Add SessionStart hook installing Swift via swiftly for web sessions - #7
Add SessionStart hook installing Swift via swiftly for web sessions#7leogdion wants to merge 6 commits into
Conversation
Installs the swift.org Ubuntu 24.04 system deps, then swiftly and the toolchain pinned by .swift-version, and persists the Swift PATH to CLAUDE_ENV_FILE. Skips entirely when swift is already installed or the session is not remote. Not yet verified end-to-end: download.swift.org is currently blocked by the environment network policy and must be allowlisted first. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012gBcWa6xeuaMwdvzSfruns
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012gBcWa6xeuaMwdvzSfruns
Adds a soft-failing mise section after the Swift install: installs mise via mise.run, trusts the repo config, and runs mise install for the pinned swift-format, SwiftLint, and periphery. Lint tooling failure warns loudly but leaves the session able to build and test. Not yet verified end-to-end: mise.run and mise.jdx.dev are blocked by the environment network policy and must be allowlisted first. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012gBcWa6xeuaMwdvzSfruns
mise install cannot run in Claude Code web sessions: the session's GitHub gateway scopes api.github.com to session-attached repos, so mise's release lookups 403 on the tool repos. Install the same pinned versions (parsed from mise.toml) via anonymous public git clones and release-asset downloads instead: SwiftLint as a prebuilt binary, swift-format and periphery built from source. The hook now runs async so the session starts immediately; progress logs to ~/.claude-session-setup.log and ~/.claude-session-setup.done marks completion. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012gBcWa6xeuaMwdvzSfruns
SwiftLint dlopens libsourcekitdInProc.so from the Swift toolchain and locates it via LINUX_SOURCEKIT_LIB_PATH; without it, swiftlint crashes on Linux. Resolve the toolchain lib dir after install and persist the export to the session env file. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012gBcWa6xeuaMwdvzSfruns
Stop compiling swift-format and periphery from source in the SessionStart hook (~15 min of the cold start). SwiftLint stays eager via its prebuilt release binary; swift-format now resolves to the binary bundled with the Swift toolchain via the swiftly shims; the periphery scan is skipped in web sessions by Scripts/lint.sh (CLAUDE_CODE_REMOTE guard) since it has no Linux binaries and is not worth building there. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012gBcWa6xeuaMwdvzSfruns
📝 WalkthroughWalkthroughThe PR adds a Claude Code session-start hook that configures Swift and SwiftLint tooling asynchronously. It registers the hook, documents Linux setup, and skips Periphery during remote Claude Code sessions. ChangesClaude Code Swift setup
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant ClaudeCode
participant session_start_sh
participant Swiftly
participant SwiftLint
participant Scripts_lint_sh
ClaudeCode->>session_start_sh: Run SessionStart hook
session_start_sh->>Swiftly: Load or install Swift toolchain
session_start_sh->>SwiftLint: Reuse or install pinned release
session_start_sh-->>ClaudeCode: Export environment and mark setup complete
ClaudeCode->>Scripts_lint_sh: Run lint script
Scripts_lint_sh-->>ClaudeCode: Skip Periphery in remote sessions
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/hooks/session-start.sh:
- Around line 105-110: Add trusted SHA-256 verification to the SwiftLint
download flow in the session-start script: define the expected digest for the
selected swiftlint_version release asset, validate swiftlint.zip before
unzip/install, and abort on mismatch. Keep installation through the verified
archive, or switch to a supported distribution path if the asset cannot be
reliably verified.
In @.claude/settings.json:
- Line 8: Quote the CLAUDE_PROJECT_DIR-based hook command in the SessionStart
configuration so paths containing whitespace remain a single shell argument;
update the command value without changing the hook script or surrounding
configuration.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 2f047745-a6fa-44aa-b672-b70778bcf23e
📒 Files selected for processing (4)
.claude/hooks/session-start.sh.claude/settings.jsonCLAUDE.mdScripts/lint.sh
| workdir="$(mktemp -d)" | ||
| curl -fsSL -o "$workdir/swiftlint.zip" \ | ||
| "https://github.com/realm/SwiftLint/releases/download/$swiftlint_version/swiftlint_linux_amd64.zip" | ||
| unzip -q -o "$workdir/swiftlint.zip" -d "$workdir" | ||
| install -m 755 "$workdir/swiftlint" "$TOOLS_BIN/swiftlint" | ||
| rm -rf "$workdir" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^|/)(session-start\.sh|package\.json|Package\.swif|README\.md|\.claude)?' || true
echo "== target lines =="
if [ -f .claude/hooks/session-start.sh ]; then
nl -ba .claude/hooks/session-start.sh | sed -n '90,120p'
else
echo "missing .claude/hooks/session-start.sh"
fi
echo "== swiftlint occurrences =="
rg -n "swiftlint|SwiftLint|SWIFTLINT|realm/SwiftLint" . -S || true
echo "== diff summary =="
git diff --stat || true
git diff -- .claude/hooks/session-start.sh | sed -n '1,220p' || true
echo "== package manifests with swiftlint =="
rg -n '"swiftlint"|swiftlint|SwiftLint' -g 'package.json' -g 'Package.swift' . || trueRepository: brightdigit/ConfigKeyKit
Length of output: 2772
🌐 Web query:
SwiftLint official GitHub releases SHA-256 manifest swiftlint_linux_amd64.zip checksum signatures
💡 Result:
