feat: add --vendor-fullsend-binary for dev iteration - #277
Closed
ralphbean wants to merge 6 commits into
Closed
Conversation
When passed to `fullsend admin install`, cross-compiles the fullsend binary for linux/amd64 and uploads it to .fullsend/bin/fullsend. The GitHub Action checks for a vendored binary before downloading from releases, enabling rapid iteration without cutting a release. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Site previewPreview: https://0a36d2ca-site.fullsend-ai.workers.dev Commit: |
GitHub's Contents API does not preserve file permissions, so the vendored binary needs chmod +x after copying. Check -f not -x. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
6 tasks
Address code review findings on the vendor-fullsend-binary feature: Security: - Gate vendored binary in action.yml behind FULLSEND_USE_VENDORED_BINARY repo variable (must be "true") to prevent supply chain attacks - Use minimal allowlisted env for go build subprocess to avoid leaking GH_TOKEN and other sensitive variables - Validate vendored binary with `fullsend version` before trusting it Correctness: - Use full module path instead of relative ./cmd/fullsend/ to fix CWD dependency that broke builds from non-root directories - Add 100MB size check before GitHub Contents API upload - Set FULLSEND_USE_VENDORED_BINARY=true on vendor, =false on normal install to prevent stale dev binaries persisting into production - Reject --vendor-fullsend-binary with --dry-run instead of silently ignoring the flag - Fix float formatting for binary size display (was showing "0 MB") Docs/style: - Fix misleading flag description and doc comment path references - Move vendorFullsendBinary to helper section, not between constructors Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix double-marshal bug: pass payload map directly to do() instead of manually marshaling and wrapping in bytes.NewReader - Add checkStatus calls for both GET (SHA fetch) and DELETE responses - Add DeleteFile stub to FakeClient so the project compiles - Add doc comment for DeleteFile on the forge.Client interface - Add else branch in runInstall to remove vendored binary when --vendor-fullsend-binary is not passed Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use defer resp.Body.Close() for consistency with other methods - Add DeletedFiles call recorder to FakeClient (matches DeletedRepos pattern) - Add DeleteFile to error injection and thread safety tests in fake_test.go - Add LiveClient.DeleteFile unit tests: happy path and idempotent 404 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move the binary upload logic into an exported layers.VendorBinary function so it can be called from both the CLI and e2e tests. The CLI retains the cross-compilation, size check, and repo variable logic. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
rh-hemartin
approved these changes
Apr 21, 2026
Member
Author
|
This got merged as a part of #279 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--vendor-fullsend-binaryflag tofullsend admin install.fullsend/bin/fullsendaction.yml) checks for a vendored binary before downloading from releasesmake go-build && ./bin/fullsend admin install --vendor-fullsend-binary ...Test plan
go vet ./...passesgo test -race ./...passes (all packages)make lintpassesadmin_test.go🤖 Generated with Claude Code