fix(bazaar): cherry-pick bazaar fixes + migrate curated.yaml to new schema - #808
fix(bazaar): cherry-pick bazaar fixes + migrate curated.yaml to new schema#808castrojo wants to merge 7 commits into
Conversation
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🧹 Nitpick comments (10)
scripts/check-oci-refs.py (1)
100-108: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
"placeholder"/"number"substring branches aren't actually exercised by the new test.Because
TAG_PATTERN's tag group ([a-zA-Z0-9._-]+) excludes<,>,{,}, template tags likee2e-pr-<N>-<sha>ore2e-pr-{pr_number}-{sha_short}get truncated toe2e-pr-before matching — so the added test passes via theendswith("-")/isupper()branches, not via the"placeholder" in tag/"number" in tagchecks. Consider adding a test case with an unbraced placeholder tag (e.g.pr-numberormy-placeholder-tag) to actually cover lines 105-106.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/check-oci-refs.py` around lines 100 - 108, The skip logic in the tag filter is not actually covering the new `"placeholder"` and `"number"` substring checks because the current test inputs are being truncated before those branches run. Update the tests around the tag-handling code in the script’s main filtering path to include a tag that reaches the `if` condition unchanged and contains one of those substrings, such as a plain `pr-number` or `my-placeholder-tag`, so the `"placeholder" in tag` / `"number" in tag` branches are exercised directly..github/scripts/assemble_bazaar_curation.py (2)
126-126: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueExtract the emoji-stripping regex to a module-level constant.
The same pattern
r'[\U00010000-\U0010ffff]|[\u2600-\u27BF]'is repeated four times. A shared precompiled constant avoids drift and slightly reduces per-call recompilation.♻️ Suggested extraction
EMOJI_RE = re.compile(r'[\U00010000-\U0010ffff]|[\u2600-\u27BF]')Then replace call sites, e.g.:
- title = re.sub(r'[\U00010000-\U0010ffff]|[\u2600-\u27BF]', '', title).strip() + title = EMOJI_RE.sub('', title).strip()Also applies to: 137-137, 191-191, 194-194
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/scripts/assemble_bazaar_curation.py at line 126, The emoji-stripping pattern is duplicated across multiple title/description cleanup sites, so extract the shared regex into a module-level constant in assemble_bazaar_curation.py. Add a precompiled constant near the other module helpers and update the existing re.sub call sites in the relevant title normalization logic to use it, keeping the behavior in the same functions that currently strip emojis.
119-119: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueUse
defusedxmlfor the GNOME feed parse.ET.fromstringon remote XML should be hardened against entity-expansion attacks;defusedxml.ElementTree.fromstringis a small swap here.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/scripts/assemble_bazaar_curation.py at line 119, Replace the remote XML parsing in assemble_bazaar_curation.py with a hardened parser: the ET.fromstring call used to build the GNOME feed tree should be swapped to defusedxml.ElementTree.fromstring. Update the imports and keep the parsing flow in the same place so the feed handling logic continues to work with the safer parser.Source: Linters/SAST tools
.github/workflows/bazaar-curation.yml (1)
18-19: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueCheckout persists credentials that remain live during the network-fetching script step.
The default
persist-credentials: trueleaves theGITHUB_TOKENin the local git config while the later step runs a script that makes many outbound HTTP requests, widening the exfiltration surface. Since the job needs to push, one option is to disable credential persistence at checkout and push explicitly with the token only in the final step.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/bazaar-curation.yml around lines 18 - 19, The Checkout step is leaving `GITHUB_TOKEN` credentials persisted in git config during the network-fetching script phase. Update the `actions/checkout` usage in the workflow to stop persisting credentials, then adjust the later push logic in the job so it uses the token only in the final push step; reference the `Checkout` step and the push-related step in the same workflow when making the change.Source: Linters/SAST tools
system_files/bluefin/etc/bazaar/article-devtools.md (1)
38-39: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueLarge inline base64 SVG data URI bloats the article markdown.
Line 39 embeds a multi-KB base64-encoded SVG directly in the markdown for the "Tavern" icon, unlike every other app card which links to a Flathub-hosted icon URL. This is likely necessary since Tavern isn't on Flathub's icon CDN, but consider extracting it to a static asset file (e.g. under
system_files/bluefin/etc/bazaar/) and referencing it by path if Bazaar's markdown renderer supports local relative images, to keep the source file reviewable/diffable.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@system_files/bluefin/etc/bazaar/article-devtools.md` around lines 38 - 39, The Tavern card is embedding a huge base64 SVG data URI in the markdown, which makes the article hard to review and bloats the source. Update the Tavern image in article-devtools.md to use an external/static asset instead of inline data, following the pattern used by the other app cards if possible. If Bazaar supports local relative images, move the SVG into a static file under system_files/bluefin/etc/bazaar/ and reference it from the Tavern image tag so the markdown stays readable and diff-friendly.tests/test_curated_config.py (1)
31-64: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winTest coverage gap:
articlesrow shape/uri is never validated.
known_row_typesincludes"articles", but the validation loop only branches on"section"and"banner"— there's no check that anarticlesrow'slist[]entries have validtitle/subtitle/image/urifields, nor any check thaturiresolves to an existing/expected path. This gap is why the hardcoded developer-local path bug incurated.yaml'sarticlesrow (flagged separately) went undetected despitepytest tests/test_curated_config.pypassing per the PR description.♻️ Proposed addition
+ if row_type == "articles": + articles = row["articles"] + assert isinstance(articles, dict) + assert "list" in articles + assert isinstance(articles["list"], list) + for article in articles["list"]: + assert "title" in article + assert "uri" in article + assert article["uri"].startswith("file:///run/host/etc/bazaar/") or article["uri"].startswith("http"), \ + f"Article uri should use the deployed host path, got: {article['uri']}"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_curated_config.py` around lines 31 - 64, The curated config test currently recognizes articles rows but never validates their contents, so add coverage in the test loop in test_curated_config.py for the articles branch. Use the existing known_row_types handling and extend the assertions to inspect row["articles"], verify the expected list structure and required fields like title, subtitle, image, and uri, and check that each uri is a valid expected path/value rather than a developer-local absolute path. Keep the new checks aligned with the existing banner and section validations so malformed articles entries fail in pytest.system_files/bluefin/usr/share/ublue-os/just/system.just (2)
360-365: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDuplicate
install -d -m0755 /etc/bazaar.This directory creation is repeated unconditionally right after the conditional block. Harmless (idempotent) but redundant.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@system_files/bluefin/usr/share/ublue-os/just/system.just` around lines 360 - 365, The /etc/bazaar directory is being created twice, once inside the conditional block and again immediately after it in the same section of system.just. Remove the redundant unconditional sudo install -d -m0755 /etc/bazaar so the directory creation happens only once, while keeping the existing conditional handling around the PNG install logic.
346-363: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winPin the podman image tag; guard against empty JXL glob.
docker.io/library/alpine:latestis a floating tag, unlike the Containerfile's pinnedalpine:latest@sha256:...used for the same conversion task. Also, ifBRANDING_DIRexists but contains no.jxlfiles, the glob*.jxlwon't expand anddjxlwill fail on the literal pattern, aborting the whole preview script due toset -euo pipefail.♻️ Proposed fix
- podman run --rm -v "${SRC_DIR}":/workspace:z -v "${TMP_PNG_DIR}":/out:z docker.io/library/alpine:latest sh -c " + podman run --rm -v "${SRC_DIR}":/workspace:z -v "${TMP_PNG_DIR}":/out:z docker.io/library/alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b sh -c " set -e apk add -q libjxl-tools && - for f in /workspace/bluefin-branding/system_files/etc/bazaar/*.jxl; do + shopt -s nullglob + for f in /workspace/bluefin-branding/system_files/etc/bazaar/*.jxl; do name=\$(basename \"\$f\" .jxl) djxl \"\$f\" \"/out/\${name}.png\" --color_space=sRGB done "🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@system_files/bluefin/usr/share/ublue-os/just/system.just` around lines 346 - 363, The banner conversion block in system.just should use a pinned podman image instead of docker.io/library/alpine:latest, matching the fixed digest used elsewhere. Also make the JXL conversion loop in the podman sh command resilient when no .jxl files exist under the branding directory by checking for matches before calling djxl, so the preview script does not fail from an unexpanded glob; update the logic around BRANDING_DIR, TMP_PNG_DIR, and the for f in /workspace/bluefin-branding/system_files/etc/bazaar/*.jxl loop accordingly.system_files/bluefin/etc/bazaar/article-sustainability.md (1)
11-33: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd blank lines around markdown tables (MD058).
Static analysis flags missing blank lines surrounding the tables at Lines 12, 23, and 30, which will fail markdownlint.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@system_files/bluefin/etc/bazaar/article-sustainability.md` around lines 11 - 33, The markdown tables in the Learning & Education, Code & Engineering Education, and Earth & Sustainability sections need blank lines before and after them to satisfy MD058. Update the article content around the affected table blocks so each table in the markdown file is surrounded by empty lines, keeping the section headings and table content unchanged.Source: Linters/SAST tools
tests/test_update_just.bats (1)
126-136: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winOdd/likely erroneous comment token "ponytail".
The comment "
ponytail: filter out directories containing 'bctl'..." appears to contain a stray, out-of-place word. Please clarify or fix the wording.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_update_just.bats` around lines 126 - 136, The inline comment in _run() contains a stray token (“ponytail”) that looks accidental. Update the comment text to clearly describe the PATH filtering behavior without that extra word, keeping the logic in _run() unchanged and preserving the intent of filtering directories that contain bctl.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/bazaar-curation.yml:
- Around line 39-40: The icon download steps use curl without fail-fast
behavior, so HTTP errors can still produce corrupt .png/.svg files; update the
download commands in the workflow to include curl’s fail option in the
icon-fetching steps so the job stops on non-2xx responses. Apply this to the
icon download commands for the OpenLens assets and keep the existing destination
paths and URLs unchanged.
In `@Justfile`:
- Around line 47-49: Hardcoded contributor-specific paths in the Justfile make
the Bazaar recipes non-portable. Update the rewrite logic in the curated-dev
generation and the Flatpak launch/desktop override steps to derive the
repository root dynamically instead of embedding /var/home/jorge/src/common,
using the existing Justfile recipe context so bazaar-preview works from any
checkout. Make the changes in the affected recipe blocks that reference the
curated.yaml rewrite and the launch commands, keeping the path construction
centralized and reusable.
In `@system_files/bluefin/etc/bazaar/article-ai.md`:
- Around line 25-31: Replace the placeholder Lorem ipsum content in the Bazaar
article section with real user-facing copy. Update the prose under the
Cloud-Native AI Lore & Architecture heading in article-ai.md so it reads like
intentional documentation or marketing text, and keep the existing
symbol/section title consistent while removing all filler paragraphs.
In `@system_files/bluefin/etc/bazaar/article-bluefin-notes.md`:
- Around line 1-26: Remove the duplicate stale “Variants promoted” sections from
the stable-20260701 article so only the single correct digest table remains.
Keep the block whose bluefin and bluefin-nvidia digests match the later
supply-chain verification commands, and delete the earlier duplicate blocks in
article-bluefin-notes.md to eliminate the repeated heading issue (MD024).
In `@system_files/bluefin/etc/bazaar/article-devtools.md`:
- Around line 198-208: The Product Lore & Design Principles section contains
placeholder Lorem ipsum text that is shown to users, so replace it with real
Bluefin content. Update the markdown in the article-devtools content to match
the style and intent of the corresponding sections in article-ai.md and
article-games.md, keeping the existing Bluefin messaging while removing all
dummy filler.
In `@system_files/bluefin/etc/bazaar/article-games.md`:
- Around line 48-54: The "Performance & Optimization Lore" section in
article-games.md still contains placeholder lorem ipsum text, matching the issue
already found in article-ai.md and article-devtools.md. Replace the placeholder
copy in that section with real content that describes Bluefin’s performance and
optimization features, keeping the existing heading and the final
Bluefin/GameMode sentence if it still fits the narrative.
In `@system_files/bluefin/etc/bazaar/curated.yaml`:
- Line 10: The curated article links are pointing at a developer-local file path
instead of the deployed host-etc path. Update the `articles.list[].uri` entries
in `curated.yaml` to use the same `/run/host/etc/bazaar/...` base as the
corresponding `image:` fields, and make sure the production `curated.yaml` does
not contain the `curated-dev.yaml` output generated by the `bazaar-preview`
Justfile recipe. Use the `articles.list` entries and the `curated-config-paths`
reference in `bazaar.yaml` to locate and correct all affected URIs.
---
Nitpick comments:
In @.github/scripts/assemble_bazaar_curation.py:
- Line 126: The emoji-stripping pattern is duplicated across multiple
title/description cleanup sites, so extract the shared regex into a module-level
constant in assemble_bazaar_curation.py. Add a precompiled constant near the
other module helpers and update the existing re.sub call sites in the relevant
title normalization logic to use it, keeping the behavior in the same functions
that currently strip emojis.
- Line 119: Replace the remote XML parsing in assemble_bazaar_curation.py with a
hardened parser: the ET.fromstring call used to build the GNOME feed tree should
be swapped to defusedxml.ElementTree.fromstring. Update the imports and keep the
parsing flow in the same place so the feed handling logic continues to work with
the safer parser.
In @.github/workflows/bazaar-curation.yml:
- Around line 18-19: The Checkout step is leaving `GITHUB_TOKEN` credentials
persisted in git config during the network-fetching script phase. Update the
`actions/checkout` usage in the workflow to stop persisting credentials, then
adjust the later push logic in the job so it uses the token only in the final
push step; reference the `Checkout` step and the push-related step in the same
workflow when making the change.
In `@scripts/check-oci-refs.py`:
- Around line 100-108: The skip logic in the tag filter is not actually covering
the new `"placeholder"` and `"number"` substring checks because the current test
inputs are being truncated before those branches run. Update the tests around
the tag-handling code in the script’s main filtering path to include a tag that
reaches the `if` condition unchanged and contains one of those substrings, such
as a plain `pr-number` or `my-placeholder-tag`, so the `"placeholder" in tag` /
`"number" in tag` branches are exercised directly.
In `@system_files/bluefin/etc/bazaar/article-devtools.md`:
- Around line 38-39: The Tavern card is embedding a huge base64 SVG data URI in
the markdown, which makes the article hard to review and bloats the source.
Update the Tavern image in article-devtools.md to use an external/static asset
instead of inline data, following the pattern used by the other app cards if
possible. If Bazaar supports local relative images, move the SVG into a static
file under system_files/bluefin/etc/bazaar/ and reference it from the Tavern
image tag so the markdown stays readable and diff-friendly.
In `@system_files/bluefin/etc/bazaar/article-sustainability.md`:
- Around line 11-33: The markdown tables in the Learning & Education, Code &
Engineering Education, and Earth & Sustainability sections need blank lines
before and after them to satisfy MD058. Update the article content around the
affected table blocks so each table in the markdown file is surrounded by empty
lines, keeping the section headings and table content unchanged.
In `@system_files/bluefin/usr/share/ublue-os/just/system.just`:
- Around line 360-365: The /etc/bazaar directory is being created twice, once
inside the conditional block and again immediately after it in the same section
of system.just. Remove the redundant unconditional sudo install -d -m0755
/etc/bazaar so the directory creation happens only once, while keeping the
existing conditional handling around the PNG install logic.
- Around line 346-363: The banner conversion block in system.just should use a
pinned podman image instead of docker.io/library/alpine:latest, matching the
fixed digest used elsewhere. Also make the JXL conversion loop in the podman sh
command resilient when no .jxl files exist under the branding directory by
checking for matches before calling djxl, so the preview script does not fail
from an unexpanded glob; update the logic around BRANDING_DIR, TMP_PNG_DIR, and
the for f in /workspace/bluefin-branding/system_files/etc/bazaar/*.jxl loop
accordingly.
In `@tests/test_curated_config.py`:
- Around line 31-64: The curated config test currently recognizes articles rows
but never validates their contents, so add coverage in the test loop in
test_curated_config.py for the articles branch. Use the existing known_row_types
handling and extend the assertions to inspect row["articles"], verify the
expected list structure and required fields like title, subtitle, image, and
uri, and check that each uri is a valid expected path/value rather than a
developer-local absolute path. Keep the new checks aligned with the existing
banner and section validations so malformed articles entries fail in pytest.
In `@tests/test_update_just.bats`:
- Around line 126-136: The inline comment in _run() contains a stray token
(“ponytail”) that looks accidental. Update the comment text to clearly describe
the PATH filtering behavior without that extra word, keeping the logic in _run()
unchanged and preserving the intent of filtering directories that contain bctl.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b613a724-778c-44b3-ae8b-c81fd3627724
📒 Files selected for processing (23)
.github/scripts/assemble_bazaar_curation.py.github/workflows/bazaar-curation.yml.gitignoreContainerfileJustfiledocs/skills/bazaar.mddocs/superpowers/plans/2026-07-02-developer-experience-portal.mddocs/superpowers/specs/2026-07-02-developer-experience-portal-design.mdscripts/check-oci-refs.pysystem_files/bluefin/etc/bazaar/article-ai.mdsystem_files/bluefin/etc/bazaar/article-bluefin-notes.mdsystem_files/bluefin/etc/bazaar/article-devtools.mdsystem_files/bluefin/etc/bazaar/article-games.mdsystem_files/bluefin/etc/bazaar/article-gnome-notes.mdsystem_files/bluefin/etc/bazaar/article-sustainability.mdsystem_files/bluefin/etc/bazaar/curated.yamlsystem_files/bluefin/etc/xdg/mimeapps.listsystem_files/bluefin/usr/lib/systemd/user/bazaar.servicesystem_files/bluefin/usr/share/ublue-os/just/system.justtests/test_changelog.batstests/test_check_oci_refs.pytests/test_curated_config.pytests/test_update_just.bats
| curl -sL -o /home/linuxbrew/.linuxbrew/share/icons/hicolor/128x128/apps/openlens.png \ | ||
| https://avatars.githubusercontent.com/u/108342416?s=128 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Add -f/--fail to the icon downloads.
Without --fail, curl exits 0 on HTTP errors (e.g. 404) and writes the error response body into the .png/.svg file, silently producing a corrupt icon that then gets committed. Fail fast instead.
🐛 Proposed fix
- curl -sL -o /home/linuxbrew/.linuxbrew/share/icons/hicolor/128x128/apps/openlens.png \
+ curl -fsSL -o /home/linuxbrew/.linuxbrew/share/icons/hicolor/128x128/apps/openlens.png \
https://avatars.githubusercontent.com/u/108342416?s=128- curl -sL -o /home/linuxbrew/.linuxbrew/share/icons/hicolor/scalable/apps/tavern.svg \
+ curl -fsSL -o /home/linuxbrew/.linuxbrew/share/icons/hicolor/scalable/apps/tavern.svg \
https://raw.githubusercontent.com/tuna-os/Tavern/main/data/icons/hicolor/scalable/apps/dev.hanthor.Tavern.svgAlso applies to: 53-54
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/bazaar-curation.yml around lines 39 - 40, The icon
download steps use curl without fail-fast behavior, so HTTP errors can still
produce corrupt .png/.svg files; update the download commands in the workflow to
include curl’s fail option in the icon-fetching steps so the job stops on
non-2xx responses. Apply this to the icon download commands for the OpenLens
assets and keep the existing destination paths and URLs unchanged.
| echo "Regenerating local curated-dev.yaml based on repository curated.yaml..." | ||
| sed 's|file:\/\/\/run/host/etc/bazaar/|file:\/\/\/var/home/jorge/src/common/system_files/bluefin/etc/bazaar/|g' system_files/bluefin/etc/bazaar/curated.yaml > system_files/bluefin/etc/bazaar/curated-dev.yaml | ||
|
|
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Hardcoded developer-specific absolute path breaks the recipe for every other contributor.
/var/home/jorge/src/common is hardcoded in the sed substitution (Line 48), the desktop override rewrite (Line 65), and both Flatpak launch invocations (Lines 84, 86). This recipe will only work correctly on the original author's machine/checkout location — any other contributor running just bazaar-preview will point Bazaar at a nonexistent path. This is very likely also the source of the same hardcoded path that leaked into the checked-in curated.yaml (see review comment there).
🐛 Proposed fix using a dynamic repo root
+ REPO_ROOT="$(git rev-parse --show-toplevel)"
echo "Regenerating local curated-dev.yaml based on repository curated.yaml..."
- sed 's|file:\/\/\/run/host/etc/bazaar/|file:\/\/\/var/home/jorge/src/common/system_files/bluefin/etc/bazaar/|g' system_files/bluefin/etc/bazaar/curated.yaml > system_files/bluefin/etc/bazaar/curated-dev.yaml
+ sed "s|file:\/\/\/run/host/etc/bazaar/|file:\/\/\/${REPO_ROOT#/}/system_files/bluefin/etc/bazaar/|g" system_files/bluefin/etc/bazaar/curated.yaml > system_files/bluefin/etc/bazaar/curated-dev.yamlAlso applies to: 61-65, 82-88
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Justfile` around lines 47 - 49, Hardcoded contributor-specific paths in the
Justfile make the Bazaar recipes non-portable. Update the rewrite logic in the
curated-dev generation and the Flatpak launch/desktop override steps to derive
the repository root dynamically instead of embedding /var/home/jorge/src/common,
using the existing Justfile recipe context so bazaar-preview works from any
checkout. Make the changes in the affected recipe blocks that reference the
curated.yaml rewrite and the launch commands, keeping the path construction
centralized and reusable.
| ## Cloud-Native AI Lore & Architecture | ||
|
|
||
| Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. | ||
|
|
||
| Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. | ||
|
|
||
| Whether you are running open-source models completely offline or orchestrating complex pipelines using PyTorch inside containerized environments, Project Bluefin's robust OCI foundation is engineered to deliver peak performance for cutting-edge machine learning and AI workloads. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Lorem ipsum placeholder text shipped in user-facing article.
The "Cloud-Native AI Lore & Architecture" section is filled with literal Lorem ipsum filler text. This will render as gibberish to end users in the curated Bazaar page.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@system_files/bluefin/etc/bazaar/article-ai.md` around lines 25 - 31, Replace
the placeholder Lorem ipsum content in the Bazaar article section with real
user-facing copy. Update the prose under the Cloud-Native AI Lore & Architecture
heading in article-ai.md so it reads like intentional documentation or marketing
text, and keep the existing symbol/section title consistent while removing all
filler paragraphs.
| # stable-20260701: Stable (stable-20260701) | ||
|
|
||
| ## Variants promoted | ||
|
|
||
| | Variant | Tag | Digest | | ||
| |---|---|---| | ||
| | `bluefin` | `:stable` | `sha256:b0276d98a256` | | ||
| | `bluefin-nvidia` | `:stable` | `sha256:3a52047ed338` | | ||
|
|
||
| --- | ||
| ## Variants promoted | ||
|
|
||
| | Variant | Tag | Digest | | ||
| |---|---|---| | ||
| | `bluefin` | `:stable` | `sha256:a1cd03bc324a` | | ||
| | `bluefin-nvidia` | `:stable` | `sha256:e1785056efb5` | | ||
|
|
||
| --- | ||
| ## Variants promoted | ||
|
|
||
| | Variant | Tag | Digest | | ||
| |---|---|---| | ||
| | `bluefin` | `:stable` | `sha256:3e31c988e761` | | ||
| | `bluefin-nvidia` | `:stable` | `sha256:94f508eddcbf` | | ||
|
|
||
| --- |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Three conflicting "Variants promoted" blocks under a single release title.
The article title is stable-20260701, but it contains three separate "## Variants promoted" tables (Lines 5-8, 13-16, 21-24) with three different sets of digests for the same bluefin/bluefin-nvidia variants. Only the third digest set (sha256:3e31c988e761...) matches the cosign/oras/slsa-verifier commands used later in the supply-chain section — the first two blocks appear to be stale/duplicate content from prior cherry-picked releases that shouldn't be in this article. Static analysis also flags this as duplicate headings (MD024) at Lines 11 and 19.
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)
[warning] 11-11: Multiple headings with the same content
(MD024, no-duplicate-heading)
[warning] 19-19: Multiple headings with the same content
(MD024, no-duplicate-heading)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@system_files/bluefin/etc/bazaar/article-bluefin-notes.md` around lines 1 -
26, Remove the duplicate stale “Variants promoted” sections from the
stable-20260701 article so only the single correct digest table remains. Keep
the block whose bluefin and bluefin-nvidia digests match the later supply-chain
verification commands, and delete the earlier duplicate blocks in
article-bluefin-notes.md to eliminate the repeated heading issue (MD024).
| ## Performance & Optimization Lore | ||
|
|
||
| Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. | ||
|
|
||
| Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. | ||
|
|
||
| Project Bluefin leverages GameMode and containerized GPU drivers out-of-the-box to ensure maximum frame rates and minimal input lag. Play on! |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Lorem ipsum placeholder text in "Performance & Optimization Lore" section.
Same placeholder-content issue as article-ai.md and article-devtools.md.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@system_files/bluefin/etc/bazaar/article-games.md` around lines 48 - 54, The
"Performance & Optimization Lore" section in article-games.md still contains
placeholder lorem ipsum text, matching the issue already found in article-ai.md
and article-devtools.md. Replace the placeholder copy in that section with real
content that describes Bluefin’s performance and optimization features, keeping
the existing heading and the final Bluefin/GameMode sentence if it still fits
the narrative.
| - title: "Bluefin Release Notes" | ||
| subtitle: "Latest stable updates from Project Bluefin" | ||
| image: file:///run/host/etc/bazaar/11-bluefin-day.png | ||
| uri: file:///var/home/jorge/src/common/system_files/bluefin/etc/bazaar/article-bluefin-notes.md |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Critical: article uri fields point to a developer's local machine, not the deployed path.
All six articles.list[].uri values use file:///var/home/jorge/src/common/system_files/bluefin/etc/bazaar/article-*.md, while the sibling image: fields on the very same rows (Lines 9, 13, 17, 21, 25, 29) correctly use file:///run/host/etc/bazaar/*.png. This is the Flatpak host-etc permission path Bazaar expects for curated content, as confirmed by bazaar.yaml's curated-config-paths: - /run/host/etc/bazaar/curated.yaml. On any machine other than the original author's, /var/home/jorge/... will not exist, so every article link will fail to resolve at runtime — defeating the PR's stated goal of fixing the curated page. This looks like it leaked from the bazaar-preview Justfile recipe, which generates curated-dev.yaml by substituting exactly this same jorge path (see Justfile Line 48) — it appears the generated dev output was accidentally checked in as the production curated.yaml instead of curated-dev.yaml.
🐛 Proposed fix
- uri: file:///var/home/jorge/src/common/system_files/bluefin/etc/bazaar/article-bluefin-notes.md
+ uri: file:///run/host/etc/bazaar/article-bluefin-notes.md
...
- uri: file:///var/home/jorge/src/common/system_files/bluefin/etc/bazaar/article-devtools.md
+ uri: file:///run/host/etc/bazaar/article-devtools.md
...
- uri: file:///var/home/jorge/src/common/system_files/bluefin/etc/bazaar/article-gnome-notes.md
+ uri: file:///run/host/etc/bazaar/article-gnome-notes.md
...
- uri: file:///var/home/jorge/src/common/system_files/bluefin/etc/bazaar/article-games.md
+ uri: file:///run/host/etc/bazaar/article-games.md
...
- uri: file:///var/home/jorge/src/common/system_files/bluefin/etc/bazaar/article-sustainability.md
+ uri: file:///run/host/etc/bazaar/article-sustainability.md
...
