feat!: deprecate full and make it default for extension validate

[Malte Janz (MalteJanz)]

What changed?

Warning

This is a proposal, up for discussion, that contains a breaking change to the default behaviour and output of extension validate

• With this change the extension validate command behaves the same as with the --full flag before, just that this is now the default
• Additionally that flag is marked as deprecated (to not error out when its still provided), but it does essentially nothing anymore

Why?

The old behavior can still be achieved with --only sw-cli and having no --full flag makes the validate command consistent with the fix and format commands. Additionally it makes the --only + --exclude flags easier to understand if you don't have to consider --full or not.

But this change could potentially cause an inconvience for some setups:

• CI pipelines that always run the latest shopware-cli and didn't run the --full check could suddenly report errors for projects.
• The same could also happen for other reasons, e.g. if we check something new in the sw-cli tool.
• The fix is easy, either change the CI to run with --only sw-cli flag or fix all newly discovered issues (which is a win in itself)
• Normally there is a best practice for CI setups to pin their dependencies, so that way they can upgrade to the new shopware-cli version in a controlled / unsurprising way and adjust the command invocation as needed

TLDR: I personally think this change is a win for user / developer experience of this command while only being a minor inconvenience to adjust to the breaking change. Additionally we are not at a semantic stable version 1.0 with the CLI anyways while we of course try our best to keep the CLI surface stable.

How was this tested?

just run shopware-cli extension validate . --full and without --full, the output should be the same. Having the flag also provides a deprecation warning.

Related issue or discussion

Discovered + depends on #1611

Summary by CodeRabbit

• Changes
  • extension validate now runs all available checkers by default, including PHPStan, ESLint, and Stylelint.
  • Use --only to select specific checkers or --exclude to omit them. The deprecated --full flag remains accepted but no longer affects validation; use --only sw-cli to run just the built-in checker.
• Documentation
  • Updated command guidance to reflect the new default behavior and checker selection options.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: eae703e6-38a9-4e83-a792-15d016765f66

📥 Commits

Reviewing files that changed from the base of the PR and between 5af72c4 and 0a60478.

📒 Files selected for processing (6)

• AGENTS.md
• architecture.md
• cmd/extension/extension_validate.go
• cmd/extension/extension_validate_selection_test.go
• skills/shopware-cli-extension-store/SKILL.md
• skills/shopware-cli/SKILL.md

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

📝 Walkthrough

Walkthrough

Extension validation now runs all checkers by default. The deprecated --full flag remains accepted but has no effect. The --only and --exclude options control checker selection. The smoke test and extension-store instructions explicitly select sw-cli.

Changes

Extension validation selection

Layer / File(s)	Summary
Default selection and flag compatibility cmd/extension/extension_validate.go, cmd/extension/extension_validate_selection_test.go	The selector no longer uses --full or defaults to sw-cli when no checker is specified. Tests cover default selection, inclusion and exclusion filters, and the deprecated flag.
Validation guidance and explicit checker selection AGENTS.md, architecture.md, .github/workflows/smoke-test.yml, skills/shopware-cli-extension-store/SKILL.md, skills/shopware-cli/SKILL.md	Guidance reflects the all-checker default and deprecated --full flag. The smoke test and extension-store instructions pass --only sw-cli explicitly.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 0a604

Validation now runs all checkers by default. Callers needing the previous behavior can use --only sw-cli; --full remains accepted. No actionable merge-blocking issue remains.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 0a604

Ordinary validation now reaches project PHP bootstrapping under the caller's privileges. Validating an untrusted extension can therefore expose a developer machine or CI job to more than metadata inspection. Using --only sw-cli preserves the previous checker selection.

Retained concerns

• High · security · inferred: Making PHPStan a default checker exposes ordinary validation to extension or dependency PHP bootstrapping with the caller's environment. For attacker-controlled extensions, this can cross from inspecting project data into executing project-controlled code on the developer or CI host. The mechanism already existed behind --full or explicit selection; this PR removes that opt-in from the default path.

Security review details

Security Blast Radius

• inferred — The independently exposed unit is a validation invocation accepting an extension controlled by another party. Project bootstrap execution would inherit the validating host's user authority and environment; accessible files, credentials, and downstream services depend on that host's permissions. No specific tenant, production data store, or deployment privilege was established.

Security Findings and Attack Paths

• inferred — A caller validating an untrusted extension without selection flags now reaches PHPStan automatically. Extension-local configuration or the configured project autoloader provides a route from extension-controlled content to PHP bootstrapping in the caller's process context. This inferred attack path was not previously reached through the default checker selection and was not tested as an exploit.

Trust Boundaries and Controls

• observed — Explicit --only and --exclude constrain execution before tool setup and invocation. Project Composer commands disable scripts and plugins, but PHPStan bootstrapping is a separate stage. Project dependency installation also receives authentication merged from the environment, including SHOPWARE_PACKAGES_TOKEN when set; credential theft or redirection was not demonstrated.

Resilience and Maintainability Implications

• inferred — The existing tool-cache lifecycle treats directory existence as readiness, although it creates that directory before unpacking and installation finish. Concurrent invocation or abrupt termination can therefore expose incomplete setup to reuse. Handled installation errors remove the directory, and checker execution errors fail the command. This pre-existing recovery limitation is now reachable through ordinary validation; it does not establish a fail-open security bypass.

Hardening Proposals

• proposed — For untrusted extension validation, run executable analyzers in an isolated, least-privileged environment without unrelated credentials, or retain an explicitly selected built-in-only validation stage before any trusted-code analysis.
• proposed — Initialize shared tools in a private staging directory, coordinate concurrent initialization, and publish a verified completed cache atomically so interrupted setup is not accepted as ready on the next invocation.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 7.69% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 52 functions across 13 files. (4 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main changes: deprecating --full and making its behavior the default for extension validate.
Description check	✅ Passed	The description includes all required sections and explains the behavior change, rationale, testing, and related discussion. It provides a textual CLI behavior comparison instead of screenshots or exa…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 7.69% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 52 functions across 13 files. (4 skipped: 4 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

❌ Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 65.72%. Comparing base (56fc0f8) to head (0a60478).

Files with missing lines	Patch %	Lines
cmd/extension/extension_validate.go	83.33%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1618   +/-   ##
=======================================
  Coverage   65.72%   65.72%           
=======================================
  Files         462      462           
  Lines       30935    30928    -7     
=======================================
- Hits        20332    20328    -4     
+ Misses      10603    10600    -3     

Flag	Coverage Δ
go-test	65.72% <83.33%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Lena Forlin (moshimorschi)]

One thing to note before we release this:

This PR only changes the CLI, but our release pipelines pick it up automatically. The store-release and build-zip actions in shopware/github-actions always install the latest CLI and run plain shopware-cli extension validate <zip>, no flags (same in the reusable workflows: build-zip.yml, store-release.yml). Today that call runs only the built-in checks, but with this PR the same call runs all checkers, since the old default is now --only sw-cli and the actions don't pass it.
As soon as a release contains this PR, it means PHPStan, ESLint and Stylelint on the zip, and any error fails the job before the store upload.

I tried the new default on SwagPayPal, SwagCmsExtensions, SwagLanguagePack and SwagMigrationAssistant, and all four fail. So the next release of most Swag* and Frosh extensions would go red without anyone touching those repos.

Draft PR here: shopware/github-actions#201

[Lena Forlin (moshimorschi)]

everything should be ready :)