feat: auto-install Solana dev skill for AI coding agents #34
feat: auto-install Solana dev skill for AI coding agents #34Dargon789 merged 7 commits intoDargon789:mainfrom
Conversation
* feat: auto-install Solana dev skill for AI coding agents Runs `npx skills add` during scaffolding to install the solana-dev-skill for all supported AI agents (Claude Code, Codex, Cursor, etc.). Non-fatal if it fails. * feat: install all skills but not all agents
* chore: update CI flow * fix: restore + fix flow
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
chore: bump version to 4.8.3
fix: warn msg
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
|
@lgalabru is attempting to deploy a commit to the Foundry development Team on Vercel. A member of the Team first needs to authorize it. |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Reviewer's GuideRefactors CI workflows into reusable TypeScript build/test/publish pipelines, simplifies versioning to changesets-only with GitHub permissions, and adds an optional post-init task that auto-installs the Solana dev skill for AI coding agents when creating a new app. Sequence diagram for Solana dev skill auto-install during app creationsequenceDiagram
actor Developer
participant CLI
participant CreateApp
participant InstallDevSkillTask
participant ExecAndWait
Developer->>CLI: run npx create-solana-dapp
CLI->>CreateApp: createApp(args)
CreateApp->>InstallDevSkillTask: createAppTaskInstallDevSkill(args)
InstallDevSkillTask->>InstallDevSkillTask: enabled = !args.skipInstall
alt install enabled
InstallDevSkillTask->>ExecAndWait: execAndWait("npx -y skills add solana-dev-skill ...", args.targetDirectory)
ExecAndWait-->>InstallDevSkillTask: success or error
alt success
InstallDevSkillTask-->>CreateApp: result(message: Installed Solana dev skill)
else error
InstallDevSkillTask-->>CreateApp: result(message: Skipped Solana dev skill installation)
end
else install skipped
InstallDevSkillTask-->>CreateApp: skipped (skipInstall true)
end
Class diagram for createAppTaskInstallDevSkill and related typesclassDiagram
class GetArgsResult {
+boolean skipInstall
+boolean verbose
+string targetDirectory
}
class Task {
+boolean enabled
+function task(result)
+string title
}
class CreateAppTaskInstallDevSkillModule {
+createAppTaskInstallDevSkill(args)
}
class ExecAndWaitModule {
+execAndWait(command, cwd)
}
class ClackLogModule {
+log_warn(message)
+log_error(message)
}
GetArgsResult --> CreateAppTaskInstallDevSkillModule : parameter
CreateAppTaskInstallDevSkillModule ..> Task : returns
CreateAppTaskInstallDevSkillModule ..> ExecAndWaitModule : uses
CreateAppTaskInstallDevSkillModule ..> ClackLogModule : logs
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the Highlights
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- The Solana dev skill install step is tightly coupled to
skipInstall; if users want to skip dependency installs but still add (or explicitly opt out of) the dev skill, consider introducing a separate flag or environment-based toggle so these behaviors can be controlled independently. - The hard-coded
npx -y skills add https://github.com/solana-foundation/solana-dev-skill --skill "*" -ycommand increateAppTaskInstallDevSkillcould be made more maintainable by extracting the URL/skill spec into a constant or configuration so it’s easier to update or override (e.g., for forks or testing). - In
typescript-publish.yml, thepublishjob re-installs dependencies and rebuilds even though it depends ontypescript-build/typescript-test; if publish frequency or workflow duration becomes an issue, consider passing build artifacts between jobs instead of rebuilding to reduce CI time.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The Solana dev skill install step is tightly coupled to `skipInstall`; if users want to skip dependency installs but still add (or explicitly opt out of) the dev skill, consider introducing a separate flag or environment-based toggle so these behaviors can be controlled independently.
- The hard-coded `npx -y skills add https://github.com/solana-foundation/solana-dev-skill --skill "*" -y` command in `createAppTaskInstallDevSkill` could be made more maintainable by extracting the URL/skill spec into a constant or configuration so it’s easier to update or override (e.g., for forks or testing).
