fix(release): regenerate package directory index - #400
Conversation
|
Warning Review limit reachedNext included review available in 37 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR adds directory index regeneration to ensure atomic package updates include the complete directory.json file. The implementation correctly adds the generation step and updates both the production script and test coverage.
Critical Issue: The directory generation step lacks error handling, which could cause silent failures if the node script encounters issues. This must be fixed before merge to prevent validation gate failures.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
| ( | ||
| cd "$WORK/pkgs" | ||
| node scripts/generate-directory.mjs | ||
| ) |
There was a problem hiding this comment.
🛑 Crash Risk: The subshell executes node scripts/generate-directory.mjs without error handling. If the node script fails (missing dependencies, script errors, or missing scripts/generate-directory.mjs in the cloned repository), the failure will be silently ignored due to the subshell, and the build will continue with a stale or missing directory.json, causing the validation gate to fail.
| ( | |
| cd "$WORK/pkgs" | |
| node scripts/generate-directory.mjs | |
| ) | |
| cd "$WORK/pkgs" | |
| if ! node scripts/generate-directory.mjs; then | |
| echo "publish-cli-manifests: failed to generate directory index" >&2 | |
| exit 1 | |
| fi |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c028573852
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| cp "$SCOOP_MANIFEST" "$WORK/pkgs/bucket/radioactive-ralph.json" | ||
| ( | ||
| cd "$WORK/pkgs" | ||
| node scripts/generate-directory.mjs |
There was a problem hiding this comment.
When jbcom/pkgs main contains a compromised or malicious scripts/generate-directory.mjs, this executes mutable cross-repository code while PKGS_GH_TOKEN and RELEASE_GH_TOKEN are present in the environment and the token-bearing GIT_ASKPASS file is available. The inspected package-manifests job in .github/workflows/release.yml grants the release token contents: write, so that code can modify both the package repository and radioactive-ralph release contents; generate the index using trusted code from this repository, or otherwise isolate the generator from all credentials and credential files.
Useful? React with 👍 / 👎.
|
1 participant
Regenerates jbcom/pkgs deterministic directory.json in the same signed cask/Scoop manifest update, so the package PR's validation gate receives a complete atomic change.\n\nValidated locally: bash scripts/ci/test_publish_cli_manifests.sh; go test ./tests/releasecontrol; actionlint; git diff --check.