Rejeição falsa no Portal do Criador para n8n-nodes-speechall

atacan · Julho 18, 2026, 12:14pm

Falso Positivo do Creator Portal para `n8n-nodes-speechall@0.1.5`

Olá time n8n,

Estou reportando o que parece ser uma incompatibilidade de versão do scanner no Creator Portal afetando o pacote comunitário n8n-nodes-speechall@0.1.5.

Pacote: n8n-nodes-speechall@0.1.5
npm: https://www.npmjs.com/package/n8n-nodes-speechall
GitHub: GitHub - Speechall/speechall-n8n-node · GitHub
Commit atestado: 61562b67af982c735a943a5fa1b38b0ba838a032
O Creator Portal rejeita este pacote, mas o scanner atual passa.
Reprodução:

@n8n/scan-community-package@0.27.0 rejeita falsamente:
dist/credentials/SpeechallApi.credentials.d.ts
@n8n/scan-community-package@0.28.1 passa em todas as verificações.
Este falso positivo exato do .d.ts foi corrigido no n8n PR #34214
e portado para versões anteriores no PR #34391.

Poderia por favor confirmar a versão do scanner do Creator Portal, atualizar seu worker de verificação,
limpar o resultado em cache e reexecutar a submissão?

kjooleng · Julho 18, 2026, 2:06pm

Oi @atacan

Para resolver isso rapidamente, escale este relatório através dos seguintes canais oficiais:

Discord n8n (canal #community-nodes): Esta é a forma mais rápida de chamar a atenção dos desenvolvedores que mantêm o ecossistema de nós comunitários. Poste suas descobertas lá, pois os mantenedores podem disparar manualmente uma atualização de worker ou uma nova verificação.
Email de Suporte: Envie este relatório exato para support@n8n.io. Como você citou os PRs específicos, a equipe de suporte pode encaminhar isso diretamente para o time central como um “bug confirmado” em vez de uma solicitação de suporte geral.

Ao postar/enviar um email, mantenha o seguinte resumo para os engenheiros:

Problema: Creator Portal usando scanner desatualizado (@n8n/scan-community-package@0.27.0) causando falsos positivos em arquivos .d.ts.
Pacote Afetado: n8n-nodes-speechall@0.1.5
Arquivo com Falha: dist/credentials/SpeechallApi.credentials.d.ts
Resolução: Atualizar scanner do Portal para v0.28.1 (Correção implementada no PR #34214 / #34391).
Solicitação: Atualizar worker de avaliação → Limpar cache → Executar envio novamente.

Anshul_Namdev · Julho 18, 2026, 10:36pm

Oi @atacan Bem-vindo!
PR #34214, fix(core): Lint community packages against their provenance-attested source, mesclado no master em 15 de julho de 2026. @n8n/scan-community-package 0.28.0 publicado no npm no dia seguinte, 0.28.1 no dia após. Esse cronograma se alinha exatamente com seu relatório: 0.27.0, publicado em 14 de julho, antecede a correção, 0.28.1 não.
Anexe os timestamps de merge e publicação ao seu relatório. Isso fornece a quem revisar isso evidências concretas da versão do scanner fixada em vez de apenas sua reprodução local.

github.com/n8n-io/n8n

fix(core): Lint community packages against their provenance-attested source (#34214)

master ← fix-package-scan-source

opened 08:52AM - 15 Jul 26 UTC

garritfra

+342 -22

## Summary `@n8n/scan-community-package` linted only the **compiled** output sh…ipped in published tarballs. The node/credential lint rules are written for `.ts` sources: against `dist/` output they mostly silently no-op (the plugin's own file resolution maps `dist/nodes/Foo.node.js` → `nodes/Foo.node.ts`, which doesn't exist in a tarball) or false-positive (the filename-convention rules can never be satisfied by `.d.ts` files). Since npm provenance is already mandatory for the scan to proceed, the attestation tells us exactly which repo + commit the published artifact was built from. This PR makes the scanner: 1. Parse the provenance attestation (`registry.npmjs.org/-/npm/v1/attestations/…`) to extract the attested GitHub repo and commit. 2. Download that exact source checkout and locate the package root by `package.json` name (monorepo-aware). 3. Lint the source scoped to `package.json` + `nodes/**` + `credentials/**` — the same surface `n8n-node lint` covers at dev time, deliberately excluding repo dev files (gulpfile, test configs, committed `dist/`) that never end up in the published package. 4. **Keep scanning the shipped artifact**: provenance pins the source commit, not the build output — a build step can emit anything into `dist/`. The tarball leg is scoped to compiled `**/*.js` + the published `package.json` (so `no-dangerous-functions`, `no-restricted-imports`, `no-forbidden-lifecycle-scripts`, `no-console` etc. still run against what users actually install); `.ts`/`.d.ts` declarations are covered better by the source scan and only false-positive on filename rules there. 5. **Hard-fail when the source can't be fetched** (unsupported host, unreachable repo, no matching package root) with an actionable message — a tarball-only fallback would silently reintroduce the blind spot this PR removes. Both source-fetch requests are bounded by a 30s timeout so a stalled connection fails fast instead of hanging the gate. Since `.ts`/`.d.ts` files are never linted from tarballs anymore, this supersedes the need for #34203 on this path. ## How to test ```bash cd packages/@n8n/scan-community-package && pnpm vitest run scanner/scanner.test.mjs ``` End-to-end against the package from the ticket: ```bash node packages/@n8n/scan-community-package/scanner/cli.mjs @luzconsulting/n8n-nodes-salessuite ``` - **Before:** fails with the bogus `Rename file to SalesSuiteApi.credentials.ts` false positive; all source-level rules blind. - **After:** `✅ Fetched source from github.com/luzconsulting/n8n-nodes-salessuite@42cdce5` — the false positive is gone, and the scan surfaces 6 real violations in the source (`require-node-api-error`, dynamic-options display-name rules) that the compiled-output scan missed entirely. Note: `test/provenance.test.mjs` fails under vitest on `master` already (it uses `node:test`, which vitest 4 rejects as "no test suite") — pre-existing, untouched here. ## Related Linear tickets, Github issues, and Community forum posts https://linear.app/n8n/issue/CE-1713 ## Review / Merge checklist - [x] I have seen this code, I have run this code, and I take responsibility for this code. - [x] PR title and summary are descriptive. ([conventions](../blob/master/.github/pull_request_title_conventions.md)) - [ ] [Docs updated](https://github.com/n8n-docs) or follow-up ticket created. - [x] Tests included. - [x] PR Labeled with `Backport to Beta`, `Backport to Stable`, or `Backport to v1` (if the PR is an urgent fix that needs to be backported) 🤖 PR Summary generated by AI 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Tópico		Respostas	Visualizações
Creator Portal reports "tests failed" but `scan-community-package` passes on the published package Questions bug:confirmed	5	111	24 de Julho de 2026
Verification pre-check fails with generic "some tests have failed", but scan-community-package passes Questions bug:unconfirmed	3	96	21 de Julho de 2026
@n8n/scan-community-package failing for cred filename Questions deployment , community-node , bug:unconfirmed	4	73	22 de Julho de 2026
Issue with Community Node Submission - n8n-nodes-chainstream Questions node	0	51	17 de Outubro de 2025
Request to submit a new n8n community node for review Help me Build my Workflow	4	106	17 de Março de 2026

Rejeição falsa no Portal do Criador para n8n-nodes-speechall

Falso Positivo do Creator Portal para n8n-nodes-speechall@0.1.5

Tópicos relacionados

Falso Positivo do Creator Portal para `n8n-nodes-speechall@0.1.5`