Add agent environment setup script #1167
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| // Agent environment setup tool for Devsy repository. | ||
| package main | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
| ) | ||
|
|
||
| func main() { | ||
| if err := run(); err != nil { | ||
| fmt.Fprintln(os.Stderr, "error:", err) | ||
| os.Exit(1) | ||
| } | ||
| } | ||
|
|
||
| func run() error { | ||
| fmt.Println("Agent environment setup verified.") | ||
| return nil | ||
| } | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
|
|
||
| SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)" | ||
| REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)" | ||
| cd "${REPO_ROOT}" | ||
|
|
||
| echo "==> Installing go-task..." | ||
| if ! command -v task &>/dev/null; then | ||
| sudo sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🔎 Supported by static analysis🏁 Script executed: printf '%s\n' '--- repository conventions ---'
find /tmp/coderabbit-repo-knowledge/devsy-org-devsy-aeebf472 -maxdepth 2 -type f -name '*.md' -print
printf '%s\n' '--- hack/agent-env/setup.sh ---'
cat -n hack/agent-env/setup.shRepository: devsy-org/devsy Length of output: 2488 🏁 Script executed: cat -n /tmp/coderabbit-repo-knowledge/devsy-org-devsy-aeebf472/conventions/repo-wide.mdRepository: devsy-org/devsy Length of output: 434 Pin and verify installer payloads before execution. Lines 10, 14, and 26 execute shell code downloaded at runtime without checksum or signature verification. Line 10 runs the Task installer through 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| fi | ||
|
|
||
| echo "==> Installing prek..." | ||
| curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.0/prek-installer.sh | sh | ||
| if git rev-parse --git-dir &>/dev/null; then | ||
| prek install --force || true | ||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: printf '%s\n' '--- applicable repository conventions ---'
find /tmp/coderabbit-repo-knowledge/devsy-org-devsy-aeebf472 -maxdepth 2 -type f -name '*.md' -print
printf '%s\n' '--- setup script ---'
cat -n hack/agent-env/setup.shRepository: devsy-org/devsy Length of output: 2488 🏁 Script executed: cat /tmp/coderabbit-repo-knowledge/devsy-org-devsy-aeebf472/conventions/repo-wide.mdRepository: devsy-org/devsy Length of output: 392 Do not hide
🤖 Prompt for AI Agents |
||
| fi | ||
|
|
||
| echo "==> Setting up Go modules..." | ||
| export GOTOOLCHAIN=auto | ||
| go mod download | ||
| go mod verify | ||
|
|
||
| echo "==> Installing golangci-lint..." | ||
| GOLANGCI_VERSION="$(cat .golangci-version | tr -d '[:space:]')" | ||
| curl -sSfL https://golangci-lint.run/install.sh | sh -s "${GOLANGCI_VERSION}" | ||
|
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- applicable repository conventions ---'
find /tmp/coderabbit-repo-knowledge/devsy-org-devsy-aeebf472 -maxdepth 2 -type f -name '*.md' -print
printf '%s\n' '--- changed file ---'
cat -n hack/agent-env/setup.sh
printf '%s\n' '--- relevant Taskfile references ---'
rg -n -C 3 'golangci-lint|cli:lint' Taskfile.yml hack/agent-env
printf '%s\n' '--- repository root and setup callers ---'
rg -n -C 2 'hack/agent-env/setup\.sh|agent-env|REPO_ROOT' .github hack Taskfile.yml 2>/dev/null || trueRepository: devsy-org/devsy Length of output: 5779 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- repository-wide review convention ---'
cat /tmp/coderabbit-repo-knowledge/devsy-org-devsy-aeebf472/conventions/repo-wide.md
printf '%s\n' '--- version file and PATH-related setup logic ---'
cat -n .golangci-version
rg -n -C 2 '(^|[[:space:]])PATH|bin/golangci-lint|golangci-lint' hack/agent-env Taskfile.yml .github 2>/dev/null || true
printf '%s\n' '--- installer contract ---'
curl -fsSL https://golangci-lint.run/install.sh | sed -n '1,220p'Repository: devsy-org/devsy Length of output: 11893 Install The installer defaults to 🤖 Prompt for AI Agents |
||
|
|
||
| echo "==> Installing Node dependencies with pnpm..." | ||
| pnpm install | ||
|
|
||
| if [ -n "${GPG_PRIVATE_KEY:-}" ]; then | ||
| echo "==> Configuring GPG signing..." | ||
| mkdir -p ~/.gnupg | ||
| chmod 700 ~/.gnupg | ||
| echo "allow-loopback-pinentry" >>~/.gnupg/gpg-agent.conf | ||
| gpgconf --kill gpg-agent || true | ||
|
|
||
| echo "$GPG_PRIVATE_KEY" | gpg --batch --import --passphrase "${GPG_PASSPHRASE:-}" || true | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: printf '%s\n' '--- repository conventions ---'
head -5 /tmp/coderabbit-repo-knowledge/devsy-org-devsy-aeebf472/*/*.md 2>/dev/null || true
printf '%s\n' '--- target file ---'
cat -n hack/agent-env/setup.sh | sed -n '1,70p'
printf '%s\n' '--- related GPG usage ---'
rg -n --glob '!node_modules' 'GPG_PASSPHRASE|gpg .*passphrase|--passphrase|GPG_PRIVATE_KEY' hack .github 2>/dev/null || trueRepository: devsy-org/devsy Length of output: 2860 Keep Line 38 starts 🤖 Prompt for AI Agents |
||
|
|
||
| KEY_ID=$(gpg --list-secret-keys --keyid-format LONG 2>/dev/null | awk '/^sec/ {print $2}' | cut -d'/' -f2 | head -n 1 || true) | ||
|
Comment on lines
+38
to
+40
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- repository conventions ---'
find /tmp/coderabbit-repo-knowledge/devsy-org-devsy-aeebf472 -maxdepth 2 -type f -name '*.md' -print
