ci: run the Scoop installer as a script file so it still installs after ScoopInstaller/Install#136 - #524
ci: run the Scoop installer as a script file so it still installs after ScoopInstaller/Install#136#524robobun wants to merge 1 commit into
Conversation
…ession ScoopInstaller/Install#136 (2026-08-27) made install.ps1 skip the install flow when it is dot-sourced: the script now only calls Install-Scoop when $MyInvocation.InvocationName is not '.'. GitHub Actions runs a pwsh step by dot-sourcing the step script, so `irm get.scoop.sh | iex` inherits that invocation name, defines the functions and exits without installing. The next step then fails on `scoop config` within a second. Every Preview Build and release build in this repository has failed that way on the windows-11-arm job since 09:48 UTC. Download the installer to a file and run it with the call operator, whose invocation name is the file path, and fail the step if scoop.ps1 is not in the shims directory afterwards.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — straightforward CI hotfix for the upstream Scoop installer's new dot-sourcing guard.
What was reviewed:
- Confirmed the download source (
https://get.scoop.sh) and installer invocation options are unchanged, so no new supply-chain surface is introduced. - Checked that
& $scoopInstallergives the script its file path as$MyInvocation.InvocationName, satisfying the-ne '.'guard added in ScoopInstaller/Install#136. - Verified the new
Test-Pathguard and the unchanged$GITHUB_PATHappend both resolve~\scoop\shimsthe same way, so the fail-fast check matches what the next step actually needs. - Scoped to the
windows-11-armjob only; no other matrix legs or the artifact-publish path are touched.
Extended reasoning...
Overview
This PR modifies a single step ("Install Scoop") in the Windows job of .github/workflows/build-reusable.yml. It replaces the one-line Invoke-RestMethod https://get.scoop.sh | Invoke-Expression with a download-to-temp-file + call-operator invocation, adds a Test-Path guard that throws if ~\scoop\shims\scoop.ps1 is missing after the installer returns, and keeps the existing $GITHUB_PATH append. The change is 1 line removed, 9 lines added (3 of which are an explanatory comment). It addresses an upstream behavior change in ScoopInstaller/Install#136 where the installer now no-ops when dot-sourced — and GitHub Actions dot-sources pwsh step scripts, so iex inherits . as the invocation name.
Security risks
None introduced. The script is still fetched over HTTPS from the same origin (get.scoop.sh) that the workflow already trusted; the only difference is that it lands in $env:RUNNER_TEMP before execution instead of being piped through iex. No new network endpoints, no credentials, no -RunAsAdmin or other privilege changes, and no user- or PR-controlled input flows into the step. The added Test-Path check is purely defensive and reads a fixed path under the runner's home directory.
Level of scrutiny
Low. This is a small, mechanical CI-infrastructure fix with a well-documented root cause and a standard workaround (run the installer as a script file rather than via iex). The Windows job it touches is a single matrix leg (windows-11-arm, Debug), and the change is self-contained within one step. The bug-hunt exited on dry_streak with no findings and no ruled-out candidates. The repository's .github/CODEOWNERS nominally covers /.github, but that file is inherited verbatim from upstream Apple WebKit (Apple copyright header, all upstream WebKit contributors) and does not reflect ownership of Bun-fork-specific CI workflows like build-reusable.yml, which do not exist upstream.
Other factors
The PR description is unusually thorough and matches the diff exactly. The added inline comment documents why the workaround is needed, which will help future maintainers. The fail-fast throw moves the error to the step that caused it rather than the following scoop config call, improving debuggability. Runtime verification is provided by this PR's own Preview Build, which exercises the exact job being fixed.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 5 included reviews per hour; 1 remains after this review. WalkthroughChangesThe Windows ARM64 runner now executes the Scoop installer from a temporary PowerShell script. The workflow verifies the Scoop shim and reports installation failure explicitly. Windows Scoop installation
Merge Risk: ⚪ Minimal · up to The change runs the Scoop installer from a script file and fails fast if installation does not complete, restoring Windows ARM build setup behavior; no actionable merge-blocking risk remains beyond normal checks and review. 🚥 Pre-merge checks | ✅ 3 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (3 passed)
Full details: Description checkExplanation The description clearly explains the CI failure, root cause, fix, validation, and affected workflow. It does not follow the repository template because it omits a bug title, Bugzilla URL or ID, the required review line, and a dedicated changed-file/function list.
Warning Git: CodeRabbit could not clone the repository, so clone-backed analysis was skipped and this review may be incomplete. Verify repository clone access, such as SSH credentials, before requesting another full review. If clone access is intentionally unavailable, use Comment |
Preview Builds
|
|
Runtime check of this fix: the Preview Build of #485 at |
|
#523 (opened at 10:55 UTC) fixes the same break by removing scoop from the job instead of keeping it alive. Two findings from that PR's preview build that apply here as well:
Keeping the installer alive keeps the job dependent on get.scoop.sh, which changed behavior three times in 2026. Since nothing in the job needs scoop, I suggest closing this one in favor of #523. |
|
Superseded by #523, which removed Scoop from the Windows arm64 job instead of fixing the installer call. Closing. |
1 participant
Problem
windows-11-armjob (bun-webkit-windows-arm64-debug) about 7 seconds after it starts: theInstall Scoopstep finishes in 2 seconds instead of 24, and the next step dies onscoop configbecausescoopis not onPATH. Nine runs on nine branches fail the same way, and no preview release gets published because the release job needs every build job.a6210927("refactor!: guard install flow against dot-sourcing", Replace Cygwin-based ICU build with MSBuild on Windows #136, 07:15 UTC today) wraps the install flow inif ($MyInvocation.InvocationName -ne '.'). GitHub Actions runs apwshstep by dot-sourcing the step script, soInvoke-RestMethod -Uri https://get.scoop.sh | Invoke-Expression(build-reusable.yml:260) now inherits.as the invocation name, defines the installer's functions, and returns without installing anything.Fix
get.scoop.shto a file under$env:RUNNER_TEMPand run it with the call operator. A script run as& $pathhas the path as its invocation name, so the guard passes andInstall-Scoopruns, exactly as before the upstream change. No installer option changes (-RunAsAdminis still not passed).scoop\shims\scoop.ps1is missing afterwards, so a silent skip like this one stops at the step that caused it instead of one step later.c64d4147anda6210927in ScoopInstaller/Install are the only changes to it today, and$IS_EXECUTED_FROM_IEX(the only other place that looks at how the script was started) affects just how a failed install exits, which$env:CIalready controls. The Preview Build of this PR is the runtime check: itswindows-11-armjob has to pass.Background
build-reusable.ymlis the shared build matrix behind both the Preview Build workflow (PRs) and the release builds. The Windows arm64 jobs installninjathrough Scoop and LLVM from a release archive.$MyInvocation.InvocationNameis the command name as typed by the caller:.for a dot-sourced script,&for a script block run with the call operator, and the path for& $path.Invoke-Expressionruns its text in the caller's scope, so the text sees the caller's$MyInvocation.