Skip to content

Self update#271

Open
jai-deepsource wants to merge 9 commits intomasterfrom
self-update
Open

Self update#271
jai-deepsource wants to merge 9 commits intomasterfrom
self-update

Conversation

@jai-deepsource
Copy link
Contributor

No description provided.

- Fetch manifest from CDN on every invocation, download and replace
  binary if a newer version exists
- Verify SHA256 checksum before replacing, extract from tar.gz or zip
- Skip update in dev builds, CI environments, or when auto_update is
  false in config.toml
- Run update check in background goroutine, print notice to stderr
  after command completes
- Add AutoUpdate *bool field to CLIConfig for opt-out
- Phase 1 (CheckForUpdate) fetches manifest and writes state file if newer version exists, with a short 3s timeout to avoid slowing down CLI startup
- Phase 2 (ApplyUpdate) reads state file on next run and applies the update with a 30s timeout
- Removes background goroutine and channel-based approach in favor of synchronous two-phase model
- State file (update.json) is cleared before applying so broken updates don't retry forever
- Adds UpdateState struct and read/write/clear helpers for on-disk persistence
- Adds tests for state file lifecycle, version comparison, download + checksum verification, and no-op when state file is absent
- Extract hardcoded cli.deepsource.com URL into buildinfo.BaseURL so dev builds can point to cli.deepsource.one
- Only skip auto-update for local dev builds (version == "development"), not all dev-mode builds
- Update tests to reflect the new behavior
- Strip pre-release/build suffix (e.g. "44-e888cf0f" → "44") before parsing patch version
- Fixes strconv.Atoi failure when version contains a commit hash
@deepsource-io
Copy link

deepsource-io bot commented Mar 2, 2026

DeepSource Code Review

We reviewed changes in 093ba87...d7d18bc on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade  

Focus Area: Security
Security  

Reliability  

Complexity  

Hygiene  

Coverage  

Code Review Summary

Analyzer Status Updated (UTC) Details
Go Mar 2, 2026 7:38p.m. Review ↗
Secrets Mar 2, 2026 7:38p.m. Review ↗
Test coverage Mar 2, 2026 7:38p.m. Review ↗

Code Coverage Summary

Language Line Coverage (New Code) Line Coverage (Overall)
Aggregate
32.5%
20.8%
[▲ up 1.4% from master]
Go
32.5%
[⤫ below threshold]
20.8%
[▲ up 1.4% from master]
[✓ above threshold]

➟ Additional coverage metrics may have been reported. See full coverage report ↗

return fmt.Errorf("marshaling update state: %w", err)
}
p := updateStatePath()
if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Expect directory permissions to be 0750 or less


Excessive permissions granted when creating a directory. This warning is
triggered whenever permission greater than 0750 is given.

checksum := sha256.Sum256(archive)
checksumHex := hex.EncodeToString(checksum[:])

srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

parameter 'r' seems to be unused, consider removing or renaming it as _


Unused parameters in functions or methods should be replaced with _
(underscore) or removed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant