(`npm i --package-lock-only --prefix ${root}`)
+    }
   }
 
   if (cds.cli.options.to === 'k8s') {

package/lib/bind/cf.js

@@ -33,6 +33,10 @@ module.exports = new class CFBind extends require('./plugin') {
         return service
     }
 
+    async services4(app) {
+        return (await cf.services(app)).filter(s => Object.keys(s.credentials).length > 0)
+    }
+
     async resolve(name, binding) {
         this.target ??= await cf.target()
         this.#checkApiEndpoint(name, binding)

package/lib/bind/k8s.js

@@ -30,6 +30,27 @@ module.exports = new class K8SBind extends require('./plugin') {
     return service
   }
 
+  services4(app) {
+    const { execSync } = require('node:child_process')
+    const json = cmd => JSON.parse(execSync(cmd, { encoding: 'utf8' }))
+
+    const bindings = json('kubectl get servicebindings -o json').items
+      .filter(b => b.metadata.name.startsWith(app))
+    if (!bindings.length) throw `cannot find services with metadata name starting with '${app}'`
+
+    const offerings = Object.fromEntries(
+      json('kubectl get serviceinstances -o json').items
+        .map(i => [i.metadata.name, i.spec.serviceOfferingName])
+    )
+
+    for (const b of bindings) {
+      const offering = offerings[b.spec.serviceInstanceName]
+      b.label = b.type = offering
+      b.name  = b.metadata.name
+    }
+    return bindings
+  }
+
   async resolve(name, binding) {
     const { context, namespace, cluster } = await this.#context4(binding)
 

package/lib/bind/plugin.js

@@ -36,6 +36,15 @@ module.exports = class BindPlugin {
     throw new Error('credentials4 not implemented')
   }
 
+  /**
+   * Returns the services for the given app
+   * @param {string} app - The name of the app
+   * @returns {Promise<Array>} A promise that resolves to an array of bound service names
+   */
+  services4(_app) {
+    throw new Error('services4 not implemented')
+  }
+
   /**
    * Resolves the binding configuration for the given service name
    * @param {string} name - The name of the service

package/lib/build/buildTaskProviderFactory.js

@@ -8,24 +8,13 @@ const BuildTaskProvider = require('./buildTaskProvider')
 const { BuildError, normalizePath } = require('./util')
 const DEBUG = cds.debug('cli|build')
 
-/** 
- * @typedef {{
- *  clean?: boolean,
- *  outputMode?: number,
- *  for?: string,
- *  src?: string,
- *  dest?: string,
- * } & {[key:string]:unknown}} BuildTaskProviderFactoryOptions
- */
-
 /**
- * TODO
- * @typedef {object} Task
+ * @typedef {import('./plugin').Task} Task
  */
 
 class BuildTaskProviderFactory {
     /**
-     * @param {BuildTaskProviderFactoryOptions} options - build options
+     * @param {import('./index').BuildOptions} options - build options
      */
     constructor(options = {}) {
         options.outputMode = options.outputMode || OUTPUT_MODE_FILESYSTEM
@@ -43,7 +32,7 @@ class BuildTaskProviderFactory {
                 }
             }
         })
-        /** @type {{ options: BuildTaskProviderFactoryOptions, tasks: Task}} */
+        /** @type {{ options: import('./index').BuildOptions, tasks: Task[]}} */
         this._context = { options, tasks: [] } // resolved tasks
     }
     get options() {
@@ -112,6 +101,7 @@ class BuildTaskProviderFactory {
      * 'for' defines an alias for built-in plugins like 'hana', 'java', 'node', 'fiori' or 'mtx'.
      * 'use' defines the fully qualified module name of custom build plugins implementations.
      * @param {Task} task
+     * @returns {typeof import('./plugin')}
      */
     getPlugin(task) {
         const provider = this._getProvider(task)
@@ -227,6 +217,10 @@ class PluginBuildTaskProvider extends BuildTaskProvider {
         })
     }
 
+    /**
+     * @param {{for: string}} key
+     * @returns {Task}
+     */
     getTask(key) {
         // plugin entry is already validated, a taskDefaults default member exists
         const task = JSON.parse(JSON.stringify(this.plugins.get(key.for)?.taskDefaults ?? {}))

package/lib/build/constants.js

@@ -38,6 +38,7 @@ exports.OPTION_WS = "ws"                                        // run a workspa
 exports.OPTION_WS_PACK = "ws-pack"                              // enable tarball based packaging of workspace dependencies
 exports.CSV_FILE_TARGET = "csvFileTarget"                       // target folder when copying CSV files to the deployment target folder ./db/src/gen/*, default is 'data'
 exports.CSV_FILE_DETECTION = "csvFileDetection"                 // detect CSV files based on CDS model location - ENABLED by default
+exports.CSV_TRIM_WHITESPACES = "trimCsvWhitespaces"        // trim whitespaces from CSV column names and values - DISABLED by default
 exports.EXTENSION_POINT_VALIDATION = "extensionPointValidation" // validate extension point restrictions defined by the extended SaaS app - ENABLED by default
 exports.MTX_SIDECAR_DB_VALIDATION = "mtxSidecarDbValidation"    // validate consistency of app and sidecar db configuration - ENABLED by default
 exports.CONTINUE_UNRESOLVED_SCHEMA_CHANGES = "continueUnresolvedSchemaChanges" // build doesn't fail if unresolved HANA schema changes are detected

package/lib/build/index.js

@@ -6,10 +6,25 @@ const { BuildError } = require('./util')
 
 module.exports = { build, register, Plugin, BuildError }
 
+// reuse schema definition from cds-rc.js used for package.json code completion
+/** @typedef{import('../env/schemas/cds-rc')['$defs']['buildTaskType']['enum'][number]} BuildFor */
+
+// using (string & {}) prevents widening of `'x' | string` to just `string`
+/**
+ * @typedef {{
+ *  clean?: boolean,
+ *  outputMode?: number,
+ *  for?: BuildFor | (string & {}),
+ *  src?: string,
+ *  dest?: string,
+ *  model?: string[]
+ * } & {[key:string]:unknown}} BuildOptions
+ */
+
 /**
  * Executes cds build in the directory defined by cds.root.
  *
- * @param {object} options - command options as defined by build command.
+ * @param {BuildOptions} options - command options as defined by build command.
  */
 async function build(options = {}) {
     if (!fs.existsSync(cds.root) || !cds.utils.isdir(cds.root)) {
@@ -31,4 +46,4 @@ async function build(options = {}) {
 
 function register(id, plugin) {
     return require('./plugins').register(id, plugin)
-}
+}

package/lib/build/plugin.js

@@ -21,7 +21,7 @@ const DEBUG = cds.debug('cli|build')
 
 /**
  * The build plugin creates the build output for a dedicated build task. It is uniquely identified
- * by the build task's `for<` or `use` property. The `use` property represents 
+ * by the build task's `for<` or `use` property. The `use` property represents
  * the fully qualified node module path of the build plugin implementation.
  * The build task engine defines the following protocol. The methods are invoked in descending order:
  *  - `init()` - optional
@@ -40,13 +40,11 @@ class Plugin {
 
     /**
      * @type {Task | undefined}
-     * @private
      */
     _task
 
     /**
      * @type {Context | undefined}
-     * @private
      */
     _context
 
@@ -69,7 +67,7 @@ class Plugin {
      */
     _messages = []
     /**
-     * Returns a list of build and compiler messages created by this build plugin. 
+     * Returns a list of build and compiler messages created by this build plugin.
      * Supported message severities are 'Info', 'Warning', and 'Error'.
      */
     get messages() {
@@ -176,9 +174,9 @@ class Plugin {
 
     /**
      * Asynchronously copies a single file or the entire directory structure from 'src' to 'dest', including subdirectories and files.
-     * 
+     *
      * Note: The file names are stored in the list of files written by this build plugin.
-     * 
+     *
      * @param {string} src - The absolute or relative source path of the file or directory to copy.
      * Relative paths will be resolved to this task's source path.
      * @returns {FileWriter}
@@ -216,7 +214,7 @@ class Plugin {
 
