Address audit findings: WSL config correctness, safer bootstrap installs, portable wallpaper script runtime, reproducible pytest deps#5
Merged
Conversation
Copilot
AI
changed the title
[WIP] Address dotfiles audit findings with PR
Address audit findings: WSL config correctness, safer bootstrap installs, portable wallpaper script runtime, reproducible pytest deps
May 24, 2026
KevinTCoughlin
marked this pull request as ready for review
May 24, 2026 15:31
There was a problem hiding this comment.
Pull request overview
This PR follows up on an audit by tightening install guidance/scripts (avoiding pipe-to-shell), improving portability of a user-facing wallpaper script, correcting WSL configuration placement, and centralizing Python test dependencies for easier setup.
Changes:
- Centralizes pytest-related dependencies in
tests/requirements-dev.txtand updates test docs/comments to install from it. - Hardens Homebrew install guidance and the bootstrap script by downloading installer scripts to a temp file and executing explicitly.
- Adjusts
.wslconfigCPU/memory-reclaim settings and updates the wallpaper script shebang to useenv python3.
Reviewed changes
Copilot reviewed 5 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/test_obs.py | Updates dependency guidance to install via the shared requirements file. |
| tests/requirements-dev.txt | Adds a shared dependency list for pytest-related tests. |
| tests/README.md | Updates Python test setup to use a venv and install from requirements-dev.txt. |
| SETUP.md | Replaces `curl |
| dot_wslconfig | Updates processor count and moves autoMemoryReclaim under [experimental]. |
| dot_local/bin/private_executable_stylize-wallpaper | Changes shebang from a machine-local venv path to #!/usr/bin/env python3. |
| dot_local/bin/executable_bootstrap | Replaces `curl |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+1
to
+3
| pytest>=8,<9 | ||
| pytest-asyncio>=0.23,<1 | ||
| websockets>=12,<16 |
Comment on lines
+53
to
+57
| curl --fail --show-error --location --proto '=https' --tlsv1.2 \ | ||
| -o "$install_script" \ | ||
| https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh | ||
| /bin/bash "$install_script" | ||
| rm -f "$install_script" |
Comment on lines
10
to
11
| # Nested virtualization | ||
| nestedVirtualization=true |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR addresses the audit follow-up by correcting WSL host-specific settings, removing unsafe pipe-to-shell install patterns, improving interpreter portability for a user script, and making Python test dependencies reproducible across environments. It also includes a final rubber-duck pass and small follow-up adjustments from that critique.
WSL config correctness
dot_wslconfignow matches the current 12-core profile (processors=12).autoMemoryReclaimis removed from[wsl2]and retained only in[experimental].Bootstrap/install hardening
curl | bashpatterns in setup guidance and bootstrap flow with: download to temp file → execute explicitly → cleanup.Interpreter portability
dot_local/bin/private_executable_stylize-wallpapershebang changed from a machine-local venv path to:#!/usr/bin/env python3Reproducible Python test dependencies
tests/requirements-dev.txtas a single source of truth for pytest-related dependencies.tests/README.mdandtests/test_obs.pydependency guidance to install from that file via venv/pip.Final rubber-duck review (required)
mktempusage and ensured cleanup on bootstrap failure paths.