Skip to content

build: make standalone source builds reproducible #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
0717lee wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build: make standalone source builds reproducible #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 21 additions & 13 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,21 +75,29 @@ The hosted catalog remains available while the native integration is finalized a
| `store_catalog` | Browse and rank catalog entries. |
| `store_install` | Return reviewed installation instructions. |

## Reproducible development installation
## Reproducible standalone development

DeepSeek Harness is evolving rapidly. For the current source integration, clone
this repository into a Harness checkout, install the workspace, and build the
host and Web client faces:
The source build no longer requires a DeepSeek Harness monorepo checkout. A
clean clone installs the public rc.8 development packages and reproduces the
committed Host, Web client, and declaration artifacts:

```bash
cd /path/to/deepseek-harness
git clone https://github.com/sandbaseai/dsh-plugin-store.git packages/plugins/dsh-store
pnpm install
pnpm --filter @sandbaseai/dsh-plugin-store typecheck
pnpm --filter @sandbaseai/dsh-plugin-store bundle
git clone https://github.com/sandbaseai/dsh-plugin-store.git
cd dsh-plugin-store
corepack pnpm install --frozen-lockfile
corepack pnpm verify
```

Then enable the bundle in the Web profile:
To test source changes in DSH, build a local tarball and install that explicit
artifact into a disposable Web profile:

```bash
corepack pnpm build
npm pack
dsh plugin --profile web add -w /absolute/path/sandbaseai-dsh-plugin-store-0.1.0-preview.5.tgz
```

The bundle uses this Web profile configuration:

```yaml
- insert:
Expand All @@ -105,9 +113,9 @@ The release tarball installs the committed Host and Web client artifacts.
Preview 5 declares public rc.8 runtime peers, uses the rc.8 `insert` patch
schema, and installs only Leaderboard runtime-verified npm package specs. Its
package graph, Host entrypoint, composed profile configuration, and Store-button
installation path are verified in an isolated DSH environment. The
source-checkout path above remains the development route for rebuilding
artifacts inside the Harness workspace.
installation path are verified in an isolated DSH environment. The standalone
build keeps the rc.8 runtime packages as peers; its pinned development packages
exist only to typecheck and reproduce the published artifacts.

## Architecture

Expand Down
33 changes: 14 additions & 19 deletions README.zh.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,22 +27,26 @@ dsh plugin --profile web add -w /tmp/sandbaseai-dsh-plugin-store-0.1.0-preview.5

版本化 tarball 可避免 `main` 后续更新悄然改变实际安装的代码，并绕开 git 依赖的构建授权；`-w` 明确确认 Web profile 是 pnpm workspace 根目录。Preview 5 面向公开的 DeepSeek Harness `0.1.0-rc.8` 运行时。重启 DSH Web 后打开 **Settings → Store**。当前仍是预览集成，安装前请检查源码。

## 可复现的开发安装
## 可复现的独立开发构建

如需重新构建产物，请将本仓库克隆到 DeepSeek Harness 源码工作区，再构建 Host 与 Web client：
源码构建不再依赖 DeepSeek Harness monorepo。全新 clone 会安装公开的 rc.8 开发包，并复现已提交的 Host、Web client 和类型声明产物：

```bash
cd /path/to/deepseek-harness
git clone https://github.com/sandbaseai/dsh-plugin-store.git packages/plugins/dsh-store
pnpm install
pnpm --filter @sandbaseai/dsh-plugin-store typecheck
pnpm --filter @sandbaseai/dsh-plugin-store bundle
dsh web
git clone https://github.com/sandbaseai/dsh-plugin-store.git
cd dsh-plugin-store
corepack pnpm install --frozen-lockfile
corepack pnpm verify
```

启动后打开 DSH Settings，选择 **Store**。
如需在 DSH 中验证源码改动，请构建本地 tarball，并将这个明确的产物安装到一次性 Web profile：

Release tarball 安装仓库中已提交的 Host 与 Web client 构建产物。Preview 5 已改用公开 rc.8 运行时 peer 与 rc.8 `insert` patch schema，并且只允许安装 Leaderboard 已完成运行时验证的 npm package spec；package graph、Host 入口、profile 配置合成与 Store 按钮安装路径均在隔离 DSH 环境中验证。源码 checkout 仍用于在 Harness 工作区内重新构建这些产物。
```bash
corepack pnpm build
npm pack
dsh plugin --profile web add -w /absolute/path/sandbaseai-dsh-plugin-store-0.1.0-preview.5.tgz
```

Release tarball 安装仓库中已提交的 Host 与 Web client 构建产物。Preview 5 已改用公开 rc.8 运行时 peer 与 rc.8 `insert` patch schema，并且只允许安装 Leaderboard 已完成运行时验证的 npm package spec；package graph、Host 入口、profile 配置合成与 Store 按钮安装路径均在隔离 DSH 环境中验证。独立构建继续把 rc.8 运行时包保留为 peer；固定的开发包只用于类型检查和复现发布产物。

## 配置

Expand Down Expand Up @@ -85,15 +89,6 @@ Release tarball 安装仓库中已提交的 Host 与 Web client 构建产物。P
- 安装 spec 必须来自详情 API，且只能是 npm package spec；拒绝 URL、git spec 与 shell 语法
- 新插件需要重启 DSH 后生效

## 开发

```bash
pnpm install
pnpm --dir packages/plugins/dsh-store run typecheck
pnpm --dir packages/plugins/dsh-store run bundle
pnpm dsh web
```

## 相关项目

- [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)
Expand Down
Loading