Certify pm CLI 2026.9.23 and adopt the guarded pm-ops merge-driver launcher - #97
Conversation
…uncher - Pins @unbrained/pm-cli 2026.9.21 -> 2026.9.23, pm-ops 2026.9.18 -> 2026.9.23, pm-changelog 2026.9.18 -> 2026.9.23, @types/node ^26.1.1 -> ^26.6.2 exactly (package.json and package-lock.json); absorbs Dependabot #95. - scripts/prepare-merge-driver.ts is now the launcher template pm-ops ships, copied unchanged: it imports nothing from pm-ops, so `npm ci --omit=dev` in a clone skips with one notice instead of failing, while a stale or broken pm-ops still fails. A test keeps it byte-identical to the pinned template and proves it registers the drivers. pm items: pm-github-d2az. Companion epic pm-cli-website-5s6z. release:check exits 0.
Reviewer's GuideThis PR upgrades and certifies the pm toolchain at 2026.9.23, adopts pm-ops’ guarded merge-driver launcher to make omit-dev installs safe without hiding stale-tool failures, and adds documentation, provenance, and tests covering template fidelity and driver registration. Sequence diagram for the guarded merge-driver prepare hooksequenceDiagram
participant NPM
participant Launcher as prepare-merge-driver.ts
participant Resolver as Node module resolver
participant PMOps as pm-ops installer
participant Git as Git config
NPM->>Launcher: execute prepare hook
Launcher->>Resolver: resolve pm-ops/merge-driver/prepare
alt pm-ops is absent
Resolver-->>Launcher: MODULE_NOT_FOUND
Launcher->>Resolver: resolve pm-ops/package.json
Resolver-->>Launcher: package absent
Launcher-->>NPM: print notice and skip
else pm-ops is installed
Resolver-->>Launcher: installer path
Launcher->>PMOps: spawn installer
PMOps->>Git: register merge drivers
Git-->>PMOps: drivers registered
PMOps-->>Launcher: exit status
Launcher-->>NPM: propagate status
end
alt pm-ops is stale or installer fails
Resolver-->>Launcher: resolution error
Launcher-->>NPM: fail installation
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="test/prepare-merge-driver.test.ts" line_range="24-27" />
<code_context>
+});
+
+test("the prepare launcher registers pm's merge drivers in this checkout", () => {
+ const run = spawnSync(process.execPath, [launcher], { cwd: root, encoding: "utf8" });
+ assert.equal(run.status, 0, run.stderr);
+ const drivers = spawnSync("git", ["config", "--get-regexp", "^merge\\.pm"], { cwd: root, encoding: "utf8" });
+ assert.match(drivers.stdout, /^merge\.pm/m);
+});
</code_context>
<issue_to_address>
**issue (testing):** The registration test can pass without the launcher registering any drivers because it never clears the repository's existing `merge.pm` configuration and only checks whether `git config` returns a matching line. A prior `npm install`/`prepare` run or developer-global repository configuration can satisfy the assertion even if the current launcher invocation did nothing.
**Triggers:** When merge-driver configuration already exists in the checkout before this test runs.
**Suggested fix:** Use an isolated temporary Git config for the launcher and verification, or remove/assert the relevant `merge.pm` entries before invoking the launcher, and also assert that the `git config` command itself succeeds.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and if the launcher or upgraded pm tooling is wrong, installs can fail or Git can register incorrect merge-driver commands. Reverting restores the prior code, but merge-driver settings already written to a clone's local Git config can outlive the revert and must be repaired or reinstalled.
Blocking findings: test/prepare-merge-driver.test.ts:27
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…d driver Review round 1 (Sourcery, Greptile): the first test could pass on merge drivers this repository's own npm ci had already registered, and it accepted any single driver. Each case now runs the launcher as npm's prepare hook would, inside a fresh git-init checkout with this repository's .gitattributes and tracker settings, and asserts the exact driver set .gitattributes declares. It also covers the omit-dev skip, a stale pm-ops, and failing and signal-killed installers. The README now describes the guarded launcher as it behaves (Greptile): it hands over to pm-ops's installer, skips with one notice when pm-ops is absent, and fails on a stale or broken pm-ops. pm item: pm-github-d2az.
|
Review round complete before merge. All 2 inline bot threads were answered in-thread, and each was either fixed in this PR or tracked on the companion hub (launcher template: pm-cli-website-dqg7; release-workflow verifier: pm-cli-website-mxrp). Greptile's latest review covers the current head 541b9de with Confidence Score: 5/5. Sourcery skipped this head (its weekly diff allowance), so its earlier findings on this PR are the last it gave, and all were answered. CodeRabbit posted only its free-plan notice: this repository has fewer than 10 stars, so it doesn't review automatically, and its one-review-per-hour allowance is kept for PRs that need it. Every required check is green on 541b9de. |
1 participant
Summary
Fleet wave of 2026-09-25 (companion epic
pm-cli-website-5s6z), applied by the fleet's deterministic wave script and verified by this repository's own gates.pm-cli-website-xy19):scripts/prepare-merge-driver.tsis now the template pm-ops 2026.9.23 ships, copied unchanged (it replaces the static-import launcher). It imports nothing from pm-ops, so a production install of a clone (npm ci --omit=dev) skips with one notice instead of dying onERR_MODULE_NOT_FOUND, while a stale or broken pm-ops still fails the install.prepare-merge-driver.test.tscompares the file byte-for-byte withnode_modules/pm-ops/templates/prepare-merge-driver.ts(pm-ops covers every branch of that template with real fixtures) and runs it to prove the drivers register.pm items
Verification
git config --get-regexp '^merge\.pm'afternpm cipm health ... --require-merge-drivers), executed from ci.ymlnpm run release:checkverify-release-publish-attestation: every publish invocation is attested.)changelog:fullthenchangelog:checkSummary by Sourcery
Certify the pm toolchain at 2026.9.23 and adopt the guarded merge-driver launcher for reliable clone installation behavior.
Bug Fixes:
Enhancements:
Documentation:
Tests:
Chores:
Summary by cubic
Certifies the pm toolchain to 2026.9.23 and swaps the prepare merge-driver launcher for the canonical pm-ops template, so
npm ci --omit=devskips merge-driver setup with a notice instead of failing.@unbrained/pm-cli,pm-ops,pm-changelog, and@types/nodeto the new versions inpackage.jsonandpackage-lock.json.git initcheckouts and asserts the full driver set.gitattributesdeclares, plus the skip, stale, and failing-installer branches.Written for commit 541b9de. Summary will update on new commits.