Install the CI lint tools; update devenv to 0.2.9

.devenv-version

@@ -1 +1 @@
-0.2.8
+0.2.9

.github/actions/devenv-lint-tools/action.yml

@@ -0,0 +1,27 @@
+# Managed by devenv (copy/ci). Edit it there, not in a child repo.
+name: devenv lint tools
+description: >-
+  Install the lint tools devenv's bin/ scripts run with Homebrew and put them
+  on PATH for later steps. The latest of each, as on the dev machines. Works
+  on ubuntu runners, where Homebrew is installed but not on PATH, and on macOS.
+inputs:
+  tools:
+    description: Space-separated Homebrew formulae to install.
+    default: shellcheck shellharden shfmt hadolint dockerfmt actionlint
+runs:
+  using: composite
+  steps:
+    - name: Install lint tools with Homebrew
+      shell: bash
+      env:
+        TOOLS: ${{ inputs.tools }}
+        HOMEBREW_NO_AUTO_UPDATE: "1"
+        HOMEBREW_NO_INSTALL_CLEANUP: "1"
+        HOMEBREW_NO_ANALYTICS: "1"
+      run: |
+        if [[ -x /home/linuxbrew/.linuxbrew/bin/brew ]]; then
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+        fi
+        read -ra formulae <<<"$TOOLS"
+        brew install "${formulae[@]}"
+        echo "$(brew --prefix)/bin" >>"$GITHUB_PATH"

.github/workflows/devenv-check.yml

@@ -2,9 +2,10 @@
 #
 # Gate, one CI image build, a fail-fast lint/test/build matrix that pulls that
 # image, and the required-check aggregator. With container: false the matrix
-# runs natively on inputs.runner instead (for macOS-only projects) and no
-# image is built. Call it from a job in ci.yml; later jobs read its outputs
-# instead of repeating any trigger logic:
+# runs natively on inputs.runner instead (for macOS-only projects), no image
+# is built and the lint combo installs the lint tools with brew. Call it from
+# a job in ci.yml; later jobs read its outputs instead of repeating any
+# trigger logic:
 #
 #   ci:
 #     uses: ./.github/workflows/devenv-check.yml
@@ -36,7 +37,8 @@ on:
         description: >-
           true runs every combo in the CI image built from the Dockerfile.
           false runs it natively on the runner after setup-uv, setup-bun and
-          make install, for projects that cannot run in a Linux container.
+          make install, for projects that cannot run in a Linux container; a
+          combo that runs lint installs the lint tools with brew first.
         type: boolean
         default: true
       runner:
@@ -296,6 +298,12 @@ jobs:
         if: ${{ !inputs.container }}
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
 
+      # Only the combo that lints pays for the install. In container mode the
+      # CI stage of the project's Dockerfile has the tools.
+      - name: Install lint tools
+        if: ${{ !inputs.container && contains(matrix.make, 'lint') }}
+        uses: ./.github/actions/devenv-lint-tools
+
       - name: Install
         if: ${{ !inputs.container }}
         run: |

Dockerfile

@@ -40,17 +40,18 @@ RUN pip3 install --no-cache --upgrade pip
 FROM oven/bun:latest AS bun-source
 FROM builder-base AS codex-ci
 
-# hadolint ignore=DL3008
-RUN apt-get clean \
-    && apt-get update \
-    && apt-get install --no-install-recommends -y \
-        shellcheck \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
-
 COPY --from=bun-source /usr/local/bin/bun /usr/local/bin/bun
 COPY --from=bun-source /usr/local/bin/bunx /usr/local/bin/bunx
 
+# Lint tools devenv's bin/ scripts run, unpinned on purpose.
+COPY --from=koalaman/shellcheck:stable /bin/shellcheck /usr/local/bin/
+COPY --from=mvdan/shfmt:latest /bin/shfmt /usr/local/bin/
+COPY --from=hadolint/hadolint:latest /bin/hadolint /usr/local/bin/
+COPY --from=rhysd/actionlint:latest /usr/local/bin/actionlint /usr/local/bin/
+COPY --from=ghcr.io/reteps/dockerfmt:latest /ko-app/dockerfmt /usr/local/bin/
+ADD https://github.com/anordal/shellharden/releases/latest/download/shellharden-x86_64-unknown-linux-musl.tar.gz /tmp/shellharden.tar.gz
+RUN tar -xzf /tmp/shellharden.tar.gz -C /usr/local/bin shellharden && rm /tmp/shellharden.tar.gz
+
 WORKDIR /app
 
 # Python deps (cacheable when lockfiles unchanged)
@@ -143,4 +144,4 @@ RUN python -B -c "import django, cryptography, granian, rapidfuzz" \
 VOLUME /comics
 VOLUME /config
 EXPOSE 9810
-CMD ["/opt/codex/bin/codex"]
+CMD ["/opt/codex/bin/codex"]

bin/_lib.sh

@@ -17,11 +17,16 @@ is_darwin() {
 }
 
 # Succeed when the tool is on PATH. Otherwise say so and how to install it, and
-# fail, so a caller can skip that tool visibly instead of silently.
+# fail, so a caller can skip that tool visibly instead of silently. In CI (CI
+# set, as GitHub sets it) a missing tool is an error instead, so a green CI
+# run means every tool ran.
 need() {
   if command -v "$1" >/dev/null 2>&1; then
     return 0
   fi
+  if [[ -n ${CI:-} ]]; then
+    die "$1 not installed. CI must install it: brew install $1, or add it to the Dockerfile's CI stage"
+  fi
   echo "skipped: $1 not installed (brew install $1)" >&2
   return 1
 }

codex/migrations/0001_init.py

@@ -1,6 +1,6 @@
 """Generated by Django 3.1 on 2020-08-21 18:59."""
 