- uri: file:///var/home/jorge/src/common/system_files/bluefin/etc/bazaar/article-ai.md
+ uri: file:///run/host/etc/bazaar/article-ai.mdAlso applies to: 14-14, 18-18, 22-22, 26-26, 30-30
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@system_files/bluefin/etc/bazaar/curated.yaml` at line 10, The curated article
links are pointing at a developer-local file path instead of the deployed
host-etc path. Update the `articles.list[].uri` entries in `curated.yaml` to use
the same `/run/host/etc/bazaar/...` base as the corresponding `image:` fields,
and make sure the production `curated.yaml` does not contain the
`curated-dev.yaml` output generated by the `bazaar-preview` Justfile recipe. Use
the `articles.list` entries and the `curated-config-paths` reference in
`bazaar.yaml` to locate and correct all affected URIs.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@system_files/bluefin/etc/bazaar/article-devtools.md`:
- Around line 180-186: The “Recommended workflows” list mentions k9s without
introducing it elsewhere, so make the reference self-contained by either adding
a brief k9s introduction in this section or removing the k9s mention from the
Kubernetes workflow bullet; update the “Recommended workflows” content
consistently so the Kubernetes entry stands on its own.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: a21d3aff-3a7e-44f3-b766-0c949291398d
📒 Files selected for processing (4)
docs/skills/bazaar.mdsystem_files/bluefin/etc/bazaar/article-devtools.mdsystem_files/bluefin/etc/bazaar/curated.yamltests/test_curated_config.py
🚧 Files skipped from review as they are similar to previous changes (2)
- tests/test_curated_config.py
- docs/skills/bazaar.md
| ## Recommended workflows | ||
|
|
||
| - **Local container development** — `ujust devmode` → Docker or Podman Desktop, then `devcontainer up` from your project directory. | ||
| - **Remote development containers** — install the `ms-vscode-remote.remote-containers` and `ms-vscode-remote.remote-ssh` VS Code extensions (on by default) and open a folder over SSH or in a devcontainer. | ||
| - **Kubernetes cluster work** — `kind` or `minikube` for local clusters, `kubectl` + `helm` for day-to-day operations, `k9s` or Headlamp/OpenLens when you want a visual view. | ||
| - **Virtualization and local VM work** — `ujust devmode` → virt-manager + QEMU for full VMs, or Lima for lightweight KVM-backed Linux VMs. | ||
| - **General shell productivity** — `mise` for per-project runtime versions, `atuin` for searchable shell history, `eza`/`bat`/`fd`/`ripgrep` as everyday replacements for `ls`/`cat`/`find`/`grep`. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the relevant section and search for all mentions of k9s in the article.
file="system_files/bluefin/etc/bazaar/article-devtools.md"
echo "== Relevant lines =="
nl -ba "$file" | sed -n '1,220p' | sed -n '160,200p'
echo
echo "== k9s mentions in the file =="
rg -n -C 2 '\bk9s\b' "$file" || true
echo
echo "== Headings for context =="
rg -n '^#{1,3}\s' "$file" || trueRepository: projectbluefin/common
Length of output: 220
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file="system_files/bluefin/etc/bazaar/article-devtools.md"
echo "== Relevant section =="
sed -n '170,190p' "$file" | cat -n
echo
echo "== All k9s mentions =="
rg -n -C 2 '\bk9s\b' "$file" || true
echo
echo "== Section headings =="
rg -n '^#{1,3}\s' "$file" || trueRepository: projectbluefin/common
Length of output: 2773
Keep k9s self-contained in the workflow list. It appears only here, so add a matching introduction above or remove the reference.
🧰 Tools
🪛 LanguageTool
[grammar] ~182-~182: Ensure spelling is correct
Context: ...flows - Local container development — ujust devmode → Docker or Podman Desktop, th...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@system_files/bluefin/etc/bazaar/article-devtools.md` around lines 180 - 186,
The “Recommended workflows” list mentions k9s without introducing it elsewhere,
so make the reference self-contained by either adding a brief k9s introduction
in this section or removing the k9s mention from the Kubernetes workflow bullet;
update the “Recommended workflows” content consistently so the Kubernetes entry
stands on its own.
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/skills/bazaar.md (1)
158-160: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAvoid hardcoding a contributor-specific checkout path here.
/var/home/jorge/src/common/...will only work on one machine, so this example is not copy/paste-safe for other contributors. Prefer a repo-relative placeholder or derive the path from the current checkout.Suggested edit
- --extra-content-config=/var/home/jorge/src/common/system_files/bluefin/etc/bazaar/curated-dev.yaml \ + --extra-content-config="$REPO_ROOT/system_files/bluefin/etc/bazaar/curated-dev.yaml" \🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/skills/bazaar.md` around lines 158 - 160, The Bazaar example hardcodes a contributor-specific checkout path, which makes the snippet unsafe to copy for others. Update the command in the Bazaar docs example to use a repo-relative placeholder or a path derived from the current checkout instead of the fixed `/var/home/jorge/src/common/...` location, keeping the `setsid flatpak run` invocation and `--extra-content-config` usage intact.
♻️ Duplicate comments (1)
system_files/bluefin/usr/libexec/bazaar-hook (1)
155-161: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winSame bare
except: passissue ashooks.py.This mirrors the identical
handle_gui_cask_hook/handle_cli_editoraction-stage exception handling flagged insystem_files/bluefin/etc/bazaar/hooks.py; apply the same fix here to keep both scripts behavior-identical.Also applies to: 237-242
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@system_files/bluefin/usr/libexec/bazaar-hook` around lines 155 - 161, The action-stage exception handling in the bazaar hook still uses a bare except with pass, mirroring the same problem as the related hook code. Update the action branch around the cask lookup and spawn_brew_tap_cask call to catch only the expected exception type(s) and handle them consistently with the corresponding hook behavior in the other script, so both bazaar hook implementations stay behavior-identical. Use the local action-case logic and the spawn_brew_tap_cask path as the target for the fix.
🧹 Nitpick comments (3)
tests/test_hooks.py (1)
308-314: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winWeaker action-stage assertions than the
bazaar-hooktest suite.
test_action_returns_emptyonly checks the empty response, while the equivalent test intests/test_bazaar_hook.pyalso asserts the spawned subprocess args contain the expected cask/tap/formula. Exposing the mockedPopencalls from_load_hooks(similar to_run_hook_with_mockintest_bazaar_hook.py) would let this suite catch cask/tap/formula mapping errors too.Also applies to: 370-376
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_hooks.py` around lines 308 - 314, Strengthen the action-stage tests in test_action_returns_empty and the matching case around test_hooks by exposing the mocked Popen invocation from _load_hooks, similar to _run_hook_with_mock in test_bazaar_hook.py. Update the test to assert the spawned subprocess arguments include the expected cask/tap/formula mapping in addition to the empty response, so the hook loading path validates both output and command construction.docs/superpowers/plans/2026-07-04-dx-appstore-hook-tiles.md (1)
230-246: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valuePlan doc omits the
## JetBrainssection.The "Produces" list only mentions
## IDEsand## AI apps, but the actual regression test (tests/test_dx_article_devtools.py) also asserts a## JetBrainsheading. Consider updating the plan for consistency with the final implementation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/superpowers/plans/2026-07-04-dx-appstore-hook-tiles.md` around lines 230 - 246, Update the plan snippet to match the expected final headings: the “Produces” list and the Step 1 example in the DX plan should also include a `## JetBrains` tile-only section alongside `## IDEs` and `## AI apps`. Use the existing `Developer Experience (DX)` plan block and the `Step 1: Replace verbose content with minimal headings and tile grids` example as the place to add the missing section so it stays consistent with `tests/test_dx_article_devtools.py`.system_files/bluefin/etc/bazaar/hooks.py (1)
43-129: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDuplicate source of truth for
appidsandcaskskeys.Each
GUI_CASK_HOOKSentry keeps a separateappidstuple andcasksdict that must be kept manually in sync. A future edit adding an appid to one but not the other would silently break installs (theactionstage's bareexceptwould swallow the resultingKeyError).Consider deriving
appidsfromcasks.keys()to eliminate the duplication.♻️ Proposed refactor
- 'code': { - 'appids': ('com.visualstudio.code', 'com.vscodium.codium'), - 'tap': 'ublue-os/tap', - 'casks': { - 'com.visualstudio.code': 'visual-studio-code-linux', - 'com.vscodium.codium': 'vscodium-linux', - }, - }, + 'code': { + 'tap': 'ublue-os/tap', + 'casks': { + 'com.visualstudio.code': 'visual-studio-code-linux', + 'com.vscodium.codium': 'vscodium-linux', + }, + },And update
handle_gui_cask_hookto usecasks.keys()instead of a separateappidsfield.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@system_files/bluefin/etc/bazaar/hooks.py` around lines 43 - 129, `GUI_CASK_HOOKS` duplicates the same app identifiers in both `appids` and `casks`, which can drift out of sync. Refactor the hook definitions so each entry derives its app IDs from the `casks` mapping instead of storing a separate `appids` tuple. Then update `handle_gui_cask_hook` to iterate over `casks.keys()` (or equivalent) and remove reliance on the `appids` field, keeping the logic in sync with symbols like `GUI_CASK_HOOKS` and `handle_gui_cask_hook`.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@system_files/bluefin/etc/bazaar/hooks.py`:
- Around line 155-161: Replace the bare except in hooks.py’s action handling
with explicit exception handling so install failures are not swallowed; in the
action branch around spawn_brew_tap_cask (and the casks[transaction_appid]
lookup), catch the relevant exceptions, log or surface the error, and avoid a
silent pass. Apply the same fix to the similar action path referenced by the
duplicate occurrence so both spawn_brew_tap_cask/spawn_brew_formula flows report
failures instead of returning an empty result with no feedback.
---
Outside diff comments:
In `@docs/skills/bazaar.md`:
- Around line 158-160: The Bazaar example hardcodes a contributor-specific
checkout path, which makes the snippet unsafe to copy for others. Update the
command in the Bazaar docs example to use a repo-relative placeholder or a path
derived from the current checkout instead of the fixed
`/var/home/jorge/src/common/...` location, keeping the `setsid flatpak run`
invocation and `--extra-content-config` usage intact.
---
Duplicate comments:
In `@system_files/bluefin/usr/libexec/bazaar-hook`:
- Around line 155-161: The action-stage exception handling in the bazaar hook
still uses a bare except with pass, mirroring the same problem as the related
hook code. Update the action branch around the cask lookup and
spawn_brew_tap_cask call to catch only the expected exception type(s) and handle
them consistently with the corresponding hook behavior in the other script, so
both bazaar hook implementations stay behavior-identical. Use the local
action-case logic and the spawn_brew_tap_cask path as the target for the fix.
---
Nitpick comments:
In `@docs/superpowers/plans/2026-07-04-dx-appstore-hook-tiles.md`:
- Around line 230-246: Update the plan snippet to match the expected final
headings: the “Produces” list and the Step 1 example in the DX plan should also
include a `## JetBrains` tile-only section alongside `## IDEs` and `## AI apps`.
Use the existing `Developer Experience (DX)` plan block and the `Step 1: Replace
verbose content with minimal headings and tile grids` example as the place to
add the missing section so it stays consistent with
`tests/test_dx_article_devtools.py`.
In `@system_files/bluefin/etc/bazaar/hooks.py`:
- Around line 43-129: `GUI_CASK_HOOKS` duplicates the same app identifiers in
both `appids` and `casks`, which can drift out of sync. Refactor the hook
definitions so each entry derives its app IDs from the `casks` mapping instead
of storing a separate `appids` tuple. Then update `handle_gui_cask_hook` to
iterate over `casks.keys()` (or equivalent) and remove reliance on the `appids`
field, keeping the logic in sync with symbols like `GUI_CASK_HOOKS` and
`handle_gui_cask_hook`.