     /**
      * Adds the given user message and severity to the list of messages issued by this build task.
-     * 
+     *
      * User messages will be logged after CDS build has been finished based on the log-level that has been set.
      * By default messages with severity <em>warning</em> and <em>error</em> will be logged.
      * @param {string} message - the message text

package/lib/build/provider/hana/index.js

@@ -74,7 +74,7 @@ class HanaBuildPlugin extends InternalBuildPlugin {
                 await this._writePackageJson()
             }
 
-            // copy native hana artifacts from other workspaces including .hdbmigrationtable files defined for 
+            // copy native hana artifacts from other workspaces including .hdbmigrationtable files defined for
             // common model artifacts that are not part of the current project
             if (wsPaths.length || cds.cli.options?.[OPTION_WS] || hasOptionValue(this.task.options[OPTION_WS], true)) {
                 // first is winning, e.g. a .hdiconfig file might exist in multiple workspaces
@@ -272,7 +272,7 @@ class HanaBuildPlugin extends InternalBuildPlugin {
 
         for (const file of csvFiles) {
             if (this.isStagingBuild() || file.startsWith(this.task.options.compileDest)) {
-                await stripComments(file)
+                await stripComments(file, null, this.task.options.trimCsvWhitespaces)
             }
         }
     }
@@ -394,7 +394,7 @@ class HanaBuildPlugin extends InternalBuildPlugin {
             }
         }
         // The last-dev CSN shall only be updated, if all .hdbmigrationtable files could be successfully updated.
-        // Of course, .hdbmigrationtable files already written would need to be manually reverted before the 
+        // Of course, .hdbmigrationtable files already written would need to be manually reverted before the
         // cds build command is again executed.
         await Promise.all(promises)
 
@@ -578,7 +578,7 @@ class HanaBuildPlugin extends InternalBuildPlugin {
     /**
      * Returns all hana native artifacts located in db/src/** workspace folders.
      * @param {Array} workspacePaths Array of workspace paths, 'cds.root' is excluded from the list
-     * @returns {Array} Array of workspace files, each entry contains the db src directory, 
+     * @returns {Array} Array of workspace files, each entry contains the db src directory,
      * the relative file path and the file name.
      */
     async _getWorkspaceFiles(workspacePaths) {

package/lib/env/schemas/cds-rc.js

@@ -278,7 +278,7 @@ module.exports = {
         },
 
         buildTaskType: {
-            enum: [
+            enum: /**@type { const } */ ([
                 "nodejs",
                 "java",
                 "hana",
@@ -288,7 +288,7 @@ module.exports = {
                 "node-cf",
                 "java-cf",
                 "helm"
-            ],
+            ]),
             enumDescriptions: [
                 "Node.js build plugin",
                 "Java build plugin",

package/lib/init/constants.js

@@ -5,7 +5,7 @@ module.exports = {
     COMMAND_ADD: 'add',
 
     JAVA_LTS_VERSIONS: [17, 21],
-    MAVEN_ARCHETYPE_VERSION: '4.1.1',
+    MAVEN_ARCHETYPE_VERSION: '4.2.0',
 
     OPTIONS: Object.freeze({
         COMPLETION: 'completion',
@@ -60,6 +60,7 @@ module.exports = {
         NOTIFICATIONS: 'notifications',
         WORKZONE: 'workzone',
         WORKZONE_STANDARD: 'workzone-standard',
+        UI5: 'ui5',
         DATA: 'data',
         HTTP: 'http',
         LINT: 'lint',
@@ -74,7 +75,7 @@ module.exports = {
 
