mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 5
56036be2a1
A single anonymous GET for the pinned hadolint binary completed its TLS
handshake and its request, then got a clean FIN with no status line after
3.6s. download_file was a bare urlopen with no retry, and make install-lint
is a prerequisite of autoformat, lint and every lint-* target -- so one shed
socket took down the whole quality gate. The same asset downloaded fine five
times elsewhere in that run, 15s after the failure on another distro.
Retry four times with exponential backoff, catching (OSError, HTTPException).
Two names, not the obvious four: ssl.SSLError is an OSError but NOT a
URLError, so the narrow tuple would have missed it, while OSError subsumes
URLError, ConnectionError, TimeoutError and gaierror in one token.
HTTPException is needed separately because IncompleteRead is not an OSError.
HTTPError is caught FIRST and re-raised immediately for any status outside
{408,429,500,502,503,504}. That ordering is load-bearing -- HTTPError is
itself an OSError, so a broader catch first would swallow it -- and it is
what keeps this robustness rather than masking: a 404 is exactly what a
stale version pin looks like after roles/sys-lint is bumped, and it still
fails on the first attempt with the URL. The final attempt re-raises the
original with its traceback, and write_bytes stays in the else branch so a
full disk is never retried.
apt was the other uncached, unretried input in the same target (its default
Acquire::Retries is 0), so give both invocations -o Acquire::Retries=3,
matching what eight Dockerfiles in this repo already do.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
utils/install
This directory hosts the Python implementation behind make install-lint.
For the general rules that govern READMEs in code directories see documentation.md.
Purpose
The package installs the lint toolchain (actionlint, shfmt, ruff, ansible-lint, mbake, markdownlint-cli2, eslint, shellcheck, ansible-playbook, ansible-galaxy) using the right channel per tool (system package manager, pip, npm, or GitHub release). Modules at this level are channel-agnostic primitives; per-tool policy lives one level down in lint/.
Structure
| File | Role |
|---|---|
primitives.py |
Logging, sudo wrapping, PATH mutation, and stdlib-based URL download. |
pip.py |
Venv-aware pip installer with --break-system-packages and --user fallback. |
npm.py |
Global / local npm install with per-user --prefix fallback. |
github_release.py |
Latest-tag resolver and asset downloader for GitHub releases. |
system_pkg.py |
Per-manager dispatch for pacman / apt-get / dnf / yum / brew. |
lint/ |
One module per tool, each exposing ensure(). See lint README. |
The CLI entry point lives at __main__.py, invoked from lint.sh as python3 -m utils.install.lint.
The matching dispatcher wrapper.sh routes make install-lint host vs container based on INFINITO_LINT_RUNNER.
File Naming
- Module names MUST stay lowercase snake_case.
- Channel-agnostic helpers MUST live directly under
utils/install/. - Per-tool policy (one tool per file) MUST live under
lint/(see lint README). - Test files live in tests/unit/utils/install/ and mirror the module name with a
test_prefix.
Import Rules
primitives.pyMUST NOT import from any other module in this package.pip.py,npm.py,github_release.py, andsystem_pkg.pyMAY import fromprimitives.py.npm.pyMAY import fromsystem_pkg.pyto bootstrap npm itself; no other cross-imports between these four are allowed.- Per-tool modules under
lint/MUST NOT import each other (see lint README).