@mnci/cli 4.10.7 → 4.10.8

package/README.md

@@ -1420,9 +1420,12 @@ build` links statically, so the binary in the drop already contains
 - **CI** runs Go through the same `nx run-many -t lint,test,build` as
   everything else. Two guarded steps precede it: `go mod download` (so a
   network failure reads as a dependency failure rather than a confusing
-  build error), and a `golangci-lint` install via `go install` — no package
-  manager, no sudo, same command on every agent OS — whose `GOPATH/bin` is
-  then added to `PATH` for later steps. All three skip cleanly when the
+  build error), and a `golangci-lint` install whose `GOPATH/bin` is then added
+  to `PATH` for later steps. The linter is **pinned** (`GOLANGCI_LINT_VERSION`)
+  and installed from its prebuilt release, verified against the release's
+  SHA-256 checksums, in about a second; compiling it with `go install` took
+  over a minute per run. Any download or verification failure falls back to
+  `go install` at the same pinned version. All three skip cleanly when the
   workspace has no root `go.mod`, and the linter install also skips when the
   agent already provides it.
 
@@ -1486,7 +1489,7 @@ build agents, so the generated pipeline installs it itself (see below).
   under the agent's home directory: the SDK ships dozens of its own
   `pubspec.yaml` files, which inside the tree would pollute pub's resolution and
   give Nx thousands of extra files to glob. The SDK version is **pinned**
-  (unlike `golangci-lint`'s `@latest`) because it determines the Dart version,
+  (as is `golangci-lint`'s) because it determines the Dart version,
   and pub workspaces need Dart 3.6+. Three guarded steps precede the build —
   install, add to `PATH`, and one root `flutter pub get` — and all three skip
   cleanly when the workspace has no root `pubspec.yaml`; the install also skips

