TK-12032: require shared fail-closed leak guard before Shopify product create

a37d4b239cefa81a484bd71e9160658d65834b20 · 2026-09-22 14:33:11 -0700 · Steve

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M scripts/push_shopify.js

Diff

commit a37d4b239cefa81a484bd71e9160658d65834b20
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Sep 22 14:33:11 2026 -0700

    TK-12032: require shared fail-closed leak guard before Shopify product create
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 scripts/push_shopify.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/push_shopify.js b/scripts/push_shopify.js
index db3f00f..cdf801d 100644
--- a/scripts/push_shopify.js
+++ b/scripts/push_shopify.js
@@ -12,6 +12,7 @@ require('dotenv').config({ path: require('path').join(__dirname,'..','.env') });
 const fs = require('fs');
 const path = require('path');
 const { execSync } = require('child_process');
+const { assertNoPublicLeak } = require(path.join(process.env.HOME, 'Projects/_shared/leak-guard/leak-guard.cjs')); // TK-12032 fail-closed private-label leak guard
 
 const SHOP = process.env.SHOPIFY_STORE;
 const TOKEN = process.env.SHOPIFY_ADMIN_TOKEN;
@@ -187,6 +188,8 @@ async function setVariantInventory(variantId, qty) {
   for (let i = 0; i < products.length; i++) {
     const p = products[i];
     const payload = buildProductPayload(p);
+    try { assertNoPublicLeak(payload, { context: `sister-parish ${p.sp_product_id}` }); }
+    catch (e) { console.error(`  ⛔ LEAK GUARD ${p.sp_product_id}: ${e.message}`); failed.push({ sp_id: p.sp_product_id, error: e.message }); continue; }
     const stamp = `[${String(i+1).padStart(3,'0')}/${products.length}]`;
     if (DRY) {
       console.log(`${stamp} would create: ${p.title} (${payload.product.variants.length} variants, ${payload.product.images.length} images)`);

← 4322d1d governance(TK-11370): make live-by-default Shopify writers d · back to Sister Parish Onboarding · Make SP guard shim path portable and skip $0-orderable varia b126d74 →