Repository navigation
feat(packages): configure package managers for Depot Packages - #636
jacobwgillespie wants to merge 62 commits into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5db81a80b1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ite, and report other mamba channels
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5bbc5c02d0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…rror, and reject mamba 1
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6aeb2a5c31
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ments on explicit false
Risk: high. Dismissed this automation’s prior approval because Cursor Bugbot reported a new unresolved medium-severity finding on the current head (writeGemSources can drop other gemrc sources). Human review is needed, and no reviewers were assigned.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ebff7241aa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… validate the packages URL
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 52db49966c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 115a077a4c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…d npm config paths
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dbb536f2e1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Risk: high. Dismissing the prior approval because Cursor Bugbot completed on the current head with 1 unresolved finding that needs human review. No reviewers were assigned.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c8efbfa55f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… and keep Helm pass-credentials
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: caa214e5b5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dc2d884c6d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 99bc3cf292
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e4de77bb80
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…oject trust rules
- Check the file type before reading a system file, so a FIFO doesn't block.
- Read the zypper repository file with privileges and report read errors.
- Ignore project tokenHelper entries for pnpm, and on pnpm 11.5.3 and later
ignore project registry and credential entries with ${...} references.
- Use PNPM_CONFIG__AUTH only when pnpm_config__auth is empty.
- Stop when NPM_CONFIG_USERCONFIG is set and the Bun version can't be read.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: defe490b92
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ndler parsing - Write pnpm settings to npmrcAuthFile when the environment or config.yaml selects it, because pnpm then reads it instead of ~/.npmrc. - Skip the .npmrc of an npm workspace member, which npm ignores. - Read Bundler scalar values with Bundler's own quote and comment rules. - Report a failed `bundle config get` instead of treating it as no setting. - Read /etc/apk/repositories through the privileged reader. - Remove Yarn key quotes after the -- prefix. - Treat a Mamba custom multichannel as upstream only when all its channels are.
…skip to .npmrc - Treat exit status 1 with no output from `bundle config get` as an unset key, which is how Bundler 4.0.12 and later report it. - Apply the npm workspace member skip only to the .npmrc check, so the publishConfig note still reads the member's package.json.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 15d058fa7b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…rce safely, and accept Depot Helm aliases in other organizations - Match ** and negated npm workspace patterns when deciding whether npm ignores a member's .npmrc. - Read /etc/apk/repositories through the privileged reader during branch detection and report read errors. - Allow the depot Helm alias to move between organizations on the same Depot Packages server.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5cddc0a4b0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…matching, and Helm and Cargo ordering
- Check the Helm repository file type before running helm repo list.
- Expand {a,b} in npm workspace patterns, and skip a member's .npmrc only
when the member has a package.json.
- Let the Cargo home file's replace-with take precedence over its includes.
- Read the lowercase form of each pnpm path variable first, as pnpm does.
- Reject any tokenHelper in a project .npmrc for pnpm, which refuses to run.
- Reject token helper paths with characters pnpm can't parse.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 62dc01ef69
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…markers, and reject special user config files - Use `npm prefix` to find the one project .npmrc npm reads, instead of matching workspace patterns in setup. - Treat only pnpm-workspace.yaml as a pnpm workspace root. - Reject a user configuration path that isn't a regular file before reading.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0b0f1963d2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…credentials across Depot repositories - Expand ~/ in config.yaml npmrcAuthFile for pnpm 11, which does so, and report relative paths, which pnpm resolves from the current directory. - Parse pnpm_config__auth as JSON, as pnpm does. - Reject unscoped credentials in a pnpm project .npmrc whose registry is the Depot repository, because pnpm applies them to that registry. - Check only the workspace root .npmrc for pnpm 11 and later. - Keep pass_credentials_all when the depot Helm alias moves between Depot repositories. - Read the Cargo home configuration through the regular-file check.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
There are 15 total unresolved issues (including 13 from previous reviews).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 0dcffd4. Configure here.
…st rules to unscoped credentials
- For pnpm 11 and later, check the .npmrc of the nearest directory with
pnpm-workspace.yaml, which can be the project directory itself.
- Skip the unscoped credential check when pnpm ignores the file's registry
because it contains ${...}.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bb174d186f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…n XDG_CONFIG_HOME is set pnpm reads auth.ini in its config directory before the user .npmrc, even when npmrcAuthFile selects another file, so setup now always checks it. Bun reads $XDG_CONFIG_HOME/.bunfig.toml instead of ~/.bunfig.toml when XDG_CONFIG_HOME is set, so setup checks only the file Bun reads.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
There are 14 total unresolved issues (including 13 from previous reviews).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6529aa6. Configure here.
Adds
depot packages configure, which configures a package manager to use a Depot Packages repository, and a hiddendepot packages tokencommand that credential helpers call.Token source:
DEPOT_TOKENwhen set, otherwise thedepot logintoken.Clients
tokenHelper→~/.depot/bin/depot-package-token(printsBearer <token>)~/.npmrc, wrapper scriptcargo:token-from-stdout→depot packages token~/.cargo/config.toml_authToken.npmrc(Bun before 1.4.4 ignoresNPM_CONFIG_USERCONFIGand prefers$XDG_CONFIG_HOME/.npmrcwhen present), mode06000600)depot-<org>_<repository>push keycredentials(mode0600)helm repo add depot --password-stdin,repositories.yamlset to mode0600~/.mamba/auth/authentication.json,$MAMBARC,$CONDARC, or~/.mambarcpixi auth login(keyring or credential file), workspace channels/etc/apt/auth.conf.d/,sources.list.d/*.sources, keyring/etc/yum.repos.d/*.repo(mode0600), metadata key when no--package-key/etc/zypp/credentials.d/,repos.d/,rpm --import/root/.netrc,/etc/apk/repositories, repository key--auth storemakes pnpm and Cargo save a token instead of using the helper. Clients whose default setup needs a Depot plugin (Yarn 2+, pip, uv, Poetry, twine, Maven, Gradle, sbt, NuGet, Terraform, OpenTofu, Composer, conda) are not included.flowchart LR pnpm -->|tokenHelper| wrapper["~/.depot/bin/depot-package-token"] wrapper --> token["depot packages token"] cargo -->|cargo:token-from-stdout| token token --> env{"DEPOT_TOKEN set?"} env -->|yes| out[print token] env -->|no| login["depot login token"] --> outBehavior
[registries.depot]and[source.crates-io]tables. If those are defined in another form, setup stops with an error instead of overwriting them.--replace-upstreamroutes the default public source through the repository: crates.io source replacement, the Bundler mirror, removal ofrubygems.orgfrom gem sources, and replacement of conda-forge and defaults channels. It defaults to true when the repository is that registry's built-in cache.--replace-upstream=false, setup undoes an earlier replacement: it removes the Bundler mirror, addsrubygems.orgback to the gem sources, and addsconda-forgeback to the mamba channels.--scope @acmeand--auth-onlycontrol npm routing, so a publish repository can be added without replacing the install registry.sudo/doasby piping file contents on stdin, so the token is not in argv. The calling user's token is used, not root's login.depotfound onPATHwhen it is the running binary, so Homebrew upgrades do not break the path. Otherwise setup reports the path and says to rerun after upgrades.--package-key, packages are verified with that key only (gpgcheck=1,repo_gpgcheck=0), because dnf and zypper would also trust a listed metadata key for packages. Without it, Depot's metadata signature is verified (repo_gpgcheck=1) and package checks are off, with a notice. Built-in caches require--package-key..npmrc, or a project.cargo/config.toml.DEPOT_PACKAGES_URLoverrideshttps://packages.depot.dev.Known limitations
Unknown user config "tokenHelper"(pnpm) and"always-auth"(Yarn Classic). pnpm readstokenHelperonly from~/.npmrc, and Yarn Classic sends tokens for unscoped packages only withalways-auth.pixi auth loginhas no stdin or environment option and is the only way to write to Pixi's keyring.tokenHelperon whitespace.--auth storeis the alternative..cmdwrapper for pnpm compiles but has not been run on Windows.Note
Medium Risk
The command persists API tokens and edits system package-manager configuration (including via sudo), so misconfiguration or precedence bugs could leak credentials or break installs, though validation and atomic file writes mitigate much of that risk.
Overview
Adds
depot packageswithconfigureand a hiddentokenhelper so users can point many package managers at a Depot Packages repository (--org,--repository, plus client-specific flags like--scope,--replace-upstream,--suite,--path).depot packages configureresolves the token fromDEPOT_TOKENordepot login, builds repository URLs (overridable viaDEPOT_PACKAGES_URL), and writes only managed settings while preserving unrelated config. pnpm and Cargo default to credential helpers (~/.depot/bin/depot-package-tokenanddepot packages token); other clients store tokens in their own files. Linux system clients (apt, dnf/yum/zypper, apk) install keys, auth, and repo entries via privileged writes without putting the token on the command line.The implementation includes extensive pre-flight checks (env overrides, project
.npmrc/.cargoconfigs, pnpm/Bun/Yarn/Bundler/mamba edge cases) and optional upstream replacement for built-in caches (crates.io, rubygems.org, conda-forge, etc.). README documents the command and flags;go-toml/v2is a direct dependency for Cargo TOML editing; a largeconfigure_testsuite covers parsers and write behavior.Reviewed by Cursor Bugbot for commit 6529aa6. Bugbot is set up for automated code reviews on this repo. Configure here.