feat(install): replace install.sh with GitHub Releases installer (autopg-finalize G1) by namastex888 · Pull Request #95 · automagik-dev/autopg

namastex888 · 2026-05-09T03:00:26Z

Summary

Closes G1 of `autopg-distribution-cutover-finalize` (PR #93). Replaces `install.sh` in-place with the new GitHub Releases + cosign-verify body. No additional .sh files; no deprecation banner.

What ships

File	LOC	Change
`install.sh`	74 (≤80 ✓)	Replaced — fetches the signed tarball from GitHub Releases, verifies via `gh attestation verify` (Sigstore Rekor public-good), extracts, runs `pgserve install`. Resolves `PGSERVE_VERSION=latest` via the GitHub releases API. `--dry-run` + `--help` supported.
`README.md`	—	Install section references the single `install.sh` (binary install path on top, npm paths preserved below for development).

Decisions implemented

Per Felipe directive: don't deprecate, replace — single `install.sh`. The npm + pm2 install path is preserved via the existing `pgserve install` CLI verb (operators who want it do `npm install -g pgserve && pgserve install`).

Test plan

`shellcheck install.sh` → clean
`wc -l install.sh` = 74 (≤80)
`bash install.sh --dry-run` on linux-x64 prints the GitHub Releases URL + `gh attestation verify` command without executing
`bash install.sh --help` prints the usage block

Wish update

This overrides Decision #1 of the merged `autopg-distribution-cutover-finalize` wish (which prescribed the 3-file split). A follow-up commit to the wish file updates the decision to match this PR.

🤖 Generated with Claude Code

…ze G1) Closes G1 of `autopg-distribution-cutover-finalize` (PR #93). Splits the install surface into three files: install-autopg.sh (NEW, 74 lines, ≤80 spec ✓): Canonical v2.6+ installer. Detects platform, fetches the signed tarball from GitHub Releases, verifies via `gh attestation verify` (Sigstore Rekor public-good — no private CDN, no custom verifier), extracts, and runs `pgserve install`. Resolves `PGSERVE_VERSION=latest` via the GitHub releases API. `--dry-run` prints what would happen without executing; `--help` / `-h` shows usage. install-pgserve-legacy.sh (RENAMED from install.sh, +banner): The original 123-line npm + pm2 installer, unchanged behavior. Top of file gets a deprecation banner pointing operators at install-autopg.sh; running it prints a one-line stderr deprecation note before proceeding so existing CI doesn't hard-break. install.sh (REPLACED with 13-line shim, ≤15 spec ✓): Tiny shim that prints a stderr deprecation note + the new install URL and exits 0. Operators with bookmarked `curl … | sh` get a clear hint instead of a 404 (which a plain rename would have produced) or a silent break. README.md: Installation section gains the `curl … | bash install-autopg.sh` recommended path on top, with the npm paths preserved below for development. Note explains the gh-CLI dependency and the legacy installer's location. Validation: - shellcheck install.sh install-autopg.sh install-pgserve-legacy.sh: clean - wc -l install.sh = 13 (≤15) - wc -l install-autopg.sh = 74 (≤80) - bash install-autopg.sh --dry-run on linux-x64 prints the expected GitHub Releases URL + `gh attestation verify` command - bash install-autopg.sh --help prints the usage block - bash install.sh prints the deprecation note + new URL on stderr and exits 0 Cohort: G1 of autopg-distribution-cutover-finalize. G2 (pg-query dedup) shipped in PR #94. Wave 1 complete after both merge. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

coderabbitai · 2026-05-09T03:00:35Z

Warning

Rate limit exceeded

@namastex888 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 27 minutes and 7 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6389a295-76f3-42ea-a55a-7021f3a33c6a

📥 Commits

Reviewing files that changed from the base of the PR and between db95305 and 842975d.

📒 Files selected for processing (4)

.genie/wishes/autopg-distribution-cutover-finalize/WISH.md
README.md
install.sh
src/upgrade/steps/binary-cache-flush.js

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/finalize-g1-install

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request introduces a new signed binary installation method via install-autopg.sh, which verifies releases using GitHub attestations. The legacy npm-based installer is deprecated and moved to install-pgserve-legacy.sh, with install.sh converted into a shim. Reviewers identified that the new installation path is not added to the user's PATH, the README contains an incomplete command URL, and the installation process redundantly copies the source tarball to the final directory.

gemini-code-assist · 2026-05-09T03:02:04Z

+echo "[autopg] installing pm2 supervisor"
+"$INSTALL_DIR/bin/pgserve" install
+
+echo "[autopg] done — pgserve@${VERSION} installed under pm2"


The script installs the binary to a versioned directory (~/.local/share/pgserve/...) but does not add this directory to the user's PATH or create a symlink in a common binary directory (like ~/.local/bin). This means that after installation, the pgserve and autopg commands will not be available in the shell as expected by the documentation. Consider adding a symlink or providing instructions to update the PATH.

gemini-code-assist · 2026-05-09T03:02:04Z

+curl -fsSL https://raw.githubusercontent.com/namastexlabs/pgserve/main/install-autopg.sh | bash
+
+# Pinned version
+PGSERVE_VERSION=v2.6.0 curl -fsSL .../install-autopg.sh | bash


The use of ... in the curl command makes the snippet non-functional for users who copy-paste it. It is better to provide the full URL to ensure the documentation is immediately usable.

Suggested change

PGSERVE_VERSION=v2.6.0 curl -fsSL .../install-autopg.sh | bash

PGSERVE_VERSION=v2.6.0 curl -fsSL https://raw.githubusercontent.com/namastexlabs/pgserve/main/install-autopg.sh | bash

gemini-code-assist · 2026-05-09T03:02:04Z

+# `pgserve install` Just Works after extract.
+INSTALL_DIR="$HOME/.local/share/pgserve/${VERSION}"
+mkdir -p "$INSTALL_DIR"
+cp -r "$TMP"/* "$INSTALL_DIR/"


This command copies everything from the temporary directory to the installation directory, which includes the downloaded .tar.gz file. This results in unnecessary disk usage in the user's home directory. Removing the tarball before copying the extracted contents is more efficient.

Suggested change

cp -r "$TMP"/* "$INSTALL_DIR/"

rm "$TMP/$TARBALL" && cp -r "$TMP"/* "$INSTALL_DIR/"

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ade40b76bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-09T03:02:28Z

+  *)              echo "[autopg] unsupported platform: $(uname -s)-$(uname -m)" >&2; exit 1 ;;
+esac
+
+TARBALL="pgserve-${VERSION#v}-${PLATFORM}.tar.gz"


Fetch the release asset name produced by CI

The installer constructs pgserve-${VERSION#v}-${PLATFORM}.tar.gz, but the build/release pipeline publishes autopg-${version}-${platform}.tar.gz artifacts (see scripts/assemble-tarball.sh and .github/workflows/build-tarballs.yml). This makes the generated GitHub Releases URL invalid, so curl -fsSL --output ... "$URL" fails and the canonical installer cannot install anything.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-09T03:02:28Z

+cp -r "$TMP"/* "$INSTALL_DIR/"
+
+echo "[autopg] installing pm2 supervisor"
+"$INSTALL_DIR/bin/pgserve" install


Run the executable path that actually exists after extract

After extraction, the script executes $INSTALL_DIR/bin/pgserve, but the tarball assembly currently packages files under an autopg/ root (tar ... autopg/ in scripts/assemble-tarball.sh), not bin/pgserve. Even with a successful download, this command path does not exist and the install exits with a file-not-found error.

Useful? React with 👍 / 👎.