- In `typescript-publish.yml`, the `publish` job re-installs dependencies and rebuilds even though it depends on `typescript-build`/`typescript-test`; if publish frequency or workflow duration becomes an issue, consider passing build artifacts between jobs instead of rebuilding to reduce CI time.
## Individual Comments
### Comment 1
<location path=".github/workflows/typescript-publish.yml" line_range="59-47" />
<code_context>
+ - name: Install Dependencies
+ uses: ./.github/workflows/actions/install-dependencies
+
+ - name: Setup npm registry auth
+ uses: actions/setup-node@v4
+ with:
+ registry-url: 'https://registry.npmjs.org'
+
</code_context>
<issue_to_address>
**issue (bug_risk):** npm publish will likely fail without an auth token configured for the registry
This workflow only sets the registry URL; it never configures credentials. `NPM_TOKEN` isn’t used anywhere and `NODE_AUTH_TOKEN` isn’t set in the `npm publish` step, so the job won’t have auth when publishing.
You can either:
- Configure `token` (and `node-version`) on `actions/setup-node@v4` to use its built‑in npm auth, or
- Explicitly set `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` on the publish step or at the job env level.
Since this replaces a flow that already used `NPM_TOKEN`, that secret should be wired into this workflow as well.
</issue_to_address>
### Comment 2
<location path="src/utils/create-app-task-install-dev-skill.ts" line_range="14-15" />
<code_context>
+ if (args.verbose) {
+ log.warn(`Installing Solana dev skill`)
+ }
+ await execAndWait(
+ 'npx -y skills add https://github.com/solana-foundation/solana-dev-skill --skill "*" -y',
+ args.targetDirectory,
+ )
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Installing an unpinned CLI via `npx` on every run has security and stability implications
Since this scaffolding runs on users’ machines, relying on the latest `skills` CLI each time can introduce breaking changes and supply‑chain risk. Please either pin the CLI version in the command (e.g. `npx -y skills@<version> add …`) or invoke it via a wrapper script you control so updates happen deliberately and behavior stays predictable.
Suggested implementation:
```typescript
if (args.verbose) {
log.warn(`Installing Solana dev skill`)
}
// Use a pinned major version of the skills CLI to avoid unexpected breaking changes
await execAndWait(
'npx -y skills@1 add https://github.com/solana-foundation/solana-dev-skill --skill "*" -y',
args.targetDirectory,
)
```
If you maintain your own wrapper or know the exact version you want to support, replace `skills@1` with a more specific version (e.g. `skills@1.3.2`) or with the wrapper package name you control. You may also want to expose the pinned version as a constant or configuration value if it is shared across multiple tasks.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the project version to 4.8.4 and introduces a new feature to install a Solana dev skill during app creation. The createAppTaskInstallDevSkill function was added to handle this installation, including verbose logging and error handling. Additionally, security improvements were made to the git initialization process by changing shell: true to shell: false and modifying the git commit command to pass arguments as separate elements, mitigating potential shell injection vulnerabilities. Review feedback suggests addressing a redundant -y flag in the npx command and logging error.message instead of the raw error object for better security and clarity.
There was a problem hiding this comment.
Code Review
This pull request introduces a new task to automatically install a 'Solana dev skill' for AI coding agents during the app creation process, and updates the project version. It also includes significant security and robustness improvements in the git.ts utility by disabling shell execution for git commands and correctly passing commit messages as separate arguments. A high-severity review comment points out an inconsistency and potential security risk in the newly added createAppTaskInstallDevSkill, where execAndWait (which implicitly uses a shell) is employed, suggesting it should align with the safer spawn pattern with shell: false adopted for git commands.
3 participants
Summary by Sourcery
Automatically install the Solana dev skill during app creation and restructure CI/CD workflows for TypeScript build, test, and publish pipelines.
New Features:
Enhancements:
Build:
CI:
Tests:
Chores: