refactor: support OCI web bundles for spx runtime installs

[aofei]

Update install-spx.sh to try the GitHub release asset first and fall back to downloading ghcr.io/goplus/spx:web-zip-<version> from GHCR with wget for pseudo-versioned runtimes.

Align Docker and Vercel with the lighter install flow. Keep the runtime installation on the Node install path and avoid requiring Go there.

Bump the project Go toolchain to 1.25 across Docker, Vercel, CI, and the tools/ai, tools/ispx, and tools/spxls modules.

Refresh spx to 2.0.0-pre.46.0.20260311090023-f1d975cfeca5 across the runtime defaults and tool modules, and bump xgolsw to 0.16.2-0.20260311065322-dd7cbc43c3b4 while keeping the ixgo-based toolchain on versions that no longer require the old linkname flags.

Update the local Wasm build toolchain to match the new runtime bundle flow and dependency versions.

Updates goplus/spx#1348

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces significant changes to how the spx runtime is installed and managed, primarily by adding support for OCI web bundles as a fallback mechanism. It also includes a comprehensive upgrade of the Go toolchain to version 1.25 across various environments and modules, along with updates to several Go dependencies. These changes streamline the build process, particularly for Docker and Wasm components, and ensure compatibility with the latest spx module versions, improving the overall development and deployment workflow.

Highlights

• OCI Web Bundle Support: The install-spx.sh script has been refactored to first attempt downloading spx runtime assets from GitHub releases and then fall back to pulling from an OCI registry (ghcr.io/goplus/spx) for pseudo-versioned runtimes.
• Go Toolchain and Dependency Updates: The project's Go toolchain has been upgraded to Go 1.25 across Docker, Vercel, CI, and the tools/ai, tools/ispx, and tools/spxls modules. Additionally, spx modules were refreshed to 2.0.0-pre.46.0.20260310122154-8ad6b7da03ad, xgolsw was updated, and other Go dependencies were bumped to versions that no longer require the old linkname flags.
• Docker Build Process Alignment: The Docker build process has been updated to install the spx runtime in the Go build stage, reuse it in the frontend stage, and ensure Go is set up before npm ci triggers postinstall.
• Wasm Build Toolchain Refresh: The local Wasm build toolchain has been updated to align with the new runtime bundle flow and dependency versions, including removing the -checklinkname=0 flag from ispx's build script.
• Automated Agent Instructions Update: The spx-upgrader agent's instructions were modified to reflect the new pseudo-version verification process for OCI packages and updated installation steps.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• .github/agents/spx-upgrader.md
  • Updated instructions to require specifying target spx version or pseudo-version.
  • Modified verification steps to check GitHub releases for released versions and OCI packages for pseudo-versioned dev commits.
  • Adjusted .env update instruction to only mention VITE_SPX_VERSION.
  • Updated install-spx.sh execution description to reflect downloading runtime assets instead of just spx_web.zip.
• Dockerfile
  • Updated GO_BASE_IMAGE from golang:1.24.4 to golang:1.25.8.
  • Added unzip package installation to the go-builder stage.
  • Moved install-spx.sh execution before build-wasm.sh in the go-builder stage.
  • Modified frontend-builder stage to copy public directory from the go-builder stage.
• spx-gui/.env
  • Updated VITE_SPX_VERSION from 2.0.0-pre.46 to 2.0.0-pre.46.0.20260310122154-8ad6b7da03ad.
• spx-gui/.vscode/tasks.json
  • Updated GOTOOLCHAIN environment variable from go1.24.4 to go1.25.8 for Wasm build task.
• spx-gui/README.md
  • Updated minimum Go version requirement from >= 1.24.0 to >= 1.25.0.
• spx-gui/install-spx.sh
  • Updated SPX_VERSION to 2.0.0-pre.46.0.20260310122154-8ad6b7da03ad and added ORAS_CLI_VERSION.
  • Introduced SPX_RELEASE_URL and SPX_OCI_REF variables for different download sources.
  • Implemented logic to first attempt installation from GitHub release and fall back to OCI registry if the release URL is not found.
  • Added staging directory (SPX_STAGING_DIR) for temporary downloads and extraction, ensuring cleanup with a trap command.
• spx-gui/vercel-install.sh
  • Updated Go download URL and extraction for Vercel deployments from go1.24.4 to go1.25.8.
• tools/ai/go.mod
  • Updated Go language version from 1.24.0 to 1.25.0.
  • Updated github.com/goplus/spx/v2 dependency to v2.0.0-pre.46.0.20260310122154-8ad6b7da03ad.
• tools/ai/go.sum
  • Updated checksums for github.com/goplus/spx/v2.
  • Removed github.com/h2non/filetype dependency and its checksums.
• tools/ispx/build.sh
  • Removed -checklinkname=0 flag from go build -ldflags command.
• tools/ispx/go.mod
  • Updated Go language version from 1.24.0 to 1.25.0.
  • Updated github.com/goplus/ixgo from v0.61.0 to v1.0.4.
  • Updated github.com/goplus/mod from v0.19.2 to v0.19.5.
  • Updated github.com/goplus/spx/v2 to v2.0.0-pre.46.0.20260310122154-8ad6b7da03ad.
  • Updated various indirect dependencies including github.com/goplus/gogen, github.com/goplus/reflectx, github.com/goplus/xgo, github.com/qiniu/x, github.com/visualfc/goembed, github.com/visualfc/xtype, golang.org/x/mod, and golang.org/x/tools.
• tools/ispx/go.sum
  • Updated checksums for numerous Go module dependencies, reflecting version bumps and removals (e.g., github.com/gopherjs/gopherjs, github.com/h2non/filetype, github.com/pkg/errors, github.com/visualfc/gid).
• tools/spxls/go.mod
  • Updated Go language version from 1.24.0 to 1.25.0.
  • Updated github.com/goplus/xgolsw to v0.16.2-0.20260310020249-cc92d247b672.
  • Updated various indirect dependencies including github.com/goplus/gogen, github.com/goplus/mod, github.com/goplus/spx/v2, github.com/goplus/xgo, github.com/qiniu/x, golang.org/x/mod, golang.org/x/sync, golang.org/x/text, and golang.org/x/tools.
• tools/spxls/go.sum
  • Updated checksums for numerous Go module dependencies, reflecting version bumps and removals (e.g., github.com/h2non/filetype, github.com/pkg/errors).

