clawbot
8879aeb68e
check / check (push) Waiting to run
script/bootstrap kept any yarn on PATH, so YARN_VERSION applied only where none was installed. It now keeps the yarn on PATH only when yarn --version is exactly YARN_VERSION, and otherwise installs that version. The node on PATH is used only when it has the pinned major version, as REPO_POLICIES.md asks, and is at least NODE_MIN_VERSION. After installing either, bootstrap looks the tool up through PATH again, stops, naming the path, if that one fails the same check, and prints the version it uses, as for Go. Every other host script that runs yarn now goes through the new script/yarn, which uses the first node on PATH, ~/.local/bin first, when it passes the same test, and otherwise the pinned node in nvm. Model: opus-5-5
337 lines
12 KiB
Bash
Executable File
337 lines
12 KiB
Bash
Executable File
#!/bin/sh
|
|
# script/bootstrap: install all dependencies needed to build and develop
|
|
# this repo. Idempotent: every install is guarded by a check so already
|
|
# installed tools are skipped. Base tooling comes from nix, apt, brew,
|
|
# or apk (detected in that order); assumes nothing is present. Node is
|
|
# used directly only if it has the major version of NODE_VERSION and is
|
|
# at least NODE_MIN_VERSION; otherwise NODE_VERSION is installed via nvm
|
|
# (installing nvm itself first, from a hash-verified release archive,
|
|
# never curl | sh). Yarn is used directly only if it is exactly
|
|
# YARN_VERSION; otherwise that version is prepared through corepack,
|
|
# or installed with npm where there is no corepack.
|
|
# Go, with its gofmt, is used directly only if it is exactly GO_VERSION;
|
|
# otherwise that release is installed from its hash-verified archive.
|
|
#
|
|
# What this script installs outside the system package manager lives
|
|
# under $HOME and is linked into ~/.local/bin, where make and the git
|
|
# hook find it once that directory is on PATH. Nothing in ~/.local/bin
|
|
# that this script did not create is ever replaced.
|
|
#
|
|
# golangci-lint is not installed: make lint runs it in Docker, as make
|
|
# test runs the tests, and this script does not install Docker either.
|
|
#
|
|
# Unlike the org model: Go for the backend, a newer node for eslint.
|
|
set -eu
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
|
|
|
# Pinned versions, 2026-07-06
|
|
NODE_VERSION="22.17.0"
|
|
# The oldest node the frontend's dependencies accept: the "engines"
|
|
# field of eslint 10.12.0, the most demanding of them, asks for 22.13.0
|
|
# or newer, 2026-10-03. An older installed node is not used.
|
|
NODE_MIN_VERSION="22.13.0"
|
|
NVM_VERSION="0.40.3"
|
|
# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
|
|
NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
|
|
YARN_VERSION="1.22.22"
|
|
# The Go inside the golang:1.25-alpine image Dockerfile builds the
|
|
# backend with, 2026-08-09. The archive hashes are in ensure_go.
|
|
GO_VERSION="1.25.7"
|
|
|
|
BIN_DIR="$HOME/.local/bin"
|
|
TOOLCHAIN="$HOME/.local/share/$("$ROOT/script/projectname")/toolchain"
|
|
|
|
PKGMGR=""
|
|
SUDO=""
|
|
APT_UPDATED=""
|
|
|
|
detect_pkgmgr() {
|
|
[ -n "$PKGMGR" ] && return 0
|
|
if command -v nix-env >/dev/null 2>&1; then
|
|
PKGMGR="nix"
|
|
elif command -v apt-get >/dev/null 2>&1; then
|
|
PKGMGR="apt"
|
|
elif command -v brew >/dev/null 2>&1; then
|
|
PKGMGR="brew"
|
|
elif command -v apk >/dev/null 2>&1; then
|
|
PKGMGR="apk"
|
|
else
|
|
echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
|
|
exit 1
|
|
fi
|
|
if [ "$PKGMGR" = "apt" ]; then
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
if [ "$(id -u)" != "0" ]; then
|
|
SUDO="sudo"
