[CFX-4450] dr self update --version - #788
Conversation
|
🎫 Jira: |
|
/approve-smoke-tests |
|
🔐 Fork PR smoke tests triggered by @taras-pokornyy What happens next:
Warning This PR modifies files under Changed files:
|
|
🔐 Fork smoke tests started by maintainer ⏳ Security scans passed. Running smoke tests... Commit: Warning This PR modifies files under Changed files:
|
|
✅ All smoke tests passed! (Fork PR) ✅ Security Scan: success |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 2b841ea. Configure here.
| uses: arduino/setup-task@c0bc642852239c2689f73f4ea6459c29405f3c52 # v3.0.0 | ||
| with: | ||
| version: 3.x | ||
| version: 3.52.0 |
There was a problem hiding this comment.
Composite action CI not exercised
Low Severity
This PR pins Taskfile to 3.52.0 in the reusable setup composite action. Reusable workflows still pull that action via @main, so this PR’s CI does not exercise the new pin—only post-merge runs will. The change needs a branch-ref CI check or a manual workflow_dispatch verification after merge.
Triggered by project rule: Bugbot Rules for DataRobot CLI
Reviewed by Cursor Bugbot for commit 2b841ea. Configure here.
|
Hi Taras - 1 question before I approve: the rationale lists rollback-for-testing as a motivation, but
should |
| func brewCaskVersionError(targetVersion string) error { | ||
| return fmt.Errorf( | ||
| "dr was installed via Homebrew (dr-cli cask). Homebrew always installs the latest release and cannot pin versions.\n\n"+ | ||
| "To install %s manually, uninstall the cask and run:\n\n"+ |
There was a problem hiding this comment.
maybe "... manually, brew uninstall --cask dr-cli and run`:
| # Update to latest version | ||
| dr self update | ||
|
|
||
| # Install a specific version |
There was a problem hiding this comment.
Appreciate that you made either one available.
| - [dotenv](commands/dotenv.md)—environment variable management with interactive wizard and validation. | ||
| - [completion](commands/completion.md)—shell completion setup (install/uninstall or generate for bash, zsh, fish, PowerShell). | ||
| - [self](commands/self.md)—CLI utility commands (version, update, config, completion, and plugin authoring: add, publish, package). | ||
| - [self](commands/self.md)—CLI utility commands (version, update — including installing a specific released version, config, completion, and plugin authoring: add, publish, package). |
Hey @chasdr ! @ajalon1 , do we want to allow |
|
/approve-smoke-tests |
|
🔐 Fork PR smoke tests triggered by @taras-pokornyy What happens next:
Warning This PR modifies files under Changed files:
|
|
🔐 Fork smoke tests started by maintainer ⏳ Security scans passed. Running smoke tests... Commit: Warning This PR modifies files under Changed files:
|
|
✅ All smoke tests passed! (Fork PR) ✅ Security Scan: success |
@taras-pokornyy discussed in standup, but yes, if we allow |
`version: 3.x` in the three arduino/setup-task call sites floats to whatever go-task/task release GitHub reports as latest on every run. go-task/task cut v3.53.1 on 2026-08-18 but its release assets weren't fully published until ~18 minutes after the tag was created; our build-windows and smoke-test (macos-latest) jobs ran in that window, resolved the brand-new tag, and 404'd downloading its binary: Failed to download version v3.53.1: Unexpected HTTP response: 404 Pin to the exact, already-published 3.52.0 to close the race, matching the project's existing convention of pinning tool versions explicitly (GOLANGCI_LINT_VERSION, LEFTHOOK_VERSION, JSCPD_VERSION, GORELEASER_VERSION in Taskfile.yaml). The action.yaml pin mirrors the fix Taras Pokornyy already landed for that call site in datarobot-oss#788; this extends it to the two other call sites his PR doesn't touch. Ref: CFX-7669 Co-authored-by: Taras Pokornyy <34406052+taras-pokornyy@users.noreply.github.com>
fix(ci): pin arduino/setup-task Task version to 3.52.0 `version: 3.x` in the three arduino/setup-task call sites floats to whatever go-task/task release GitHub reports as latest on every run. go-task/task cut v3.53.1 on 2026-08-18 but its release assets weren't fully published until ~18 minutes after the tag was created; our build-windows and smoke-test (macos-latest) jobs ran in that window, resolved the brand-new tag, and 404'd downloading its binary: Failed to download version v3.53.1: Unexpected HTTP response: 404 Pin to the exact, already-published 3.52.0 to close the race, matching the project's existing convention of pinning tool versions explicitly (GOLANGCI_LINT_VERSION, LEFTHOOK_VERSION, JSCPD_VERSION, GORELEASER_VERSION in Taskfile.yaml). The action.yaml pin mirrors the fix Taras Pokornyy already landed for that call site in #788; this extends it to the two other call sites his PR doesn't touch. Co-authored-by: Taras Pokornyy <34406052+taras-pokornyy@users.noreply.github.com>
| if err := refuseDowngrade(targetVersion); err != nil { | ||
| return err | ||
| } |
There was a problem hiding this comment.