In `@tests/test_hooks.py`:
- Around line 308-314: Strengthen the action-stage tests in
test_action_returns_empty and the matching case around test_hooks by exposing
the mocked Popen invocation from _load_hooks, similar to _run_hook_with_mock in
test_bazaar_hook.py. Update the test to assert the spawned subprocess arguments
include the expected cask/tap/formula mapping in addition to the empty response,
so the hook loading path validates both output and command construction.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b9b451f4-8422-41f2-8433-5de7fe3b7b63
📒 Files selected for processing (10)
docs/skills/bazaar.mddocs/superpowers/plans/2026-07-04-dx-appstore-hook-tiles.mddocs/superpowers/specs/2026-07-04-dx-appstore-hook-tiles-design.mdsystem_files/bluefin/etc/bazaar/article-devtools.mdsystem_files/bluefin/etc/bazaar/bazaar.yamlsystem_files/bluefin/etc/bazaar/hooks.pysystem_files/bluefin/usr/libexec/bazaar-hooktests/test_bazaar_hook.pytests/test_dx_article_devtools.pytests/test_hooks.py
✅ Files skipped from review due to trivial changes (1)
- system_files/bluefin/etc/bazaar/article-devtools.md
| case 'action': | ||
| try: | ||
| cask = casks[transaction_appid] | ||
| spawn_brew_tap_cask(tap, cask) | ||
| except: | ||
| pass | ||
| return '' |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Bare except: pass swallows install failures silently.
If spawn_brew_tap_cask/spawn_brew_formula (or the casks[transaction_appid] lookup) raises, the exception is silently discarded and the dialog completes with no feedback to the user, per Ruff's E722/S110 findings.
🐛 Proposed fix
case 'action':
try:
cask = casks[transaction_appid]
spawn_brew_tap_cask(tap, cask)
- except:
- pass
+ except Exception:
+ pass # TODO: surface failure via a follow-up dialog/log
return ''Also applies to: 237-242
🧰 Tools
🪛 Ruff (0.15.20)
[error] 159-159: Do not use bare except
(E722)
[error] 159-160: try-except-pass detected, consider logging the exception
(S110)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@system_files/bluefin/etc/bazaar/hooks.py` around lines 155 - 161, Replace the
bare except in hooks.py’s action handling with explicit exception handling so
install failures are not swallowed; in the action branch around
spawn_brew_tap_cask (and the casks[transaction_appid] lookup), catch the
relevant exceptions, log or surface the error, and avoid a silent pass. Apply
the same fix to the similar action path referenced by the duplicate occurrence
so both spawn_brew_tap_cask/spawn_brew_formula flows report failures instead of
returning an empty result with no feedback.
Source: Linters/SAST tools
hanthor
left a comment
hanthor
left a comment
There was a problem hiding this comment.
This PR currently has merge conflicts with the base branch and can't be merged as-is. Could you rebase / resolve the conflicts? Happy to re-review once it's mergeable — the change itself looks reasonable.
castrojo
added
blocked
- Replaced djxl `-C sRGB` with `--color_space=sRGB` to fix missing content in PNG conversions. - Changed bazaar.service `Type=oneshot` to `Type=simple` and removed `RemainAfterExit=yes` to prevent systemctl from hanging indefinitely on startup. - Cleaned the PATH in test_changelog.bats setup() to isolate tests from host-installed bctl, unblocking local development test runs. Assisted-by: Gemini 3.5 Flash via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Integrated automated podman-based JXL-to-PNG conversion in `just bazaar-preview` and `ujust bazaar-preview`. - This ensures host preview displays populated banners in io.github.kolunmi.Bazaar without requiring local host-installed `djxl`. Assisted-by: Gemini 3.5 Flash via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Documented sRGB conversion guidelines and the podman-based local conversion loop. - Specified Type=simple and no-window daemon lifecycle constraints for systemd integration. - Standardized file triggers, pitfalls, and verification criteria against the canonical /addyosmani/agent-skills spec. Assisted-by: Gemini 3.5 Flash via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pin docker.io/library/alpine in the bazaar-preview podman containers to the same SHA already used by the Containerfile build stage. Assisted-by: Claude Sonnet via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bazaar upstream merged PR #1655 'Rework Curated System' on 2026-06-23,
changing the curated page config format before the next Flathub release.
Old schema: root css block + rows[].sections[].category with classes,
i18n titles, and inline banner fields.
New schema: rows[] with separate banner/section row types, no CSS,
plain string titles, subtitle as markdown object,
and appids under appids.list.
Changes:
- Remove root css block (CSS-based section styling dropped upstream)
- Split each combined section+banner into a banner row + section row
- Migrate category.title (en only) -> section.title
- Migrate category.subtitle (en only) -> section.subtitle.string
- Migrate category.appids -> section.appids.list
- Move banner URIs to banner.image.light-uri / dark-uri
- Set banner.light-color and dark-color from old gradient end colors
- Drop i18n strings (not supported in new schema)
- Update test_curated_config.py to validate new schema shape
Assisted-by: Claude Sonnet 4.6 via GitHub Copilot
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
… metadata Rubber-duck review of the schema migration found several gaps: - bazaar.service: add Restart=on-failure/RestartSec=5 so the daemon self-heals on curated config parse errors instead of going silently inactive (StartLimitBurst=10 already provides crash-loop protection) - bazaar-preview Justfile + system.just: add 'set -e' to inner sh -c of podman-based JXL conversion so a per-file djxl failure aborts rather than letting partial PNG sets be silently installed - curated.yaml: add can-shrink: true to all 9 banners (prevents clipping at narrow window widths); add overflow-count: 12 to Utilities (20 apps) and Developers (22 apps) to enable Show More; add alt: text to the Bluefin Recommends banner for accessibility - docs/skills/bazaar.md: rewrite from legacy-schema perspective to new schema (post-0.8.3 / PR #1655). Correct the dangerously wrong claim that '-C sRGB' is the valid djxl flag (it isn't — use '--color_space=sRGB'). Update Red Flags and Verification checklist to reflect the new schema shape. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
9c05eae to
80588ac
Compare
2 participants
Bazaar PR #1655 breaks the curated page. This cherry-picks ready fixes from feature branches and migrates curated.yaml to the new schema.
Commits: djxl flag fix (--color_space=sRGB), bazaar.service Type=simple+Restart, preview recipe set -e hardening, curated.yaml schema migration (css/sections/category -> banner/section rows), bazaar.md rewrite with correct docs.
Tests: pytest tests/test_curated_config.py passes.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation
Tests