feat(make): support local formula path and improve test coverage#104
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces support for local formula paths in llar make, which is a great feature for local development and CI. The refactoring to a Store interface with remoteStore and localStore implementations is well-executed. My review includes a few suggestions to improve code consistency, idiomatic Go usage, and reduce code duplication. Overall, this is a solid contribution that also significantly improves test coverage.
![fennoai[bot]](https://avatars.githubusercontent.com/in/1924301?s=60&v=4){kind=small}
| } | ||
|
|
||
| // ModuleFS returns an fs.FS rooted at the module's local formula directory. | ||
| func (s *localStore) ModuleFS(_ context.Context, modPath string) (fs.FS, error) { |
There was a problem hiding this comment.
Path traversal / missing validation (CWE-22): remoteStore.ModuleFS validates modPath via module.EscapePath (in moduleDirOf), and localStore.LockModule also calls module.EscapePath — but localStore.ModuleFS does not. A crafted path like ../../etc would survive parseModuleArg's prefix stripping and cause filepath.Join(s.root, "../../etc") to escape the root directory.
| func (s *localStore) ModuleFS(_ context.Context, modPath string) (fs.FS, error) { | |
| func (s *localStore) ModuleFS(_ context.Context, modPath string) (fs.FS, error) { | |
| escapedModPath, err := module.EscapePath(modPath) | |
| if err != nil { | |
| return nil, err | |
| } | |
| return os.DirFS(filepath.Join(s.root, escapedModPath)), nil | |
| } |
There was a problem hiding this comment.
Fix applied
Added module.EscapePath validation to localStore.ModuleFS to match the validation already present in remoteStore.ModuleFS and localStore.LockModule. This prevents path traversal (CWE-22) where crafted paths like ../../etc could escape the root directory.
Changes:
internal/formula/repo/store.go: Addedmodule.EscapePath(modPath)call beforefilepath.JoininlocalStore.ModuleFSinternal/formula/repo/store_test.go: AddedTestLocalStore_ModuleFS_InvalidPathtest verifying rejection of"","../../../etc", and"owner//repo"
All internal/formula/repo tests pass.
PR: MeteorsLiu#5
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #104 +/- ##
==========================================
+ Coverage 76.15% 78.11% +1.95%
==========================================
Files 32 34 +2
Lines 1732 1855 +123
==========================================
+ Hits 1319 1449 +130
+ Misses 314 303 -11
- Partials 99 103 +4 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Add support for local filesystem patterns (., ./path, ./path@ver) in `llar make`, enabling CI workflows within the llarhub repository to build local formulas while resolving dependencies from the remote store. Key changes: - Extract Store interface from concrete struct in repo package - Add overlayStore to serve local modules with remote fallback - Add modlocal package for local module discovery via versions.json - Update parseModuleArg to detect and validate local patterns - Split runMake into local/remote branches with overlay composition
MeteorsLiu
force-pushed
the
feat/support-fs-pattern
branch
from
f6f8b98 to
6af6443
Compare
Add documentation examples demonstrating how to build local formulas using `llar make` command with local paths. This clarifies the usage of the tool for building formulas from local directories.
| var newRemoteStore = func() (repo.Store, error) { | ||
| formulaDir, err := repo.DefaultDir() | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to get formula dir: %w", err) | ||
| } | ||
| formulaRepo, err := vcs.NewRepo("github.com/goplus/llarhub") | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return repo.New(formulaDir, formulaRepo), nil | ||
| } | ||
|
|
There was a problem hiding this comment.
NOTE: allow mock for test
|
/review |
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces a significant and well-implemented feature to support local formula builds, which is crucial for CI workflows. The refactoring of repo.Store into an interface to accommodate the overlayStore is a clean and effective design choice. The new modlocal package provides a solid foundation for local module discovery. The test coverage has been substantially improved with comprehensive unit and integration tests for the new functionality. I have one suggestion for a minor refactoring to improve the readability of the runMake function.
Add documentation note explaining that `..` and `../path` patterns are not supported for local module imports. Users should use `.` instead, which automatically walks up from the current directory to find the nearest `versions.json` file, eliminating the need for manual parent directory navigation.
|
/review |
|
/review |
| func resolveCurrentDir(cwd string) ([]Module, error) { | ||
| dir := cwd | ||
| for { | ||
| vFile := filepath.Join(dir, "versions.json") | ||
| if _, err := os.Stat(vFile); err == nil { | ||
| v, err := versions.Parse(vFile, nil) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to parse %s: %w", vFile, err) | ||
| } | ||
| if v.Path == "" { | ||
| return nil, fmt.Errorf("versions.json at %s has no path field", dir) | ||
| } | ||
| return []Module{{Path: v.Path, Dir: dir}}, nil | ||
| } | ||
| parent := filepath.Dir(dir) | ||
| if parent == dir { | ||
| return nil, fmt.Errorf("no versions.json found in %s or any parent directory", cwd) | ||
| } | ||
| dir = parent | ||
| } |
There was a problem hiding this comment.
findLocalRoot (lines 66-78) and resolveCurrentDir (lines 82-101) contain near-identical upward-walk logic (filepath.Dir, parent == dir termination). resolveCurrentDir could reuse findLocalRoot to locate the root directory, then parse the versions.json at the returned path, eliminating one copy of the walk.
Review SummaryWell-structured PR. The Key feedback (inline):
|
| func resolveCurrentDir(cwd string) ([]Module, error) { | ||
| dir := cwd | ||
| for { | ||
| vFile := filepath.Join(dir, "versions.json") | ||
| if _, err := os.Stat(vFile); err == nil { | ||
| v, err := versions.Parse(vFile, nil) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to parse %s: %w", vFile, err) | ||
| } | ||
| if v.Path == "" { | ||
| return nil, fmt.Errorf("versions.json at %s has no path field", dir) | ||
| } | ||
| return []Module{{Path: v.Path, Dir: dir}}, nil |
There was a problem hiding this comment.
seems current only return a Module ?
There was a problem hiding this comment.
Currently, yes. However, the reason we still return multiple modules is to reserve for the future ... support.
2 participants
Add support for local filesystem patterns (., ./path, ./path@ver) in
llar make, enabling CI workflows within the llarhub repository to buildlocal formulas while resolving dependencies from the remote store.
Key changes: