Skip to content

chore: automate library updates #129

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
keito4 merged 2 commits into from
Nov 10, 2025
Merged

chore: automate library updates #129

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
80561cc
chore: automate library updates
keito4 Nov 10, 2025
2d891bd
chore: bump codex cli
keito4 Nov 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .devcontainer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ RUN bash -c "pnpm setup" \

USER root

RUN npm install -g typescript eslint @anthropic-ai/claude-code@2.0.35 @openai/codex@0.55.0 vercel
RUN npm install -g typescript eslint @anthropic-ai/claude-code@2.0.36 @openai/codex@0.57.0 vercel

@coderabbitai coderabbitai Bot Nov 10, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Pin versions of typescript, eslint, and vercel for reproducible DevContainer builds.

Global npm CLI tools are installed without version constraints for typescript, eslint, and vercel, which means the image will have different tool versions depending on when it's rebuilt. This breaks reproducibility and contradicts the PR's intent to automate and standardize library updates. The PR explicitly upgrades to ESLint 9, but the Dockerfile doesn't pin it.

Pin all three tools to specific versions to ensure consistent image builds. Based on the PR description, at minimum use eslint@9. Verify target versions for typescript and vercel from npm/global.json:

Then update line 46 to match:

-RUN npm install -g typescript eslint @anthropic-ai/claude-code@2.0.36 @openai/codex@0.57.0 vercel
+RUN npm install -g typescript@<VERSION> eslint@9 @anthropic-ai/claude-code@2.0.36 @openai/codex@0.57.0 vercel@<VERSION>

🏁 Script executed:

#!/bin/bash
# Description: Verify global CLI tool versions in npm/global.json

# Check if npm/global.json exists and display its content
if [ -f npm/global.json ]; then
  echo "=== npm/global.json ===" 
  cat npm/global.json
else
  echo "npm/global.json not found"
fi

# Also search for any version constraints in package.json or other config files
echo -e "\n=== package.json devDependencies (eslint, typescript) ===" 
rg -A 5 '"devDependencies"' package.json | head -20

Length of output: 870

🏁 Script executed:

#!/bin/bash
# Description: Verify typescript, eslint, and vercel versions in package.json and Dockerfile context

# Get full devDependencies section to find typescript and eslint versions
echo "=== Full package.json devDependencies ===" 
rg -A 100 '"devDependencies"' package.json | grep -E '(typescript|eslint|vercel)' | head -10

# Search for vercel configuration
echo -e "\n=== Vercel configuration ===" 
if [ -f vercel.json ]; then
  echo "vercel.json found:"
  cat vercel.json
else
  echo "vercel.json not found"
fi

# Check .devcontainer/Dockerfile for context/comments around line 46
echo -e "\n=== .devcontainer/Dockerfile context (lines 40-50) ===" 
sed -n '40,50p' .devcontainer/Dockerfile

# Search for any .npmrc or npm configuration that might set default versions
echo -e "\n=== .npmrc or npm configuration ===" 
if [ -f .npmrc ]; then
  cat .npmrc
else
  echo ".npmrc not found"
fi

Length of output: 324

🏁 Script executed:

#!/bin/bash
# Description: Verify typescript, eslint, and vercel versions in package.json and Dockerfile context

# Get full devDependencies section to find typescript and eslint versions
echo "=== Full package.json devDependencies ===" 
rg -A 100 '"devDependencies"' package.json | grep -E '(typescript|eslint|vercel)' | head -10

# Search for vercel configuration
echo -e "\n=== Vercel configuration ===" 
if [ -f vercel.json ]; then
  echo "vercel.json found:"
  cat vercel.json
else
  echo "vercel.json not found"
fi

# Check .devcontainer/Dockerfile for context/comments around line 46
echo -e "\n=== .devcontainer/Dockerfile context (lines 40-50) ===" 
sed -n '40,50p' .devcontainer/Dockerfile

