feat: add VS Code installation script following spilled coffee principle#1275
feat: add VS Code installation script following spilled coffee principle#1275atxtechbro wants to merge 2 commits intomainfrom
Conversation
- Create utils/install-vscode.sh for automated VS Code installation - Support both Linux (apt/dnf/pacman/snap) and macOS (brew) platforms - Follow existing installer patterns with logging.sh integration - Detect existing installations and handle gracefully - Use official Microsoft repositories for Linux distributions - Ensure idempotent operation (safe to run multiple times) This enables `code .` command for read-only code browsing while maintaining the primary tmux + Claude Code workflow for OSE principle adherence. Closes #1274
|
⏳ Code review in progress. Analyzing for code quality issues and best practices. Detailed findings will be posted upon completion. Using Amazon Q Developer for GitHubAmazon Q Developer1 is an AI-powered assistant that integrates directly into your GitHub workflow, enhancing your development process with intelligent features for code development, review, and transformation. Slash Commands
FeaturesAgentic Chat Code Review CustomizationYou can create project-specific rules for Amazon Q Developer to follow:
Example rule: FeedbackTo provide feedback on Amazon Q Developer, create an issue in the Amazon Q Developer public repository. For more detailed information, visit the Amazon Q for GitHub documentation. Footnotes
|
- Add VS Code installation to setup.sh automation - Place after tmux setup (logical grouping with development tools) - Mark as optional with clear messaging about its purpose - Follows spilled coffee principle: now fully automated Without this, the install script existed but was never called, violating the core automation principle.
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
Thank you for adding the VS Code installation script. The implementation is well-structured and follows the repository's patterns. However, there are several important areas that need attention:
- Security: The GPG key handling needs to be more secure using proper temporary file management
- Error Handling: Additional error checking is needed for dependency installation and downloads
- Cleanup: A trap handler should be added to ensure proper cleanup on script interruption
- Version Verification: The version check could be more robust with format validation
The changes are generally well-documented and the multi-platform support is comprehensive. Please address the security concerns as a priority before merging.
| elif [[ "$OSTYPE" == "linux-gnu"* ]]; then | ||
| # Linux installation using official Microsoft repository | ||
| if command -v apt &> /dev/null; then | ||
| # Ubuntu/Debian/Linux Mint | ||
| log_info "Using apt with Microsoft repository..." | ||
|
|
||
| # Install dependencies | ||
| sudo apt-get update | ||
| sudo apt-get install -y wget gpg apt-transport-https |
There was a problem hiding this comment.
🛑 [Security Vulnerability]: The GPG key is downloaded and stored in an insecure manner. The temporary file is created in the current directory and could be tampered with before being installed1. Consider using a secure temporary directory with proper permissions.
| elif [[ "$OSTYPE" == "linux-gnu"* ]]; then | |
| # Linux installation using official Microsoft repository | |
| if command -v apt &> /dev/null; then | |
| # Ubuntu/Debian/Linux Mint | |
| log_info "Using apt with Microsoft repository..." | |
| # Install dependencies | |
| sudo apt-get update | |
| sudo apt-get install -y wget gpg apt-transport-https | |
| # Add Microsoft GPG key using mktemp for secure temporary file handling | |
| TEMP_GPG=$(mktemp) | |
| wget -qO "$TEMP_GPG" | |
| gpg --dearmor < "$TEMP_GPG" > "${TEMP_GPG}.gpg" | |
| sudo install -D -o root -g root -m 644 "${TEMP_GPG}.gpg" /etc/apt/keyrings/packages.microsoft.gpg | |
| rm -f "$TEMP_GPG" "${TEMP_GPG}.gpg" |
Footnotes
-
CWE-379: Creation of Temporary File in Directory with Insecure Permissions - https://cwe.mitre.org/data/definitions/379.html ↩
| return 1 | ||
| fi | ||
|
|
||
| elif [[ "$OSTYPE" == "linux-gnu"* ]]; then |
There was a problem hiding this comment.
The wget command should include error handling to detect and handle download failures. This could lead to installation proceeding with an invalid or incomplete GPG key.
| source "${SCRIPT_DIR}/logging.sh" | ||
|
|
There was a problem hiding this comment.
Consider adding a trap to handle script interruption and cleanup any temporary files. This ensures proper cleanup even if the script is interrupted.
| source "${SCRIPT_DIR}/logging.sh" | |
| # Setup cleanup trap | |
| cleanup() { | |
| rm -f packages.microsoft.gpg "${TEMP_GPG:-}" "${TEMP_GPG:-}.gpg" 2>/dev/null | |
| } | |
| trap cleanup EXIT | |
| log_info "Installing VS Code..." |
| else | ||
| log_error "Homebrew not found" | ||
| return 1 |
There was a problem hiding this comment.
The dependency installation should include error checking. If the package manager fails to install dependencies, the script continues without proper error handling.
| else | |
| log_error "Homebrew not found" | |
| return 1 | |
| # Install dependencies | |
| if ! sudo apt-get update; then | |
| log_error "Failed to update package lists" | |
| return 1 | |
| fi | |
| if ! sudo apt-get install -y wget gpg apt-transport-https; then | |
| log_error "Failed to install required dependencies" | |
| return 1 | |
| fi |
|
|
||
| else |
There was a problem hiding this comment.
The version verification could be more robust. Consider adding a minimum version check to ensure compatibility with the dotfiles setup.
| else | |
| # Verify installation and version | |
| if command -v code &> /dev/null; then | |
| NEW_VERSION=$(code --version 2>/dev/null | head -n1) | |
| if [[ -z "$NEW_VERSION" ]]; then | |
| log_error "Failed to get VS Code version" | |
| return 1 | |
| fi | |
| # Compare version (optional: adjust minimum version as needed) | |
| if ! echo "$NEW_VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then | |
| log_error "Invalid version format: $NEW_VERSION" | |
| return 1 | |
| fi | |
| log_success "VS Code installed successfully: $NEW_VERSION" | |
| log_info "You can now use 'code .' to open VS Code in the current directory" | |
| return 0 |
1 participant
Summary
utils/install-vscode.shfor automated VS Code installationImplementation Details
Testing
Definition of Done
✅
utils/install-vscode.shscript created✅ Script handles multiple platforms (Linux/macOS)
✅ Script detects existing installations
✅
code .command will work after installation✅ Script follows existing logging patterns
✅ Script is idempotent
Closes #1274