Repository navigation
vlt-src: vlt built from source on our node + go (byte-matches the npm release) - #832
Draft
bryan-minimal wants to merge 1 commit into
Draft
bryan-minimal wants to merge 1 commit into
bryan-minimal wants to merge 1 commit into
Conversation
…vlt, esbuild or wasm)
Experimental sibling of `vlt` (which installs the npm tarball). Chain:
1. esbuild 0.27.7 (the exact version vlt's bundler pins) built from source
with our go, used via ESBUILD_BINARY_PATH instead of npm's prebuilt binary.
2. Stage 1: vlt runs from its own TypeScript source (its dev launcher:
node --experimental-strip-types infra/build/src/bins/vlt.ts). Its 34
external runtime deps come from vlt-lock.json at exact versions, installed
by our node's npm with --ignore-scripts.
3. Stage 2: that bootstrap vlt installs vlt's own monorepo from its own
lockfile with --allow-scripts=':not(*)' (vlt's repo config otherwise
allows #esbuild/#tailwindcss/#node-pty). Prebuilt @esbuild/<platform> and
@resvg (optional mermaid PNG wasm) are moved out of the tree.
4. vlt's own release tool (infra/build/src/prepack.ts) bundles it with our
esbuild; installed like packages/vlt.
Result (aarch64): 106 of 107 files byte-identical to the published npm
vlt-1.3.7.tgz; package.json differs only by publish-time metadata
normalization (author/bugs shape). min check passes, including --version,
exact-version and a real-work standalone test.
Trust bar, stated plainly: vlt's 34 JS deps (and their transitive deps) are
published JavaScript fetched by integrity, not rebuilt from each project's git.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft / experiment. A from-source
vltthat uses no prebuilt vlt, no prebuilt esbuild and no prebuilt wasm, built on our node and go. It sits beside the existingvlt(npm tarball) package; nothing switches over.Chain
goand used viaESBUILD_BINARY_PATH.node --experimental-strip-types infra/build/src/bins/vlt.ts. The 34 external runtime deps come fromvlt-lock.jsonat exact versions, installed by our node's npm with--ignore-scripts.--allow-scripts=':not(*)'. vlt's default is no scripts, but its repo config allows#esbuild,#tailwindcssand#node-pty. The prebuilt@esbuild/<platform>and@resvgpackages (an optional mermaid-PNG wasm) are moved out of the tree.prepack.ts) bundles it with our esbuild, and it's installed likepackages/vlt.Result (aarch64,
min package build --rebuild)vlt-1.3.7.tgz, including every JS file.package.jsondiffers only by publish-time metadata normalization (authorandbugsshape).min check: all Pass, including--version, the exact version, and a real-work test (vlt pkg get).Trust bar
vlt's 34 JS deps and their transitive deps are published JavaScript fetched by integrity hash, not rebuilt from each project's git. Everything executable that we compile ourselves (node, go, esbuild) comes from our hex0-rooted toolchain.
Open
vlt.🤖 Generated with Claude Code