fix: install the downloaded decaf binary to a directory, not CWD by levibostian · Pull Request #121 · levibostian/decaf

levibostian · 2026-01-06T16:08:04Z

Summary

Updated the install script to follow XDG Base Directory standards by installing the binary to ~/.local/bin instead of the current working directory.

Why? In some of my projects where I push code to jsr, the jsr publish command will fail unless I add --allow-dirty to the command. I dont like doing this, the binary should be put somewhere else honestly.

Changes Made

Install script (install):
- Changed installation directory from ./ to ~/.local/bin
- Added automatic creation of ~/.local/bin if it doesn't exist
- Updated success message to show where the binary was installed
CI workflow (.github/workflows/tests.yml):
- Added new test-install-script job to verify the install script works
- Tests that the binary is created in the correct location
- Tests that the binary is executable
- Verifies the binary can run via PATH (decaf --help)

Why These Changes

The install script is designed for CI environments where:

Running as root/sudo is not desired or available
Binaries need to be in a standard location that's typically in PATH
Following common best practices used by tools like rustup, cargo-binstall, and pipx

Installing to ~/.local/bin provides:

No sudo required
Standard XDG Base Directory location
Already in PATH on most modern Linux distributions
Easy cleanup (just delete the binary)
Isolated from system binaries

This PR was written using Vibe Kanban

…actice of installing to `~/.local/bin`. Here's what changed: ## Changes Made 1. **Installation directory**: Changed from `./` (current directory) to `~/.local/bin` - This is the standard XDG Base Directory location for user binaries - Commonly used by Rust tools, Go tools, and many other projects - Already in PATH on most modern Linux distributions and can be easily added on others 2. **Directory creation**: Added `mkdir -p "$INSTALL_DIR"` to ensure the directory exists 3. **PATH checking**: Added helpful feedback that checks if `~/.local/bin` is in the PATH: - If it's already in PATH, users can run `decaf` directly - If not, provides clear instructions on how to add it or run the binary directly 4. **Better output**: Updated the success message to show the full installation path ## Why `~/.local/bin`? This is the standard choice for CI servers and user installations because: - ✅ No sudo required - ✅ Follows XDG Base Directory specification - ✅ Already in PATH on most modern systems (Ubuntu 18.04+, Fedora, etc.) - ✅ Used by major projects like `pipx`, `cargo-binstall`, and many others - ✅ Isolated from system binaries, making it safe for CI environments - ✅ Easy to clean up (just delete `~/.local/bin/decaf`) The script will work perfectly in CI environments since CI runners typically have `~/.local/bin` in their PATH by default.

…ovided instructions. The script is now more minimal - it just installs the binary to `~/.local/bin` and reports where it was installed (install:41).

…kflow. Here's what it does: 1. **Checks out the repository** - Gets the code including the install script 2. **Runs the install script** - Executes `bash install v0.0.1` to test installing a specific version 3. **Verifies the binary** - Checks that: - The file exists at `~/.local/bin/decaf` - The file is executable This is a quick, simple test that validates the core functionality of the install script - that it downloads the binary and places it in the correct location (`~/.local/bin`) with the right permissions. The test runs on `ubuntu-latest` which is sufficient for a basic smoke test.

1. Run `./install` without any arguments (which will install the latest release) 2. Added `"$HOME/.local/bin/decaf" --help` to verify the binary runs successfully The test now checks that: - The file exists at `~/.local/bin/decaf` - The file is executable - The binary can be executed and responds to `--help`

1. Export `$HOME/.local/bin` to the PATH (in case it's not already there) 2. Run just `decaf --help` (not the full path) This ensures we're testing that the binary can be executed via PATH, which is what users would do in practice (.github/workflows/tests.yml:60).

github-actions · 2026-01-06T16:08:20Z

decaf

Running deployments in test mode. Results will appear below.
If this pull request and all of it's parent pull requests are merged using the...

...🟩 squash 🟩 merge method... 🚢 The next version of the project will be: 0.9.1

Learn more

Latest release: 0.9.0
Commit of latest release: ec7c774

Commits since last release:
- fix: install the downloaded decaf binary to a directory, not CWD

Summary

Updated the install script to follow XDG Base Directory standards by installing the binary to ~/.local/bin instead of the current working directory.

Why? In some of my projects where I push code to jsr, the jsr publish command will fail unless I add --allow-dirty to the command. I dont like doing this, the binary should be put somewhere else honestly.

Changes Made

Install script (install):
- Changed installation directory from ./ to ~/.local/bin
- Added automatic creation of ~/.local/bin if it doesn't exist
- Updated success message to show where the binary was installed
CI workflow (.github/workflows/tests.yml):
- Added new test-install-script job to verify the install script works
- Tests that the binary is created in the correct location
- Tests that the binary is executable
- Verifies the binary can run via PATH (decaf --help)

Why These Changes

The install script is designed for CI environments where:

Running as root/sudo is not desired or available
Binaries need to be in a standard location that's typically in PATH
Following common best practices used by tools like rustup, cargo-binstall, and pipx

Installing to ~/.local/bin provides:

No sudo required
Standard XDG Base Directory location
Already in PATH on most modern Linux distributions
Easy cleanup (just delete the binary)
Isolated from system binaries

This PR was written using Vibe Kanban
- ci: fix code scanning warnings for github action workflow files (#122)

I enabled code scanning recently. I got some warnings. This change
should silence them.
- refactor: update deno from 2.5 to 2.6 (#116)

I used to have this project setup so it would always use the latest
version of deno on the CI. but a couple times I would find bugs in deno
release so the CI would fail and block the PR.

This PR does...

uses asdf for setting a hard-coded version of deno to use. share same
stable version on CI and locally. renovatebot updates this file for us.
Wait to merge this PR until a stable version of 2.6 is out. 2.6.4 just
came out and has a bug fix for us.
- chore(deps): update granodigital/report-annotate action to v3.1.1 (chore(deps): update granodigital/report-annotate action to v3.1.1 #120)

This PR contains the following updates:

Package	Type	Update	Change

Release Notes

granodigital/report-annotate (granodigital/report-annotate)

v3.1.1

Compare
Source

Full Changelog:
granodigital/report-annotate@v3.1.0...v3.1.1

v3.1.0

Compare
Source

Full Changelog:
granodigital/report-annotate@v3.0.1...v3.1.0

v3.0.1

Compare
Source

What's Changed

Fixed

Improved PR comment formatting with clickable file links when
annotations are skipped
Added validation for invalid report format configuration
Added error handling for malformed YAML config files
Added error handling for invalid custom-matchers JSON input
Skip annotations with empty messages to avoid creating blank
annotations
Improved error messages and handling in XML report parsing
Ensure all annotations have a start line for proper GitHub display
Added test coverage for invalid YAML config parsing error handling
Excluded untestable xpath fallback code from coverage reporting

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone
America/Chicago, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update
again.

If you want to rebase/retry this PR, check
this box

This PR was generated by Mend Renovate.
View the repository job
log.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
- chore(deps): update dependency deno to v2.6.3 (#119)

This PR contains the following updates:

| Package | Change |
Age |
Confidence |
|---|---|---|---|
| deno
(source) | v2.5.6 ->
2.6.3 |

|

|

Release Notes

denoland/deno (deno)

v2.6.3

Compare
Source

fix(check): improve node types handling
Revert "fix(ext/node): stub out Module.register and
Module.registerHooks"

(#31684)

v2.6.2

Compare
Source

feat(unstable): add sandbox subcommand
(#31568)
fix(audit): fix deserde for transitive npm audit actions
(#31671)
fix(check): handle workspace members having different jsx import
sources and
importing each other
(#31654)
fix(check): regression with tsgo and node globals
(#31621)
fix(cli): deno tunnel when token storage isn't working or without
deno.json

(#31584)

fix(compile): ensure temp dir exists during x64 codesign
(#31672)
fix(ext/node): sqlite:backup compatibility
(#31610)
fix(ext/node): add error handling functions and tests for UV bindings
(#31639)
fix(ext/node): avoid env permission for TERM in console and readline
(#31638)
fix(ext/node): fix hot loop in setImmediate with a pending timer
(#31643)
fix(ext/node): stub out Module.register and Module.registerHooks
(#31666)
fix(ext/node): support named pipe listen, connect and open
(#31624)
fix(ext/telemetry): otel baggage propagation
(#31620)
fix(fetch): fix SOCKS5 proxy URL validation logic
(#31604)
fix(flags): implement a better sandbox subcommand
(#31657)
fix(inspector): worker debugging support via CDP
(#31527)
fix(x): cache on demand when running, resolve packages with only one
binary,
don't fail on node-gyp if not present
(#31619)
fix(x): fix shim script when use custom alias name, re-enable alias
tests

(#31653)

fix: panic on dropped inspector session
(#31658)
fix: update glob implementation to match with latest node
(#31627)

v2.6.1

Compare
Source

feat(unstable): deploy config allow app to be optional
(#31567)
fix(add): include type-only imports when building graph
(#31552)
fix(cli): add streams as transferable types
(#31586)
fix(compile): intel mac compile fix
(#31575)
fix(compile): sentinal conflict with strtab on intel mac
(#31587)
fix(ext/node): DatabaseSync compatibility
(#31515)
fix(x): correct alias deno command location for Windows
(#31573)
fix(x): fix executing native binary on windows + some cleanup
(#31551)
fix: --preload and --require flags only available in runtime
subcommands

(#31614)

fix: adjust deno_cache version
(#31553)
fix: source map file names to non-existent paths
(#31564)

v2.6.0

Compare
Source

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone
America/Chicago, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update
again.

If you want to rebase/retry this PR, check
this box

This PR was generated by Mend Renovate.
View the repository job
log.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
- chore(deps): update granodigital/report-annotate action to v3

...🟩 rebase 🟩 merge method... 🌴 It will not trigger a deployment. No new version will be deployed.

Learn more

Latest release: 0.9.0
Commit of latest release: ec7c774

Commits since last release:
- Done! I've updated the test to use `which decaf` instead of `decaf --help`. The `which` command will verify that the `decaf` binary is available in the PATH (.github/workflows/tests.yml:57).
- Done! The test now only runs `decaf --help` directly, which will verify that the binary is in the PATH (.github/workflows/tests.yml:56).
- Done! I've simplified the test to only run `decaf --help` after adding `~/.local/bin` to PATH. The test file checks have been removed as requested (.github/workflows/tests.yml:57-60).
- Perfect! I've updated the test to: 1. Export `$HOME/.local/bin` to the PATH (in case it's not already there) 2. Run just `decaf --help` (not the full path)

This ensures we're testing that the binary can be executed via PATH, which is what users would do in practice (.github/workflows/tests.yml:60).
- Done! I've updated the test job to:

Run ./install without any arguments (which will install the latest release)
Added "$HOME/.local/bin/decaf" --help to verify the binary runs successfully

The test now checks that:

The file exists at ~/.local/bin/decaf
The file is executable
The binary can be executed and responds to --help
- Perfect! I've added a new job called test-install-script to the workflow. Here's what it does:

Checks out the repository - Gets the code including the install script
Runs the install script - Executes bash install v0.0.1 to test installing a specific version
Verifies the binary - Checks that:
- The file exists at ~/.local/bin/decaf
- The file is executable

This is a quick, simple test that validates the core functionality of the install script - that it downloads the binary and places it in the correct location (~/.local/bin) with the right permissions. The test runs on ubuntu-latest which is sufficient for a basic smoke test.
- Done! I've removed the extra echo statements that checked PATH and provided instructions. The script is now more minimal - it just installs the binary to ~/.local/bin and reports where it was installed (install:41).
- Perfect! I've updated the install script to follow the common best practice of installing to ~/.local/bin. Here's what changed:

Changes Made

Installation directory: Changed from ./ (current directory) to ~/.local/bin
- This is the standard XDG Base Directory location for user binaries
- Commonly used by Rust tools, Go tools, and many other projects
- Already in PATH on most modern Linux distributions and can be easily added on others
Directory creation: Added mkdir -p "$INSTALL_DIR" to ensure the directory exists
PATH checking: Added helpful feedback that checks if ~/.local/bin is in the PATH:
- If it's already in PATH, users can run decaf directly
- If not, provides clear instructions on how to add it or run the binary directly
Better output: Updated the success message to show the full installation path

Why `~/.local/bin`?

This is the standard choice for CI servers and user installations because:

✅ No sudo required
✅ Follows XDG Base Directory specification
✅ Already in PATH on most modern systems (Ubuntu 18.04+, Fedora, etc.)
✅ Used by major projects like pipx, cargo-binstall, and many others
✅ Isolated from system binaries, making it safe for CI environments
✅ Easy to clean up (just delete ~/.local/bin/decaf)

The script will work perfectly in CI environments since CI runners typically have ~/.local/bin in their PATH by default.
- ci: fix code scanning warnings for github action workflow files (#122)

I enabled code scanning recently. I got some warnings. This change
should silence them.
- refactor: update deno from 2.5 to 2.6 (#116)

I used to have this project setup so it would always use the latest
version of deno on the CI. but a couple times I would find bugs in deno
release so the CI would fail and block the PR.

This PR does...

uses asdf for setting a hard-coded version of deno to use. share same
stable version on CI and locally. renovatebot updates this file for us.
Wait to merge this PR until a stable version of 2.6 is out. 2.6.4 just
came out and has a bug fix for us.
- chore(deps): update granodigital/report-annotate action to v3.1.1 (chore(deps): update granodigital/report-annotate action to v3.1.1 #120)

This PR contains the following updates:

Package	Type	Update	Change

Release Notes

granodigital/report-annotate (granodigital/report-annotate)

v3.1.1

Compare
Source

Full Changelog:
granodigital/report-annotate@v3.1.0...v3.1.1

v3.1.0

Compare
Source

Full Changelog:
granodigital/report-annotate@v3.0.1...v3.1.0

v3.0.1

Compare
Source

What's Changed

Fixed

Improved PR comment formatting with clickable file links when
annotations are skipped
Added validation for invalid report format configuration
Added error handling for malformed YAML config files
Added error handling for invalid custom-matchers JSON input
Skip annotations with empty messages to avoid creating blank
annotations
Improved error messages and handling in XML report parsing
Ensure all annotations have a start line for proper GitHub display
Added test coverage for invalid YAML config parsing error handling
Excluded untestable xpath fallback code from coverage reporting

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone
America/Chicago, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update
again.

If you want to rebase/retry this PR, check
this box

This PR was generated by Mend Renovate.
View the repository job
log.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
- chore(deps): update dependency deno to v2.6.3 (#119)

This PR contains the following updates:

| Package | Change |
Age |
Confidence |
|---|---|---|---|
| deno
(source) | v2.5.6 ->
2.6.3 |

|

|

Release Notes

denoland/deno (deno)

v2.6.3

Compare
Source

fix(check): improve node types handling
Revert "fix(ext/node): stub out Module.register and
Module.registerHooks"

(#31684)

v2.6.2

Compare
Source

feat(unstable): add sandbox subcommand
(#31568)
fix(audit): fix deserde for transitive npm audit actions
(#31671)
fix(check): handle workspace members having different jsx import
sources and
importing each other
(#31654)
fix(check): regression with tsgo and node globals
(#31621)
fix(cli): deno tunnel when token storage isn't working or without
deno.json

(#31584)

fix(compile): ensure temp dir exists during x64 codesign
(#31672)
fix(ext/node): sqlite:backup compatibility
(#31610)
fix(ext/node): add error handling functions and tests for UV bindings
(#31639)
fix(ext/node): avoid env permission for TERM in console and readline
(#31638)
fix(ext/node): fix hot loop in setImmediate with a pending timer
(#31643)
fix(ext/node): stub out Module.register and Module.registerHooks
(#31666)
fix(ext/node): support named pipe listen, connect and open
(#31624)
fix(ext/telemetry): otel baggage propagation
(#31620)
fix(fetch): fix SOCKS5 proxy URL validation logic
(#31604)
fix(flags): implement a better sandbox subcommand
(#31657)
fix(inspector): worker debugging support via CDP
(#31527)
fix(x): cache on demand when running, resolve packages with only one
binary,
don't fail on node-gyp if not present
(#31619)
fix(x): fix shim script when use custom alias name, re-enable alias
tests

(#31653)

fix: panic on dropped inspector session
(#31658)
fix: update glob implementation to match with latest node
(#31627)

v2.6.1

Compare
Source

feat(unstable): deploy config allow app to be optional
(#31567)
fix(add): include type-only imports when building graph
(#31552)
fix(cli): add streams as transferable types
(#31586)
fix(compile): intel mac compile fix
(#31575)
fix(compile): sentinal conflict with strtab on intel mac
(#31587)
fix(ext/node): DatabaseSync compatibility
(#31515)
fix(x): correct alias deno command location for Windows
(#31573)
fix(x): fix executing native binary on windows + some cleanup
(#31551)
fix: --preload and --require flags only available in runtime
subcommands

(#31614)

fix: adjust deno_cache version
(#31553)
fix: source map file names to non-existent paths
(#31564)

v2.6.0

Compare
Source

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone
America/Chicago, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update
again.

If you want to rebase/retry this PR, check
this box

This PR was generated by Mend Renovate.
View the repository job
log.

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
- chore(deps): update granodigital/report-annotate action to v3

.github/workflows/tests.yml

coveralls · 2026-01-06T16:09:34Z

Pull Request Test Coverage Report for Build 20782915410

Details

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 80.806%

Totals
Change from base Build 20755812787:	0.0%
Covered Lines:	1235
Relevant Lines:	1564

💛 - Coveralls

…g `~/.local/bin` to PATH. The test file checks have been removed as requested (.github/workflows/tests.yml:57-60).

…fy that the binary is in the PATH (.github/workflows/tests.yml:56).

.github/workflows/tests.yml

…help`. The `which` command will verify that the `decaf` binary is available in the PATH (.github/workflows/tests.yml:57).

.github/workflows/tests.yml

+  test-install-script:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+
+    - name: Run install script
+      run: ./install
+
+    - name: Verify binary was installed


In general, the fix is to add an explicit permissions: block that sets the minimal required GITHUB_TOKEN scopes. Because none of the steps in the workflow interacts with the GitHub API in a way that needs write access (they only checkout code, run Deno commands locally, upload artifacts, and send coverage to Coveralls), we can safely set contents: read and leave everything else at the default of none. This should be added at the workflow root so it applies to both jobs.

The single best fix without changing functionality is to add a top‑level permissions: block right after the on: declaration. This ensures both test and test-install-script jobs inherit contents: read, and no job gets unnecessary write permissions. No imports or additional methods are needed; this is purely a YAML configuration change inside .github/workflows/tests.yml.

Concretely:

Edit .github/workflows/tests.yml.

Insert:

permissions: contents: read

between line 1 (on: [push, pull_request]) and line 3 (jobs:), preserving indentation (top-level).

levibostian added 5 commits January 6, 2026 09:50

Done! I've removed the extra echo statements that checked PATH and pr…

b58c9b7

…ovided instructions. The script is now more minimal - it just installs the binary to `~/.local/bin` and reports where it was installed (install:41).

levibostian changed the title ~~update the install script so that we dont put the downloaded binary in the cwd, but somewhere else. (vibe-kanban)~~ Install binary to ~/.local/bin instead of current directory (Vibe Kanban) Jan 6, 2026

github-advanced-security bot found potential problems Jan 6, 2026

View reviewed changes

.github/workflows/tests.yml Fixed Show fixed Hide fixed

levibostian changed the title ~~Install binary to ~/.local/bin instead of current directory (Vibe Kanban)~~ fix: install the downloaded decaf binary to a directory, not CWD Jan 6, 2026

levibostian added 2 commits January 6, 2026 10:12

Done! I've simplified the test to only run decaf --help after addin…

13e4bfc

…g `~/.local/bin` to PATH. The test file checks have been removed as requested (.github/workflows/tests.yml:57-60).

Done! The test now only runs decaf --help directly, which will veri…

868810b

…fy that the binary is in the PATH (.github/workflows/tests.yml:56).

github-advanced-security bot found potential problems Jan 6, 2026

View reviewed changes

.github/workflows/tests.yml Fixed Show fixed Hide fixed

Done! I've updated the test to use which decaf instead of `decaf --…

9f5a5e8

…help`. The `which` command will verify that the `decaf` binary is available in the PATH (.github/workflows/tests.yml:57).

levibostian force-pushed the vk/3f53-update-the-insta branch from 26c0691 to 9f5a5e8 Compare January 7, 2026 13:22

github-advanced-security bot found potential problems Jan 7, 2026

View reviewed changes

levibostian merged commit 2e7f982 into main Jan 7, 2026
11 checks passed

levibostian deleted the vk/3f53-update-the-insta branch January 7, 2026 13:24

@@ -1,5 +1,8 @@
             on: [push, pull_request]
+            permissions:
+              contents: read
             jobs:
               test:
                 runs-on: ubuntu-latest

Conversation

levibostian commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes Made

Why These Changes

Uh oh!

github-actions bot commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

decaf

Summary

Changes Made

Why These Changes

Release Notes

What's Changed

Fixed

Configuration

Release Notes

Configuration

Changes Made

Why ~/.local/bin?

Release Notes

What's Changed

Fixed

Configuration

Release Notes

Configuration

Uh oh!

Uh oh!

coveralls commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 20782915410

Details

💛 - Coveralls

Uh oh!

Uh oh!

Check warning

Copilot Autofix

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

levibostian commented Jan 6, 2026 •

edited

Loading

github-actions bot commented Jan 6, 2026 •

edited

Loading

Why `~/.local/bin`?

coveralls commented Jan 6, 2026 •

edited

Loading