     URLS: Object.freeze({
         PIPELINE_HELP: 'https://www.project-piper.io/',
-        SAMPLES: 'https://github.com/SAP-samples/cloud-cap-samples',
+        SAMPLES: 'https://github.com/capire/samples',
         CAPIRE: 'https://cap.cloud.sap',
         MAVEN_ARCHETYPE_HELP: `https://cap.cloud.sap/docs/java/developing-applications/building#the-maven-archetype`,
         MAVEN_INSTALL_HELP: `https://maven.apache.org/install.html`,

package/lib/init/projectReader.js

@@ -124,7 +124,6 @@ module.exports = new class ProjectReader {
         const _isTypescript = () => !!pkgJson().dependencies?.typescript || !!pkgJson().devDependencies?.typescript
         const _hasTyper     = () => !!pkgJson().dependencies?.['@cap-js/cds-typer'] || !!pkgJson().devDependencies?.['@cap-js/cds-typer']
         const _inProd = plugin => require(`./template/${plugin}`).hasInProduction(env) || cds.cli.argv.includes(plugin) || cds.cli.options.add?.has(plugin)
-        const _ui5 = () => pkgJson().sapux
         const _uiEmbedded = () => exists(join(env.folders.app, 'xs-app.json'))
         const _uiModule = () => !_uiEmbedded() && isdir(env.folders.app) && fs.readdirSync(resolve(cds.root, env.folders.app)).length > 0
         const _isJava = () => this.isJava
@@ -134,6 +133,7 @@ module.exports = new class ProjectReader {
         }
         const reserved = {
             dependencies: () => pkgJson().dependencies,
+            devDependencies: () => pkgJson().devDependencies,
             has: x => _inProd(x),
             profile: () => cds.cli.options?.for,
             language: () => _isJava() ? 'java' : 'nodejs',
@@ -183,7 +183,7 @@ module.exports = new class ProjectReader {
             appPath: () => env.folders.app,
             appVersion: () => appVersion,
             jdkVersion: () => jdkVersion,
-            approuterPath: () => (_uiEmbedded() ? join(env.folders.app) : join(env.folders.app, 'router')).replace(/\\/g, '/'),
+            approuterPath: () => (_uiEmbedded() ? join(env.folders.app) : exists('.deploy/app-router') ? join('.deploy', 'app-router') : join(env.folders.app, 'router')).replace(/\\/g, '/'),
             appName: () => appName,
             cleanedAppName: () => appName.replaceAll('_', '-'),
             strippedAppName: () => appName.replace(/-/g, ''),
@@ -192,8 +192,6 @@ module.exports = new class ProjectReader {
             hasUIEmbedded: _uiEmbedded,
             hasUIModule: _uiModule,
             hasUI: () => _uiEmbedded() || _uiModule(),
-            isUI5: _ui5,
-            hasUI5: _ui5,
             literal: () => () => text => text,
             hasMTXRoute: () => _inProd('extensibility') || (_inProd('multitenancy') && !_isJava()),
             hasMTXRouteJava: () => (_inProd('helm-unified-runtime') || _inProd('helm')) && _isJava() && _inProd('multitenancy'),

package/lib/init/template/ams/index.js

@@ -1,4 +1,3 @@
-const cds = require('../../../cds')
 const { readProject } = require('../../projectReader')
 const { merge, sort } = require('../../merge')
 const { srv4 } = require('../../registries/mta')
@@ -15,7 +14,7 @@ module.exports = class AmsTemplate extends require('../../plugin') {
     }
 
     static hasInProduction(env) {
-        return env.requires?.auth?.ams || cds.cli.options?.add?.has('ams') || cds.cli.argv?.some(arg => arg?.match?.(/(^|,)ams(,|$)/))
+        return env.requires?.auth?.ams || readProject().devDependencies?.['@sap/ams']
     }
 
     async run() {

package/lib/init/template/approuter/files/containerize.yaml.hbs

@@ -10,6 +10,6 @@ modules:
         type: nodejs
         builder: builder-jammy-base
         {{/hasHelmUnifiedRuntime}}
-        path: app/router
+        path: {{& approuterPath}}
         env:
           BP_NODE_RUN_SCRIPTS: ""

