@sap/cds-dk 9.4.2 → 9.5.0

package/CHANGELOG.md

@@ -6,6 +6,64 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 9.5.0 - 2025-12-01
+
+### Added
+
+- `cds import` now accepts `--into-namespace <string>` to override the namespace entities are imported to, when importing OpenAPI definitions.
+
+### Changed
+
+- `cds add portal` adds the correct service key configuration to the _mta.yaml_.
+- `cds add sample` creates sample files aligned with recent versions of bookshop and bookstore in https://github.com/capire.
+- `cds add sample` uses a matching ID in generated `manifest.json` and UI5 components.
+- `cds build` uses `hdblogicalschema` and `hdblogicalschemaconfig` plugins in its default `.hdiconfig`.
+- `cds add cloud-logging` adds required dependencies to _pom.xml_ for Java projects.
+- `cds add kyma` is now the only suggested Kyma facet in `cds add help`.
+- `cds add helm-unified-runtime` option is now deprecated; use `cds add kyma --unified-runtime` instead.
+- `cds up --to k8s` now saves the checksum of buildpack images to determine if a rebuild is necessary.
+- `cds up --to k8s` will interactively ask for registry credentials if they don't exist on the remote cluster.
+- `cds build` automatically adds `contentLocalizedEdmx=true` to the java build task configuration if OData V2 is set.
+- `cds add github-actions` has out-of-the-box support for Java projects.
+- `cds add html5-repo` and `cds add app-frontend` do not create a separate _ui5-deploy.yaml_ but use the default _ui5.yaml_.
+- `cds add` plugins allow merging into non-existing files with `cds.add.merge(<object>).into(<yaml-path>)`.
+- `cds build` tasks that produce `csn.json` now emit the `compile.for.runtime` event, in alignment with other runtime CSN producers like `cds serve`. Plugins can use such events to hook into CSN creation.
+- `cds add xsuaa` sets `credential-types: [ "binding-secret", "x509" ]` for XSUAA instances.
+- `cds add hana` does not create an explicit `.hdiconfig` file any more as `cds build` provides defaults.
+- `cds import` generates the on condition for a composition when the corresponding OData navigation property targets a collection, is contained (`$ContainsTarget` in OData EDM) and has a backlink (`$Partner` in OData EDM).
+- `cds import` now considers OData contained navigation properties as compositions instead of associations.
+
+### Fixed
+
+- `cds add ias` will always add a binding to the MTX sidecar or approuter if required.
+- `cds add ias` has improved support for multitenancy scenarios on Kyma.
+- `cds lint` no longer fails with error code 1 and no message when loading the config fails.
+- `cds version` no longer prints an `undefined` value for `@sap/cds-dk`.
+- `cds compile --flavor files` no longer crashes with a `TypeError`.
+- `cds add workzone` does not add superfluous `destinations` configuration to the `srv-api` import.
+
+## Version 9.4.3 - 2025-10-29
+
+### Added
+
+### Changed
+
+- `cds add github-actions` will use the `cap-js/cf-setup` action from GitHub marketplace instead of creating a local copy.
+- `cds add containerize` omits the Unix-based `before_all` scripts in `containerize.yaml` in favor of a cross-platform compatible `cds up --to k8s` integration.
+- `cds up --to k8s` now uses built-in containerization, eliminating the hard dependency on the `ctz` library.
+- `cds up --to k8s` will interactively ask for a domain if it can't be determined from the current Kubernetes configuration.
+- `cds build --for hana` no longer requires `.hdbgrants` and `.hdbrevokes` to be specified as a plugin in the `.hdiconfig` file.
+- `cds import` no longer emits usage info when invoked with the dry option.
+
+### Fixed
+
+- `cds add data` fixes an issue where randomly generated `Decimal` and `Integer` values could exceed their defined precision or scale.
+- `cds add pipeline` does not add UI5 template files in some cases.
+- `cds add ias` does not write to the `mta.yaml` for non-MTA projects.
+- `cds add ias` automatically adds the `authenticationType` to `xs-app.json` if required.
+- `cds add ias` adds a binding to the approuter component if required.
+- `cds import --from ...` yields a better error message for unknown import kinds.
+
 ## Version 9.4.2 - 2025-10-23
 
 ### Changed
@@ -23,6 +81,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - `cds add test` creates correct OData URLs with unqualified entity names in service paths.
 - `cds add http` skips contained composition targets.
 - `cds add sample` no longer comes with an error when creating a Book through Fiori.
+- `cds build` now places the `i18n` folder in the generated output root directory instead of nested locations.
 
 ## Version 9.4.1 - 2025-10-09
 
@@ -313,6 +372,41 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - `cds add ams` for Java adds a custom builder to the `mta.yaml` to circumvent the missing `srv/src/gen/policies`.
 - `cds add multitenancy` requires the `srv-api` instead of the `mtx-api` for Java projects.
 
+## Version 8.9.11 - 2025-11-21
+
+### Fixed
+
+- Bump dependencies in shrinkwrap.
+
+## Version 8.9.10 - 2025-09-19
+
+### Fixed
+
+- Updated shrinkwrap to include `@sap/cds-compiler` version 5.9.12.
+
+## Version 8.9.9 - 2025-09-16
+
+### Fixed
+
+- CVE-2025-58754: vulnerability with `axios` versions <1.12.0.
+
+## Version 8.9.8 - 2025-07-24
+
+### Fixed
+
+- CVE-2025-7783: vulnerability with `form-data` versions <4.0.4.
+
+## Version 8.9.7 - 2025-07-17
+
+### Fixed
+
+- Bump dependencies in shrinkwrap.
+
+## Version 8.9.6 - 2025-06-05
+
+### Fixed
+
+- Bump dependencies in shrinkwrap.
 
 ## Version 8.9.5 - 2025-06-05
 

package/bin/compile/index.js

@@ -297,7 +297,7 @@ async function compile (models, options={}) {
     throw `You must specify a model to compile.\nRun 'cds c -?' to learn more.`
   }
 
-  let chain = model.then (m => model=m)
+  let chain = model.then?. (m => model=m) ?? Promise.resolve(model) // model could be a sync. value
 
   // add processors for compiling
   if (options.for) for (let each of options.for.split(',')) {

package/bin/data-products/index.js

@@ -6,8 +6,16 @@ const path = require ('node:path')
 
 exports.load_data_product  = async function (sources, o) {
   let service = /\/([^/]+)\//.exec(o.services)?.[1].replaceAll('\\.','.')
-  if (!service.includes(':apiResource:')) {
-    const [,namespace,name,version] = /^(.+)-([^-]+)-(v[0-9]+)\.json$/ .exec (path.basename(String(sources)))
+  if (service != 'all') {
+    // ORD ID has been provided as parameter "-s", valid example: "sap.s4com:apiResource:Product:v1"
+    if (!service.match(/^([^:]+):apiResource:([^:]+):(v[0-9]+)$/))
+      throw new Error(`"${service}" is not a valid output port ORD ID`)
+  }
+  else {
+    // try to deduce ORD ID from file name, valid example: "sap-s4com-Product-v1.json"
+    const m = /^(.+)-([^-]+)-(v[0-9]+)\.(json|csn)$/ .exec (path.basename(String(sources)))
+    if (m?.length != 5) throw new Error(`Output port ORD ID cannot be deduced from file name`)
+    const [,namespace,name,version] = m
     service = namespace.replace(/-/g,'.') + ':apiResource:' + name + ':' + version
   }
 

package/bin/data-products/prepare-csn.js

@@ -180,38 +180,75 @@ exports.prepareCsn = function (csn, srvName, ordId) {
   //
   // ---------- step 5: wrap everyting into service if not yet done -------------------------------
   //
-  // Prefix all entity names with service name. Adapt association targets.
-  // Add CAP specific annotations for DP handling.
+  // This function must be called with a service name "srvName" as argument.
+  if (!srvName) throw new Error('No service name has been provided.')
 