The official SwiftLint GitHub releases do not currently provide a dedicated, separate SHA-256 manifest file for the swiftlint_linux_amd64.zip artifact [1][2]. While SwiftLint provides checksums for some Bazel-related files (e.g., bazel.tar.gz.sha256) within their release assets, they do not publish an equivalent file for the Linux binary zip archives [2][3][4]. To verify the integrity of the swiftlint_linux_amd64.zip file, you must compute the SHA-256 checksum manually after downloading and compare it against the expected hash, if available from other trusted infrastructure-as-code or packaging sources that reference these binaries [5][6]. If you are using SwiftLint in an automated environment, the recommended practice for verifying downloaded binaries is to compute the checksum locally using the sha256sum utility [7][8]: sha256sum swiftlint_linux_amd64.zip Note that because the maintainers do not provide an official manifest file for the Linux zip, you cannot verify the file against an official SwiftLint-hosted checksum file [2][3][4]. Some third-party integrations (such as package managers or CI tools) maintain their own lists of known-good hashes for SwiftLint versions [5]. If you are relying on these, you should ensure those sources are trusted. {top_results: [2][3][4][5]}
Citations:
- 1: https://github.com/realm/SwiftLint/releases
- 2: https://github.com/realm/SwiftLint/releases/tag/0.65.0
- 3: https://github.com/realm/SwiftLint/releases/tag/0.63.3
- 4: https://github.com/realm/SwiftLint/releases/tag/0.64.1
- 5: https://github.com/cashapp/hermit-packages/blob/master/swiftlint.hcl
- 6: https://github.com/ashfurrow/danger-ruby-swiftlint/blob/master/ext/swiftlint/README.md
- 7: https://thanoskoutr.com/posts/download-release-github/
- 8: https://unix.stackexchange.com/questions/464010/how-to-verify-a-checksum-using-one-command-line
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== target lines =="
python3 - <<'PY' path=.claude/hooks/session-start.sh 120 95 lin=106-110
import sys
path=sys.argv[1]
with open(path, 'r') as f:
lines=f.read().splitlines()
print(f"file {path} line count {len(lines)}")
for i in range(max(1,len(lines)-125), min(len(lines),130)+1):
if 90 <= i <= 120:
print(f"{i:5d}\t{lines[i-1]}")
PY
echo "== swiftlint occurrences =="
rg -n "swiftlint|SwiftLint|SWIFTLINT|realm/SwiftLint|swiftlint_version" . -S || true
echo "== package manifests with swiftlint =="
rg -n '"swiftlint"|SwiftLint|SwiftLint\.Tools|swiftlint' -g 'package.json' -g 'Package.swift' . || true
echo "== tools setup snippets =="
if [ -f .github/actions/setup-tools/action.yml ]; then
sed -n '1,220p' .github/tasks || sed -n '1,220p' .github/actions/setup-tools/action.yml
fi
echo "== behavioral/static extraction =="
python3 - <<'PY'
import re, pathlib
p=pathlib.Path('.claude/hooks/session-start.sh')
text=p.read_text()
m=re.search(r'swiftlint_version\s*=\s*["'\'']([^"'\'']+)["'\'']', text)
print("swiftlint_version", m.group(1) if m else "NOT FOUND")
asset='swiftlint_linux_amd64.zip'
checksum_tokens=[x for x in ['sha256sum','shasum','sha256']]
found=[]
for tok in checksum_tokens:
if tok in text.lower():
found.append(tok)
print("checksum/token", found if found else "NONE")
print("curl asset present", 'curl' in text and asset.replace('_','_') in text)
PYRepository: brightdigit/ConfigKeyKit
Length of output: 348
Verify the SwiftLint release asset before installation.
The script installs swiftlint_linux_amd64.zip without a checksum or signature check. Add a trusted SHA-256 digest for this release asset and validate the archive before install. If SwiftLint only supports another distribution path, use that path instead of the direct release asset.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/hooks/session-start.sh around lines 105 - 110, Add trusted SHA-256
verification to the SwiftLint download flow in the session-start script: define
the expected digest for the selected swiftlint_version release asset, validate
swiftlint.zip before unzip/install, and abort on mismatch. Keep installation
through the verified archive, or switch to a supported distribution path if the
asset cannot be reliably verified.
| "hooks": [ | ||
| { | ||
| "type": "command", | ||
| "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/session-start.sh" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Quote the hook path.
Line 8 expands CLAUDE_PROJECT_DIR without quotes. If the project path contains whitespace, the shell splits the command and the SessionStart hook fails.
Proposed fix
- "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/session-start.sh"
+ "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/session-start.sh\""📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/session-start.sh" | |
| "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/session-start.sh\"" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/settings.json at line 8, Quote the CLAUDE_PROJECT_DIR-based hook
command in the SessionStart configuration so paths containing whitespace remain
a single shell argument; update the command value without changing the hook
script or surrounding configuration.
2 participants
Installs the swift.org Ubuntu 24.04 system deps, then swiftly and the
toolchain pinned by .swift-version, and persists the Swift PATH to
CLAUDE_ENV_FILE. Skips entirely when swift is already installed or the
session is not remote.
Not yet verified end-to-end: download.swift.org is currently blocked by
the environment network policy and must be allowlisted first.
Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_012gBcWa6xeuaMwdvzSfruns
Summary by CodeRabbit
Chores
Bug Fixes
Documentation