Refactor Dockerfile and analysis script to remove Node.js dependency for Claude CLI installation#2101
Refactor Dockerfile and analysis script to remove Node.js dependency for Claude CLI installation#2101kaovilai wants to merge 1 commit intoopenshift:oadp-devfrom
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review infoConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Cache: Disabled due to data retention organization setting Knowledge base: Disabled due to data retention organization setting 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
WalkthroughReplaces Node.js/npm-based Claude CLI installation with a native Claude CLI binary installer (via curl) across build config, documentation, and test scripts; removes NodeSource/Node.js/npm install steps and adds a symlinked native Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Comment |
openshift-ci
bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@build/ci-Dockerfile`:
- Around line 17-19: Replace the unpinned installer invocation that runs "curl
-fsSL https://claude.ai/install.sh | bash" with a pinned-and-verified install:
call the installer with an explicit channel or version (e.g., pass "stable" or
"X.Y.Z" via "bash -s") and validate the downloaded release checksum before
running the installer by fetching the VERSION's manifest.json from Anthropic's
release storage and verifying the SHA256; keep the existing symlink step that
creates /usr/local/bin/claude after successful installation (the ln -sf
~/.claude/bin/claude /usr/local/bin/claude command) so the binary path remains
unchanged.
ℹ️ Review info
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
📒 Files selected for processing (3)
build/ci-Dockerfiledocs/design/claude-prow-failure-analysis_design.mdtests/e2e/scripts/analyze_failures.sh
build/ci-Dockerfile
Outdated
| # Install Claude CLI (native binary, no Node.js dependency) | ||
| RUN curl -fsSL https://claude.ai/install.sh | bash && \ | ||
| ln -sf ~/.claude/bin/claude /usr/local/bin/claude |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Claude CLI official installation method version pinning checksum verification
💡 Result:
Official install (Claude Code / “Claude CLI”)
Native installer (recommended):
- macOS / Linux / WSL:
curl -fsSL https://claude.ai/install.sh | bash - Windows PowerShell:
irm https://claude.ai/install.ps1 | iex - Windows CMD:
curl -fsSL https://claude.ai/install.cmd -o install.cmd && install.cmd && del install.cmd[1]
Homebrew / WinGet:
brew install --cask claude-codewinget install Anthropic.ClaudeCode[1]
NPM (deprecated): npm install -g @anthropic-ai/claude-code`` [1]
Version pinning
Native installer: pin to a channel or exact version
- Stable channel:
curl -fsSL https://claude.ai/install.sh | bash -s stable - Exact version:
curl -fsSL https://claude.ai/install.sh | bash -s 1.0.58
(Windows variants are shown in the same doc.) [1]
Also: the install-time choice (“latest” vs “stable”) becomes the default for auto-updates, and you can set "autoUpdatesChannel": "stable" in settings.json to stay on stable. [1]
NPM: pin to an exact version
Use standard npm version syntax, e.g.:
npm install -g@anthropic-ai/claude-code@X.Y.Z
(NPM is deprecated, but still supported.) [1]
Checksum verification (SHA256) + code signing
- Anthropic publishes SHA256 checksums in a per-version release manifest:
https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/{VERSION}/manifest.json[1]
Typical workflow:
- Download the binary you intend to install.
- Download the matching
manifest.jsonfor that exact{VERSION}. - Compare your local
sha256of the binary against the manifest’s SHA256 for your OS/arch. [1]
Code signing: macOS binaries are signed by “Anthropic PBC” (and notarized by Apple) and Windows binaries are signed by “Anthropic, PBC”. [1]
Source: Set up Claude Code (official docs). [1]
Pin the Claude CLI installer to a stable version.
The current curl -fsSL https://claude.ai/install.sh | bash pulls "latest" at build time, creating non-reproducible builds and weakening supply-chain guarantees. Anthropic provides version pinning and checksum verification:
- Version pinning: Append
bash -s stable(for stable channel) orbash -s X.Y.Z(for exact version, e.g.,bash -s 1.0.58) - Checksum verification: SHA256 checksums are published per-version at
https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/{VERSION}/manifest.json, along with code signing (macOS/Windows) - Alternative: Consider
brew install --cask claude-code(if Homebrew is available in your base image) for better reproducibility in container environments
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@build/ci-Dockerfile` around lines 17 - 19, Replace the unpinned installer
invocation that runs "curl -fsSL https://claude.ai/install.sh | bash" with a
pinned-and-verified install: call the installer with an explicit channel or
version (e.g., pass "stable" or "X.Y.Z" via "bash -s") and validate the
downloaded release checksum before running the installer by fetching the
VERSION's manifest.json from Anthropic's release storage and verifying the
SHA256; keep the existing symlink step that creates /usr/local/bin/claude after
successful installation (the ln -sf ~/.claude/bin/claude /usr/local/bin/claude
command) so the binary path remains unchanged.
There was a problem hiding this comment.
Pull request overview
This pull request removes the Node.js dependency for Claude CLI installation by switching from the npm package @anthropic-ai/claude-code to a direct installation using a shell script. The change simplifies the container image by eliminating the need for Node.js and npm, relying instead on a native binary installation method.
Changes:
- Replaced Node.js/npm-based Claude CLI installation with a curl-based shell script installation
- Updated installation instructions in error messages to reflect the new installation method
- Updated design documentation to reflect the new installation approach
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| build/ci-Dockerfile | Removed Node.js installation steps and replaced with direct Claude CLI installation via shell script |
| docs/design/claude-prow-failure-analysis_design.md | Updated Dockerfile documentation and error message with new installation command |
| tests/e2e/scripts/analyze_failures.sh | Updated error message to show new installation command using curl instead of npm |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| dnf clean all | ||
| # Install Claude CLI (native binary, no Node.js dependency) | ||
| RUN curl -fsSL https://claude.ai/install.sh | bash && \ | ||
| ln -sf ~/.claude/bin/claude /usr/local/bin/claude |
There was a problem hiding this comment.
The symlink uses ~/.claude/bin/claude which expands to the home directory of the user running the RUN command (typically root in Dockerfiles). If the container runs as a different user at runtime, the symlink may point to a non-existent path. Consider using an absolute path or verify that the installation script places the binary in a location accessible to all users, or copy the binary directly to /usr/local/bin instead of symlinking.
| ln -sf ~/.claude/bin/claude /usr/local/bin/claude | |
| cp ~/.claude/bin/claude /usr/local/bin/claude |
build/ci-Dockerfile
Outdated
| dnf clean all | ||
| # Install Claude CLI (native binary, no Node.js dependency) | ||
| RUN curl -fsSL https://claude.ai/install.sh | bash && \ | ||
| ln -sf ~/.claude/bin/claude /usr/local/bin/claude |
There was a problem hiding this comment.
The symlink uses ~/.claude/bin/claude which expands to the home directory of the user running the RUN command (typically root in Dockerfiles). If the container runs as a different user at runtime, the symlink may point to a non-existent path. Consider using an absolute path or verify that the installation script places the binary in a location accessible to all users, or copy the binary directly to /usr/local/bin instead of symlinking.
| ln -sf ~/.claude/bin/claude /usr/local/bin/claude | |
| cp "$HOME/.claude/bin/claude" /usr/local/bin/claude && \ | |
| chmod 755 /usr/local/bin/claude |
| RUN curl -fsSL https://claude.ai/install.sh | bash && \ | ||
| ln -sf ~/.claude/bin/claude /usr/local/bin/claude |
There was a problem hiding this comment.
The installation URL https://claude.ai/install.sh should be verified to ensure it exists and is the correct official installation source for Claude CLI. Consider adding verification (such as checking a checksum or signature) after downloading the installation script, or documenting the source URL in comments to help future maintainers verify its authenticity. The curl | bash pattern executes remote code directly, which requires high trust in the source.
| RUN curl -fsSL https://claude.ai/install.sh | bash && \ | |
| ln -sf ~/.claude/bin/claude /usr/local/bin/claude | |
| # The installer script is served from the official Claude site. For hardened builds, | |
| # provide CLAUDE_INSTALL_SHA256 to verify the script integrity. | |
| ARG CLAUDE_INSTALL_SHA256 | |
| RUN curl -fsSLo /tmp/claude-install.sh https://claude.ai/install.sh && \ | |
| if [ -n "${CLAUDE_INSTALL_SHA256:-}" ]; then \ | |
| echo "${CLAUDE_INSTALL_SHA256} /tmp/claude-install.sh" | sha256sum -c -; \ | |
| fi && \ | |
| bash /tmp/claude-install.sh && \ | |
| ln -sf ~/.claude/bin/claude /usr/local/bin/claude && \ | |
| rm -f /tmp/claude-install.sh |
| npm install -g @anthropic-ai/claude-code && \ | ||
| dnf clean all | ||
| # Install Claude CLI (native binary, no Node.js dependency) | ||
| RUN curl -fsSL https://claude.ai/install.sh | bash && \ |
There was a problem hiding this comment.
The RUN curl -fsSL https://claude.ai/install.sh | bash line executes a remote installation script as root during the CI image build without any integrity or authenticity verification beyond HTTPS. If an attacker compromises claude.ai or this script’s delivery path, they can run arbitrary code inside your build image and, transitively, any CI jobs that use it, leading to a supply chain compromise. Prefer installing the Claude CLI from a package or pinned artifact with a verified checksum or signature instead of piping a mutable remote script directly to bash.
|
kaovilai
force-pushed
the
no-npm-claude
branch
from
d804f74 to
1df2f8e
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docs/design/claude-prow-failure-analysis_design.md`:
- Around line 66-68: Update the design doc snippet to match the Dockerfile by
replacing the installer path "~/.claude/bin/claude" with the actual path used in
the build ( "~/.local/bin/claude" ) and mention that the Dockerfile runs a
CLAUDE version check after installation; ensure the doc text mirrors the install
line and the subsequent version verification so the design doc and
build/ci-Dockerfile remain consistent.
ℹ️ Review info
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge base: Disabled due to data retention organization setting
📒 Files selected for processing (3)
build/ci-Dockerfiledocs/design/claude-prow-failure-analysis_design.mdtests/e2e/scripts/analyze_failures.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- tests/e2e/scripts/analyze_failures.sh
…for Claude CLI installation Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
kaovilai
force-pushed
the
no-npm-claude
branch
from
1df2f8e to
2cfcf02
Compare
kaovilai
added
the
tide/merge-method-squash
almost there.. need to update model name |
|
actually it was project name. edited per slack /retest |
|
@kaovilai: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
weshayutin
left a comment
weshayutin
left a comment
There was a problem hiding this comment.
/LGTM
THANK YOU @kaovilai
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: kaovilai, weshayutin The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Signed-off-by: Tiger Kaovilai tkaovila@redhat.com
Why the changes were made
How to test the changes made
Summary by CodeRabbit
Chores
Documentation