fix: added branch set via the stack config

[cs-raj]

Summary

Two bugs in the taxonomy localisation implementation introduced in feat: add localized taxonomy and term delivery (CDA) support:

1. Branch fallback ?? "main" breaks non-branched stacks — every request injected branch=main when Config.Branch was null, causing 422 Branch not found on any stack without branching configured.
2. 4xx API errors lose structured detail — TaxonomyException.CreateForProcessingError(ex) wrapped the raw exception without reading the API response body, leaving ErrorCode, StatusCode, and Errors always at their zero/null defaults.

---

Files Changed

File	Changes
Contentstack.Core/Models/Taxonomy.cs	Remove ?? "main" branch fallback; wire GetContentstackError() into catch block
Contentstack.Core/Models/Term.cs	Remove ?? "main" branch fallback in ExecuteRequest; wire GetContentstackError() in all four catch blocks (Fetch, Locales, Ancestors, Descendants)
Contentstack.Core/Models/TermQuery.cs	Remove ?? "main" branch fallback; wire GetContentstackError() into catch block; swap new List<T>() empty fallback for Enumerable.Empty<T>()
Contentstack.Core.Tests/Integration/Taxonomy/TaxonomyLocalisationTest.cs	Remove one stale assertion that was checking removed behaviour

---

Bug 1 — Branch fallback ?? "main"

Before

// Taxonomy.cs, Term.cs, TermQuery.cs — all three
var branch = Stack.Config?.Branch ?? "main";
var result = await handler.ProcessRequest(_Url, headerAll, mainJson, Branch: branch, ...);

After

var result = await handler.ProcessRequest(_Url, headerAll, mainJson, Branch: Stack.Config.Branch, ...);

Why it broke

When a stack is created without branching configured, Config.Branch is null. HttpRequestHandler.ProcessRequest omits the branch header when passed null — correct behaviour. The ?? "main" fallback bypassed that and sent branch=main on every request. Any stack that does not have a branch named "main" got a 422 Branch not found back from the CDA.

Asset and Entry pass Config.Branch directly with no fallback. This change aligns taxonomy with that pattern.

---

Bug 2 — Structured error propagation

Before

catch (Exception ex)
{
    throw TaxonomyException.CreateForProcessingError(ex);
}

CreateForProcessingError does this:

public static TaxonomyException CreateForProcessingError(Exception innerException)
{
    return new TaxonomyException(
        string.Format(ErrorMessages.TaxonomyProcessingError,
        ErrorMessages.FormatExceptionDetails(innerException)),
        innerException);
}

It formats the exception message string and wraps it. It never reads the HTTP response body. So on a 401 or 422, callers got:

TaxonomyException.ErrorCode   → 0
TaxonomyException.StatusCode  → 500
TaxonomyException.Errors      → null
TaxonomyException.Message     → "An error occurred while processing the Taxonomy: The remote server returned an error: (401) Unauthorized."

After

catch (Exception ex)
{
    var contentstackError = GetContentstackError(ex);         // Taxonomy.cs
    // var contentstackError = Taxonomy.GetContentstackError(ex); // Term.cs, TermQuery.cs
    throw new TaxonomyException(contentstackError.Message, ex)
    {
        ErrorCode  = contentstackError.ErrorCode,
        StatusCode = contentstackError.StatusCode,
        Errors     = contentstackError.Errors
    };
}

GetContentstackError(ex) was already present on Taxonomy — identical to the implementation on Asset and Entry. It opens the WebException response stream, reads the JSON body, and extracts error_code, error_message, and errors. Callers now get:

TaxonomyException.ErrorCode   → 105
TaxonomyException.StatusCode  → 401
TaxonomyException.Errors      → { "api_key": "is not valid" }
TaxonomyException.Message     → "Access denied"

This allows proper error handling at the call site:

catch (TaxonomyException ex) when (ex.ErrorCode == 105)
{
    // handle access denied
}
catch (TaxonomyException ex) when (ex.StatusCode == HttpStatusCode.UnprocessableEntity)
{
    // handle validation errors — inspect ex.Errors
}

---

Minor — TermQuery.Find<T>() empty fallback

Changed new List<T>() to Enumerable.Empty<T>() for the zero-terms case. Avoids allocating an empty list on every call that returns no terms.

---

Out of scope

Taxonomy.cs still contains dead code carried over from the initial implementation: _ObjectAttributes, _Headers, _StackHeaders, UrlQueries, and GetHeader() are all declared but never used in any active code path. GetContentstackError() itself is now used but was previously dead. Cleaning up the remaining dead fields belongs in a separate PR to keep the diff reviewable.

---

Test results

Passed!  - Failed: 0, Passed: 46, Skipped: 0, Total: 46
Contentstack.Core.Unit.Tests — TaxonomyUnitTests (net7.0)

Integration tests (TaxonomyLocalisationTest) cover all eight CDA endpoints against the real API and pass unchanged.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed