feat(compliance-benchmarks): support selectedOsVersions; bump jamfplatform-go-sdk to v0.12.0

[neilmartin83]

What

Brings jamf-cli up to date with jamfplatform-go-sdk v0.12.0, which regenerated the compliancebenchmarks package for an updated engine spec.

Engine spec change (from the SDK):

• BenchmarkRequestV2 dropped sources — the engine now derives content sources from sourceBaselineId, so a create request can no longer set it.
• BenchmarkRequestV2 gained selectedOsVersions — pins a benchmark to specific OS versions (osType MAC_OS or IOS); omit it to track all versions available for the baseline (the API default).
• Responses gained availableOsVersions / selectedOsVersions.

Changes

• Drop sources from the portable apply/export format and from the create request in apply and clone (it was silently ignored by the new API). Old export files that still carry sources keep applying — the key is ignored by the non-strict unmarshaller.
• Add selectedOsVersions to the portable format (omitempty): apply sends it when present, clone copies it from the source, export round-trips it from the response.
• Scaffolds: static apply --scaffold shows an illustrative selectedOsVersions entry so the knob is discoverable; --scaffold-from-baseline intentionally omits it so new benchmarks track all available OS versions.
• backup captures selectedOsVersions so diffs/backups stay faithful.
• go directive → 1.26.5 and golang.org/x/net → v0.57.0 (both pulled in by the SDK).

Testing

• make build, go vet, make test (full suite), make verify-generated, make lint (0 issues) — all pass.
• Added apply/clone/export unit coverage for selectedOsVersions plus the omitted-default case; updated existing tests for the new model.
• Live-verified against a test instance:
  • export of a macOS-26-pinned benchmark surfaces selectedOsVersions: [{MAC_OS 26}] with no sources key.
  • apply (create) → re-export round-trips selectedOsVersions (110 rules intact).
  • clone copies selectedOsVersions from the source; delete --name cleans up. Instance left clean.

Open-PR impact

Checked the only open PR, #279 (app-installer deployment endpoints). It touches generator/parser/*, generated app-installer/misc commands, and specs/AppInstallerDeployments.yaml — no overlap with benchmarks, the SDK, or go.mod/go.sum. No conflict expected.

🤖 Generated with Claude Code

[ktn-jamf]

Tip

✅ Merge-ready — Adapts compliance benchmark commands to jamfplatform-go-sdk v0.12.0: drops sources from create requests, adds optional selectedOsVersions OS-version pinning across apply/clone/export/backup. No critical or important issues found.

Rating: 5/5

• Clean surgical SDK adaptation with thorough test coverage — nothing blocking merge.

What's done well

✅ Backward compatibility via JSON non-strict unmarshalling — old export files with a sources key will silently drop it on apply, with no user-visible breakage. This is called out explicitly in the PR description, which sets the right expectation.

✅ Nil/empty slice semantics are consistent throughout — benchmarkPortableInput.SelectedOsVersions is a flat []OsVersion (portable format, JSON omitempty), BenchmarkRequestV2.SelectedOsVersions is *[]OsVersion (API boundary). All four code paths — apply from portable, apply from legacy format, clone, backup — handle the slice→pointer bridging correctly. The two new tests explicitly verify both the send-when-present and nil-when-omitted cases, which is exactly the invariant that matters.

Review coverage

• Design and architecture: portable format pattern unchanged; selectedOsVersions follows same slice→pointer bridge as other optional fields; no new abstraction boundaries
• Correctness: traced all four data paths (export→portable→apply, legacy format path in newCBApplyCmd, clone from response, backup via raw map); nil/empty slice checks consistent; omitempty prevents spurious JSON key on export
• [na] Security: no auth, input validation, or command-injection changes; user data passed as typed SDK structs
• [na] Performance: no hot paths, N+1 queries, or allocations in loops changed
• Test coverage: TestCBApply_SelectedOsVersions (send case), TestCBApply_OmitSelectedOsVersions (nil case), updated clone/export/scaffold-from-baseline tests — covers all behavioral branches
• Reliability: error propagation unchanged; no new failure modes
• Code quality: comments on intentional omissions are precise (cbScaffoldFromBaseline explains why SelectedOsVersions is left out)
• [na] Simplification: changes are surgical
• [na] Frontend concerns: CLI only
• [na] Documentation currency: adding an optional field to an existing command's portable format is not a notable new construct per §8
• [na] Project rules compliance: no .claude/rules/ directory in this repo

Scope of review

• Diff: 179 lines changed across 5 files; full diff read
• Files read in full: internal/commands/pro_compliance_benchmarks.go, internal/commands/pro_backup.go (backup section), internal/commands/pro_platform_test.go (new and updated tests)
• Skipped: go.sum (only SDK hash changes consistent with manifest)
• Risk tier: High (go.mod changed) → full review; specialist dispatch skipped given narrow scope (<300 lines, single-package change)

Generated by pr-review v1.12.1, a Jamf Claude Code skill