Address the maintainer review of export-scopes:
- export-scopes no longer inherits auth's RequireBuiltinCredentialProvider
guard: it defines its own PersistentPreRunE, so a build machine that has CLI
credential env vars set (the downstream scopes build's environment) can still
run the export instead of exiting before RunE. make test-scopeexport runs one
invocation with a credential env var set to lock this in.
- make test-scopeexport now byte-format-pins the marshaler via a golden test on
a fixed document (indentation, key order, HTML escaping, trailing newline,
empty list), runs the whole cmd/auth package under -race (dropping the -run
allowlist that silently excluded future tests), and removes its throwaway
binary under $TMPDIR.
- packageJSONVersion only trusts a manifest named @larksuite/cli, so an
unrelated package.json in the working directory cannot stamp a foreign
version; the --version help text now matches the real fallback order.
- The --output IO test writes under /tmp (inside SafeOutputPath's allowlist)
instead of leaving an untracked directory in the package.
dc-bytedance
33f09f9345