-  if (srvName) {
-    if (!csn.definitions[srvName] || csn.definitions[srvName].kind !== 'service') {
-      // add the service
-      csn.definitions[srvName] = {kind: 'service'}
-      // loop over all entities and prefix names with service name
-      for (let n in csn.definitions) {
-        let entity = csn.definitions[n]
-        if (entity.kind === 'entity') {
-          // find association elements and rename the targets
-          for (let en in entity.elements || {} ) {
-            let element = entity.elements[en]
-            if (element?.type == 'cds.Association' || element?.type == 'cds.Composition') {
-              element.target = srvName + '.' + element.target
-            }
-          }
-          csn.definitions[srvName + '.' + n] = entity
-          delete csn.definitions[n]
+  // Assumptions (based on the rules for DP CSNs):
+  // 1) there is no or one context or service in the CSN
+  // 2) if there is a context or service, all objects in the CSN belong to it
+  //
+  // If there is no context/service (this is a DP CSN coming from BAH):
+  //   put all entities into a new service "srvName", i.e.
+  //   - prefix all object and association target names with "srvName"
+  //   - add a service "srvName" with CAP specific annotations for DP handling
+  // If there is a context/service (DP CSN comes from UCL, context/service name is the schema name in the HDLFS share):
+  //   move all entities out of the context/service and put them into a new service "srvName", i.e.
+  //   - remove the context/service
+  //   - change the prefix for all entity and association target names from
+  //     the old context/service name to "srvName"
+  //   - add a service "srvName" with CAP specific annotations for DP handling
+  //
+  // Note: Currently an existing context/service doesn't contain further info (e.g. annos),
+  //       so deleting it is ok.
+
+  let ctxName = null;
+  const ctxs = Object.entries(csn.definitions).filter(([,o]) => o.kind === 'context' || o.kind === 'service')
+  if (ctxs.length > 0) {
+    // check assumption 1
+    if (ctxs.length > 1) throw new Error('Data Product CSN is invalid: it has more than one context or service.')
+    ctxName = ctxs[0][0]
+    delete csn.definitions[ctxName]
+    // check assumption 2
+    const bad = Object.keys(csn.definitions).filter((n) => !n.startsWith(ctxName + '.'))
+    if (bad.length > 0)
+      throw new Error(`Unexpected entity name "${bad[0]}" without prefix in Data product CSN with context "${ctxName}"`)
+  }
+
+  function changePrefix(name) {
+    if (ctxName) {
+      name = name.substring(ctxName.length + 1) // remove prefix incl. '.'
+    }
+    return srvName + '.' + name
+  }
+
+  // loop over all definitions and prefix names with service name
+  // if ctxName accidentially equals srvName, do nothing
+  if (ctxName != srvName) {
+    for (let n in csn.definitions) {
+      let def = csn.definitions[n]
+      // adapt assoc targets
+      for (let en in def.elements || {} ) {
+        let element = def.elements[en]
+        if (element?.type === 'cds.Association' || element?.type === 'cds.Composition') {
+          element.target = changePrefix(element.target)
         }
       }
+      csn.definitions[changePrefix(n)] = def
+      delete csn.definitions[n]
     }
-    // add service annotations
-    Object.assign(csn.definitions[srvName], {
-      '@cds.dp.ordId': ordId,
-      '@cds.external': true,
-      '@data.product': true,
-      '@protocol'    : 'none'  // don't serve via OData
-    })
   }
 