looks like standup landed on letting --force downgrade. this still runs unconditionally, so --force can't get past it. gate it?
| if err := refuseDowngrade(targetVersion); err != nil { | |
| return err | |
| } | |
| if !force { | |
| if err := refuseDowngrade(targetVersion); err != nil { | |
| return err | |
| } | |
| } |
(and the "refuses to install older" line in README + self.md could mention the --force escape hatch)
|
/approve-smoke-tests |
|
🔐 Fork PR smoke tests triggered by @taras-pokornyy What happens next:
Warning This PR modifies files under Changed files:
|
|
🔐 Fork smoke tests started by maintainer ⏳ Security scans passed. Running smoke tests... Commit: Warning This PR modifies files under Changed files:
|
|
✅ All smoke tests passed! (Fork PR) ✅ Security Scan: success |
4 participants
RATIONALE
dr self updatecould only ever install the latest release — there was no way to pin a specific version. This blocks reproducible environments, rollback-for-testing, and matching a specificdrversion to a teammate's or CI's. This change adds a--versionflag with strict validation, refuses downgrades, and hard-errors under Homebrew (which can't pin versions at all).While implementing this, the existing Homebrew-cask detection was found to be macOS-only (
if runtime.GOOS == "darwin"), even though Homebrew ("Linuxbrew") is a documented, supported install method on Linux too (README.md's own "Install via Homebrew / Linuxbrew" section). A Linux user on a brew-managed install would previously fall straight through to the rawcurl | shpath, bypassing brew entirely and getting no protection from the new--version-under-Homebrew guard. This is fixed alongside the main feature.CHANGES
--version <version>flag todr self update(no shorthand, not settable via any env var).normalizeAndValidateVersion: strictvMAJOR.MINOR.PATCHvalidation (optional leadingv, optional-prerelease/+buildsuffix), normalized to av-prefixed form. Uses a regex rather than the semver library's lenient parser, since the ticket's own example ("1.2"→ error) would otherwise silently pass.refuseDowngrade: usesgithub.com/Masterminds/semver/v3to block installing a version older than the one currently running; skipped entirely for non-release ("dev") builds.--versionrequest.tryBrewUpdate, and extended it to run on bothdarwinandlinux(previously darwin-only), consolidated into the singleswitch runtime.GOOS { case "darwin", "linux": ... }dispatch instead of a separate standaloneifblock. Shell detection now only runs when actually needed (previously called unconditionally, even for the brew-handled path and for Windows where it's unused).brewCaskVersionError: hard error returned when--versionis passed butdris installed via the Homebrew cask, with the manualinstall.shcommand to run instead.targetVersioninto the non-brew install paths: appended to thecurl | shinvocation (sh -s -- <version>) and set via$env:VERSION='<version>';before the PowerShell one-liner on Windows — both install scripts already supported pinned versions, this just wires the flag through.PR Automation
Comment-Commands: Trigger CI by commenting on the PR:
/trigger-smoke-testor/trigger-test-smoke- Run smoke tests/trigger-install-testor/trigger-test-install- Run installation testsLabels: Apply labels to trigger workflows:
run-smoke-testsorgo- Run smoke tests on demand (only works for non-forked PRs)Important
For Forked PRs: The
run-smoke-testslabel won't work. A required Smoke Tests check will block merge until a maintainer acts:/approve-smoke-teststo run smoke tests (results will set the check)/skip-smoke-teststo bypass the check without running testsPlease comment requesting a maintainer review if you need smoke tests to run.
Note
Medium Risk
Changes how the CLI replaces itself (brew reinstall and remote install scripts) on user machines; behavior is well-tested but mistakes could break updates or pin the wrong release.
Overview
Adds
--versiontodr self updateso users can install a specific release (vX.Y.ZorX.Y.Z) instead of always taking latest. Versions are validated with a strict MAJOR.MINOR.PATCH regex, normalized to avprefix, and downgrades are refused against the running binary (skipped fordevbuilds). An explicit--versionrequest is no longer blocked by the “already sufficient, skip update” shortcut.Pinned installs are wired into the existing install scripts on Windows (
$env:VERSION) and Unix shell (install.sh -s -- <version>). Homebrew cask installs cannot pin versions;--versionnow returns a guided error with the manualinstall.shcommand.Homebrew self-update logic is refactored into
tryBrewUpdateand extended from macOS-only to macOS and Linux, so Linuxbrew-manageddr-clicask installs usebrew update/reinstallinstead of falling through tocurl | sh. Shell detection runs only when the generic install path is needed.User docs (README,
self, quick reference) and unit tests for validation, downgrade refusal, and the Homebrew pin error are updated. CI pins Taskfile to 3.52.0.Reviewed by Cursor Bugbot for commit 2b841ea. Configure here.