fix(installer): derive every gentle-ai version literal from one authoritative pin - #262
Merged
Merged
Conversation
The pinned Gentle AI version was hand-duplicated across five literals plus a textual grep in verify-package-files.mjs, which is exactly why a prior pin bump shipped installing v2.1.11 while writing v2.2.0 to disk (see scripts/install-gentle-ai.mjs header comment). scripts/gentle-ai-installer.mjs INSTALLER_VERSION is now the single source: RELEASE_BASE_URL, GENTLE_AI_WINDOWS_SOURCE_TAG, and the installed-binary version check all derive from it, and lib/gentle-ai-binary.ts imports it instead of repeating the literal (runtime/gentle-ai-binary.mjs regenerated to match). verify-package-files.mjs now imports and compares the live constants via gentleAiVersionPinMismatches instead of grepping file text for a version substring, so a drifted derived location fails with a specific message instead of silently passing the old textual check.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThe installer version is now the authoritative Gentle AI version source. Binary metadata, release URLs, Windows source tags, regex validation, and package verification use derived values. Tests cover mismatched and consistent version pins. ChangesGentle AI version pinning
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Quick win. Independent of the release-artifact initiative and of any tracker.
Problem
The pinned gentle-ai version was hand-duplicated across six literals plus a textual grep. This already caused a production incident, documented verbatim in the header of
scripts/install-gentle-ai.mjs: the installer reported installing v2.1.11 while writing v2.2.0 to disk, because two hardcoded copies survived a pin bump.The check meant to catch that was
installer.includes(...)on a literal string — it verifies a string appears in a file, not that the values agree. That is exactly why it did not catch the incident.Change
INSTALLER_VERSIONbecomes the sole authoritative literal.RELEASE_BASE_URL,GENTLE_AI_WINDOWS_SOURCE_TAG,lib/gentle-ai-binary.ts'sGENTLE_AI_VERSION, and the previously undocumented sixth copy (the hardcoded version regex inassertExactGentleAiVersion) all derive from it.scripts/verify-package-files.mjsnow imports the live constants and compares actual values through a new puregentleAiVersionPinMismatches(...), replacing the textual grep.The pinned version value is unchanged (2.2.3). This is a refactor of how the value is expressed, not a bump.
Out of scope, deliberately
Per-platform sha256 digests stay as data — they are inherently plural and cannot be single-sourced. Symlink rejection, path confinement and the TOCTOU re-check in
runtime/gentle-ai-binary.mjsare untouched.Tests
RED first: importing
RELEASE_BASE_URLfailed before the export existed. Three new tests intests/verify-package-files.test.tscover a single-field mismatch, a multi-field mismatch, and agreement across the real values — the first is the regression test for the documented incident and could not have failed under the old grep.pnpm run check:transaction-runnerpasses (runtime/regenerated, never hand-edited).node scripts/verify-package-files.mjspasses.Three tests in
native-review-parity-runtime.test.tsfail on this branch and fail identically on cleanmain— they require receipt-driven development to be enabled, which is globally off in this environment. Verified independently against the base commit.Rollback
Single commit. Reverting restores the prior six-literal-plus-grep state with no other side effects.
Summary by CodeRabbit
Bug Fixes
Tests