-import datetime
+import datetime as dt
 from decimal import Decimal
 
 import django.db.models.deletion
@@ -88,7 +88,7 @@ class Migration(migrations.Migration):
                 ("enable_scan_cron", models.BooleanField(db_index=True, default=True)),
                 (
                     "scan_frequency",
-                    models.DurationField(default=datetime.timedelta(seconds=43200)),
+                    models.DurationField(default=dt.timedelta(seconds=43200)),
                 ),
                 ("last_scan", models.DateTimeField(null=True)),
                 ("scan_in_progress", models.BooleanField(default=False)),

codex/migrations/0007_auto_20211210_1710.py

@@ -1,6 +1,6 @@
 """Generated by Django 3.2.9 on 2021-12-11 01:10."""
 
-import datetime
+import datetime as dt
 
 import django.db.models.deletion
 from django.db import migrations, models
@@ -111,7 +111,7 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name="library",
             name="poll_every",
-            field=models.DurationField(default=datetime.timedelta(seconds=3600)),
+            field=models.DurationField(default=dt.timedelta(seconds=3600)),
         ),
         migrations.AlterField(
             model_name="comic",

codex/user_data/restore.py

@@ -270,7 +270,7 @@ def _restore_libraries(
     store: SidecarStore, report: RestoreReport, *, dry_run: bool
 ) -> None:
     """Restore Library rows."""
-    import datetime
+    import datetime as dt
 
     from codex.models.library import Library
 
@@ -285,9 +285,7 @@ def _restore_libraries(
         }
         if row["poll_every"]:
             # Stored as total-seconds float by ``serialize_library``.
-            defaults["poll_every"] = datetime.timedelta(
-                seconds=float(row["poll_every"])
-            )
+            defaults["poll_every"] = dt.timedelta(seconds=float(row["poll_every"]))
         Library.objects.update_or_create(path=row["path"], defaults=defaults)
         report.note_written("libraries")
 

compose.yaml

@@ -9,6 +9,7 @@ services:
       - infinity
     environment:
       - PYTHONUNBUFFERED=1
+      - CI
     image: ${CI_IMAGE}
     volumes:
       - ./test-results:/app/test-results

frontend/src/api/v4/browser.js

@@ -55,13 +55,12 @@ export const getBrowserHref = ({ collection, pks, query }) => {
 
 export const getCoverSrc = ({ coverPk, coverCustomPk }, ts) => {
   const query = ts ? `?ts=${ts}` : "";
-  if (coverCustomPk) {
-    return `${V4_BASE}covers/custom/${coverCustomPk}${query}`;
-  }
   // ``coverPk`` is the representative comic pk pre-annotated by the
   // browser response. v4 keeps the per-comic source so the URL is
   // cacheable across cards that share a representative.
-  return `${V4_BASE}covers/comic/${coverPk}${query}`;
+  return coverCustomPk
+    ? `${V4_BASE}covers/custom/${coverCustomPk}${query}`
+    : `${V4_BASE}covers/comic/${coverPk}${query}`;
 };
 
 const PLACEHOLDER_BY_GROUP = Object.freeze({

frontend/src/stores/admin.js

@@ -170,7 +170,6 @@ export const useAdminStore = defineStore("admin", {
       }
     },
     async loadTables(tables, options) {
-      if (this._requireAdmin()) return false;
       /*
        * ``Promise.all`` so every fetch runs concurrently and the
        * returned promise resolves only once they've all settled.
@@ -179,9 +178,11 @@ export const useAdminStore = defineStore("admin", {
        * could observe an admin tab's state mid-load (some tables
        * populated, some still empty), which presented as flicker.
        */
-      return await Promise.all(
-        tables.map((table) => this.loadTable(table, options)),
-      );
+      return this._requireAdmin()
+        ? false
+        : await Promise.all(
+            tables.map((table) => this.loadTable(table, options)),
+          );
     },
     async loadFolders(path, showHidden) {
       if (this._requireAdmin()) return false;

frontend/src/stores/reader.js

@@ -371,8 +371,7 @@ export const useReaderStore = defineStore("reader", {
     },
     fitToClass(bookSettings) {
       const classes = {};
-      let fitTo;
-      fitTo =
+      const fitTo =
         this.clientSettings.scale > SCALE_DEFAULT
           ? FIT_TO_CLASSES.O
           : FIT_TO_CLASSES[bookSettings.fitTo];

pyproject.toml

@@ -161,6 +161,9 @@ source-include = [
   "docs/**",
 ]
 source-exclude = [
+  # Symlinks to directories, which the sdist builder reads as files.
+  "docs/NEWS/codex",
+  "docs/img",
   "**/*\\~",
   "**/.DS_Store",
   "codex/static_build",

tests/test_models.py

@@ -1,6 +1,6 @@
 """Test models."""
 
-import datetime
+import datetime as dt
 import shutil
 from typing import override
 
@@ -40,7 +40,7 @@ class ComicTestCase(TestCase):
     YEAR = 1975
     MONTH = 4
     DAY = 9
-    DATE = datetime.date(YEAR, MONTH, DAY)
+    DATE = dt.date(YEAR, MONTH, DAY)
 
     @override
     def setUp(self):