Centralize tool version pins and improve web provisioning#80
Merged
Conversation
DX improvements for Claude Code on the web sessions, mined from session friction: - session-start.sh now emits one line per step and sends verbose output to /tmp/session-start.log — the raw apt-get output previously injected ~38KB into the agent's context every session start. - Provision actionlint + gitleaks (go install) and pin prettier to CI's version, so check.sh enforces in web sessions the same gates CI runs instead of self-skipping them and failing late in CI. - Unshallow the clone at session start: a shallow clone has origin/main but no merge base, which crashes diff-cover/mutation with a confusing 'fatal: no merge base' instead of self-skipping. - Single-source the non-Python tool pins in scripts/gate_tool_pins.sh, sourced by both ci.yml and the hook (they can't live in pyproject — gitleaks/actionlint ship no PyPI distribution). - shellcheck-gate the hook and pins file in check.sh; add an explicit 600s hook timeout and a few safe read-only permission allowlist entries. - Document the provisioning contract in AGENTS.md. https://claude.ai/code/session_01FUszDSwvuSLgvBXnXJQ3M7
alexkroman
enabled auto-merge (squash)
June 11, 2026 22:57
…ein-4fhc9k # Conflicts: # .claude/hooks/session-start.sh # scripts/check.sh
Parallel pytest-cov runs write .coverage.vm.pid*.* files that are combined and removed on success but linger after an interrupted run, showing up as untracked files that trip commit hooks. https://claude.ai/code/session_01FUszDSwvuSLgvBXnXJQ3M7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidate non-Python tool version pins into a single source of truth (
scripts/gate_tool_pins.sh) shared by both CI and the web session-start hook. This ensures the same tool versions run in all environments and simplifies maintenance. Additionally, enhance the session-start hook to fully provision web containers with all gate dependencies (Go binaries, git history) and improve observability by logging verbose output separately.Key Changes
New
scripts/gate_tool_pins.sh: Single source of truth for markdownlint, prettier, actionlint, and gitleaks versions. Sourced by both.github/workflows/ci.ymland.claude/hooks/session-start.shso version bumps apply everywhere automatically.Enhanced
.claude/hooks/session-start.sh:actionlint,gitleaks) at CI's pinned versions, so web containers enforce the same gates as CI instead of silently skipping themgit fetch --unshallow) to provide merge base withorigin/main, fixing crashes in diff-scoped tail gates (diff-cover, mutation)/tmp/session-start.logto keep hook stdout terse (one line per step) and avoid bloating agent context.claude/settings.jsonto prevent hanging sessionsUpdated
.github/workflows/ci.yml: Sourcescripts/gate_tool_pins.shfor Node and Go tool installations, replacing hardcoded versions.Updated
scripts/check.sh: Add shellcheck linting for the newgate_tool_pins.shand session-start hook with-x --source-path=.flags to follow sourced files.Updated
AGENTS.md: Document that web containers are fully provisioned at session start and explain how to debug provisioning failures via/tmp/session-start.log.Updated
.claude/settings.json: Whitelist additional git and gh commands (git rev-parse,git ls-files,git grep,gh pr diff,gh pr checks,timeout 30 uv run assembly) for agent use.Notable Details
/tmp/session-start.logto keep the hook's stdout clean (one line per step), preventing context bloat in agent sessionshttps://claude.ai/code/session_01FUszDSwvuSLgvBXnXJQ3M7