chore: version packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@codacy/codacy-cloud-cli@1.9.0

Minor Changes

• #37 402edd8 Thanks @alerizzo! - Add repository (project) token support

  You can now authenticate with a repository token — scoped to a single repository — instead of a personal account API token that reaches every organization and repository you can see. This is the right credential for CI and for the auto-configuration agent: if it leaks, the blast radius is one repository.

  codacy tools --repository-token <your-repository-token>
  # or, for a whole CI job:
  export CODACY_PROJECT_TOKEN=<your-repository-token>

  Get one from Codacy > Repository > Settings > Integrations > Project API token. The new --repository-token <token> flag is accepted by every command, and CODACY_PROJECT_TOKEN is picked up automatically.

  Token precedence (identical to the Codacy Analysis CLI): --repository-token > CODACY_PROJECT_TOKEN > CODACY_API_TOKEN > stored codacy login. An explicit --repository-token wins outright, so a deliberately scoped run is never silently widened. Note that CODACY_PROJECT_TOKEN outranks CODACY_API_TOKEN — unset it if you want your account token used.

  Not every command accepts a repository token, because Codacy only honours them on a limited set of repository-scoped operations:

  • Fully supported: tools, tool, patterns, pattern, issues (including --overview), tools --import, repository --reanalyze / --reanalyze-and-wait.
  • Partially supported: repository works but omits the pull request and coverage sections. In --output json, pullRequests stays an empty array and a new unavailable: ["pullRequests"] field marks what couldn't be fetched. Output under an account token is unchanged.
  • Account token required: info, repositories, ls, directories, pull-request, pull-requests, issue, findings, finding, issues --ignore/--ignored, tools --import --force, and repository's --add/--remove/--follow/--unfollow/--link-standard/--unlink-standard.

  Unsupported combinations now fail immediately with a message naming the operation, why a repository token can't perform it, and which token is in use — instead of sending a request that comes back as a bare Unauthorized.

  codacy login continues to store account tokens only; repository tokens are passed per command or via the environment.

  Also fixed: codacy repository no longer loses the entire dashboard when the pull request lookup fails, and codacy login no longer reports a repository token as "invalid" when it is rejected for being the wrong kind of token.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR performs a package version bump to 1.9.0. While the Codacy analysis is up to standards, there is a significant concern regarding the pull request's completeness. The CHANGELOG.md describes several new features and bug fixes—specifically around repository token support and authentication precedence—that are entirely absent from the provided diff. This suggests that either the implementation was intended to be included but was missed, or the changelog is being updated ahead of the actual feature delivery.

About this PR

• The PR describes significant functional changes, such as repository token support (via --repository-token and CODACY_PROJECT_TOKEN) and specific authentication precedence logic, but the current diff only contains the version bump in package.json and the changelog update. The implementation logic for these features is missing from this Pull Request.

Test suggestions

• Verify authentication precedence: CLI flag overrides environment variables.
• Verify 'repository' command output for JSON contains the 'unavailable' field when using a repository token.
• Verify blocked commands (e.g., 'info', 'repositories') return immediate specific errors when a repository token is detected.
• Verify 'codacy login' behavior when a repository token is provided instead of an account token.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify authentication precedence: CLI flag overrides environment variables.
2. Verify 'repository' command output for JSON contains the 'unavailable' field when using a repository token.
3. Verify blocked commands (e.g., 'info', 'repositories') return immediate specific errors when a repository token is detected.
4. Verify 'codacy login' behavior when a repository token is provided instead of an account token.

_{TIP How was this review? Give us feedback}