Fix github:repo accepting missing explicit commands#40
Open
cgraf78 wants to merge 1 commit into
Open
Conversation
Summary Make bare `github` method resolution and repo fallback robust when GitHub metadata cannot be fetched. The `smallstep/cli github step` failure mode was that a metadata outage could fall back to `github:repo`, accept a source checkout without `bin/step`, and leave the dependency looking installed even though no runnable command was available. - track whether `cmd` was explicitly resolved from config, including matched package-manager-qualified overrides like `apt:tool` - require `github:repo` checkouts to provide `bin/<cmd>` only when the command was explicit, preserving asset-only repo installs that use the default short name - make bare-`github` resolver caches command-aware so stale release/repo cache entries cannot mask command changes - preserve installed release-backed commands during GitHub metadata failures via manifest executable paths without refreshing the resolver TTL as though remote compatibility had been proven - avoid refreshing repo TTL or revision stamps on `MissingBinary` failures - share the explicit-command repo predicate between update and status so the two paths stay aligned A missing explicit command leaves any previous manifest/bin-link state intact rather than cleaning it during a failed update. Status reports the dependency as missing, and the old state is preserved for recovery instead of being partially torn down. Testing - `cargo fmt --check` - `git diff --check` - `cargo test --locked` - `cargo clippy --locked --all-targets -- -D warnings` - `RUSTDOCFLAGS='-D missing-docs' cargo doc --locked --no-deps` - `cargo build --locked` - `tests/shell/install-sh-test` - `tests/shell/completion-test` - `tests/shell/installer-flow-test` - `tests/shell/lua-api-test` - `tests/shell/lua-bootstrap-test` - `tests/shell/release-scripts-test` - `SHDEPS_RUST_CLI=target/debug/shdeps tests/shell/shdeps-wrapper-test` - fresh-eyes subagent review: no blocking findings after final changes - Claude tmux review: no blocking findings after final changes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix bare
github/github:repofallback behavior so metadata failures cannot leave an explicit-command dependency looking installed when the repo checkout does not providebin/<cmd>.bin/<cmd>only for explicit commands, preserving asset-only/default-command repo installsgithubmethod caches command-aware and prevent stale cache/manifest seeding from masking command changesMissingBinaryfailuresrepo::missing_explicit_commandA missing explicit command intentionally leaves any previous manifest/bin-link state intact during the failed update.
statusreports the dependency as missing while the previous state remains available for recovery.Testing
cargo fmt --checkgit diff --checkcargo test --lockedcargo clippy --locked --all-targets -- -D warningsRUSTDOCFLAGS='-D missing-docs' cargo doc --locked --no-depscargo build --lockedtests/shell/install-sh-testtests/shell/completion-testtests/shell/installer-flow-testtests/shell/lua-api-testtests/shell/lua-bootstrap-testtests/shell/release-scripts-testSHDEPS_RUST_CLI=target/debug/shdeps tests/shell/shdeps-wrapper-test