|
| 1 | +name: CLI Check |
| 2 | + |
| 3 | +# The plugin vendors the Greptile CLI at plugins/greptile/scripts/greptile.mjs. |
| 4 | +# Vendoring is a manual step, so the two things that can silently go wrong are |
| 5 | +# shipping a bundle that is not the release it claims to be, and shipping one |
| 6 | +# that is not what npm publishes at all. Both are checked by running the file |
| 7 | +# and by comparing it byte-for-byte against the published tarball. |
| 8 | +# |
| 9 | +# A local rebuild of the CLI is NOT byte-identical to the npm artifact for the |
| 10 | +# same version, so the vendored file must always be extracted from `npm pack`, |
| 11 | +# never from a local `bun scripts/bundle.ts`. |
| 12 | +# |
| 13 | +# No secrets. As in mcp-check.yml, repo-controlled values are read from disk |
| 14 | +# and never interpolated into shell source with `${{ }}` — a fork pull request |
| 15 | +# controls these files. |
| 16 | + |
| 17 | +on: |
| 18 | + push: |
| 19 | + branches: [main] |
| 20 | + paths: |
| 21 | + - 'plugins/greptile/scripts/**' |
| 22 | + - 'plugins/greptile/commands/**' |
| 23 | + - '.github/workflows/cli-check.yml' |
| 24 | + pull_request: |
| 25 | + paths: |
| 26 | + - 'plugins/greptile/scripts/**' |
| 27 | + - 'plugins/greptile/commands/**' |
| 28 | + - '.github/workflows/cli-check.yml' |
| 29 | + schedule: |
| 30 | + - cron: '41 8 * * *' |
| 31 | + workflow_dispatch: |
| 32 | + |
| 33 | +permissions: |
| 34 | + contents: read |
| 35 | + |
| 36 | +jobs: |
| 37 | + check: |
| 38 | + runs-on: ubuntu-latest |
| 39 | + timeout-minutes: 10 |
| 40 | + steps: |
| 41 | + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 |
| 42 | + |
| 43 | + - name: Recorded version is well formed |
| 44 | + run: | |
| 45 | + set -euo pipefail |
| 46 | + version=$(tr -d '[:space:]' < plugins/greptile/scripts/greptile.version) |
| 47 | + if ! printf '%s' "$version" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then |
| 48 | + echo "::error::plugins/greptile/scripts/greptile.version is not a plain semver string." |
| 49 | + exit 1 |
| 50 | + fi |
| 51 | + printf '%s' "$version" > "$RUNNER_TEMP/version.txt" |
| 52 | + echo "Recorded version $version" |
| 53 | +
|
| 54 | + - name: Bundle runs and reports the recorded version |
| 55 | + run: | |
| 56 | + set -euo pipefail |
| 57 | + version=$(cat "$RUNNER_TEMP/version.txt") |
| 58 | + reported=$(node plugins/greptile/scripts/greptile.mjs --version | tr -d '[:space:]') |
| 59 | + if [ "$reported" != "$version" ]; then |
| 60 | + echo "::error::Vendored bundle reports $reported but greptile.version records $version." |
| 61 | + exit 1 |
| 62 | + fi |
| 63 | + echo "Bundle reports $reported." |
| 64 | +
|
| 65 | + - name: Bundle is byte-identical to the published npm release |
| 66 | + run: | |
| 67 | + set -euo pipefail |
| 68 | + version=$(cat "$RUNNER_TEMP/version.txt") |
| 69 | + cd "$RUNNER_TEMP" |
| 70 | + npm pack "greptile@$version" >/dev/null |
| 71 | + tar -xzf "greptile-$version.tgz" |
| 72 | + cd "$GITHUB_WORKSPACE" |
| 73 | + published=$(shasum -a 256 "$RUNNER_TEMP/package/dist/greptile.js" | cut -d' ' -f1) |
| 74 | + vendored=$(shasum -a 256 plugins/greptile/scripts/greptile.mjs | cut -d' ' -f1) |
| 75 | + if [ "$published" != "$vendored" ]; then |
| 76 | + echo "::error::Vendored bundle does not match npm greptile@$version. published=$published vendored=$vendored. Re-vendor with: npm pack greptile@$version && tar -xzf greptile-$version.tgz && cp package/dist/greptile.js plugins/greptile/scripts/greptile.mjs" |
| 77 | + exit 1 |
| 78 | + fi |
| 79 | + echo "Vendored bundle matches npm greptile@$version ($vendored)." |
| 80 | +
|
| 81 | + - name: Commands invoke the vendored bundle, not a fetched one |
| 82 | + run: | |
| 83 | + set -euo pipefail |
| 84 | + # Assert against the fenced command block only. Matching whole files |
| 85 | + # would fail on a prose mention of npx, and — worse — would accept a |
| 86 | + # command that dropped GREPTILE_NO_UPDATE_CHECK as long as the |
| 87 | + # paragraph explaining it survived. |
| 88 | + for f in plugins/greptile/commands/review.md plugins/greptile/commands/login.md; do |
| 89 | + block=$(awk '/^```/{fence = !fence; next} fence' "$f") |
| 90 | + if [ -z "$block" ]; then |
| 91 | + echo "::error::$f has no fenced command block to validate." |
| 92 | + exit 1 |
| 93 | + fi |
| 94 | + if grep -q 'npx' <<<"$block"; then |
| 95 | + echo "::error::$f still fetches the CLI with npx. The plugin vendors it; invoke \${CLAUDE_PLUGIN_ROOT}/scripts/greptile.mjs instead." |
| 96 | + exit 1 |
| 97 | + fi |
| 98 | + if ! grep -qF 'node "${CLAUDE_PLUGIN_ROOT}/scripts/greptile.mjs"' <<<"$block"; then |
| 99 | + echo "::error::$f does not invoke the vendored bundle at \${CLAUDE_PLUGIN_ROOT}/scripts/greptile.mjs." |
| 100 | + exit 1 |
| 101 | + fi |
| 102 | + if ! grep -qF 'GREPTILE_NO_UPDATE_CHECK=1 node "${CLAUDE_PLUGIN_ROOT}/scripts/greptile.mjs"' <<<"$block"; then |
| 103 | + echo "::error::$f invokes the vendored bundle without GREPTILE_NO_UPDATE_CHECK=1. Without it the CLI reads its own path as a standalone install and tells the user to run an installer that cannot update the plugin's copy." |
| 104 | + exit 1 |
| 105 | + fi |
| 106 | + done |
| 107 | + echo "Commands invoke the vendored bundle with the update check disabled." |
0 commit comments