printf '%s\n' '--- relevant convention and learning headers ---'
for f in /tmp/coderabbit-repo-knowledge/devsy-org-devsy-aeebf472/*/*.md; do
case "$f" in
*agent*|*security*|*setup*|*shell*|*script*) printf '\n--- %s ---\n' "$f"; cat "$f";;
esac
done
printf '%s\n' '--- setup.sh ---'
cat -n hack/agent-env/setup.sh
printf '%s\n' '--- references to KEY_ID and GPG variables ---'
rg -n -C 3 'KEY_ID|GPG_PRIVATE_KEY|GPG_PASSPHRASE|git config|gpg --' hack/agent-env .Repository: devsy-org/devsy Length of output: 25630 🏁 Script executed: #!/bin/bash
set -eu
cat /tmp/coderabbit-repo-knowledge/devsy-org-devsy-aeebf472/conventions/repo-wide.mdRepository: devsy-org/devsy Length of output: 392 🌐 Web query:
💡 Result: To import a protected secret key in GnuPG 2.1 or 2.2 using an automated or batch process, you must configure the gpg-agent to allow loopback pinentry and provide the passphrase via an authorized mechanism [1][2]. The standard approach for unattended secret key import requires the following steps: 1. Configure gpg-agent: Add the following line to your ~/.gnupg/gpg-agent.conf file to permit the loopback pinentry mode [1][2][3]: allow-loopback-pinentry 2. Restart gpg-agent: If the agent is running, you must restart it or send it a SIGHUP signal to apply the new configuration [1][4]. 3. Execute the import command: Use the following syntax to import the key, where the passphrase is passed via file descriptor 0 (STDIN) [1][2]: echo "your-passphrase" | gpg --batch --pinentry-mode loopback --passphrase-fd 0 --import keyfile.asc Key Considerations: - --batch: Essential for running in non-interactive environments, as it instructs GnuPG to never ask for user input [5][2][6]. - --pinentry-mode loopback: Informs the agent to use the caller (gpg) to handle passphrase inquiries instead of invoking an external pinentry program [2][3][7]. - --passphrase-fd 0: Tells GnuPG to read the passphrase from file descriptor 0. You can also use --passphrase-file if you prefer to read the passphrase from a file [5][1]. - Environment: If running in a script, ensure the GPG_TTY environment variable is exported (e.g., export GPG_TTY=$(tty)) if the command continues to fail or exhibit unexpected behavior regarding TTY access [8][4]. For GnuPG 2.1 and newer, secret key operations are managed exclusively by the gpg-agent [2][6]. The loopback mode is the standard mechanism to bypass the interactive pinentry window in environments where that is not possible or desired [2][7]. Citations:
🌐 Web query:
💡 Result: When importing an encrypted GnuPG secret key in an automated or unattended environment, using --pinentry-mode loopback is generally necessary if you must provide a passphrase programmatically [1][2]. While the --batch option instructs GnuPG not to interact with a user, it does not automatically handle the requirement to provide a passphrase for an encrypted secret key [3][4]. Because GnuPG must decrypt and re-encrypt secret keys during the import process to convert them into the format used by the local gpg-agent, it will typically request the passphrase if one is not provided or if it cannot access a pinentry program [5][3]. By setting --pinentry-mode loopback, you instruct the gpg-agent to redirect passphrase requests back to the GnuPG command-line process instead of attempting to spawn an interactive pinentry window [5][1]. You can then supply the passphrase through the standard input, for example by using --passphrase-fd 0 or the --passphrase option [1][6]. In summary: 1. --batch is used to disable interactive prompts and ensure no terminal interaction is attempted [3][4]. 2. --pinentry-mode loopback is required to allow the passphrase to be provided non-interactively via the GnuPG command line or file descriptors, rather than a GUI or TTY pinentry prompt [1][2]. Without both, the import process may fail because GnuPG will either hang while waiting for a pinentry program that cannot be launched or fail entirely due to the inability to collect the required passphrase [5][3]. Citations:
Fail closed and select the supplied GPG key. Line 38 ignores import errors. Line 40 selects the first secret key in the keyring, which may not be the key from The 🤖 Prompt for AI Agents |
||
|
|
||
| if [ -n "$KEY_ID" ]; then | ||
| git config --global user.signingkey "$KEY_ID" | ||
| git config --global commit.gpgsign true | ||
| git config --global gpg.program gpg | ||
| if [ -n "${GPG_PASSPHRASE:-}" ]; then | ||
| git config --global gpg.pinentryMode loopback | ||
| fi | ||
| echo "GPG signing configured with key ID: $KEY_ID" | ||
| fi | ||
| fi | ||
|
|
||
| echo "==> Running agent-env Go entrypoint..." | ||
| go run ./hack/agent-env | ||
|
|
||
| echo "done" | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Make
runperform the advertised verification.runalways returnsniland only prints"Agent environment setup verified."It does not verify the installed tools, pinned versions, dependencies, or GPG configuration. Failures ignored bysetup.shcan therefore still produce a success result. Add the required checks and return an error when verification fails, or change the message so it does not claim verification.🤖 Prompt for AI Agents