|
|
fi
|
|
fi
|
|
}
|
|
|
|
# pkg_install <nix-attr> <apt-pkgs> <brew-formula> <apk-pkgs>: the apt
|
|
# and apk arguments may each list several packages, separated by spaces.
|
|
pkg_install() {
|
|
detect_pkgmgr
|
|
case "$PKGMGR" in
|
|
nix) nix-env -iA "nixpkgs.$1" ;;
|
|
apt)
|
|
if [ -z "$APT_UPDATED" ]; then
|
|
$SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
|
|
APT_UPDATED=1
|
|
fi
|
|
$SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y $2
|
|
;;
|
|
brew) brew install "$3" ;;
|
|
apk) apk add --no-cache $4 ;;
|
|
esac
|
|
}
|
|
|
|
missing() {
|
|
! command -v "$1" >/dev/null 2>&1
|
|
}
|
|
|
|
# verify_sha256 <file> <expected-hash>
|
|
verify_sha256() {
|
|
if command -v sha256sum >/dev/null 2>&1; then
|
|
actual="$(sha256sum "$1" | cut -d' ' -f1)"
|
|
else
|
|
actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
|
|
fi
|
|
if [ "$actual" != "$2" ]; then
|
|
echo "bootstrap: sha256 mismatch for $1" >&2
|
|
echo " expected: $2" >&2
|
|
echo " actual: $actual" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# link_bin <target> <name>: make an installed tool reachable as
|
|
# $BIN_DIR/<name>. Only a symlink this script made, one pointing into
|
|
# $TOOLCHAIN or ~/.nvm, is ever replaced; if anything else is already
|
|
# there, bootstrap stops.
|
|
link_bin() {
|
|
link="$BIN_DIR/$2"
|
|
if [ -L "$link" ] || [ -e "$link" ]; then
|
|
case "$(readlink "$link" || true)" in
|
|
"$TOOLCHAIN"/* | "$HOME"/.nvm/*) ;;
|
|
*)
|
|
echo "bootstrap: $link was not created by this script;" >&2
|
|
echo " remove or rename it, then re-run bootstrap" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
fi
|
|
mkdir -p "$BIN_DIR"
|
|
ln -sf "$1" "$link"
|
|
}
|
|
|
|
# nvm is a bash script; run a command in a bash with nvm loaded
|
|
nvm_sh() {
|
|
bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
|
|
}
|
|
|
|
ensure_nvm() {
|
|
[ -s "$HOME/.nvm/nvm.sh" ] && return 0
|
|
# nvm prerequisites; nvm itself requires bash
|
|
if missing bash; then pkg_install bash bash bash bash; fi
|
|
if missing curl; then pkg_install curl curl curl curl; fi
|
|
if missing git; then pkg_install git git git git; fi
|
|
tmp="$(mktemp -d)"
|
|
curl -fsSL -o "$tmp/nvm.tar.gz" \
|
|
"https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
|
|
verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
|
|
mkdir -p "$HOME/.nvm"
|
|
tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
|
|
rm -rf "$tmp"
|
|
}
|
|
|
|
# node_ok: the node on PATH has the major version of NODE_VERSION and is
|
|
# at least NODE_MIN_VERSION. Only the major is compared with the pin,
|
|
# as REPO_POLICIES.md asks. node itself compares the versions: major,
|
|
# then minor, then patch. A node that fails does not pass.
|
|
# script/bootstrap and script/yarn carry this function unchanged.
|
|
node_ok() {
|
|
if ! command -v node >/dev/null 2>&1; then return 1; fi
|
|
node -e '
|
|
const have = process.versions.node.split(".").map(Number);
|
|
const want = process.argv[1].split(".").map(Number);
|
|
const pinned = process.argv[2].split(".").map(Number);
|
|
if (have[0] !== pinned[0]) process.exit(1);
|
|
for (let i = 0; i < 3; i++) {
|
|
if (have[i] !== want[i]) process.exit(have[i] > want[i] ? 0 : 1);
|
|
}
|
|
' "$NODE_MIN_VERSION" "$NODE_VERSION"