# Search for any .npmrc or npm configuration that might set default versions
echo -e "\n=== .npmrc or npm configuration ===" 
if [ -f .npmrc ]; then
  cat .npmrc
else
  echo ".npmrc not found"
fi

Length of output: 695

🏁 Script executed:

#!/bin/bash
# Description: Find typescript version in package.json

echo "=== Searching for typescript version ===" 
rg -i 'typescript' package.json | head -5

echo -e "\n=== Full devDependencies section ===" 
rg -A 50 '"devDependencies"' package.json | head -60

Length of output: 630

Pin eslint@9.39.1 to match project configuration; verify and pin typescript and vercel versions.

The Dockerfile installs global npm tools without version constraints. The project's package.json pins eslint@9.39.1, but line 46 installs global eslint without a version, creating reproducibility issues and a mismatch with the project's dev environment.

Update line 46 to:

-RUN npm install -g typescript eslint @anthropic-ai/claude-code@2.0.36 @openai/codex@0.57.0 vercel
+RUN npm install -g typescript@<VERSION> eslint@9.39.1 @anthropic-ai/claude-code@2.0.36 @openai/codex@0.57.0 vercel@<VERSION>

Replace <VERSION> placeholders for typescript and vercel based on your intended versions (neither is documented in package.json or npm/global.json).

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents 
.devcontainer/Dockerfile around line 46: the Dockerfile installs global npm
packages without versions, causing reproducibility and a mismatch with
package.json; update the RUN to pin eslint to 9.39.1 and also pin specific
versions for typescript and vercel (replace <VERSION> placeholders with the
chosen versions), e.g. install typescript@<VERSION> eslint@9.39.1
@anthropic-ai/claude-code@2.0.36 @openai/codex@0.57.0 vercel@<VERSION>, then
rebuild the image to verify the pinned versions are used.


USER vscode
RUN bash -lc "cargo install similarity-ts" || true \
Expand Down
17 changes: 0 additions & 17 deletions .eslintrc.js
View file
Open in desktop

This file was deleted.

39 changes: 39 additions & 0 deletions .github/workflows/update-libraries.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
name: Auto Update Libraries

on:
schedule:
- cron: '0 3 * * 1'
workflow_dispatch:

permissions:
contents: write
pull-requests: write

jobs:
update:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'

- name: Refresh libraries
run: npm run update:libs

- name: Create pull request
uses: peter-evans/create-pull-request@v6
with:
token: ${{ secrets.GITHUB_TOKEN }}
branch: chore/auto-library-update
delete-branch: true
commit-message: 'chore: automated library refresh'
title: 'chore: automated library refresh'
body: |
Automated update generated by `npm run update:libs`.

- Ensures Codex/Claude Code toolchain definitions stay current
- Refreshes npm devDependencies and global CLI manifest
labels: dependencies
1 change: 1 addition & 0 deletions CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,7 @@ The repository includes comprehensive automated workflows for continuous integra

- **CI Pipeline** (`.github/workflows/ci.yml`): Code quality validation with linting, formatting, testing, and building
- **DevContainer Build** (`.github/workflows/docker-image.yml`): Automated container image building with semantic versioning and multi-platform support
- **Library Auto-Update** (`.github/workflows/update-libraries.yml`): Scheduled execution of `npm run update:libs` that opens a pull request when dependencies or Codex/Claude tooling change