package/lib/init/template/approuter/index.js

@@ -19,7 +19,7 @@ module.exports = class ApprouterTemplate extends require('../../plugin') {
     }
 
     static hasInProduction(env) {
-        return exists(join(env.folders.app, 'xs-app.json')) || exists(join(env.folders.app, 'router', 'xs-app.json'))
+        return exists(join('.deploy', 'app-router')) || exists(join(env.folders.app, 'xs-app.json')) || exists(join(env.folders.app, 'router', 'xs-app.json'))
     }
 
     async run() {

package/lib/init/template/extension/files/.base/index.cds

@@ -1,7 +1,7 @@
 entity my.bookshop.Books {
-  key ID : Integer;
-  title  : String  @title : 'Title';
-  stock  : Integer @title : 'Stock';
+  key ID    : Integer;
+      title : String  @title: 'Title';
+      stock : Integer @title: 'Stock';
 }
 
 service CatalogService {
@@ -9,7 +9,7 @@ service CatalogService {
 }
 
 annotate CatalogService.Books with @UI.LineItem: [
-  { Value: ID },
-  { Value: title },
-  { Value: stock },
+  {Value: ID},
+  {Value: title},
+  {Value: stock},
 ];

package/lib/init/template/extension/index.js

@@ -28,7 +28,7 @@ module.exports = class ExtensionProjectTemplate extends require('../../plugin')
     if (typeof base !== 'string' || !base?.length)  base = '@capire/bookshop'
 
     const pkgJson = exists('package.json') ? await read('package.json') : { name: 'my-extension-project' }
-    if (!pkgJson.extends || force) {
+    if (force || !pkgJson.extends) {
       pkgJson.extends = base
     }
 
@@ -38,7 +38,7 @@ module.exports = class ExtensionProjectTemplate extends require('../../plugin')
     }
     await write('package.json', pkgJson, { spaces: 2 })
 
-    if (!exists('.base/package.json') || force) {
+    if (force || !exists('.base/package.json')) {
       await write('.base/package.json', {name: base})
     }
 
@@ -56,17 +56,17 @@ module.exports = class ExtensionProjectTemplate extends require('../../plugin')
     const extensionNamespace = `${namespacify(proj.appName)}.${namespacify(projectSimple)}`
     const { force } = cds.cli.options
 
-    if (!exists('.base/index.cds') || force) {
+    if (force || !exists('.base/index.cds')) {
       await copy(join(__dirname, 'files/.base/index.cds'), '.base/index.cds')
     }
 
-    if (!exists('app/extension.cds') || force) {
+    if (force || !exists('app/extension.cds')) {
       await renderAndCopy(join(__dirname, 'files/app'), 'app', {
         basePackage: base,
         extensionNamespace
       })
     }
-    if (!exists('test/data') || force) {
+    if (force || !exists('test/data')) {
       await copy(join(__dirname, 'files/test/data/my.bookshop-Books.csv'), 'test/data/my.bookshop-Books.csv')
       await copy(join(__dirname, 'files/test/data/Authors.csv'), `test/data/${extensionNamespace}-x_Authors.csv`)
     }

package/lib/init/template/github-actions/files/{cf-github-deploy → github-deployment}/action.yaml

@@ -5,6 +5,9 @@ inputs:
   app-name:
     description: "Base name of the deployed CAP app"
     required: true
+  environment:
+    description: "Deployment environment name"
+    required: true
 
 runs:
   using: "composite"
@@ -21,20 +24,20 @@ runs:
       uses: actions/github-script@v7
       env:
         URL: ${{ steps.get-url.outputs.url }}
+        ENVIRONMENT: ${{ inputs.environment }}
       with:
         script: |
           const { owner, repo } = context.repo
           const ref = context.ref
           const url = process.env.URL
+          const environment = process.env.ENVIRONMENT
 
           const deployment = await github.rest.repos.createDeployment({
             owner,
             repo,
             ref,
             required_contexts: [],
-            environment: 'Production',
-            auto_merge: false,
-            description: 'Deployed to Cloud Foundry',
+            environment
           })
 
