chore(deps): upgrade clawdbot to v2026.1.20 and add automatic pnpmDepsHash computation - #637
Conversation
…sHash computation
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
|
Caution Review failedThe pull request is closed. Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. 📝 WalkthroughSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughAdds automated pnpmDepsHash computation and a Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor User
participant CLI as "upgrade-overlays.sh (CLI)"
participant Script as "compute_pnpm_deps_hash/update_pnpm_hash"
participant Nix as "nix build (temporary)"
participant Overlay as "overlays/default.nix"
User->>CLI: run `upgrade` or `pnpm-hash`
CLI->>Script: invoke compute/update helper
Script->>Overlay: write placeholder pnpmDepsHash
Script->>Nix: run `nix build` for pnpm deps
Nix-->>Script: error output contains real pnpmDepsHash
Script->>Script: parse hash from error
alt hash found
Script->>Overlay: replace placeholder with real pnpmDepsHash
Script-->>CLI: success
CLI-->>User: report updated hash and upgrade result
else hash not found
Script-->>CLI: restore original hash
CLI-->>User: warn manual verification required
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request focuses on enhancing the dependency management process for Nix-based projects. It upgrades the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Mesa DescriptionTL;DRUpgraded the What changed?
Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request successfully upgrades the clawdbot overlay to v2026.1.20 and introduces significant automation for pnpmDepsHash computation. The changes to flake.lock and overlays/default.nix reflect the updated dependency versions and hashes. The new compute_pnpm_deps_hash function and its integration into the upgrade script will greatly improve the maintainability of the Nix configuration by reducing the need for manual hash updates after build failures. The addition of a dedicated pnpm-hash command is also a valuable improvement for targeted updates.
|
|
||
| # Run nix build and capture the correct hash from error output | ||
| local build_output correct_hash | ||
| build_output=$(nix build ".#darwinConfigurations.aarch64-darwin.system" --no-link 2>&1 || true) |
There was a problem hiding this comment.
The nix build command explicitly targets . #darwinConfigurations.aarch64-darwin.system. This hardcoded path makes the compute_pnpm_deps_hash function specific to aarch64-darwin systems. If this script is intended to be run on other architectures (e.g., x86_64-linux or aarch64-linux as defined in flake.nix), this command will likely fail or produce an irrelevant hash. Consider making the build target dynamic based on the current system or an argument, or add a check to ensure it's run on the correct architecture.
| if compute_pnpm_deps_hash; then | ||
| log_info "✅ clawdbot upgraded from $current_version to $version" | ||
| else | ||
| log_info "✅ clawdbot upgraded from $current_version to $version" | ||
| log_warn "⚠️ pnpmDepsHash may need manual verification" | ||
| fi |
There was a problem hiding this comment.
The success message "✅ clawdbot upgraded..." is printed twice, once inside the if block and once inside the else block. If compute_pnpm_deps_hash fails, the script still indicates a successful upgrade, which can be misleading. It would be better to print the success message only when the full upgrade, including hash computation, is successful. If compute_pnpm_deps_hash fails, a more distinct warning or error should be shown instead of a success message.
| if compute_pnpm_deps_hash; then | |
| log_info "✅ clawdbot upgraded from $current_version to $version" | |
| else | |
| log_info "✅ clawdbot upgraded from $current_version to $version" | |
| log_warn "⚠️ pnpmDepsHash may need manual verification" | |
| fi | |
| # Update pnpmDepsHash automatically | |
| if compute_pnpm_deps_hash; then | |
| log_info "✅ clawdbot upgraded from $current_version to $version" | |
| else | |
| log_warn "⚠️ clawdbot upgraded from $current_version to $version, but pnpmDepsHash may need manual verification" | |
| fi |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@scripts/upgrade-overlays.sh`:
- Around line 86-113: The compute_pnpm_deps_hash function is currently using
global grep/sed patterns that will change every pnpmDepsHash in the overlay
file; update it to first extract the clawdbotSourceOverride block (e.g., locate
the block start/end markers for "clawdbotSourceOverride"), read the current
pnpmDepsHash only from that block (replace the current_hash extraction that uses
grep on the whole file), perform the temporary fake-hash insertion and the final
sed replacement scoped to that block (instead of global substitutions used in
the sed_inplace calls), and if the clawdbotSourceOverride block or its
pnpmDepsHash key is not found, fail with a clear error rather than proceeding
(so the function returns non-zero). Ensure you reference compute_pnpm_deps_hash,
current_hash, build_output/correct_hash and the sed_inplace usages when making
these changes.
| compute_pnpm_deps_hash() { | ||
| local fake_hash="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" | ||
| local current_hash | ||
|
|
||
| # Get current pnpmDepsHash | ||
| current_hash=$(grep 'pnpmDepsHash = "' "$OVERLAY_FILE" | head -1 | sed 's/.*pnpmDepsHash = "\([^"]*\)".*/\1/') | ||
|
|
||
| echo " Computing pnpmDepsHash (this requires a build attempt)..." | ||
|
|
||
| # Temporarily set fake hash | ||
| sed_inplace "s|pnpmDepsHash = \"[^\"]*\";|pnpmDepsHash = \"$fake_hash\";|" "$OVERLAY_FILE" | ||
|
|
||
| # Run nix build and capture the correct hash from error output | ||
| local build_output correct_hash | ||
| build_output=$(nix build ".#darwinConfigurations.aarch64-darwin.system" --no-link 2>&1 || true) | ||
|
|
||
| # Extract the correct hash from "got: sha256-..." line | ||
| correct_hash=$(echo "$build_output" | grep -o 'got:[[:space:]]*sha256-[A-Za-z0-9+/=]*' | head -1 | sed 's/got:[[:space:]]*//') | ||
|
|
||
| if [ -n "$correct_hash" ]; then | ||
| echo " pnpmDepsHash: $correct_hash" | ||
| sed_inplace "s|pnpmDepsHash = \"[^\"]*\";|pnpmDepsHash = \"$correct_hash\";|" "$OVERLAY_FILE" | ||
| return 0 | ||
| else | ||
| # Restore original hash if we couldn't get a new one | ||
| log_warn " Could not determine pnpmDepsHash, restoring original" | ||
| sed_inplace "s|pnpmDepsHash = \"[^\"]*\";|pnpmDepsHash = \"$current_hash\";|" "$OVERLAY_FILE" | ||
| return 1 |
There was a problem hiding this comment.
Scope pnpmDepsHash updates to clawdbotSourceOverride only.
Line 91 and Lines 96–112 use global grep/sed patterns that will update every pnpmDepsHash in overlays/default.nix. If other overlays add a pnpmDepsHash, this silently corrupts them. Also, with set -euo pipefail, a missing match will abort the script. Prefer scoping the read/write to the clawdbotSourceOverride block and explicitly error if the hash isn’t found.
🛠️ Proposed fix (scoped read/write + guard)
- current_hash=$(grep 'pnpmDepsHash = "' "$OVERLAY_FILE" | head -1 | sed 's/.*pnpmDepsHash = "\([^"]*\)".*/\1/')
+ current_hash=$(awk '
+ /clawdbotSourceOverride = \{/ { in_src=1 }
+ in_src && /pnpmDepsHash = "/ {
+ match($0, /pnpmDepsHash = "([^"]+)"/, m)
+ print m[1]
+ exit
+ }
+ in_src && /\}/ { in_src=0 }
+ ' "$OVERLAY_FILE")
+ if [ -z "$current_hash" ]; then
+ log_error " pnpmDepsHash not found in clawdbotSourceOverride"
+ return 1
+ fi
@@
- sed_inplace "s|pnpmDepsHash = \"[^\"]*\";|pnpmDepsHash = \"$fake_hash\";|" "$OVERLAY_FILE"
+ awk -v new_hash="$fake_hash" '
+ /clawdbotSourceOverride = \{/ { in_src=1 }
+ in_src && /pnpmDepsHash = "sha256-/ {
+ sub(/pnpmDepsHash = "[^"]*"/, "pnpmDepsHash = \"" new_hash "\"")
+ in_src=0
+ }
+ { print }
+ ' "$OVERLAY_FILE" >"$OVERLAY_FILE.tmp" && mv "$OVERLAY_FILE.tmp" "$OVERLAY_FILE"
@@
- sed_inplace "s|pnpmDepsHash = \"[^\"]*\";|pnpmDepsHash = \"$correct_hash\";|" "$OVERLAY_FILE"
+ awk -v new_hash="$correct_hash" '
+ /clawdbotSourceOverride = \{/ { in_src=1 }
+ in_src && /pnpmDepsHash = "sha256-/ {
+ sub(/pnpmDepsHash = "[^"]*"/, "pnpmDepsHash = \"" new_hash "\"")
+ in_src=0
+ }
+ { print }
+ ' "$OVERLAY_FILE" >"$OVERLAY_FILE.tmp" && mv "$OVERLAY_FILE.tmp" "$OVERLAY_FILE"
@@
- sed_inplace "s|pnpmDepsHash = \"[^\"]*\";|pnpmDepsHash = \"$current_hash\";|" "$OVERLAY_FILE"
+ awk -v new_hash="$current_hash" '
+ /clawdbotSourceOverride = \{/ { in_src=1 }
+ in_src && /pnpmDepsHash = "sha256-/ {
+ sub(/pnpmDepsHash = "[^"]*"/, "pnpmDepsHash = \"" new_hash "\"")
+ in_src=0
+ }
+ { print }
+ ' "$OVERLAY_FILE" >"$OVERLAY_FILE.tmp" && mv "$OVERLAY_FILE.tmp" "$OVERLAY_FILE"🤖 Prompt for AI Agents
In `@scripts/upgrade-overlays.sh` around lines 86 - 113, The
compute_pnpm_deps_hash function is currently using global grep/sed patterns that
will change every pnpmDepsHash in the overlay file; update it to first extract
the clawdbotSourceOverride block (e.g., locate the block start/end markers for
"clawdbotSourceOverride"), read the current pnpmDepsHash only from that block
(replace the current_hash extraction that uses grep on the whole file), perform
the temporary fake-hash insertion and the final sed replacement scoped to that
block (instead of global substitutions used in the sed_inplace calls), and if
the clawdbotSourceOverride block or its pnpmDepsHash key is not found, fail with
a clear error rather than proceeding (so the function returns non-zero). Ensure
you reference compute_pnpm_deps_hash, current_hash, build_output/correct_hash
and the sed_inplace usages when making these changes.
There was a problem hiding this comment.
Pull request overview
This PR upgrades the clawdbot dependency from v2026.1.16-2 to v2026.1.20 and introduces automatic pnpmDepsHash computation functionality to streamline future upgrades.
Changes:
- Upgraded clawdbot overlay to v2026.1.20 with updated source, app, and pnpmDepsHash values
- Added compute_pnpm_deps_hash() function that automatically determines the correct pnpmDepsHash by running a build attempt with a fake hash and extracting the correct value from error output
- Added new
pnpm-hashcommand to allow manual pnpmDepsHash updates independently of version upgrades
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
| scripts/upgrade-overlays.sh | Added compute_pnpm_deps_hash() function, update_pnpm_hash() function, integrated automatic hash computation into upgrade flow, and added pnpm-hash command |
| overlays/default.nix | Updated clawdbot from v2026.1.16-2 to v2026.1.20 with corresponding hash updates (rev, source hash, pnpmDepsHash, app hash) |
| flake.lock | Standard dependency updates for devenv, home-manager, neovim-nightly-overlay, nix-clawdbot, nixpkgs, and NUR inputs |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -83,6 +83,37 @@ sed_inplace() { | |||
| fi | |||
| } | |||
|
|
|||
There was a problem hiding this comment.
The compute_pnpm_deps_hash function lacks a comment or docstring explaining its purpose, how it works, and what it returns. Consider adding a header comment similar to other utility functions in the file to improve code documentation and maintainability.
| # Compute the correct pnpmDepsHash for the overlay. | |
| # This temporarily writes a fake pnpmDepsHash into $OVERLAY_FILE, runs a Nix | |
| # build to trigger a hash mismatch, extracts the expected hash from the build | |
| # error output, and then replaces the fake value with the correct hash. | |
| # On success, updates pnpmDepsHash in the overlay file and returns 0. | |
| # If the correct hash cannot be determined, restores the original value and | |
| # returns 1. |
| else | ||
| # Restore original hash if we couldn't get a new one | ||
| log_warn " Could not determine pnpmDepsHash, restoring original" | ||
| sed_inplace "s|pnpmDepsHash = \"[^\"]*\";|pnpmDepsHash = \"$current_hash\";|" "$OVERLAY_FILE" |
There was a problem hiding this comment.
The function assumes that if no hash is extracted from the build output, it should restore the original hash. However, this doesn't distinguish between a legitimate hash mismatch error and other types of build failures (e.g., network issues, syntax errors, missing dependencies). Consider adding validation to check if the build output contains a hash mismatch error before assuming the extraction failed, to provide more helpful error messages to users.
| compute_pnpm_deps_hash() { | ||
| local fake_hash="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" | ||
| local current_hash | ||
|
|
||
| # Get current pnpmDepsHash | ||
| current_hash=$(grep 'pnpmDepsHash = "' "$OVERLAY_FILE" | head -1 | sed 's/.*pnpmDepsHash = "\([^"]*\)".*/\1/') | ||
|
|
||
| echo " Computing pnpmDepsHash (this requires a build attempt)..." | ||
|
|
||
| # Temporarily set fake hash | ||
| sed_inplace "s|pnpmDepsHash = \"[^\"]*\";|pnpmDepsHash = \"$fake_hash\";|" "$OVERLAY_FILE" | ||
|
|
||
| # Run nix build and capture the correct hash from error output | ||
| local build_output correct_hash | ||
| build_output=$(nix build ".#darwinConfigurations.aarch64-darwin.system" --no-link 2>&1 || true) | ||
|
|
||
| # Extract the correct hash from "got: sha256-..." line | ||
| correct_hash=$(echo "$build_output" | grep -o 'got:[[:space:]]*sha256-[A-Za-z0-9+/=]*' | head -1 | sed 's/got:[[:space:]]*//') | ||
|
|
||
| if [ -n "$correct_hash" ]; then | ||
| echo " pnpmDepsHash: $correct_hash" | ||
| sed_inplace "s|pnpmDepsHash = \"[^\"]*\";|pnpmDepsHash = \"$correct_hash\";|" "$OVERLAY_FILE" | ||
| return 0 | ||
| else | ||
| # Restore original hash if we couldn't get a new one | ||
| log_warn " Could not determine pnpmDepsHash, restoring original" | ||
| sed_inplace "s|pnpmDepsHash = \"[^\"]*\";|pnpmDepsHash = \"$current_hash\";|" "$OVERLAY_FILE" | ||
| return 1 | ||
| fi | ||
| } |
There was a problem hiding this comment.
If the sed_inplace operation fails when setting the fake hash or restoring the original hash (lines 96, 107, or 112), the function will continue execution due to the 'set -euo pipefail' at the script level. However, a failure during hash restoration could leave the overlay file in an inconsistent state. Consider adding error checking after critical sed_inplace operations or wrapping the function in a trap to ensure the original hash is restored even if the function fails unexpectedly.
| ;; | ||
| *) | ||
| log_error "Unknown overlay: $target" | ||
| log_error "Unknown command: $target" |
There was a problem hiding this comment.
The error message was changed from "Unknown overlay:" to "Unknown command:", but the corresponding test in spec/upgrade_overlays_spec.sh (line 45) expects "Unknown overlay: unknown-overlay". This change will cause existing tests to fail. The tests should be updated to match this change in error messaging.
|
|
||
| # Run nix build and capture the correct hash from error output | ||
| local build_output correct_hash | ||
| build_output=$(nix build ".#darwinConfigurations.aarch64-darwin.system" --no-link 2>&1 || true) |
There was a problem hiding this comment.
The build command is hardcoded to build specifically for aarch64-darwin, which may fail on non-aarch64-darwin systems. Consider detecting the system architecture or making the target configurable to support both aarch64-darwin and x86_64-darwin systems.
| log_info "✅ clawdbot upgraded from $current_version to $version" | ||
| else | ||
| log_info "✅ clawdbot upgraded from $current_version to $version" | ||
| log_warn "⚠️ pnpmDepsHash may need manual verification" | ||
| fi | ||
|
|
There was a problem hiding this comment.
The success message is displayed in both the if and else branches, making the conditional logic redundant. The only difference is the warning message in the else branch. Consider restructuring this to avoid the duplicate log_info call, such as displaying the success message once after the conditional, or making the messages more distinct.
| log_info "✅ clawdbot upgraded from $current_version to $version" | |
| else | |
| log_info "✅ clawdbot upgraded from $current_version to $version" | |
| log_warn "⚠️ pnpmDepsHash may need manual verification" | |
| fi | |
| : | |
| else | |
| log_warn "⚠️ pnpmDepsHash may need manual verification" | |
| fi | |
| log_info "✅ clawdbot upgraded from $current_version to $version" |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
|
@claude fix shell-test |
Changes
Technical Details
Testing
Generated with opencode by claude-3.5-sonnet
Summary by cubic
Upgrades the clawdbot overlay to v2026.1.20 and automates pnpmDepsHash updates to prevent manual fixes after Nix build failures.
Dependencies
New Features
Written for commit 0c4b0eb. Summary will update on new commits.