[efegokdemir]

What changed?

Adds UG-EXT-001 for missing owner_type in eligible Checkout and Customer Account UI extension metafield declarations. It reports safe table locations, warns for target 2026-10 and errors from target 2027-01. The existing automatic-discount rule now also recognizes literal references to the removed DiscountAutomaticConnection and DiscountAutomaticEdge types.

User-facing capabilities

The existing scan --target 2027-01 command reports deployment-blocking extension declarations without guessing an owner type or exposing namespace/key values. A short migration guide covers the version boundary and relevant declarations.

Implementation

The extension file is parsed as TOML and source table locations are associated with parsed declarations. Detection is limited to Checkout and Customer Account UI extension targets; unrelated extension types and targets are ignored.

Evidence and false-positive review

• Owner type requirement
• 2027-01 release notes
• Checkout UI extensions
• Customer Account metafields

Tests cover both surfaces, nested and repeated declarations, version boundaries, present values, unrelated targets and types, comments, strings, malformed TOML and redaction. The existing GraphQL 17 Dependabot PR #43 and CodeQL PRs #44–#47 were left untouched; this change retains GraphQL 16.14.2 because the new TOML rule does not need GraphQL 17.

Compatibility

The CLI minimum is Node.js 22; the Action remains on Node.js 24. Hosted CI also runs the protected Node.js 20 check. The change adds @iarna/toml with its licence notice. Package version stays 0.3.0. Proposed next version: 0.4.0.

Testing

On Node.js 22 and 24: clean install, npm test (54/54 each), npm run coverage (97.13% statements/lines, 85.75% branches, 95.93% functions), npm run lint, npm run check:dist, npm run action:check, npm run package:smoke, npm pack --dry-run, npm audit --audit-level=high (0 vulnerabilities), and actionlint .github/workflows/ci.yml passed. Hosted GitHub Actions passed on Node.js 20, 22 and 24, plus CodeQL, Dependency Review and Snyk. Scorecard has no PR-branch result; its workflow is configured for main pushes and weekly runs.

Security

The rule does not infer owner types and reports no namespace or key values. Malformed TOML fails safely without printing configuration content. The scanner stays offline and does not execute scanned files.

Limitations

This adds only missing-property detection for the documented extension surfaces. It does not validate that a supplied owner type is correct, infer resource ownership, or add speculative 2027-01 rules. Shopify describes 2027-01 as a release candidate until its stable date.

Release impact

Recommend 0.4.0 after review and hosted CI. The Node.js 22 minimum is a documented compatibility break. No version was bumped on this branch.

Review checklist

• The new Shopify-specific rule links official sources and has positive and negative fixtures.
• No existing GraphQL or CodeQL PR was modified.
• Local checks passed on Node.js 22 and 24.
• Hosted CI, CodeQL, Dependency Review, and Snyk passed on the pushed branch.