|
|
}
|
|
|
|
# ensure_node: unless node_ok, install NODE_VERSION and link its node.
|
|
# Afterwards node is looked up through PATH again and must pass node_ok.
|
|
ensure_node() {
|
|
if node_ok; then
|
|
echo "bootstrap: using node $(node --version)"
|
|
return 0
|
|
fi
|
|
ensure_nvm
|
|
nvm_sh "nvm install $NODE_VERSION"
|
|
link_bin "$HOME/.nvm/versions/node/v$NODE_VERSION/bin/node" node
|
|
hash -r
|
|
if ! node_ok; then
|
|
echo "bootstrap: after installing node $NODE_VERSION through nvm," >&2
|
|
echo " the node on PATH, $(command -v node), is not it" >&2
|
|
exit 1
|
|
fi
|
|
echo "bootstrap: installed node $(node --version)"
|
|
}
|
|
|
|
# yarn_ok: yarn --version on PATH prints exactly YARN_VERSION, compared
|
|
# over the whole version. A yarn that fails or prints anything else does
|
|
# not pass.
|
|
yarn_ok() {
|
|
if missing yarn; then return 1; fi
|
|
version="$(yarn --version 2>/dev/null)" || return 1
|
|
[ "$version" = "$YARN_VERSION" ]
|
|
}
|
|
|
|
# ensure_yarn: unless yarn_ok, prepare YARN_VERSION and link its yarn.
|
|
# corepack writes its shims (pnpm and yarnpkg as well as yarn) into
|
|
# $TOOLCHAIN rather than next to itself, and the npm fallback installs
|
|
# there too; only yarn is linked. Afterwards yarn is looked up through
|
|
# PATH again and must pass yarn_ok, so another yarn that hides the link
|
|
# stops bootstrap.
|
|
ensure_yarn() {
|
|
if yarn_ok; then
|
|
echo "bootstrap: using yarn $(yarn --version)"
|
|
return 0
|
|
fi
|
|
shims="$TOOLCHAIN/corepack-shims"
|
|
mkdir -p "$shims"
|
|
if ! missing corepack; then
|
|
corepack enable --install-directory "$shims"
|
|
corepack prepare "yarn@$YARN_VERSION" --activate
|
|
elif [ -s "$HOME/.nvm/nvm.sh" ]; then
|
|
nvm_sh "nvm use $NODE_VERSION >/dev/null && \
|
|
corepack enable --install-directory \"$shims\" && \
|
|
corepack prepare yarn@$YARN_VERSION --activate"
|
|
else
|
|
npm install -g --prefix "$TOOLCHAIN/npm-global" "yarn@$YARN_VERSION"
|
|
shims="$TOOLCHAIN/npm-global/bin"
|
|
fi
|
|
link_bin "$shims/yarn" yarn
|
|
hash -r
|
|
if ! yarn_ok; then
|
|
echo "bootstrap: after installing yarn $YARN_VERSION in $shims," >&2
|
|
echo " the yarn on PATH, $(command -v yarn), does not report it" >&2
|
|
exit 1
|
|
fi
|
|
echo "bootstrap: installed yarn $(yarn --version)"
|
|
}
|
|
|
|
# go_ok: the go on PATH has its gofmt beside it (a Go release ships the
|
|
# two together) and go version reports exactly GO_VERSION, compared over
|
|
# the whole version, not a prefix of it. A go that fails or prints
|
|
# anything else does not pass. GOTOOLCHAIN=local makes go report itself
|
|
# rather than a toolchain it would fetch.
|
|
go_ok() {
|
|
if missing go; then return 1; fi
|
|
[ -x "$(dirname "$(command -v go)")/gofmt" ] || return 1
|
|
version="$(GOTOOLCHAIN=local go version 2>/dev/null)" || return 1
|
|
case "$version" in
|
|
"go version go$GO_VERSION "*) return 0 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
# ensure_go: unless go_ok, install GO_VERSION and link its go and gofmt.
|
|
# They are linked on every run that needs them, so a deleted link is put
|
|
# back, and the archive is unpacked again if either binary is missing.
|
|
# Afterwards go is looked up through PATH again and must pass go_ok, so
|
|
# another go that hides the link stops bootstrap.
|
|
ensure_go() {
|
|
if go_ok; then
|
|
echo "bootstrap: using $(GOTOOLCHAIN=local go version)"
|
|
return 0
|
|
fi
|
|
go_dir="$TOOLCHAIN/go-$GO_VERSION"
|
|
if [ ! -x "$go_dir/bin/go" ] || [ ! -x "$go_dir/bin/gofmt" ]; then
|
|
# sha256 of each archive, from https://go.dev/dl/?mode=json
|
|
case "$(uname -s)-$(uname -m)" in
|
|
Linux-x86_64)
|
|
plat="linux-amd64"
|
|
sha="12e6d6a191091ae27dc31f6efc630e3a3b8ba409baf3573d955b196fdf086005"
|
|
;;
|
|
Linux-aarch64)
|
|
plat="linux-arm64"
|
|
sha="ba611a53534135a81067240eff9508cd7e256c560edd5d8c2fef54f083c07129"
|
|
;;
|
|
Darwin-x86_64)
|
|
plat="darwin-amd64"
|
|
sha="bf5050a2152f4053837b886e8d9640c829dbacbc3370f913351eb0904cb706f5"
|
|
;;
|
|
Darwin-arm64)
|
|
plat="darwin-arm64"
|
|
sha="ff18369ffad05c57d5bed888b660b31385f3c913670a83ef557cdfd98ea9ae1b"
|
|
;;
|
|
*)
|
|
echo "bootstrap: no pinned Go release for this platform" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
if missing curl; then pkg_install curl curl curl curl; fi
|
|
mkdir -p "$TOOLCHAIN"
|
|
curl -fsSL -o "$go_dir.tar.gz" \
|
|
"https://go.dev/dl/go$GO_VERSION.$plat.tar.gz"
|
|
verify_sha256 "$go_dir.tar.gz" "$sha"
|
|
# Unpacked beside its final place and then moved there, so an
|
|
# interrupted run never leaves a partial Go that looks complete.
|
|
rm -rf "$go_dir.partial"
|
|
mkdir "$go_dir.partial"
|
|
tar -xzf "$go_dir.tar.gz" -C "$go_dir.partial" --strip-components=1
|
|
rm -rf "$go_dir" "$go_dir.tar.gz"
|
|
mv "$go_dir.partial" "$go_dir"
|
|
fi
|
|
link_bin "$go_dir/bin/go" go
|
|
link_bin "$go_dir/bin/gofmt" gofmt
|
|
hash -r
|
|
if ! go_ok; then
|
|
echo "bootstrap: after installing go $GO_VERSION in $go_dir," >&2
|
|
echo " the go on PATH, $(command -v go), is not it or has no gofmt" >&2
|
|
exit 1
|
|
fi
|
|
echo "bootstrap: installed $(GOTOOLCHAIN=local go version)"
|
|
}
|
|
|
|
main() {
|
|
cd "$ROOT"
|
|
|
|
# Tools linked on an earlier run count as installed, and tools linked
|
|
# on this run are found by the steps after it.
|
|
path_hint=""
|
|
case ":$PATH:" in
|
|
*":$BIN_DIR:"*) ;;
|
|
*) path_hint=yes ;;
|
|
esac
|
|
PATH="$BIN_DIR:$PATH"
|
|
|
|
if missing make; then pkg_install gnumake make make make; fi
|
|
if missing git; then pkg_install git git git git; fi
|
|
|
|
ensure_node
|
|
ensure_yarn
|
|
yarn install --frozen-lockfile
|
|
|
|
ensure_go
|
|
go mod download
|
|
|
|
if missing docker; then
|
|
echo "bootstrap: docker not found; make test and make lint, and so" >&2
|
|
echo " make check and the pre-commit hook, need it" >&2
|
|
fi
|
|
if [ -n "$path_hint" ] && [ -d "$BIN_DIR" ]; then
|
|
echo "bootstrap: add $BIN_DIR to the front of your PATH, e.g." >&2
|
|
echo " export PATH=\"\$HOME/.local/bin:\$PATH\"" >&2
|
|
fi
|
|
|
|
echo "bootstrap complete"
|
|
}
|
|
|
|
main "$@"
|