Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 65d7777ff7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| arch=('any') | ||
| url='https://github.com/Doist/todoist-cli' | ||
| license=('MIT') | ||
| depends=('nodejs>=20') |
There was a problem hiding this comment.
This PKGBUILD runs npm in package(), but it only declares nodejs in depends and no makedepends. In Arch clean-chroot builds, only declared deps are installed for the build; because npm is packaged separately, this can fail immediately with npm: command not found. Add npm to makedepends so the packaging step has the required tool.
Useful? React with 👍 / 👎.
| npm install -g \ | ||
| --prefix "${pkgdir}/usr" \ | ||
| --cache "${srcdir}/npm-cache" \ | ||
| "${srcdir}/todoist-cli-${pkgver}.tgz" |
There was a problem hiding this comment.
Running npm install -g on the tarball here causes npm to fetch transitive dependencies during package(), which are not declared in source/checksums and will fail in offline or egress-restricted builders. Since this package has runtime dependencies and no bundled modules, builds become non-reproducible and can break depending on registry access. Package from pre-vendored sources (or otherwise avoid dependency downloads during package()).
Useful? React with 👍 / 👎.
1 participant
Hey there! Not sure if this is the right place to ask, so feel free to close but would be awesome if you could publish the package to AUR.
This PR should add a PKGBUILD (
aur/PKGBUILD) that installstddirectly from the npm registry tarball.This PR only adds the PKGBUILD to the repo (doesn't publish the package). You'd need to create an account on the AUR and submit the package there.