Add CLI flags, default NeoVim to PPA, and install LazyGit - #12
Conversation
8cfd5b7 to
3fce5b8
Compare
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📝 WalkthroughWalkthroughThe pull request adds a new --nvim-deb CLI option to enable NeoVim installation from GitHub .deb releases instead of the PPA, introduces a new LazyGit installation step, adds build-essential to the base tools, and implements argument-parsing logic to handle these new configurations. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
- Switch NeoVim from PPA to .deb from GitHub releases (neovim/neovim-releases), removing PPA dependency - Use update-alternatives --install instead of --set for vi/vim registration - Add LazyGit TUI installation from GitHub releases - Add build-essential to apt tools list Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR enhances the bootstrap script by adding build-essential, installing LazyGit from GitHub releases, and switching NeoVim installation to use the latest GitHub release and properly manage vi/vim alternatives.
Changes:
- Add
build-essentialto the common CLI tools installed viaapt. - Introduce
stepInstallLazyGitto download and install LazyGit from its latest GitHub release and hook it into the mainSTEPSpipeline. - Replace the NeoVim PPA-based installation with downloading the latest
.debfrom GitHub releases and configuringupdate-alternativesto setnvimas the defaultviandvim.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| local LAZYGIT_VERSION | ||
| LAZYGIT_VERSION=$(getLatestReleaseForRepo "${LAZYGIT_REPO}") | ||
| # Remove v prefix from version string | ||
| LAZYGIT_VERSION="${LAZYGIT_VERSION#v}" | ||
| local LAZYGIT_ASSET="lazygit_${LAZYGIT_VERSION}_Linux_x86_64.tar.gz" | ||
| downloadLatestReleaseArtifact \ | ||
| "${LAZYGIT_REPO}" \ | ||
| "${LAZYGIT_ASSET}" \ | ||
| "${LAZYGIT_TMP_FILE}" |
There was a problem hiding this comment.
In stepInstallLazyGit, you call getLatestReleaseForRepo directly to build LAZYGIT_ASSET and then call downloadLatestReleaseArtifact, which internally calls getLatestReleaseForRepo again to compute the release tag. If a new LazyGit release is published between these two calls, the asset name (derived from the first version value) may no longer exist under the tag returned by the second call, causing a 404/download failure. To avoid this potential version mismatch and the redundant API call, refactor so that the version is resolved exactly once (either by passing a version into the download helper or by having the helper return both tag and asset name), and ensure the asset name and release tag are always computed from the same version value.
| local NVIM_TMP_FILE="/tmp/nvim.deb" | ||
| downloadLatestReleaseArtifact \ | ||
| "neovim/neovim-releases" \ | ||
| "nvim-linux-x86_64.deb" \ | ||
| "${NVIM_TMP_FILE}" | ||
| runCmdAndLog ${APT_INSTALL} "${NVIM_TMP_FILE}" | ||
| # Set neovim as default vim | ||
| local NVIM_BIN | ||
| NVIM_BIN="$(command -v nvim)" | ||
| runCmdAndLog update-alternatives --install /usr/bin/vi vi "${NVIM_BIN}" 110 | ||
| runCmdAndLog update-alternatives --install /usr/bin/vim vim "${NVIM_BIN}" 110 | ||
| runCmdAndLog rm -f "${NVIM_TMP_FILE}" |
There was a problem hiding this comment.
stepInstallNeoVim now installs NeoVim by downloading a .deb from the neovim/neovim-releases GitHub repository via downloadLatestReleaseArtifact and passing it directly to apt-get install, but the downloaded artifact is neither pinned to a specific version nor verified via checksum or signature. If the GitHub repo or its releases/latest endpoint is compromised, a malicious .deb (including attacker‑controlled maintainer scripts) could be served and executed as root during installation, leading to remote code execution on any system where this bootstrap runs. Prefer installing from a trusted signed APT repository or pinning to a specific release and validating its integrity before handing it to apt-get rather than blindly installing whatever the current latest artifact is.
| local LAZYGIT_REPO="jesseduffield/lazygit" | ||
| local LAZYGIT_TMP_FILE="/tmp/lazygit.tar.gz" | ||
| if ! [ -e "${LAZYGIT_BIN}" ]; then | ||
| logStep "Installing LazyGit..." | ||
| local LAZYGIT_VERSION | ||
| LAZYGIT_VERSION=$(getLatestReleaseForRepo "${LAZYGIT_REPO}") | ||
| # Remove v prefix from version string | ||
| LAZYGIT_VERSION="${LAZYGIT_VERSION#v}" | ||
| local LAZYGIT_ASSET="lazygit_${LAZYGIT_VERSION}_Linux_x86_64.tar.gz" | ||
| downloadLatestReleaseArtifact \ | ||
| "${LAZYGIT_REPO}" \ | ||
| "${LAZYGIT_ASSET}" \ | ||
| "${LAZYGIT_TMP_FILE}" | ||
| runCmdAndLog tar xf "${LAZYGIT_TMP_FILE}" -C /tmp lazygit | ||
| runCmdAndLog install /tmp/lazygit -D -t "${USR_BIN_DIR}/" | ||
| runCmdAndLog rm -rf "${LAZYGIT_TMP_FILE}" /tmp/lazygit |
There was a problem hiding this comment.
stepInstallLazyGit downloads the latest lazygit release artifact from the third‑party GitHub repo jesseduffield/lazygit via downloadLatestReleaseArtifact and installs the extracted binary system‑wide as root, without pinning to a specific version or verifying the artifact’s integrity. If the upstream GitHub repository, the releases/latest pointer, or the download path is compromised, an attacker can ship a malicious lazygit binary that will be transparently installed and later executed with user privileges, effectively enabling remote code execution on machines using this bootstrap script. To reduce this supply‑chain risk, pin to a specific trusted release (or commit) and verify its checksum or signature before installation instead of always installing the moving "latest" artifact.
yorch
changed the title
yorch
changed the title
Default NeoVim back to PPA unstable and add --nvim-deb flag to opt into GitHub releases .deb install. Add --help flag with usage output. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove Ubuntu 20.04 and SpaceVim references from README - Add lazygit, build-essential, and neovim description to tools list - Document --nvim-deb and --help CLI flags with usage examples - Update AGENTS.md line count and mention CLI flags Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Summary
--helpand--nvim-debflags--nvim-debflag to opt into installing NeoVim from GitHub releases.debpackage insteadbuild-essentialto apt tools listTest plan
bash bootstrap.sh --helpprints usage and exitsbash bootstrap.shinstalls NeoVim from PPA (default)bash bootstrap.sh --nvim-debinstalls NeoVim from GitHub releases.debbash bootstrap.sh --unknownprints error, shows usage, exits non-zeronvim --versionworks after bootstraplazygit --versionworks after bootstrapviandvimresolve to nvim via alternatives🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
--nvim-debCLI option to choose NeoVim installation source.Improvements
✏️ Tip: You can customize this high-level summary in your review settings.