+   // add the service
+  csn.definitions[srvName] = {
+     kind          : 'service',
+    '@cds.dp.ordId': ordId,
+    '@cds.external': true,
+    '@data.product': true,
+    '@protocol'    : 'none'  // don't serve via OData
+  };
+  if (ctxName) csn.definitions[srvName]['@data.product.schema'] = ctxName;
+
+
   //
   // ---------- step 6: move entity/element annotations into extensions section -------------------
   //

package/bin/export.js

@@ -111,7 +111,7 @@ class Export extends Minify {
   async export (minified,o) {
     if (this.options.to === '-') return super.print (minified)
     if (this.options.to.endsWith('/*')) this.options.to = this.export_to()
-    console.log(`\n${this.name}ing APIs to`, this.options.to, '...\n')
+    console.log(`\n${this.name}ing APIs to`, cds.utils.local(this.options.to), '...\n')
     const exports = []; exports.push(...this.export_models (minified))
     if (o.texts) exports.push (...this.export_texts (minified))
     if (o.data) exports.push (this.export_data (minified))

package/bin/help.js

@@ -12,7 +12,6 @@ module.exports = exports = Object.assign (help, {formatHelp, handleCompletion, h
 
     *i* | *init*        jump-start cds-based projects
     *a* | *add*         add a feature to an existing project
-    * * | *gen*         generate models/data using a descriptive prompt [beta]
     *m* | *import*      add models from external sources
     *c* | *compile*     compile cds models to different outputs
     *p* | *parse*       parses given cds models
@@ -32,10 +31,10 @@ module.exports = exports = Object.assign (help, {formatHelp, handleCompletion, h
     * * | *logout*      logout from extensible multitenant SaaS app
     * * | *pull*        pull base model of extensible SaaS app
     * * | *push*        push extension to extensible SaaS app
-    *t* | *lint*        run linter for env or model checks
+    * * | *lint*        run linter for env or model checks
     *v* | *version*     get detailed version information
     * * | *completion*  add/remove cli completion for cds commands
-    *?* | *help*        get detailed usage information
+    *h* | *help*        get detailed usage information
 
   Learn more about each command using:
   *cds help* <command> or

package/bin/import.js

@@ -1,7 +1,7 @@
 module.exports = Object.assign(_import, {
     _name: 'import',
-    options:   [ '--services', '--for', '--out', '--as', '--name', '--include-namespaces', '--dependencies', '--from', '--config', '--destination', '--group' ],
-    shortcuts: [ '-s', '-4',    '-o',    '-as',  '-n',     '-ns',                    '-d',            undefined,  '-c',       undefined,       undefined, '-', '-f'],
+    options:   [ '--services', '--for', '--out', '--as', '--name', '--include-namespaces', '--dependencies', '--from', '--config', '--destination', '--group', '--into-namespace',  '--data-product' ],
+    shortcuts: [ '-s',            '-4',    '-o',  '-as',     '-n',                  '-ns',             '-d',undefined,       '-c',       undefined, undefined,                '-2',        '-', '-f'],
     flags: [ '--dry', '--force', '--no-copy', '--no-save', '--keep-namespace', '--data-product', '--edmx', '--rfc', '--odata', '--openapi', '--asyncapi' ],
     help: `
 # SYNOPSIS
@@ -55,6 +55,16 @@ module.exports = Object.assign(_import, {
         Destination name under which the remote service can be reached.
         Not supported by import types "edmx", "openapi" or "asyncapi".
 
+    *--data-product*
+        Tells cds import to import a data product. The source must be a valid
+        data product CSN file, e.g. as found on http://api.sap.com/dataproducts.
+        (Not released with general availability yet)
+
+    *-2 | --into-namespace* <string>
+        Specifies a custom namespace to be used for the imported service.
+        This will override the namespace that was specified via the the
+        @title annotation of the original service.
+
     *Below options are valid for OData only*
 
     *--keep-namespace*
@@ -153,7 +163,7 @@ async function _import(args, options = {}) {
     if (options.from) {
         if (!cds.import.from[options.from]) {
             // the required plugin might not be installed, e.g. rfc importer
-            throw messages.UNSUPPORTED_FROM_OPTION;
+            throw messages.UNSUPPORTED_FROM_OPTION.replace('{0}', options.from).replace('{1}', Object.keys(cds.import.from).join(', '));
         }
         csn = await cds.import.from[options.from](input, apiOptions);
     } else {

package/bin/repl.js

@@ -35,7 +35,7 @@ module.exports = Object.assign (repl, {
     *cds eval*  to evaluate and execute JavaScript.
 `})
 
-async function repl (_, options={}) {
+async function repl ([project], options={}) {
 
   const GREEN = '\x1b[32m', RESET = '\x1b[0m'
   const cds = require('../lib/cds')
@@ -46,9 +46,9 @@ async function repl (_, options={}) {
   inspect.defaultOptions.depth = 11
 
   Object.defineProperty (cds,'repl',{value:true})
-  await cds.service.bindings
+  await cds.service.bindings // REVISIT: this pre-populates many of the cds facade's lazy properties
   let context={}, repl = { context, displayPrompt(){} }
-  if (options.run) await _run (options.run)
+  if ((options.run ??= project)) await _run (options.run)
   if (options.use) _export (...options.use.split(','))
 
   repl = require('repl').start ({
@@ -94,14 +94,10 @@ async function repl (_, options={}) {
   process.on = (event, listener) => event !== 'uncaughtException' && event !== 'unhandledRejection' && process.addListener(event, listener)
 
   async function _run (project) {
-    try {
-      if (require.resolve('@cap-js/cds-test', {paths: [cds.root, cds.home]})) {
-        await cds.test (project)
-      }
-    } catch (e) {
-      if (e.code !== 'MODULE_NOT_FOUND') throw e
-      await cds.exec ('--project', project, '--port', '0', '--in-memory?')
-    }
+    await require('../bin/serve') ([project], { project, port: 0, 
+      'in-memory?': true, 
+      'with-mocks': true 
+    })
     _export ('entities', 'services')
   }
 

package/bin/up.js

@@ -28,31 +28,88 @@ module.exports = Object.assign(up, {
 `})
 
 const { execSync } = require('node:child_process')
+const { tmpdir } = require('node:os')
+const crypto = require('node:crypto')
 const cds = require('../lib/cds')
-const { highlight } = require('../lib/util/term')
-const { exists, fs, path, path: { join } } = cds.utils
+const { highlight, warn, dim } = require('../lib/util/term')
+const { exists, fs, path, path: { join }, read, write } = cds.utils
+const { ask4 } = require('../lib/util/question')
 const { readProject } = require('../lib/init/projectReader')
+const { mkdirp, copy } = cds.utils
+const { containerize } = require('../bin/util/containerize')
+const { calcDirChecksum } = require('../lib/util/checksum')
 
-const run = cmd => {
-  console.log(highlight(cmd))
+const DEBUG = /\b(y|all|cli)\b/.test(process.env.DEBUG) ? console.debug : undefined
+
+const run = (cmd, { continueOnFail = false, silent = false } = {}) => {
+  const redactedCmd = cmd.replace(/(--docker-password=)(['"]?)[^'"\s]+(['"]?)/, '$1[REDACTED]$3')
+  console.log(highlight(redactedCmd))
   try {
     return execSync(cmd, {
-      stdio: 'inherit',
+      stdio: silent ? 'pipe' : 'inherit',
       env: { ...process.env, FORCE_COLOR: cds.utils.colors.enabled }
     })
   } catch (error) {
+    if (continueOnFail) {
+      if (!silent)
+        console.error(error.message)
+      return
+    }
     throw error.message
   }
 }
 
