Remove Codex Cloud taskfiles and revamp setup-web Taskfile; update docs and tests - #3838
Remove Codex Cloud taskfiles and revamp setup-web Taskfile; update docs and tests#3838max-sixty wants to merge 1 commit into
setup-web Taskfile; update docs and tests#3838Conversation
worktrunk-bot
left a comment
worktrunk-bot
left a comment
There was a problem hiding this comment.
Reviewing as a draft — flagging anything that looks worth a quick fix. Mark ready for a full review.
Three things on the new setup-web, all inline. The first one aborts the task on a fresh image; the other two are judgment calls.
One extra note on the wt install that isn't suggestable as a one-liner: cargo install --path . built and installed an optimized binary, while install -m 0755 target/debug/wt puts the debug build on PATH. For a CLI whose statusline renders on every prompt redraw, that's a noticeable difference in the environment this task sets up. If the point was to avoid a second full compile, cargo build --release + installing target/release/wt gets that back for one optimized build rather than two; if the debug binary is a deliberate trade for setup speed, worth a comment saying so, since wt --help at the end of the task reads as "you now have worktrunk installed".
| cmds: | ||
| - | | ||
| set -e | ||
| export PATH="$HOME/.local/bin:$HOME/bin:$PATH" |
There was a problem hiding this comment.
$HOME/.local/bin is now written to but never created. The Nushell block below runs install -m 0755 … "$HOME/.local/bin/nu", and install does not create the parent directory — on an image where ~/.local/bin doesn't already exist it exits 1 with install: cannot create regular file '…/.local/bin/nu': No such file or directory, which set -e turns into a failed task. The deleted Codex Taskfile did this explicitly (install -d /root/.local/bin), and the gh block a few lines down still does its own mkdir -p ~/bin.
The wt install at the bottom happens to be safe by accident — the uv installer creates ~/.local/bin on its way past — but nu runs before uv.
| export PATH="$HOME/.local/bin:$HOME/bin:$PATH" | |
| export PATH="$HOME/.local/bin:$HOME/bin:$PATH" | |
| mkdir -p "$HOME/.local/bin" |
| uv tool install --force pre-commit==4.6.2 | ||
| command -v cargo-insta &> /dev/null || cargo install cargo-insta --quiet | ||
| command -v cargo-nextest &> /dev/null || cargo install cargo-nextest --quiet | ||
| command -v wt &> /dev/null || install -m 0755 target/debug/wt "$HOME/.local/bin/wt" |
There was a problem hiding this comment.
The command -v wt guard makes re-running task setup-web a no-op for the binary it just built: on the second run $HOME/.local/bin/wt is on PATH, so the freshly-compiled target/debug/wt is never copied over it and you keep running the previous checkout's wt. cargo install --path . didn't have that failure mode — it re-installed when the source changed. The guards on cargo-insta/cargo-nextest are fine because those don't track the working tree; this one does, and the copy is free since cargo build above already produced the binary.
| command -v wt &> /dev/null || install -m 0755 target/debug/wt "$HOME/.local/bin/wt" | |
| install -m 0755 target/debug/wt "$HOME/.local/bin/wt" |
| @@ -301,7 +301,6 @@ For each weekly run, check upstream and bump: | |||
|
|
|||
| - **`baptiste0928/cargo-install@v3` blocks** in `.github/workflows/{affected,ci,coverage,nightly}.yaml` and `.github/actions/{test,claude}-setup/action.yaml` — every `version: "=X.Y.Z"` against `cargo info <crate>`. Today: `cargo-affected`, `cargo-insta`, `cargo-nextest`, `cargo-llvm-cov`, `cargo-msrv`, `cargo-udeps`, `lychee`, `worktrunk`. `cargo-affected` is pinned twice in `affected.yaml`; move both together. Verify each crate's `rust-version` against the pinned toolchain and note compatibility in the PR body (see PR #1657 for the format). | |||
| - **`hustcer/setup-nu@v3`** `version:` input — latest from `gh api repos/nushell/nushell/releases/latest --jq '.tag_name'`. Four call sites: `coverage.yaml` (`code-coverage`), `nightly.yaml` (`feature-powerset`), `benchmarks.yaml` (`benchmarks`), and `actions/test-setup/action.yaml`. | |||
There was a problem hiding this comment.
Deleting this bullet outright drops the only weekly-maintenance owner for setup-web's inline pins — and this PR just grew that set. setup-web now pins NU_VERSION="0.115.0" with a SHA-256, alongside the existing PWSH_VERSION="7.6.5", GH_VERSION="2.63.2", and pre-commit==4.6.2. Same reason the section exists at all ("invisible to Dependabot — it follows Cargo.toml deps and uses: foo@vN action refs, not inline version: strings"), and the Nushell pin is the one most likely to drift out of step with the hustcer/setup-nu version in CI.
| - **`hustcer/setup-nu@v3`** `version:` input — latest from `gh api repos/nushell/nushell/releases/latest --jq '.tag_name'`. Four call sites: `coverage.yaml` (`code-coverage`), `nightly.yaml` (`feature-powerset`), `benchmarks.yaml` (`benchmarks`), and `actions/test-setup/action.yaml`. | |
| - **`hustcer/setup-nu@v3`** `version:` input — latest from `gh api repos/nushell/nushell/releases/latest --jq '.tag_name'`. Four call sites: `coverage.yaml` (`code-coverage`), `nightly.yaml` (`feature-powerset`), `benchmarks.yaml` (`benchmarks`), and `actions/test-setup/action.yaml`. | |
| - **`setup-web` tool pins** — `Taskfile.yaml` pins `NU_VERSION` (with a SHA-256 checksum), `PWSH_VERSION`, `GH_VERSION`, and `pre-commit==4.6.2` inline. Keep Nushell aligned with the `setup-nu` version above, and update the checksum whenever the archive version moves. |
#3841) Consolidates the two remaining Codex Cloud drafts, #3835 and #3838, onto what #3839 landed, then cuts what was left. Main's setup is a 163-line script and a 26-line README under `scripts/codex-cloud/`; this is one 79-line file at `dev/codex.sh`, beside the repo's other development files, with the README folded into its header. That empties `scripts/` — the directory existed only for this. **Codex Cloud runs as root** (from #3835). Setup used to replace `/root/.cargo/bin/cargo` with a wrapper that re-executed cargo as a UID-1000 `ubuntu` user under `tini`, and maintenance chowned the checkout, the rustup home, and three cache directories to match. All of it existed to keep the suite's permission tests from skipping, since root can write to a read-only file. Worth stating plainly: ten tests now skip on Codex Cloud. The pair carrying the most weight is `test_remove_foreground_succeeds_with_stuck_directory` and its `_detached` twin, the only automated coverage of `wt remove` against a directory it cannot delete. It is not a new hole — `setup-web` creates no non-root user, so the Claude Code web environment has always skipped them, and `tests/integration_tests/approval_pty.rs:157` carries a standing TODO about it. Codex Cloud was the one environment buying an exception, and a cargo wrapper, `tini`, `runuser`, and four chown passes were the price. Both environments now agree about what the suite observes, and that TODO is the single place to fix it for both. Three of the ten decided that skip by reading `$USER` rather than by probing the filesystem, which fails open: a container that runs as root without exporting `USER` runs them and asserts an error root never gets. They probe now, through one helper, like the other seven. **Task, the checksums, and the retries are gone.** Nothing invoked Task on Codex Cloud once #3839 stopped routing the launchers through it, so it is no longer installed. The archive checksums follow the Taskfile digest for the same reason that one went: HTTPS authenticates GitHub and the container is disposable and secret-free, so verifying each download bought a helper pair and a 64-char line per tool for very little. Each install is now `curl | tar` and an `install`. The version numbers stay. The gate runs `--all-features`, so nu and pwsh drive PTY snapshots their own versions can move, and `.github/actions/test-setup/action.yaml` pins cargo-insta, cargo-nextest, and nu to the same three versions — unpinning those would make the environment and CI disagree about snapshot output. Nothing under `.github/` pins PowerShell, so CI runs whatever the runner image ships and that version answers to nothing but these scripts. **`setup-web` catches up** (from #3838). It gains `lsof`, installs Nushell from its release archive rather than checking that one is already present, bootstraps `uv` with pre-commit, and puts `$HOME/.local/bin` on PATH. `wt` installs from the debug build produced a few lines earlier instead of through a second full compile. Its `cargo install` of cargo-insta and cargo-nextest stays unconditional, as on main: neither form pins, and a `command -v` guard would have frozen whatever versions the image happened to carry. ## Testing `cargo run -- hook pre-merge --yes` passes, shellcheck is clean at warning level, and `task --list` still parses. The `.tar.xz` and `.tar.gz` extractions were run against the real release archives to confirm the tar flags and the paths inside them. The three converted tests pass unprivileged; their skip branch rests on the same probe the other seven root-skipping tests already use. Neither setup path is executable from a dev machine — Codex Cloud needs Linux and root on the universal image, `setup-web` needs a web image — so the first real exercise is the next environment build. > _This was written by Claude Code on behalf of max-sixty_ --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2 participants
Motivation
setup-webself-contained for regular web development images.lsof,pre-commit, cargo dev tools) so local dev and CI are aligned.Description
scripts/codex-cloud/README.mdandscripts/codex-cloud/Taskfile.yaml.setup-codex/maintain-codextasks fromTaskfile.yamland expanded thesetup-webtask to exportPATH, installlsof, install Nushell with SHA-256 verification, ensurepwsh, install or bootstrapuvandpre-commit, conditionally installcargo-insta/cargo-nextest, and install thewtbinary to~/.local/bin.CLAUDE.mdandtests/CLAUDE.mdto reflect "Web development environments", and removed the now-stale integration testtest_codex_cloud_launchers_match_taskfilefromtests/integration_tests/readme_sync.rs..claude/skills/running-tend/SKILL.mdto keep maintenance guidance consistent with the changes.Testing
cargo run -- hook pre-merge --yes, which exercised lints and the test harness and completed successfully.cargo nextest run --all-featuresand rancargo test --lib --binslocally, both of which passed after these changes.Codex Task