package/dist/cli.js

@@ -1003,7 +1003,8 @@ var PYTHON_INSTALL_GUARD = `node -e "if(!require('node:fs').existsSync('requirem
 var PYTHON_WORKSPACE_INSTALL_GUARD = `node -e "const fs=require('node:fs'),path=require('node:path');const editableDirs=[...fs.globSync('apps/*/pyproject.toml'),...fs.globSync('python-packages/*/pyproject.toml'),...fs.globSync('libs/*/pyproject.toml')].map((p)=>path.dirname(p));const requirementsFiles=fs.globSync('apps/*/requirements.txt');if(editableDirs.length===0&&requirementsFiles.length===0){console.log('No Python projects - skipping.');process.exit(0)}const args=['-m','pip','install','--quiet',...editableDirs.flatMap((d)=>['-e',d]),...requirementsFiles.flatMap((f)=>['-r',f])];const py=process.platform==='win32'?'python':'python3';process.exit(require('node:child_process').spawnSync(py,args,{stdio:'inherit'}).status ?? 1)"`;
 var PIP_AUDIT_GUARD = `node -e "if(!require('node:fs').existsSync('requirements-dev.txt')){console.log('No Python projects - skipping.');process.exit(0)}const py=process.platform==='win32'?'python':'python3';require('node:child_process').spawnSync(py,['-m','pip_audit'],{stdio:'inherit'});process.exit(0)"`;
 var GO_MODULE_DOWNLOAD_GUARD = `node -e "if(!require('node:fs').existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('go',['mod','download'],{stdio:'inherit'}).status ?? 1)"`;
-var GOLANGCI_LINT_INSTALL_GUARD = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}if(cp.spawnSync('golangci-lint',['--version'],{stdio:'ignore'}).status===0){console.log('golangci-lint already installed - skipping.');process.exit(0)}process.exit(cp.spawnSync('go',['install','github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest'],{stdio:'inherit'}).status ?? 1)"`;
+var GOLANGCI_LINT_VERSION = "2.14.0";
+var GOLANGCI_LINT_INSTALL_GUARD = `node -e "const fs=require('node:fs'),cp=require('node:child_process'),path=require('node:path'),os=require('node:os'),crypto=require('node:crypto');if(!fs.existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}if(cp.spawnSync('golangci-lint',['--version'],{stdio:'ignore'}).status===0){console.log('golangci-lint already installed - skipping.');process.exit(0)}const v='${GOLANGCI_LINT_VERSION}';const fallback=reason=>{console.log('Prebuilt golangci-lint '+v+' unavailable ('+reason+') - building it with go install instead.');process.exit(cp.spawnSync('go',['install','github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v'+v],{stdio:'inherit'}).status ?? 1)};const plat={linux:'linux',darwin:'darwin',win32:'windows'}[process.platform],arch={x64:'amd64',arm64:'arm64'}[process.arch];if(!plat||!arch)fallback('no prebuilt release for '+process.platform+'/'+process.arch);const gopath=cp.spawnSync('go',['env','GOPATH'],{encoding:'utf8'});if(gopath.status!==0)fallback('go env GOPATH failed');const name='golangci-lint-'+v+'-'+plat+'-'+arch,file=name+(plat==='windows'?'.zip':'.tar.gz'),base='https://github.com/golangci/golangci-lint/releases/download/v'+v+'/';const get=async u=>{const r=await fetch(u,{signal:AbortSignal.timeout(60000)});if(!r.ok)throw new Error('HTTP '+r.status+' for '+u);return Buffer.from(await r.arrayBuffer())};(async()=>{` + String.raw`const sums=(await get(base+'golangci-lint-'+v+'-checksums.txt')).toString('utf8').split('\n').map(l=>l.trim().split(' ').filter(Boolean));` + `const entry=sums.find(p=>p[1]===file);if(!entry)throw new Error(file+' is not in the release checksums');const archive=await get(base+file);if(crypto.createHash('sha256').update(archive).digest('hex')!==entry[0])throw new Error('checksum mismatch for '+file);const tmp=fs.mkdtempSync(path.join(os.tmpdir(),'golangci-lint-')),archivePath=path.join(tmp,file);fs.writeFileSync(archivePath,archive);const tar=plat==='windows'?path.join(process.env.SystemRoot||'','System32','tar.exe'):'tar';const x=cp.spawnSync(tar,['-xf',archivePath,'-C',tmp],{stdio:'inherit'});if(x.status!==0)throw new Error('could not extract '+file);const exe='golangci-lint'+(plat==='windows'?'.exe':''),bin=path.join(gopath.stdout.trim(),'bin');fs.mkdirSync(bin,{recursive:true});fs.copyFileSync(path.join(tmp,name,exe),path.join(bin,exe));fs.chmodSync(path.join(bin,exe),0o755);fs.rmSync(tmp,{recursive:true,force:true});console.log('golangci-lint '+v+' installed from its checksum-verified prebuilt release into '+bin)})().catch(error=>fallback(error.message))"`;
 var GO_TOOL_PATH_PRELUDE = "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}const r=cp.spawnSync('go',['env','GOPATH'],{encoding:'utf8'});if(r.status!==0){console.log('Could not resolve GOPATH - skipping.');process.exit(0)}const bin=require('node:path').join(r.stdout.trim(),'bin');";
 var GO_TOOL_PATH_AZURE = `node -e "${GO_TOOL_PATH_PRELUDE}console.log('##vso[task.prependpath]'+bin)"`;
 var GO_TOOL_PATH_GITHUB = `node -e "${GO_TOOL_PATH_PRELUDE}if(!process.env.GITHUB_PATH){console.log('Not running in GitHub Actions - skipping.');process.exit(0)}fs.appendFileSync(process.env.GITHUB_PATH,bin+${String.raw`'\n'`})"`;
@@ -1238,8 +1239,9 @@ ${npmAuthenticateStep}  - script: npm ci
     displayName: Download Go module dependencies
 
   # golangci-lint is what the generated Go lint target actually runs (the
-  # plugin's own default is 'go fmt', which only reformats). 'go install'
-  # drops it in GOPATH/bin, which is not on PATH by default on a hosted
+  # plugin's own default is 'go fmt', which only reformats). The pinned,
+  # checksum-verified prebuilt release lands in GOPATH/bin (go install at the
+  # same version is the fallback), which is not on PATH by default on a hosted
   # agent \u2014 so prepend it for every later step in the job.
   - script: ${GOLANGCI_LINT_INSTALL_GUARD}
     displayName: Install golangci-lint
@@ -1493,9 +1495,10 @@ jobs:
         name: Download Go module dependencies
 
       # golangci-lint is what the generated Go lint target actually runs (the
-      # plugin's own default is 'go fmt', which only reformats). 'go install'
-      # drops it in GOPATH/bin, which is not on PATH by default on a hosted
-      # runner \u2014 so publish it for every later step in the job.
+      # plugin's own default is 'go fmt', which only reformats). The pinned,
+      # checksum-verified prebuilt release lands in GOPATH/bin (go install at the
+      # same version is the fallback), which is not on PATH by default on a
+      # hosted runner \u2014 so publish it for every later step in the job.
       - run: ${GOLANGCI_LINT_INSTALL_GUARD}
         name: Install golangci-lint