+/**
+ * Get or create checksum file path in temp directory for UI5 apps
+ * @param {string} appName - The name of the app
+ * @returns {string} - Path to checksum file in temp directory
+ */
+function getChecksumFilePath(appName) {
+  const projectHash = crypto.createHash('md5').update(cds.root).digest('hex').substring(0, 8)
+  return join(tmpdir(), `cds-ui5-checksum-${projectHash}-${appName}.txt`)
+}
+
+/**
+ * Read stored checksum for an app from temp directory
+ * @param {string} appName - The name of the app
+ * @returns {string|null} - The stored checksum or null if not found
+ */
+function readStoredChecksum(appName) {
+  const checksumFile = getChecksumFilePath(appName)
+  if (exists(checksumFile)) {
+    try {
+      return fs.readFileSync(checksumFile, 'utf-8').trim()
+    } catch (e) {
+      // Ignore read errors and assume no checksum is stored
+    }
+  }
+  return null
+}
+
+/**
+ * Write checksum for an app to temp directory
+ * @param {string} appName - The name of the app
+ * @param {string} checksum - The checksum to store
+ */
+function writeStoredChecksum(appName, checksum) {
+  const checksumFile = getChecksumFilePath(appName)
+  fs.writeFileSync(checksumFile, checksum, 'utf-8')
+}
+
 async function up() {
   const project = readProject()
-  const { apps, appName, hasApprouter, hasXsuaa, isMonorepoMicroservice } = project
+  const { apps, appName, hasApprouter, hasXsuaa, isMonorepoMicroservice, k8s } = project
+
+  const html5DeployerPath = join(cds.root, cds.env.folders.app, 'html5-deployer', 'resources')
 
   for (const { app } of apps) {
     const appPath = path.join(cds.root, cds.env.folders.app, app)
-    if (exists(path.join(appPath, 'package.json')) && !exists(path.join(appPath, 'package-lock.json'))) {
-      run(`npm i --prefix ${appPath}`)
+    if (exists(path.join(appPath, 'package.json'))) {
+      if (!exists(path.join(appPath, 'package-lock.json'))) {
+        run(`npm i --prefix ${appPath}`)
+      } else if (process.env.CI) {
+        run(`npm ci --prefix ${appPath}`)
+      }
     }
   }
 
@@ -74,8 +131,37 @@ async function up() {
   }
 
   if (cds.cli.options.to === 'k8s') {
-    if (!exists('chart')) run('cds add helm')
-    if (!exists('containerize.yaml')) run('cds add containerize')
+    if (!exists('chart') || !exists('containerize.yaml')) run('cds add kyma')
+
+    if (project.hasHtml5Repo) {
+      if (apps.length > 0) {
+        await mkdirp(html5DeployerPath)
+      }
+
+      for (const { app } of apps) {
+        const appPath = path.join(cds.root, cds.env.folders.app, app)
+        const zipPath = path.join(appPath, `dist/${app}.zip`)
+
+        // Calculate checksum for the app source folder (excluding node_modules and dist)
+        const currentChecksum = await calcDirChecksum(
+          appPath,
+          (dir) => !dir.includes('node_modules') && !dir.includes('dist')
+        )
+
+        const storedChecksum = readStoredChecksum(app)
+        const needsBuild = currentChecksum !== storedChecksum || !exists(zipPath)
+
+        if (needsBuild) {
+          DEBUG?.(dim(`build required for '${app}' – checksums`, { old: storedChecksum, new: currentChecksum }))
+          run(`npm run build --prefix ${appPath}`)
+          writeStoredChecksum(app, currentChecksum)
+        } else {
+          console.log(highlight(`Skipping build for UI5 app '${app}' - no changes detected (checksum: ${currentChecksum.substring(0, 8)}...)`))
+        }
+
+        await copy(zipPath).to(html5DeployerPath, `${app}.zip`)
+      }
+    }
   } else {
     if (!exists('mta.yaml')) {
       run('cds add mta')
@@ -96,13 +182,78 @@ async function up() {
 
   if (cds.cli.options.to === 'k8s') {
     const ns = cds.cli.options.namespace
-    const nsHelm = ns ? `--namespace ${ns} --create-namespace` : ''
+    const nsHelm = ns ? `--namespace ${ns}` : ''
     const nsKubectl = ns ? `-n ${ns}` : ''
 
     run('npm i --package-lock')
-    run('ctz containerize.yaml --log --push')
+    run('cds build --production')
+
+    if (ns) {
+      const k8sNamespaceResult = run(`kubectl get namespace ${ns} -o jsonpath="{.metadata.name}"`, { continueOnFail: true, silent: true })
+      if (!k8sNamespaceResult) {
+        run(`kubectl create namespace ${ns}`)
+      }
+    }
+
+    const isValidDomain = str => /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(str)
+    const { image, imagePullSecret } = k8s.values.global ?? {}
+    let registry = image?.registry
+    if (!process.env.CI) {
+      if (!registry || !isValidDomain(registry)) {
+        const valuesPath = 'chart/values.yaml'
+        const [yn] = await ask4([warn(`invalid registry server '${registry}' detected, override in ${valuesPath}? (Y/n)`)])
+        if (yn?.toLowerCase() !== 'y' || process.env.CI) {
+          throw `registry parameter is invalid, please specify it in ${valuesPath}`
+        } else {
+          registry = image.registry = await ask4(['registry server (e.g. index.docker.io): '])
+          const values = (await read(valuesPath)).replace(/(registry:\s*).*/, `$1${registry}`)
+          await write(values).to(valuesPath)
+
+          const containerize = (await read('containerize.yaml')).replace(/(repository:\s*).*/, `$1${registry}`)
+          await write(containerize).to('containerize.yaml')
+        }
+      }
+      if (imagePullSecret?.name) {
+        const imagePullSecretResult = run(`kubectl get secret ${imagePullSecret.name} ${nsKubectl} -o jsonpath="{.metadata.name}"`, { continueOnFail: true, silent: true })
+        if (!imagePullSecretResult) {
+          const yn = await ask4([`image pull secret '${imagePullSecret.name}' not found in namespace '${ns || 'default'}' – do you want to create it? (Y/n) `])
+          if (yn?.toLowerCase() !== 'y' || process.env.CI) {
+            throw `image pull secret '${imagePullSecret.name}' is required to pull images from the registry`
+          } else {
+            const [username, email] = await ask4([
+              'registry username: ',
+              'registry email: ',
+            ])
+            const password = await ask4(['registry password: '], { redacted: true })
+            run(`kubectl create secret docker-registry ${imagePullSecret.name} ${nsKubectl} --docker-server=${registry} --docker-username=${username} --docker-password='${password}' --docker-email=${email}`)
+          }
+        }
+      }
+    }
+
+    const modules = await containerize()
+    const helmArgs = []
+    modules?.forEach(m => {
+      if (m.path === 'gen/srv') {
+        helmArgs.push(`--set srv.annotations.deployment.deployment-checksum=${m.checksum}`)
+      }
+      if (m.path === 'app/router') {
+        helmArgs.push(`--set approuter.annotations.deployment.deployment-checksum=${m.checksum}`)
+      }
+      if (m.path === 'app/html5-deployer') {
+        helmArgs.push(`--set html5-apps-deployer.annotations.job.job-checksum=${m.checksum}`)
+      }
+      if (m.path === 'gen/db') {
+        helmArgs.push(`--set hana-deployer.annotations.job.job-checksum=${m.checksum}`)
+      }
+      if (m.path === 'gen/mtx/sidecar') {
+        helmArgs.push(`--set sidecar.annotations.deployment.deployment-checksum=${m.checksum}`)
+      }
+    })
+
     let helmUpgrade = `helm upgrade --install ${appName} ./gen/chart ${nsHelm} --wait --wait-for-jobs --timeout=10m`
-    if (hasXsuaa) helmUpgrade += ' --set-file xsuaa.jsonParameters=xs-security.json'
+    if (hasXsuaa) helmArgs.push(' --set-file xsuaa.jsonParameters=xs-security.json')
+    if (helmArgs.length > 0) helmUpgrade += ` ${helmArgs.join(' ')}`
     run(helmUpgrade)
     run(`kubectl rollout status deployment ${appName}-srv ${nsKubectl} --timeout=8m`)
     if (hasApprouter) run(`kubectl rollout status deployment ${appName}-approuter ${nsKubectl} --timeout=8m`)