Add zvelte-check-bin 0.2.0 - #509
Open
bryan-minimal wants to merge 2 commits into
Open
Conversation
A fast Svelte diagnostic tool written in Zig, from the ampcode/homebrew-tap Homebrew formula. First package produced by `pkgmgr import homebrew`. Prebuilt per-arch binaries from upstream's own GitHub releases. Both sha256 values were RECOMPUTED from the downloaded bytes rather than copied out of the formula, so the tap is a cross-check and not the root of trust for the only value anchoring this package's integrity. `strip_prefix` is absent because the archives are genuinely flat — read off the real tarball (`tar -tzf` lists one entry, `zvelte-check`), not guessed. Homebrew auto-strips a single leading directory before `def install` and minimal does not, so this is unknowable from the formula text. Provenance is derived from the ARTIFACT URLs, which are literally github.com/ampcode/zvelte-check/releases/..., and cross-checked against the homepage. That buys real CPE identity (not a dark package) and free version checking via the GitHub tier. NOT a source build, and worth stating plainly: `zig` IS packaged, and pkgs CLAUDE.md prefers building from source when the toolchain exists. Prebuilt was chosen only because pkgmgr has no Zig BuildFlavor yet — not because the toolchain is missing. Mitigating: these are upstream's own release binaries, not a third-party redistribution, and we verify their hashes ourselves. A source-built `zvelte-check` can take the bare name later, which is why this one carries the `-bin` suffix. No reviewer TODOs: licence, provenance, outputs and deps were all resolved mechanically. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a Changeszvelte-check binary packaging
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
jtnkminimal
approved these changes
Jul 22, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/zvelte-check-bin/build.ncl`:
- Around line 3-4: Update the build dependency declaration in build.ncl to
include the repository’s tar package directly in build_deps. Ensure every
affected build configuration block, including the ranges noted in the review,
provides tar explicitly rather than relying on transitive dependencies.
In `@packages/zvelte-check-bin/build.sh`:
- Around line 1-4: Update the build script header to use the Bash interpreter
and replace the current shell options with Bash strict mode, specifically
ensuring the script starts with the required shebang and uses set -euo pipefail.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 1596b005-4708-446d-a54b-56985af90efc
📒 Files selected for processing (2)
packages/zvelte-check-bin/build.nclpackages/zvelte-check-bin/build.sh
Comment on lines
+3
to
+4
| let base = import "../base/build.ncl" in | ||
| let glibc = import "../glibc/build.ncl" in |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Declare tar as a build dependency.
The build script invokes tar, but build_deps only provides build.sh, the selected archive, and base. Add the repository’s tar package directly to build_deps instead of relying on it being present transitively.
Proposed fix
let glibc = import "../glibc/build.ncl" in
+let tar = import "../tar/build.ncl" in
@@
} target,
base,
+ tar,
],Also applies to: 14-29
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/zvelte-check-bin/build.ncl` around lines 3 - 4, Update the build
dependency declaration in build.ncl to include the repository’s tar package
directly in build_deps. Ensure every affected build configuration block,
including the ranges noted in the review, provides tar explicitly rather than
relying on transitive dependencies.
Source: Coding guidelines
Comment on lines
+1
to
+4
| #!/bin/sh | ||
| # Imported from the Homebrew formula `ampcode/homebrew-tap/zvelte-check` by `pkgmgr import homebrew`. | ||
| # Prebuilt vendor binary: unpacked and installed, never compiled. | ||
| set -ex |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Use the required Bash strict mode.
The build script must start with #!/bin/bash and set -euo pipefail; the current /bin/sh and set -ex combination does not satisfy that contract and does not fail immediately when required variables are unset.
Proposed fix
-#!/bin/sh
+#!/bin/bash
@@
-set -ex
+set -euo pipefail📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| #!/bin/sh | |
| # Imported from the Homebrew formula `ampcode/homebrew-tap/zvelte-check` by `pkgmgr import homebrew`. | |
| # Prebuilt vendor binary: unpacked and installed, never compiled. | |
| set -ex | |
| #!/bin/bash | |
| # Imported from the Homebrew formula `ampcode/homebrew-tap/zvelte-check` by `pkgmgr import homebrew`. | |
| # Prebuilt vendor binary: unpacked and installed, never compiled. | |
| set -euo pipefail |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/zvelte-check-bin/build.sh` around lines 1 - 4, Update the build
script header to use the Bash interpreter and replace the current shell options
with Bash strict mode, specifically ensuring the script starts with the required
shebang and uses set -euo pipefail.
Source: Coding guidelines
Refined against the real built tree with `pkgmgr import homebrew … --from-build`, which reads the installed ELF instead of guessing. The binary is statically linked (`file`: "ELF 64-bit LSB executable, ARM aarch64 … statically linked"), so it needs no runtime_deps at all. The discovery-mode `[glibc]` was a template default, not an observation. Verified by rebuilding: the package produces a new content-addressed tree and a real 5 MB aarch64 binary at usr/bin/zvelte-check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jtnkminimal
approved these changes
Jul 22, 2026
twitchyliquid64
approved these changes
Jul 22, 2026
| { | ||
| upstream_version = version, | ||
| license_spdx = "MIT", | ||
| source_provenance = { |
Member
There was a problem hiding this comment.
If this is truly a binary fetch, drop source provenance and set binary_from. Also if its closed source you need closed_source = true.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A fast Svelte diagnostic tool written in Zig, from the
ampcode/homebrew-tapHomebrew formula.First package produced by
pkgmgr import homebrew(pkgmgr-rs#567) — this PR is partly a test that the importer produces something a reviewer would accept by hand.What was verified rather than trusted
strip_prefixis absent because the archives are genuinely flat — read off the real tarball (tar -tzf→ one entry,zvelte-check). Homebrew auto-strips a single leading directory beforedef installand minimal does not, so this is unknowable from formula text and a guess would surface at build time as a missing file.github.com/ampcode/zvelte-check/releases/…, and cross-checked against the homepage. Never from the homepage alone — that conflation is howchromium-bincame to namemicrosoft/playwrightfor an artifact served out of Google's bucket. This buys real CPE identity (not a dark package) and free version checking via the GitHub tier.One thing I want to flag rather than bury
This is prebuilt, and
zigIS packaged. pkgs CLAUDE.md prefers a source build when the toolchain exists. Prebuilt was chosen only because pkgmgr has no ZigBuildFlavoryet — not because the toolchain is missing, and I didn't want the build.ncl header to imply otherwise.Mitigating: these are upstream's own release binaries, not a third-party redistribution, and we verify the hashes ourselves. A source-built
zvelte-checkcan take the bare name later, which is why this carries-bin.No reviewer TODOs
Licence, provenance, outputs and deps all resolved mechanically. Requires no stdlib bump and touches nothing else in the repo.
🤖 Generated with Claude Code
Summary by CodeRabbit
zvelte-checkcommand-line tool as an installable package.