### AI-Assisted Development

Expand Down
10 changes: 9 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ It includes settings for various tools, such as the shell (Zsh), Git, npm, and V
- `dot/`: Directory for dotfiles and configuration files that are typically placed in the home directory, including Zsh configuration with comprehensive aliases, functions, and environment setup.
- `git/`: Contains Git configuration files including gitconfig, gitignore, and modular configuration files in the `gitconfig.d/` subdirectory.
- `npm/`: Contains npm global package configuration.
- `script/`: Contains utility scripts for exporting configuration settings (`export.sh`), importing configuration settings (`import.sh`), checking for changes and making commits (`commit_changes.sh`), credential management (`credentials.sh`), Homebrew dependency management (`brew-deps.sh`), and version management (`version.sh`).
- `script/`: Contains utility scripts for exporting configuration settings (`export.sh`), importing configuration settings (`import.sh`), checking for changes and making commits (`commit_changes.sh`), credential management (`credentials.sh`), Homebrew dependency management (`brew-deps.sh`), semantic versioning (`version.sh`), and automated library updates for Codex/Claude Code tooling (`update-libraries.sh`).
- `vscode/`: Contains Visual Studio Code configuration including extensions list and installation documentation.

## Security
Expand Down Expand Up @@ -81,6 +81,13 @@ Ensure `REPO_PATH` points to the repository and run the `export.sh` script to ca

Run the `commit_changes.sh` script with `REPO_PATH` set to this repository to check for local modifications. If there are changes, it stages all of them and makes a commit.

### Updating Codex & Claude Tooling

- Run `npm run update:libs` (wrapper for `script/update-libraries.sh`) to refresh npm devDependencies together with Codex/Claude Code CLI definitions captured in `npm/global.json`.
- The script performs `npm-check-updates`, `npm install`, rebuilds the `dist/` artifacts, and re-synchronizes global CLI versions via `npm view <package> version`.
- Packages that currently require newer Node.js releases (`semantic-release`, `@semantic-release/github`) are excluded by default. Override the exclusion list with `UPDATE_LIBS_REJECT="pkg1,pkg2" npm run update:libs` when you are ready to bump them.
- `.github/workflows/update-libraries.yml` executes the same script weekly and opens a PR whenever it produces changes, ensuring Codex/Claude Code tooling stays current without manual effort.

### Claude Agent Configuration Setup

The `.codex/` directory contains a comprehensive agent distribution system for Claude Code. To set up the specialized agents on your system:
Expand Down Expand Up @@ -223,6 +230,7 @@ This repository includes comprehensive GitHub Actions workflows and development
- **CI Pipeline** (`.github/workflows/ci.yml`): Automated testing, linting, and quality checks
- **Claude Code Integration** (`.github/workflows/claude.yml`): AI-assisted code review and issue management
- **Docker Image Build** (`.github/workflows/docker-image.yml`): Containerized build and deployment pipeline
- **Library Auto-Update** (`.github/workflows/update-libraries.yml`): Scheduled Codex/Claude tooling refresh that raises a PR when `npm run update:libs` produces changes

#### Development Quality Tools

Expand Down
26 changes: 26 additions & 0 deletions eslint.config.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
import js from '@eslint/js';
import globals from 'globals';
import eslintConfigPrettier from 'eslint-config-prettier';

export default [
{
ignores: ['node_modules/', 'dist/', 'coverage/', '*.min.js'],
},
js.configs.recommended,
eslintConfigPrettier,
{
files: ['**/*.{js,jsx}'],
languageOptions: {
ecmaVersion: 2022,
sourceType: 'module',
globals: {
...globals.node,
...globals.jest,
},
},
rules: {
'no-console': 'off',
'no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
},
},
];
12 changes: 8 additions & 4 deletions npm/global.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,23 +2,27 @@
"name": "lib",
"dependencies": {
"@anthropic-ai/claude-code": {
"version": "2.0.35",
"version": "2.0.36",
"overridden": false
},
"@leonardsellem/n8n-mcp-server": {
"version": "0.1.8",
"overridden": false
},
"@openai/codex": {
"version": "0.57.0",
"overridden": false
},
"corepack": {
"version": "0.33.0",
"version": "0.34.3",
"overridden": false
},
"mcp-remote": {
"version": "0.1.18",
"version": "0.1.30",
"overridden": false
},
"npm": {
"version": "11.4.2",
"version": "11.6.2",
"overridden": false
}
}
Expand Down
Loading