refactor: pin the Coana CLI version in the source (#1628)

The pinned Coana CLI version moves from the @coana-tech/cli devDependency,
which rollup inlined at build time, to the COANA_CLI_VERSION constant in
src/constants.mts. Coana is about to stop publishing to npm, so the pin
can't stay a dependency, and the constant also has the same value in
tests and in unbuilt runs, where the inlined value was empty.

The bump-coana skill now edits the constant. Coana's release workflow has
to bump it the same way.

Author: BarrensZeppelin

.claude/skills/bump-coana/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: bump-coana
-description: Bump @coana-tech/cli to a new version, update changelog, and create a PR. Use when user wants to upgrade Coana CLI, bump Coana version, or says "bump coana" with a version number.
+description: Bump the pinned Coana CLI to a new version, update changelog, and create a PR. Use when user wants to upgrade Coana CLI, bump Coana version, or says "bump coana" with a version number.
 allowed-tools: Read, Edit, Write, Bash, Glob
 user-invocable: true
 ---
 
 # Bump Coana CLI Version
 
-Automates the process of upgrading the @coana-tech/cli dependency to a new version, including package.json updates, changelog entry, and PR creation.
+Automates the process of upgrading the pinned Coana CLI to a new version, including the pin, changelog entry, and PR creation.
 
 ## Input
 
@@ -32,22 +32,21 @@ if [[ ! "$COANA_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
 fi
 ```
 
-### Step 2: Update package.json
+### Step 2: Update the pin
 
-1. Read `package.json` in the repository root.
-2. Find the current `@coana-tech/cli` version in `devDependencies` and note it as `CURRENT_VERSION`.
-3. Update `@coana-tech/cli` to the new version.
-4. Write the updated `package.json`.
+1. Read `src/constants.mts`.
+2. Find the line `const COANA_CLI_VERSION = '<version>'` and note the version as `CURRENT_VERSION`.
+3. Replace the version on that line with the new one.
 
-🚨 **Do NOT touch the top-level `version` field.** The release workflow owns it:
+🚨 **Do NOT touch `package.json`'s top-level `version` field.** The release workflow owns it:
 between releases the manifest holds the last released version, and
 `scripts/release/bump.mts` derives and writes the next one in-run. Hand-writing
 it invents a version that never releases and breaks the next release — a manifest
 already sitting on the version being released has no line for the bump to
 advance.
 
 **Values to extract**:
-- `CURRENT_VERSION`: The old @coana-tech/cli version (for PR body)
+- `CURRENT_VERSION`: The old Coana CLI version (for PR body)
 
 ### Step 3: Update CHANGELOG.md
 
@@ -87,28 +86,20 @@ if it finds one; hand-editing is what puts one there.)
 - Updated the Coana CLI to v `COANA_VERSION`.
 ```
 
-### Step 4: Update Lock File
-
-```bash
-pnpm install
-```
-
-This updates `pnpm-lock.yaml` with the new dependency version.
-
-### Step 5: Create Branch and Commit
+### Step 4: Create Branch and Commit
 
 ```bash
 # Create branch
 git checkout -b "coana-$COANA_VERSION"
 
 # Stage changes
-git add package.json CHANGELOG.md pnpm-lock.yaml
+git add src/constants.mts CHANGELOG.md
 
 # Commit (skip pre-commit hooks with -n)
 git commit -n -m "upgrading coana to version $COANA_VERSION"
 ```
 
