Skip to content

v0.6.2

Latest

Choose a tag to compare

@github-actions github-actions released this 30 Aug 10:12
· 2 commits to main since this release
21f6b0a

One bug fix, in the same family as v0.6.1: output that was wrong without saying so.

Compliance and approval state fields are no longer stripped

worksome hires get <id> returned a hire's compliances as catalogue entries with no indication of which applied or were already done — rows that read as outstanding requirements when the real answer was zero. And the same data was unreachable from the other direction:

$ worksome hires get <id> --fields id,compliances.completed
Error: unknown field "compliances.completed"

Two commands, same data, opposite answers — compliance get <id> had been correct all along.

Nested objects are filtered through an allowlist of field names that are safe to request, which exists to avoid asking for access-controlled fields. The labels were on it; the state was not. Six field names have been added — actor, state, cancellationReason, applicable, completed, completedAt:

- compliances    { name type title description }
+ compliances    { actor name applicable completed completedAt type title description }

- approvalStates { id state createdAt }
+ approvalStates { id state cancellationReason createdAt }

79 of the 198 generated queries changed. Four table columns that could not previously render now do: Compliances Actor, Approval States State, and — because the allowlist matches on field name rather than type — Address State and Location State, where "state" is a geographic region rather than a workflow one.

A note on what was deliberately not done

An earlier revision of this change took a broader rule: select every enum on nested objects, on the reasoning that access-controlled fields are sensitive booleans and strings, never enums. That was withdrawn.

GraphQL introspection does not return applied directives, so the vendored schema the CLI generates from carries none of the API's field-level authorization. A rule that selects by type is therefore permissive about a property the generator cannot see — and at least one field disproves the assumption. The narrower change touches 79 documents instead of 118 and grows the generated GraphQL by 2.2% rather than 19.4%.


Upgrade: brew upgrade --cask worksome