packages: wolfi import batch 4 — node (eslint, lerna, json-server, serve)

[bryan-minimal]

Fourth batch from pkgmgr import-wolfi — node CLI tools. Node is a different shape from the tarball-built families: Minimal installs node CLIs from the npm registry by name+version (cf. typescript-language-server), not from a github source — so these have no Source, they npm install -g at build time.

What's here (4 packages, all build + pass every minimal check at 0 TODOs)

package	npm	what it is
eslint 10.6.0	eslint	JS/TS linter
lerna 9.0.2	lerna	monorepo manager (ships native @nx addons)
json-server 1.0.0-beta.3	json-server	zero-code mock REST API
serve 14.2.5	serve	static file server

How they're produced

• build.sh: npm install -g --prefix="$OUTPUT_DIR/usr" <name>@$MINIMAL_ARG_VERSION.
• build.ncl: base + node build_deps, coreutils + node runtime_deps, a needs = { dns, internet } block for the npm fetch, and build_args { include version }.
• outputs: the console-script bins (a node usr/bin/<tool> is a symlink into node_modules) + node_modules (allow_executable — some packages ship native .node addons). Read from a verified build.

Reviewer notes (surfaced, not hidden)

• No source_provenance — node packages install from the npm registry, not a pinned github tarball, so there's no 'GithubRepo provenance for vuln-scanning (matches Minimal's existing node packages like typescript-language-server). Worth a follow-up: an npm PURL for scan coverage.
• Peer packages: some node CLIs need peers installed alongside (typescript-language-server pulls typescript). These 4 resolve their own deps via npm install; the generated build.sh installs the single named package, and the import surfaces a reviewer note to add peers if a tool needs them.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added support for packaging and installing four additional Node.js tools: eslint, json-server, lerna, and serve.
  • Each package now includes a reproducible build setup and exposes the expected command-line binary plus installed modules.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 82809b42-c3a2-4c63-8106-a854b6c88dd3

📥 Commits

Reviewing files that changed from the base of the PR and between 99f1af9 and fc59d64.

📒 Files selected for processing (8)

• packages/eslint/build.ncl
• packages/eslint/build.sh
• packages/json-server/build.ncl
• packages/json-server/build.sh
• packages/lerna/build.ncl
• packages/lerna/build.sh
• packages/serve/build.ncl
• packages/serve/build.sh

---

📝 Walkthrough

Walkthrough

This PR adds build specifications and install scripts for four new npm-based packages: eslint (10.6.0), json-server (0.17.4), lerna (9.0.7), and serve (14.2.6). Each package includes a build.ncl spec and a build.sh script performing global npm installs.

Changes

New npm package build specs

Layer / File(s)	Summary
eslint build spec and script packages/eslint/build.ncl, packages/eslint/build.sh	Defines the eslint BuildSpec pinned to version 10.6.0 with deps, needs, outputs, and attrs; script installs eslint globally via npm.
json-server build spec and script packages/json-server/build.ncl, packages/json-server/build.sh	Defines the json-server BuildSpec pinned to version 0.17.4 with deps, needs, outputs, and attrs; script installs json-server globally via npm.
lerna build spec and script packages/lerna/build.ncl, packages/lerna/build.sh	Defines the lerna BuildSpec pinned to version 9.0.7 with deps, needs, outputs, and attrs; script installs lerna globally via npm.
serve build spec and script packages/serve/build.ncl, packages/serve/build.sh	Defines the serve BuildSpec pinned to version 14.2.6 with deps, needs, outputs, and attrs; script installs serve globally via npm.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: msample

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the batch import of four Wolfi node packages and names the affected packages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch add-wolfi-imports-batch4-node

---

_{Comment @coderabbitai help to get the list of available commands.}