-### Step 6: Push and Create PR
+### Step 5: Push and Create PR
 
 ```bash
 # Push branch
@@ -117,7 +108,7 @@ git push -u origin "coana-$COANA_VERSION"
 # Create PR targeting v1.x branch
 gh pr create --base v1.x --title "upgrading coana to version $COANA_VERSION" --body "$(cat <<'EOF'
 ## Summary
-- Upgrades @coana-tech/cli from CURRENT_VERSION to COANA_VERSION
+- Upgrades the Coana CLI from CURRENT_VERSION to COANA_VERSION
 
 ## Coana Changelog
 For details on what's included in this Coana release, see the [Coana Changelogs](https://docs.coana.tech/changelogs).
@@ -131,16 +122,15 @@ Replace `CURRENT_VERSION` and `COANA_VERSION` with actual values.
 
 - Branch: `coana-<VERSION>` pushed to origin
 - PR: Created targeting `v1.x` branch
-- Files modified: `package.json` (the `@coana-tech/cli` devDependency only, never
-  the top-level `version`), `CHANGELOG.md` (under `## [Unreleased]`), `pnpm-lock.yaml`
+- Files modified: `src/constants.mts` (the `COANA_CLI_VERSION` line only),
+  `CHANGELOG.md` (under `## [Unreleased]`)
 
 Report the PR URL to the user when complete.
 
 ## Error Handling
 
 - **No version provided**: Ask user for the version number
 - **Invalid version format**: Report error with expected format
-- **pnpm install fails**: Check network connectivity and npm registry access
 - **PR creation fails**: Verify `gh` CLI is authenticated
 
 ## Important Notes

.config/rollup.base.config.mjs

@@ -23,7 +23,6 @@ import {
 } from '../scripts/utils/packages.js'
 
 const {
-  INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION,
   INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION,
   INLINED_SOCKET_CLI_HOMEPAGE,
   INLINED_SOCKET_CLI_LEGACY_BUILD,
@@ -192,13 +191,6 @@ export default function baseConfig(extendConfig = {}) {
         delimiters: ['(?<![\'"])\\b', '(?![\'"])'],
         preventAssignment: true,
         values: [
-          [
-            INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION,
-            () =>
-              JSON.stringify(
-                getRootPkgJsonSync().devDependencies['@coana-tech/cli'],
-              ),
-          ],
           [
             INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION,
             () =>

package.json

@@ -105,7 +105,6 @@
     "@babel/preset-typescript": "7.27.1",
     "@babel/runtime": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@coana-tech/cli": "15.12.9",
     "@cyclonedx/cdxgen": "12.1.2",
     "@dotenvx/dotenvx": "1.49.0",
     "@eslint/compat": "1.3.2",

pnpm-lock.yaml

@@ -13,8 +13,6 @@ const {
 } = registryConstants
 
 const CONSTANTS = 'constants'
-const INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION =
-  'INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION'
 const INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION =
   'INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION'
 const INLINED_SOCKET_CLI_HOMEPAGE = 'INLINED_SOCKET_CLI_HOMEPAGE'
@@ -99,7 +97,6 @@ const constants = createConstantsObject(
     ...registryConstantsAttribs.props,
     CONSTANTS,
     ENV: undefined,
-    INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION,
     INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION,
     INLINED_SOCKET_CLI_HOMEPAGE,
     INLINED_SOCKET_CLI_LEGACY_BUILD,

scripts/constants.js

@@ -12,6 +12,7 @@ import { logger } from '@socketsecurity/registry/lib/logger'
 
 import { handleFix } from './handle-fix.mts'
 import constants, {
+  COANA_CLI_VERSION,
   ERROR_UNABLE_RESOLVE_ORG,
   FLAG_ID,
 } from '../../constants.mts'
@@ -73,7 +74,7 @@ const generalFlags: MeowFlags = {
   },
   fixVersion: {
     type: 'string',
-    description: `Override the version of @coana-tech/cli used for fix analysis. Default: ${constants.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`,
+    description: `Override the version of @coana-tech/cli used for fix analysis. Default: ${COANA_CLI_VERSION}.`,
   },
   applyFixes: {
     aliases: ['onlyCompute'],

