Skip to content

Fix standalone setup.cmake version resolution to avoid invalid vX.Y.Z checkout#21

Open
Copilot wants to merge 3 commits into
mainfrom
copilot/fix-initialization-fail-quick-start
Open

Fix standalone setup.cmake version resolution to avoid invalid vX.Y.Z checkout#21
Copilot wants to merge 3 commits into
mainfrom
copilot/fix-initialization-fail-quick-start

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 19, 2026

Quick-start usage of downloaded setup.cmake (curl ... && cmake -P setup.cmake) could not resolve a local git tag, emitted X.Y.Z, and generated CPMAddPackage("gh:stlab/cpp-library@X.Y.Z"), which fails at checkout. This change makes standalone setup resolve a valid ref instead of producing an unusable placeholder.

  • Version resolution in setup.cmake

    • Keep current behavior when local git tags exist (git describe --tags --abbrev=0).
    • Add standalone fallback: query remote tags from stlab/cpp-library, extract semver tags, and select the latest version.
    • Add a bounded network lookup (TIMEOUT 10) to avoid hanging on restricted networks.
    • Replace placeholder fallback from X.Y.Z to main as a safe last resort.
  • Regression coverage for quick-start path

    • Add tests/setup/test_setup_version_resolution.cmake to exercise the standalone-script flow.
    • Assert generated project CMakeLists:
      • does not contain @X.Y.Z
      • contains @<semver> or @main
  • CI integration

    • Run the new setup-version regression test in the unit test job.
# Generated by standalone setup flow (now guaranteed valid)
CPMAddPackage("gh:stlab/cpp-library@5.2.0")
# ...or fallback:
CPMAddPackage("gh:stlab/cpp-library@main")

Note

Medium Risk
Moderate risk because it changes bootstrap/version-selection behavior and adds a remote git ls-remote call (bounded by a timeout), which could affect users in restricted network environments.

Overview
Standalone setup.cmake now generates a valid cpp-library ref. When no local git tags are available, it queries remote tags, extracts the latest semver release, and uses that for CPMAddPackage; if that fails it falls back to main instead of X.Y.Z.

Adds a new integration test (tests/setup/test_setup_version_resolution.cmake) asserting the generated project never references @X.Y.Z and only references @<semver> or @main, and wires this test into the unit-test CI workflow.

Reviewed by Cursor Bugbot for commit dcab025. Bugbot is set up for automated code reviews on this repo. Configure here.

Copilot AI and others added 2 commits May 19, 2026 23:30
Copilot AI changed the title [WIP] Fix initialization failure in quick start setup Fix standalone setup.cmake version resolution to avoid invalid vX.Y.Z checkout May 19, 2026
Copilot AI requested a review from sean-parent May 19, 2026 23:33
Copy link
Copy Markdown
Member

@sean-parent sean-parent left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sean-parent sean-parent marked this pull request as ready for review May 19, 2026 23:38
Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit dcab025. Configure here.

Comment thread setup.cmake

# Last-resort fallback to main branch so initialization still works
if(NOT CPP_LIBRARY_VERSION)
set(CPP_LIBRARY_VERSION "main")
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fallback @main produces invalid CPM checkout tag

High Severity

The last-resort fallback sets CPP_LIBRARY_VERSION to "main", which gets interpolated into the template as CPMAddPackage("gh:stlab/cpp-library@main"). In CPM.cmake's shorthand syntax, the @ operator sets the VERSION parameter, and CPM derives GIT_TAG by prepending v — so @main resolves to GIT_TAG=vmain, a tag that doesn't exist. The correct syntax for a branch reference is #main, not @main. This means the fallback path still produces an unusable checkout, which is exactly the bug this PR aims to fix.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit dcab025. Configure here.

Comment thread setup.cmake
# Detect cpp-library version from git tags
# Extract latest semantic version from a list of refs/tags/vX.Y.Z entries
function(extract_latest_cpp_library_version_from_tags TAG_REFS OUTPUT_VAR)
string(REGEX MATCHALL "refs/tags/v[0-9]+\\.[0-9]+\\.[0-9]+" TAG_REFS_MATCHES "${TAG_REFS}")
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unanchored regex matches pre-release tags as releases

Low Severity

The MATCHALL regex refs/tags/v[0-9]+\\.[0-9]+\\.[0-9]+ has no end-of-token anchor, so it performs substring matching. A pre-release tag like refs/tags/v2.0.0-rc1 would partially match as refs/tags/v2.0.0, causing the function to return version 2.0.0 even if only the -rc1 tag exists. CPM would then attempt to check out the nonexistent v2.0.0 tag and fail — the same class of problem this PR aims to fix.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit dcab025. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Initialization fail when using quick start setup

2 participants