           await github.rest.repos.createDeploymentStatus({
@@ -43,6 +46,5 @@ runs:
             deployment_id: deployment.data.id,
             state: 'success',
             environment_url: url,
-            log_url: `https://github.com/${owner}/${repo}/actions/runs/${context.runId}`,
-            description: 'CAP app is live',
+            log_url: `https://github.com/${owner}/${repo}/actions/runs/${context.runId}`
           })

package/lib/init/template/github-actions/files/kyma-info/action.yaml

@@ -12,7 +12,7 @@ runs:
   steps:
     - name: Get Events
       shell: bash
-      run: kubectl get events --sort-by='.lastTimestamp' | tail -n 10
+      run: kubectl get events --sort-by='.lastTimestamp' | tail -n 20
     - name: Get Pods
       shell: bash
       run: kubectl get pods

package/lib/init/template/github-actions/files/workflows/cf.yaml.hbs

@@ -3,11 +3,14 @@ name: Cloud Foundry
 on:
   workflow_call:
   workflow_dispatch:
-  merge_group:
   push:
     branches:
       - main
 
+permissions:
+  contents: read
+  deployments: write
+
 concurrency:
   group: {{#literal}}cf-${{ github.workflow }}-${{ github.head_ref || github.run_id }}{{/literal}}
   cancel-in-progress: true
@@ -18,7 +21,7 @@ jobs:
   deploy:
     runs-on: {{#sap}}[self-hosted, solinas]{{/sap}}{{^sap}}ubuntu-latest{{/sap}}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: actions/setup-node@v4
         with:
           node-version: 22
@@ -32,21 +35,21 @@ jobs:
       - run: npm install
       - run: npx cds up
 
-      - uses: ./.github/actions/cf-github-deploy
+      - uses: ./.github/actions/github-deployment
         with:
           app-name: {{#literal}}${{ env.APP_NAME }}{{/literal}}
 
       {{#hasApprouter}}
-      - run: cf logs "${{ env.APP_NAME }}" --recent
+      - run: cf logs {{#literal}}"${{ env.APP_NAME }}"{{/literal}} --recent
         if: always()
       {{/hasApprouter}}
-      - run: cf logs "${{ env.APP_NAME }}-srv" --recent
+      - run: cf logs {{#literal}}"${{ env.APP_NAME }}-srv"{{/literal}} --recent
         if: always()
       {{^hasMultitenancy}}
-      - run: cf logs "${{ env.APP_NAME }}-db-deployer" --recent
+      - run: cf logs {{#literal}}"${{ env.APP_NAME }}-db-deployer"{{/literal}} --recent
         if: always()
       {{/hasMultitenancy}}
       {{#hasMultitenancy}}
-      - run: cf logs "${{ env.APP_NAME }}-mtx" --recent
+      - run: cf logs {{#literal}}"${{ env.APP_NAME }}-mtx"{{/literal}} --recent
         if: always()
       {{/hasMultitenancy}}

package/lib/init/template/github-actions/files/workflows/kyma.yaml.hbs

@@ -3,11 +3,14 @@ name: Kyma
 on:
   workflow_call:
   workflow_dispatch:
-  merge_group:
   push:
     branches:
       - main
 
+permissions:
+  contents: read
+  deployments: write
+
 concurrency:
   group: {{#literal}}deploy-${{ github.workflow }}-${{ github.head_ref || github.run_id }}{{/literal}}
   cancel-in-progress: true
@@ -16,11 +19,11 @@ env:
   APP_NAME: {{ appName }}
 jobs:
   deploy:
-    runs-on: [self-hosted, {{#sap}}solinas{{/sap}}{{^sap}}ubuntu-latest{{/sap}}]
+    runs-on: {{#sap}}[self-hosted, solinas]{{/sap}}{{^sap}}ubuntu-latest{{/sap}}
     container:
       image: public.int.repositories.cloud.sap/ubuntu:24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: actions/setup-node@v4
         with:
           node-version: 22