…installer Felipe directive: don't deprecate, replace. Single install.sh. The earlier shape (3 files: install.sh shim + install-autopg.sh + install-pgserve-legacy.sh) was the wrong tradeoff. Replacing in-place is cleaner — operators with bookmarked `curl … main/install.sh | bash` invocations get the new behavior directly, no migration step. The npm + pm2 install path is preserved via the existing `pgserve install` CLI verb (operators who want it do `npm install -g pgserve && pgserve install`). Changes: - install-autopg.sh: deleted (its body became install.sh). - install-pgserve-legacy.sh: deleted (no legacy file kept). - install.sh: replaced with the GitHub Releases + gh-attestation body. 74 lines (≤80 spec ✓), shellcheck clean, `bash install.sh --dry-run` resolves the latest version via the GitHub releases API and prints the fetch URL + verify command without executing. - README.md: install section references install.sh (no autopg name, no legacy note). Wish-side note: this overrides Decision #1 in the merged autopg-distribution-cutover-finalize wish, which prescribed the 3-file split. Decision needs an update — separate follow-up commit to the wish file. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…e directive

… (PR #95) Felipe directive: no more npm, effective immediately. pgserve update will not rely on npm anymore. Next PR drops npmjs publishing once we prove install + update work without it. Changes: README.md: install section now shows ONLY the binary install path (`curl … main/install.sh | bash` + pinned-version variant). The npm paths (`npx pgserve`, `npm install -g pgserve`, `npm install pgserve`) are removed. Note explicitly states "pgserve no longer depends on npm". src/upgrade/steps/binary-cache-flush.js: when the upgrade flow detects a binary-cache mismatch and the postgres-module download API isn't exposed, the operator hint pointed at `bun install -g @automagik/autopg@latest`. Now points at `curl … main/install.sh | bash` — same outcome, no npm dependency. Detail message updated to "binary refresh needs install.sh rerun (no npm dependency)". What still depends on npm (FOLLOW-UP PR territory): - package.json `bin` entries route through `bin/pgserve-wrapper.cjs` + `bin/autopg-wrapper.cjs`. These work whether the package was installed via npm OR via install.sh's tarball — no change needed. - The release-publish workflow still pushes to npmjs. Felipe's plan: keep that until we've seen install + update work end-to-end without it, then drop npm publishing in a follow-up. Validation: bun test tests/upgrade/ → 3/3 pass; lint clean. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

gemini-code-assist Bot reviewed May 9, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed May 9, 2026

View reviewed changes

namastex888 changed the title ~~feat(install): GitHub Releases installer + legacy shim (autopg-finalize G1)~~ feat(install): replace install.sh with GitHub Releases installer (autopg-finalize G1) May 9, 2026

namastex888 and others added 2 commits May 9, 2026 00:05

docs(wish): G1 → single install.sh (replace, not deprecate) per Felip…

ab4d859

…e directive

namastex888 merged commit a18c849 into main May 9, 2026
9 checks passed

namastex888 deleted the feat/finalize-g1-install branch May 10, 2026 02:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(install): replace install.sh with GitHub Releases installer (autopg-finalize G1)#95

feat(install): replace install.sh with GitHub Releases installer (autopg-finalize G1)#95
namastex888 merged 4 commits into
mainfrom
feat/finalize-g1-install

namastex888 commented May 9, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 9, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 9, 2026

Uh oh!

gemini-code-assist Bot May 9, 2026

Uh oh!

gemini-code-assist Bot May 9, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 9, 2026

Uh oh!

chatgpt-codex-connector Bot May 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	PGSERVE_VERSION=v2.6.0 curl -fsSL .../install-autopg.sh \| bash
	PGSERVE_VERSION=v2.6.0 curl -fsSL https://raw.githubusercontent.com/namastexlabs/pgserve/main/install-autopg.sh \| bash

	cp -r "$TMP"/* "$INSTALL_DIR/"
	rm "$TMP/$TARBALL" && cp -r "$TMP"/* "$INSTALL_DIR/"

Conversation

namastex888 commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What ships

Decisions implemented

Test plan

Wish update

Uh oh!

coderabbitai Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 9, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 9, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 9, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 9, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

namastex888 commented May 9, 2026 •

edited

Loading

coderabbitai Bot commented May 9, 2026 •

edited

Loading