packages: wolfi import batch 4 — node (eslint, lerna, json-server, serve) by bryan-minimal · Pull Request #370 · gominimal/pkgs

bryan-minimal · 2026-07-08T18:24:05Z

Fourth batch from pkgmgr import-wolfi — node CLI tools. Node is a different shape from the tarball-built families: Minimal installs node CLIs from the npm registry by name+version (cf. typescript-language-server), not from a github source — so these have no Source, they npm install -g at build time.

What's here (4 packages, all build + pass every `minimal check` at 0 TODOs)

package	npm	what it is
eslint 10.6.0	eslint	JS/TS linter
lerna 9.0.2	lerna	monorepo manager (ships native `@nx` addons)
json-server 1.0.0-beta.3	json-server	zero-code mock REST API
serve 14.2.5	serve	static file server

How they're produced

build.sh: npm install -g --prefix="$OUTPUT_DIR/usr" <name>@$MINIMAL_ARG_VERSION.
build.ncl: base + node build_deps, coreutils + node runtime_deps, a needs = { dns, internet } block for the npm fetch, and build_args { include version }.
outputs: the console-script bins (a node usr/bin/<tool> is a symlink into node_modules) + node_modules (allow_executable — some packages ship native .node addons). Read from a verified build.

Reviewer notes (surfaced, not hidden)

No source_provenance — node packages install from the npm registry, not a pinned github tarball, so there's no 'GithubRepo provenance for vuln-scanning (matches Minimal's existing node packages like typescript-language-server). Worth a follow-up: an npm PURL for scan coverage.
Peer packages: some node CLIs need peers installed alongside (typescript-language-server pulls typescript). These 4 resolve their own deps via npm install; the generated build.sh installs the single named package, and the import surfaces a reviewer note to add peers if a tool needs them.

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- Added support for packaging and installing four additional Node.js tools: eslint, json-server, lerna, and serve.
- Each package now includes a reproducible build setup and exposes the expected command-line binary plus installed modules.

Fourth batch from `pkgmgr import-wolfi` — node CLI tools. Node installs from the npm registry by name+version (cf. typescript-language-server), so these have no Source: build.sh runs `npm install -g --prefix=$OUTPUT_DIR/usr <name>@$MINIMAL_ARG_VERSION`, with base+node build_deps, coreutils+node runtime, a needs{dns,internet} block, and outputs = console-script bins + node_modules. Each builds clean and passes every `minimal check` at 0 TODOs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai · 2026-07-08T18:24:24Z

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 12 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8724c15b-203e-45ac-a8dd-f009de6db5c1

📥 Commits

Reviewing files that changed from the base of the PR and between fc59d64 and 7dcd2b6.

📒 Files selected for processing (8)

packages/eslint/build.ncl
packages/eslint/build.sh
packages/json-server/build.ncl
packages/json-server/build.sh
packages/lerna/build.ncl
packages/lerna/build.sh
packages/serve/build.ncl
packages/serve/build.sh

📝 Walkthrough

Walkthrough

This PR adds build specifications and install scripts for four new npm-based packages: eslint (10.6.0), json-server (0.17.4), lerna (9.0.7), and serve (14.2.6). Each package includes a build.ncl spec and a build.sh script performing global npm installs.

Changes

New npm package build specs

Layer / File(s)	Summary
eslint build spec and script `packages/eslint/build.ncl`, `packages/eslint/build.sh`	Defines the eslint BuildSpec pinned to version 10.6.0 with deps, needs, outputs, and attrs; script installs eslint globally via npm.
json-server build spec and script `packages/json-server/build.ncl`, `packages/json-server/build.sh`	Defines the json-server BuildSpec pinned to version 0.17.4 with deps, needs, outputs, and attrs; script installs json-server globally via npm.
lerna build spec and script `packages/lerna/build.ncl`, `packages/lerna/build.sh`	Defines the lerna BuildSpec pinned to version 9.0.7 with deps, needs, outputs, and attrs; script installs lerna globally via npm.
serve build spec and script `packages/serve/build.ncl`, `packages/serve/build.sh`	Defines the serve BuildSpec pinned to version 14.2.6 with deps, needs, outputs, and attrs; script installs serve globally via npm.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: msample

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the batch import of four Wolfi node packages and names the affected packages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch add-wolfi-imports-batch4-node

_{Comment @coderabbitai help to get the list of available commands.}

twitchyliquid64 · 2026-07-16T18:04:49Z

+  },
+  outputs = {
+    json-server = { glob = "usr/bin/json-server" } | OutputBin,
+    node_modules = { glob = "usr/lib/node_modules/**", allow_executable = true } | OutputData,


I dont think a global node_modules is gonna go so well, particularly if someone uses node vs node-lts

twitchyliquid64 · 2026-07-16T18:04:58Z

+  },
+  outputs = {
+    lerna = { glob = "usr/bin/lerna" } | OutputBin,
+    node_modules = { glob = "usr/lib/node_modules/**", allow_executable = true } | OutputData,


twitchyliquid64 flagged the global usr/lib/node_modules output — it overlaps the node/node-lts runtime's ownership of that path and welds the tool to one node variant. Install each tool into a package-private prefix (usr/libexec/<pkg>) and expose the bins as relative symlinks on PATH (../libexec/<pkg>/bin/<tool>). The inner `#!/usr/bin/env node` shebang is served by coreutils(env)+node, so no shell is needed and runtime_deps=[coreutils, node] stays correct — matching what pnpm and bash-language-server already ship. (Deliberately NOT a `#!/bin/sh` wrapper, which would need bash in the runtime closure and fail at runtime with "bad interpreter" while still passing minimal check.) Build-proven all 4: usr/bin/<tool> resolves through libexec to the node script; zero leak into usr/lib/node_modules. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bryan-minimal · 2026-07-17T02:29:16Z

Good catch — fixed in 7dcd2b6. All four now install into a package-private usr/libexec/<pkg> prefix instead of the shared global usr/lib/node_modules, so there's no overlap with node/node-lts's ownership of that path and the tool isn't welded to one node variant.

The bins are exposed as relative symlinks on PATH (usr/bin/<tool> → ../libexec/<pkg>/bin/<tool>) — matching what pnpm, agent-browser, and today's bash-language-server already ship. Deliberately not a #!/bin/sh wrapper: a review pass caught that a wrapper would need bash in the runtime closure ([coreutils, node] has no shell) and would fail at runtime with "bad interpreter" while still passing minimal check. The symlink keeps the inner #!/usr/bin/env node shebang, which coreutils(env)+node already satisfy.

Build-proven all four: usr/bin/<tool> resolves through libexec to the node script, zero leak into usr/lib/node_modules.

Follow-ups (separate PRs): fixing the import-wolfi node flavor to generate this shape by default, and retrofitting the existing node packages that had the same global pattern (typescript-language-server, pyright, wrangler, next, cf, mermaid-cli, bash-language-server, capy).

Follows Tom's review on #370 — "I dont think a global `node_modules` is gonna go so well, particularly if someone uses `node` vs `node-lts`". The collision half of that was already handled: vlt installs into a private `usr/libexec/vlt` prefix with relative PATH symlinks, never the shared `usr/lib/node_modules` the node runtime owns. But the variant question the comment raises was still answered by the importer's hardcoded default rather than by evidence. The evidence says LTS: - vlt's own CI tests Node 22.x ONLY (`node-version: '^22.22.0'` and `[22.x]`); `engines` says `>=22.22.0`. Our node-lts is 24.14.1 and node is 25.8.2 — neither is 22.x, but LTS is two majors closer to what upstream actually tests against. - pnpm is the closest analogue in this repo (a package manager, a node CLI, same shape of package) and it is on node-lts, per #97/#98: the node most users and hosting providers run is whatever ships with current LTS. node-lts ships its own npm, so it serves the build (`npm ci`) and the runtime (`#!/usr/bin/env node`) both — no split between build_deps and runtime_deps. Rebuilt and re-checked on the min path: 15/15 Pass.

bryan-minimal mentioned this pull request Jul 8, 2026

packages: wolfi import batch 5 — 10 CLI tools (dive, restic, gitleaks, sccache, …) #371

Merged

mitodrummer approved these changes Jul 15, 2026

View reviewed changes

twitchyliquid64 reviewed Jul 16, 2026

View reviewed changes

bryan-minimal mentioned this pull request Jul 17, 2026

node language-servers: private-libexec install + symlink launchers #438

Merged

bryan-minimal added this pull request to the merge queue Jul 17, 2026

Merged via the queue into main with commit b1a1fc2 Jul 17, 2026
9 checks passed

bryan-minimal deleted the add-wolfi-imports-batch4-node branch July 17, 2026 16:55

Navigation Menu

Uh oh!

packages: wolfi import batch 4 — node (eslint, lerna, json-server, serve) - #370

packages: wolfi import batch 4 — node (eslint, lerna, json-server, serve)#370
bryan-minimal merged 2 commits into
mainfrom
add-wolfi-imports-batch4-node

bryan-minimal commented Jul 8, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 8, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Uh oh!

twitchyliquid64 Jul 16, 2026

Uh oh!

twitchyliquid64 Jul 16, 2026

Uh oh!

bryan-minimal commented Jul 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

bryan-minimal commented Jul 8, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What's here (4 packages, all build + pass every minimal check at 0 TODOs)

How they're produced

Reviewer notes (surfaced, not hidden)

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

twitchyliquid64 Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

twitchyliquid64 Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

bryan-minimal commented Jul 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bryan-minimal commented Jul 8, 2026 •

edited by coderabbitai Bot

Loading

What's here (4 packages, all build + pass every `minimal check` at 0 TODOs)

coderabbitai Bot commented Jul 8, 2026 •

edited

Loading