tools/scripts/lib_install/ubuntu/install-dev-common.sh (2)

18-18: 💤 Low value

Consider adding DEBIAN_FRONTEND=noninteractive to apt-get update for consistency.

While apt-get update typically doesn't prompt interactively, setting DEBIAN_FRONTEND=noninteractive here would match the pattern used on line 19 and ensure consistent non-interactive behaviour across all apt operations.

♻️ Proposed change

-${privileged_command_prefix} apt-get update
+DEBIAN_FRONTEND=noninteractive ${privileged_command_prefix} apt-get update

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/scripts/lib_install/ubuntu/install-dev-common.sh` at line 18, The
apt-get update invocation using ${privileged_command_prefix} should be run
non-interactively like the subsequent apt commands; update the command that
invokes "apt-get update" (the line using the variable
${privileged_command_prefix}) to prefix it with DEBIAN_FRONTEND=noninteractive
so it matches the non-interactive pattern used on the following line and ensures
consistent behavior across all apt operations.

---

29-29: ⚡ Quick win

Consider verifying the uv installer script integrity.

Piping a remote script directly to sh is convenient but introduces a supply-chain risk. While the URL uses HTTPS and points to the official Astral uv installer, consider adding checksum verification or pinning to a specific version if reproducibility and additional security assurance are priorities.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tools/scripts/lib_install/ubuntu/install-dev-common.sh` at line 29, The
installer is being piped directly into sh which is a supply-chain risk; change
the flow in install-dev-common.sh so you first download the script (referenced
by the existing curl invocation), verify integrity (either fetch a published
checksum/signature from the vendor and validate it or pin to a specific
versioned installer URL), and only then execute the verified script;
alternatively replace the piped URL with a stable, versioned release URL from
Astral (or verify a GPG signature) before invoking sh.

.github/workflows/code-linting-checks.yaml (1)

47-50: Informational: uv is installed twice in jobs using install-dev-common.sh.

The workflow installs uv via the GitHub action (line 47), then install-dev-common.sh installs it again (line 50). The uv installer is idempotent, so this works correctly but performs redundant work. The same pattern applies to lint-python (lines 151-154). This redundancy likely existed before this refactor and is not a new issue.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/code-linting-checks.yaml around lines 47 - 50, Remove the
duplicate uv installation by choosing one source of truth: either keep the
GitHub action step "./tools/yscope-dev-utils/exports/github/actions/install-uv"
or keep the script step named "Install dev dependencies" that runs
"./tools/scripts/lib_install/ubuntu/install-dev-common.sh"; update the workflow
to remove the other step, or alternatively modify install-dev-common.sh to
detect an existing uv install and skip reinstalling (add an idempotent check
before install). Also apply the same de-duplication for the lint-python
installation (the corresponding install action and the install-dev-common.sh
invocation).

.devcontainer/Dockerfile (1)

8-9: Note: install-dev-common.sh runs twice (once per component script).

Since both wolf and huntsman internally call install-dev-common.sh, the common setup (including apt-get update and base package checks) executes twice. This is slightly inefficient but maintains script independence, allowing each component script to run standalone. The duplicate installations are harmless (apt and uv are idempotent), so this trade-off is acceptable for maintainability.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.devcontainer/Dockerfile around lines 8 - 9, Both component installers
(install-dev-wolf.sh and install-dev-huntsman.sh) call install-dev-common.sh,
causing the common setup to run twice; change the Dockerfile so
install-dev-common.sh runs only once before invoking the two component scripts,
or modify the component scripts to respect an environment flag (e.g.,
SKIP_COMMON) and set that flag when calling the second script. Locate
install-dev-wolf.sh, install-dev-huntsman.sh and install-dev-common.sh
references in the diff and either (A) add a separate RUN invocation for
install-dev-common.sh once and then run both component scripts, or (B) update
the component scripts to check SKIP_COMMON and set SKIP_COMMON=1 in the
Dockerfile for subsequent calls to avoid re-running the common installer.