Ignored Files

• Ignored by pattern: .github/workflows/** (1)
  • .github/workflows/validate.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request refactors the spx runtime installation to support OCI web bundles, providing a fallback mechanism for pseudo-versions. The changes include updating install-spx.sh with a more robust installation flow, aligning Docker and CI configurations, and bumping the Go toolchain to 1.25 across the project. The dependencies for various tools have also been updated. The changes are well-structured and align with the goals described. I have one suggestion to improve the installation script's portability and maintainability.

I am having trouble creating individual review comments. Click here to see my feedback.

spx-gui/install-spx.sh (30-40)

This block can be improved for both portability and maintainability.

1. Portability: Using curl instead of wget is generally safer as curl is more widely available on different systems, which is beneficial for local development setups.
2. Maintainability: The unzip and rm commands are duplicated. They can be moved outside the if/else block to avoid repetition.

Here is a suggested refactoring that addresses both points.

if curl --output /dev/null --silent --head --fail "${SPX_RELEASE_URL}"; then
  # Install from GitHub release
  curl -L -o "${SPX_STAGING_DIR}/spx_web.zip" "${SPX_RELEASE_URL}"
else
  # Install from OCI registry
  go run "oras.land/oras/cmd/oras@v${ORAS_CLI_VERSION}" pull "${SPX_OCI_REF}" -o "${SPX_STAGING_DIR}"
fi

unzip -o "${SPX_STAGING_DIR}/spx_web.zip" -d "${SPX_STAGING_DIR}"
rm -f "${SPX_STAGING_DIR}/spx_web.zip"