ci: pin local @sockethub packages during test install by silverbucket · Pull Request #1105 · sockethub/sockethub

silverbucket · Jun 7, 2026

Summary

Fixes bun runtime failure in Test NPM Package when source=local.

Root cause

Local installs only pinned the top-level sockethub tarball. Transitive @sockethub/* dependencies (e.g. @sockethub/data-layer) were still resolved from the npm registry.

Node uses the "import": "./dist/index.js" export condition → worked
Bun uses the "bun": "./src/index.ts" export condition → loaded stale registry source missing CredentialsNotShareableError → sockethub crashed on startup

From run https://github.com/sockethub/sockethub/actions/runs/27102125560:

SyntaxError: Export named 'CredentialsNotShareableError' not found in module '.../data-layer/src/index.ts'

Fix

Return the full tarball map from buildAndPackLocally() and add npm/bun overrides for all @sockethub/* packages during local test installs.

Test plan

Reproduced bun failure before fix (sockethub --info exit 1)
Verified fix locally (bun node_modules/.bin/sockethub --info succeeds)
bun run lint

Summary by CodeRabbit

Chores
- Improved test infrastructure to better handle local package artifacts during testing, enabling comprehensive testing scenarios with multiple local packages.

Local installs were resolving transitive @sockethub/* dependencies from npm instead of the packed workspace tarballs. Bun then loaded stale registry source and failed to start sockethub while node used dist/ successfully. Co-authored-by: Nick Jennings <silverbucket@users.noreply.github.com>

coderabbitai · Jun 7, 2026

📝 Walkthrough

Walkthrough

Local-mode testing in the test-installed-version script now exposes and threads locally built package artifacts through the installation pipeline. The build process returns a mapping of package names to tarball paths, which the install manager uses to configure npm dependency overrides for scoped packages, enabling the test runner to validate multiple local packages together.

Changes

Local package artifacts in test flow

Layer / File(s)	Summary
Local build output exposes package mapping `scripts/test-installed-version/local-build.js`	`buildAndPackLocally` now returns a `packages` object mapping each packed package name to its local tarball path.
Install manager processes local packages for overrides `scripts/test-installed-version/install.js`	`InstallManager.install()` accepts optional `localPackages` parameter and builds `package.json` with conditional npm `overrides` section for `@sockethub/*` scoped packages found in the map.
Test runner flow threads local packages through installation `scripts/test-installed-version.js`	`runTestsForRuntime()` signature accepts `localPackages`, and `main()` destructures packages from `buildAndPackLocally()` and forwards them through both installer and runtime test calls.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

sockethub/sockethub#1103: Modifies the same scripts/test-installed-version local-mode flow by updating what buildAndPackLocally returns and how the tarball names are generated, which then feeds into this PR's dependency override logic.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning local `@sockethub` packages during test installation, which aligns with the changeset's core objective of adding package overrides to local test installs.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/local-install-bun-overrides-26b0

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cursor

Security review complete: no high-confidence medium, high, or critical vulnerabilities found in the modified install-test scripts.

Notes: I checked the local tarball/package override flow for supply-chain bypass, package/path injection, command injection, and secret/logging exposure. The new overrides entries are derived from locally packed workspace packages and only applied to @sockethub/* package names; install commands continue to use argv-based process execution rather than shell interpolation.

_{Sent by Cursor Automation: Find vulnerabilities}

coderabbitai

🧹 Nitpick comments (1)

scripts/test-installed-version/install.js (1)

19-19: ⚡ Quick win

Refine JSDoc type to include null.

The parameter accepts null as well as Record<string, string> (default is null on line 21, and test-installed-version.js line 208 types it as | null). Update the JSDoc for precision.

📝 Suggested JSDoc fix

-     * `@param` {Record<string, string>} [localPackages] - Map of package name to local tarball path
+     * `@param` {Record<string, string> | null} [localPackages] - Map of package name to local tarball path

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/test-installed-version/install.js` at line 19, Update the JSDoc for
the parameter named localPackages to include null in its type (e.g., change
Record<string, string> to Record<string, string> | null) so the documented type
matches the default and usages (see the localPackages parameter in this file and
the reference in test-installed-version.js); ensure the JSDoc line that
currently reads "`@param` {Record<string, string>} [localPackages]" is replaced
with the union type that allows null.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@scripts/test-installed-version/install.js`:
- Line 19: Update the JSDoc for the parameter named localPackages to include
null in its type (e.g., change Record<string, string> to Record<string, string>
| null) so the documented type matches the default and usages (see the
localPackages parameter in this file and the reference in
test-installed-version.js); ensure the JSDoc line that currently reads "`@param`
{Record<string, string>} [localPackages]" is replaced with the union type that
allows null.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d49ff2e6-2a50-48c4-9a2e-581748ac35ea

📥 Commits

Reviewing files that changed from the base of the PR and between 98f822c and 8a9d6d3.

📒 Files selected for processing (3)

scripts/test-installed-version.js
scripts/test-installed-version/install.js
scripts/test-installed-version/local-build.js

silverbucket changed the title ~~fix(ci): pin local @sockethub packages during test install~~ ci: pin local @sockethub packages during test install Jun 7, 2026

silverbucket self-assigned this Jun 7, 2026

github-actions Bot added the type:ci CI/CD changes label Jun 7, 2026

silverbucket marked this pull request as ready for review June 7, 2026 19:40

cursor Bot reviewed Jun 7, 2026

View reviewed changes

coderabbitai Bot reviewed Jun 7, 2026

View reviewed changes

silverbucket merged commit 8510e91 into master Jun 7, 2026
19 of 21 checks passed

silverbucket deleted the fix/local-install-bun-overrides-26b0 branch June 7, 2026 19:45

coderabbitai Bot mentioned this pull request Jun 8, 2026

ci: simplify package verification #1106

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: pin local @sockethub packages during test install#1105

ci: pin local @sockethub packages during test install#1105
silverbucket merged 1 commit into
mastersockethub/sockethub:masterfrom
fix/local-install-bun-overrides-26b0sockethub/sockethub:fix/local-install-bun-overrides-26b0Copy head branch name to clipboard

silverbucket commented Jun 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 7, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Uh oh!

cursor Bot left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Search code, repositories, users, issues, pull requests...

Uh oh!

Conversation

silverbucket commented Jun 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root cause

Fix

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

silverbucket commented Jun 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 7, 2026 •

edited

Loading