Skip to content

enhancement(dev): make prepare.sh safer on workstations#25430

Closed
pront wants to merge 1 commit into
masterfrom
chore/prepare-sh-local-safe
Closed

enhancement(dev): make prepare.sh safer on workstations#25430
pront wants to merge 1 commit into
masterfrom
chore/prepare-sh-local-safe

Conversation

@pront
Copy link
Copy Markdown
Member

@pront pront commented May 13, 2026

Summary

prepare.sh is primarily a CI bootstrap, but #25429 promotes it as the recommended one-shot install for contributor tooling in docs/DEVELOPING.md. That doc commit added a warning about three specific surprises the script causes on a personal laptop. This PR removes those surprises so the warning can shrink.

Each change is a CI-gated guard: behavior on CI is unchanged (because the workflows set CI=true); behavior differs only when CI is unset.

What changes

  • git config --global --add safe.directory "$(pwd)" runs only when CI is set. Contributors own their checkouts and don't hit git's dubious-ownership error, so the global config write is unnecessary on a workstation.
  • The cargo tool version check no longer downgrades a newer locally installed version. CI starts from nothing and keeps pinning exactly; on a workstation, if the installed version is newer than the pin, the script keeps it and prints a notice. Setting CI=1 forces the pin.
  • The npm tool symlinks into the global npm bin dir ($(npm config get prefix -g)/bin) are skipped outside CI. This avoids sudo ln -sf /usr/local/bin/... without the user opting in. The script prints a PATH hint pointing at the project-local node_modules/.bin instead.

How did you test this PR?

  • bash -n scripts/environment/prepare.sh passes.
  • shellcheck scripts/environment/prepare.sh is clean.
  • Each guard's if [[ -n "${CI:-}" ]] / if [[ -z "${CI:-}" ]] reads correctly for both CI=true (CI path retained) and CI unset (new local path taken).
  • Version-extraction regex (grep -oE '[0-9]+\.[0-9]+\.[0-9]+') and sort -V produce the expected newer/older ordering on the pinned tools.

Change Type

  • Bug fix
  • New feature
  • Dependencies
  • Non-functional (chore, refactoring, docs)
  • Performance

Is this a breaking change?

  • Yes
  • No

Does this PR include user facing changes?

  • Yes. Please add a changelog fragment based on our guidelines.
  • No. A maintainer will apply the no-changelog label to this PR.

References

prepare.sh is primarily a CI bootstrap, but contributors are increasingly
the second audience (see the new tooling-shortcut note in
docs/DEVELOPING.md). This adds three small CI-gated guards so running the
script on a personal laptop is less surprising. Each guard preserves the
existing CI behavior; the differences only apply when `CI` is unset.

1. `git config --global --add safe.directory "$(pwd)"` is now skipped
   outside CI. Contributors own their checkouts and don't hit git's
   dubious-ownership error, so we avoid a write to ~/.gitconfig.

2. The version-pin check no longer downgrades cargo tools the user has
   already installed at a newer version. CI starts from nothing and
   keeps installing the exact pin; on workstations, if the installed
   version is newer than the pin, the script keeps it and prints a
   notice. Setting CI=1 forces the pin.

3. The npm tool symlinks into the global npm bin dir are skipped
   outside CI. Avoids `sudo ln -sf` into /usr/local/bin (or equivalent)
   without the user opting in. The script prints a PATH hint pointing
   at the project-local `node_modules/.bin` directory instead.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@pront
Copy link
Copy Markdown
Member Author

pront commented May 13, 2026

Folded into #25429. The three CI-gated safety guards now ship as the last commit of that PR.

@pront pront closed this May 13, 2026
@github-actions github-actions Bot locked and limited conversation to collaborators May 13, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant