feat: pin the install script to the requested version - #127
Merged
Conversation
Select install.sh/install.ps1 from the git ref matching the requested version: the v<version> release tag for exact versions, the commit itself for pkg.pr.new preview builds. The latest script tracks the latest CLI and can break installs of older versions (e.g. the XDG directory-layout switch in voidzero-dev/vite-plus#2346). Dist-tags keep using the latest script. When the pinned sources are exhausted (missing tag, mirror outage), fall back to the latest script with a warning so CI is not blocked. The URL selection is shared in src/ci/install-script-urls.ts and applied to the GitHub action, the Azure runtime, and the GitLab bootstrap.
Member
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Replace the urlGroups/groupIndex indirection with a tryUrls helper called for the pinned then latest URL groups, matching the shape of the GitLab bootstrap. Merge the redundant release-tag and commit-build URL tests into one parametrized test and drop a double cast in the Azure test.
Split long sentences, use active voice, and remove em dashes in the comments and fallback warnings added by this branch.
Resolve the newest 0.0.0-commit.<sha> build from the registry bridge and install it via the version input on ubuntu and windows, so the commit-pinned install script path is covered end-to-end.
Contributor
There was a problem hiding this comment.
Pull request overview
Pins the Vite+ installer script URL to the git ref that corresponds to the requested version, so older versions continue to install with a compatible script even if main’s installer changes. This reduces the risk of upstream installer changes breaking installs of historical versions, while still degrading gracefully to the previous “latest script” behavior if pinned sources are unavailable.
Changes:
- Introduce shared URL selection logic (
pinnedvslatest) for install scripts based on exact versions and0.0.0-commit.<sha>preview builds. - Update GitHub Action and Azure runtime installers to try pinned URLs first (GitHub raw + jsDelivr mirror), then fall back to latest URLs with a compatibility warning.
- Update GitLab bootstrap to mirror the same pinned-then-latest behavior; add tests and an end-to-end workflow job for preview-build installs.
Reviewed changes
Copilot reviewed 8 out of 10 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| src/install-viteplus.ts | Uses shared URL selection to prefer pinned installer scripts, with fallback to latest. |
| src/install-viteplus.test.ts | Adds coverage ensuring the requested version reaches URL selection and fallback behavior is correct. |
| src/ci/install-script-urls.ts | New shared helper that maps version → git ref and returns pinned/latest script URL groups. |
| src/ci/install-script-urls.test.ts | Tests exact URL generation, ref mapping, and Windows installer selection. |
| src/azure/install-viteplus.ts | Applies the same pinned-then-latest installer strategy to the Azure runtime. |
| src/azure/install-viteplus.test.ts | Verifies Azure runtime URL ordering, fallback warning behavior, and VP_PR_VERSION routing. |
| gitlab/bootstrap.sh | Implements pinned ref detection and retries pinned URLs before falling back to latest. |
| dist/azure/index.mjs | Updates the compiled Azure runtime bundle to include the new pinned-script behavior. |
| .github/workflows/test.yml | Adds an end-to-end job validating the commit-pinned preview-build install path. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The action always installed vp with the latest install.sh, so an install-script change like the XDG directory layout in voidzero-dev/vite-plus#2346 could break installing older versions.
The script is now fetched from the git ref matching the requested version:
0.2.9,0.1.21-alpha.7): thev<version>release tag on raw.githubusercontent.com, with jsDelivr as an independent mirror (both verified to servepackages/cli/install.shback to v0.1.0).0.0.0-commit.<sha>): the script from that exact commit, so a preview build always installs with the script it was built with.latest,next): unchanged, the latest script matches whatever they resolve to.If all pinned sources fail (missing tag, mirror outage), the install warns and falls back to the latest script, so availability degrades to the previous behavior instead of blocking CI. Worst case for pinned versions is 8 attempts across 4 URLs instead of 4 across 2.
The URL selection is shared in
src/ci/install-script-urls.tsand applied to the GitHub action, the Azure runtime, and the GitLab bootstrap.