packages: wolfi import batch 5 — 10 CLI tools (dive, restic, gitleaks, sccache, …)#371
packages: wolfi import batch 5 — 10 CLI tools (dive, restic, gitleaks, sccache, …)#371bryan-minimal wants to merge 3 commits into
Conversation
…70 merge High-star single-binary CLIs from `pkgmgr import-wolfi`: go: dive, lazydocker, esbuild, croc, restic, gitleaks, sops rust: sccache, tealdeer (→ tldr), dua Each builds clean + passes every `minimal check` at 0 TODOs. Sources mirrored to gs://minimal-staging-archives. NOT pushed / no PR yet — staged on this branch to open once batches 1-4 (#367-#370) land. Co-Authored-By: Claude Opus 4.8 <[email protected]>
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 54 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughAdds ten new package build specifications (croc, dive, dua, esbuild, gitleaks, lazydocker, restic, sccache, sops, tealdeer), each with a build.ncl defining dependencies, build commands, outputs, runtime deps, metadata, and smoke tests, plus corresponding build.sh scripts compiling Go or Rust binaries into fixed output paths. ChangesGo-based package builds
Rust-based package builds
Estimated code review effort: 3 (Moderate) | ~25 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Buildbot: `restic --version` → "unknown flag: --version". restic exposes its version via the `restic version` subcommand, not a `--version` flag. Regenerated with the fixed importer, which now probes both forms (`restic --version 2>/dev/null || restic version`). Passes every check. Co-Authored-By: Claude Opus 4.8 <[email protected]>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/gitleaks/build.sh`:
- Line 6: The version stamp in the gitleaks build command is pointing at the
wrong module path, so the linker never sets the intended version value. Update
the go build ldflags in build.sh to use the correct
github.com/zricethezav/gitleaks/v8/cmd.Version symbol so the binary gets the
expected version string.
In `@packages/lazydocker/build.sh`:
- Line 6: The build metadata in the lazydocker build script is incorrectly
hardcoded to wolfiRelease, which can misrepresent the binary’s provenance.
Update the ldflags in the build command to set main.buildSource to a value that
reflects this local/package build instead, and keep the existing main.version
wiring intact. Use the build command in build.sh and the BuildSource field
referenced by lazydocker --version as the places to align the provenance label.
In `@packages/tealdeer/build.ncl`:
- Line 40: The license metadata for tealdeer is incomplete because only
Apache-2.0 is recorded, while the package is dual-licensed upstream. Update the
license declaration in the build spec to reflect both MIT and Apache-2.0,
keeping the existing licensing metadata block consistent with the upstream
Cargo.toml so the package is not misrepresented.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: a9e47ad9-04fc-418e-adb0-53f29fead8a9
📒 Files selected for processing (20)
packages/croc/build.nclpackages/croc/build.shpackages/dive/build.nclpackages/dive/build.shpackages/dua/build.nclpackages/dua/build.shpackages/esbuild/build.nclpackages/esbuild/build.shpackages/gitleaks/build.nclpackages/gitleaks/build.shpackages/lazydocker/build.nclpackages/lazydocker/build.shpackages/restic/build.nclpackages/restic/build.shpackages/sccache/build.nclpackages/sccache/build.shpackages/sops/build.nclpackages/sops/build.shpackages/tealdeer/build.nclpackages/tealdeer/build.sh
| set -eu | ||
| export GOROOT=/usr/go | ||
| mkdir -p "$OUTPUT_DIR/usr/bin" | ||
| go build -trimpath -ldflags "-buildid= -w -s -X main.version=${MINIMAL_ARG_VERSION} -X main.buildSource=wolfiRelease" -o "$OUTPUT_DIR/usr/bin/lazydocker" . |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
buildSource=wolfiRelease is inaccurate provenance metadata.
This is a leftover from the Wolfi recipe; the binary is actually built here, not via Wolfi. Since lazydocker --version prints BuildSource (confirmed against upstream's main.go/.goreleaser.yml usage of this ldflag), this label could mislead anyone debugging the origin of the binary.
🩹 Proposed fix
-go build -trimpath -ldflags "-buildid= -w -s -X main.version=${MINIMAL_ARG_VERSION} -X main.buildSource=wolfiRelease" -o "$OUTPUT_DIR/usr/bin/lazydocker" .
+go build -trimpath -ldflags "-buildid= -w -s -X main.version=${MINIMAL_ARG_VERSION} -X main.buildSource=minimal" -o "$OUTPUT_DIR/usr/bin/lazydocker" .📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| go build -trimpath -ldflags "-buildid= -w -s -X main.version=${MINIMAL_ARG_VERSION} -X main.buildSource=wolfiRelease" -o "$OUTPUT_DIR/usr/bin/lazydocker" . | |
| go build -trimpath -ldflags "-buildid= -w -s -X main.version=${MINIMAL_ARG_VERSION} -X main.buildSource=minimal" -o "$OUTPUT_DIR/usr/bin/lazydocker" . |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/lazydocker/build.sh` at line 6, The build metadata in the lazydocker
build script is incorrectly hardcoded to wolfiRelease, which can misrepresent
the binary’s provenance. Update the ldflags in the build command to set
main.buildSource to a value that reflects this local/package build instead, and
keep the existing main.version wiring intact. Use the build command in build.sh
and the BuildSource field referenced by lazydocker --version as the places to
align the provenance label.
- gitleaks: fix the version ldflag target. Upstream .goreleaser.yml stamps `github.com/zricethezav/gitleaks/v8/version.Version` — the module path kept the original zricethezav org (despite the GitHub org rename) and the var lives in the `version` package, not `cmd`. The old wrong path was silently ignored by the linker, leaving the version unstamped. Verified 8.30.1 embeds now. - lazydocker: drop `-X main.buildSource=wolfiRelease` — we build from source, so that origin label (printed by --version) was inaccurate. - tealdeer: license_spdx Apache-2.0 → "MIT OR Apache-2.0" (v1.8.1 Cargo.toml declares the dual license and ships both LICENSE-MIT and LICENSE-APACHE). Co-Authored-By: Claude Opus 4.8 <[email protected]>
Addressed CodeRabbit review (pushed)
gitleaks + lazydocker rebuilt clean with versions correctly embedded. |
1 participant
Fifth batch from
pkgmgr import-wolfi— high-star single-binary CLI tools (go + rust). Chosen from a stars survey; all pure-go / pure-rust (deps bundled by the module/crate tree).What's here (10 packages, all build + pass every
minimal checkat 0 TODOs)tldrclientHow they're produced
go build -trimpath(built straight into$OUTPUT_DIR/usr/bin— avoids a<name>/package-dir clash),glibcruntime,needs = { dns, internet }, version stamped viaMINIMAL_ARG_VERSION.cargo build --releasewith reproducibleRUSTFLAGS; sccache'sopenssl-syscrate pullsopenssl+pkgconfbuild-deps andopensslruntime (resolved from the ELF'slibssllinkage).gs://minimal-staging-archives/<owner>/<repo>/<tag>.tar.gz.Reviewer notes
tldrbinary (crate name ≠ binary name).🤖 Generated with Claude Code
Summary by CodeRabbit
croc,dive,dua,esbuild,gitleaks,lazydocker,restic,sccache,sops, andtealdeer.