src/commands/fix/cmd-fix.mts

@@ -6,7 +6,7 @@ import path from 'node:path'
 import { logger } from '@socketsecurity/registry/lib/logger'
 
 import { isOmittedReachValue } from './reachability-units.mts'
-import constants from '../../constants.mts'
+import constants, { COANA_CLI_VERSION } from '../../constants.mts'
 import { handleApiCall } from '../../utils/api.mts'
 import {
   extractTier1ReachabilityScanId,
@@ -303,9 +303,7 @@ export async function performReachabilityAnalysis(
     }
 
     if (!coanaResult.ok) {
-      const coanaVersion =
-        reachabilityOptions.reachVersion ||
-        constants.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION
+      const coanaVersion = reachabilityOptions.reachVersion || COANA_CLI_VERSION
       logger.error(
         `Coana reachability analysis failed. Version: ${coanaVersion}, target: ${analysisTarget}, cwd: ${cwd}`,
       )

src/commands/scan/perform-reachability-analysis.mts

@@ -76,9 +76,9 @@ vi.mock('../../utils/terminal-link.mts', () => ({
 }))
 
 vi.mock('../../constants.mts', () => ({
+  COANA_CLI_VERSION: 'test',
   default: {
     DOT_SOCKET_DOT_FACTS_JSON: '.socket.facts.json',
-    ENV: { INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: 'test' },
     HTTP_STATUS_UNAUTHORIZED: 401,
     SOCKET_DEFAULT_BRANCH: 'socket-default-branch',
     SOCKET_DEFAULT_REPOSITORY: 'socket-default-repository',

src/commands/scan/perform-reachability-analysis.test.mts

@@ -1,4 +1,4 @@
-import constants from '../../constants.mts'
+import { COANA_CLI_VERSION } from '../../constants.mts'
 import { getReachabilityEcosystemChoices } from '../../utils/ecosystem.mts'
 
 import type { MeowFlags } from '../../flags.mts'
@@ -12,7 +12,7 @@ export const DYNAMIC_SBOM_INFERENCE_DESCRIPTION =
 export const reachabilityFlags: MeowFlags = {
   reachVersion: {
     type: 'string',
-    description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${constants.ENV.INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION}.`,
+    description: `Override the version of @coana-tech/cli used for reachability analysis. Default: ${COANA_CLI_VERSION}.`,
   },
   reachAnalysisMemoryLimit: {
     type: 'string',

src/commands/scan/reachability-flags.mts

@@ -137,7 +137,6 @@ export type ENV = Remap<
       GITHUB_REPOSITORY: string
       GITHUB_SERVER_URL: string
       GITHUB_TOKEN: string
-      INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: string
       INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: string
       INLINED_SOCKET_CLI_HOMEPAGE: string
       INLINED_SOCKET_CLI_LEGACY_BUILD: string
@@ -193,6 +192,9 @@ const ALERT_TYPE_CVE = 'cve'
 const ALERT_TYPE_MEDIUM_CVE = 'mediumCVE'
 const ALERT_TYPE_MILD_CVE = 'mildCVE'
 const API_V0_URL = 'https://api.socket.dev/v0/'
+// The Coana CLI version Socket CLI runs by default. Coana's release workflow
+// rewrites this line in its bump PRs.
+const COANA_CLI_VERSION = '15.12.9'
 const CONFIG_KEY_API_BASE_URL = 'apiBaseUrl'
 const CONFIG_KEY_API_PROXY = 'apiProxy'
 const CONFIG_KEY_API_TOKEN = 'apiToken'
@@ -493,11 +495,6 @@ const LAZY_ENV = () => {
     // workflow.
     // https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#about-the-github_token-secret
     GITHUB_TOKEN,
-    // Comp-time inlined @coana-tech/cli package version.
-    // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION']".
-    INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION: envAsString(
-      process.env['INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION'],
-    ),
     // Comp-time inlined @cyclonedx/cdxgen package version.
     // The '@rollup/plugin-replace' will replace "process.env['INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION']".
     INLINED_SOCKET_CLI_CYCLONEDX_CDXGEN_VERSION: envAsString(
@@ -1145,6 +1142,7 @@ export {
   ALERT_TYPE_MEDIUM_CVE,
   ALERT_TYPE_MILD_CVE,
   API_V0_URL,
+  COANA_CLI_VERSION,
   CONFIG_KEY_API_BASE_URL,
   CONFIG_KEY_API_PROXY,
   CONFIG_KEY_API_TOKEN,