install: reuse lockfile-resolved git packages for branch and bare refs when re-resolving - #37143
Open
robobun wants to merge 11 commits into
Open
install: reuse lockfile-resolved git packages for branch and bare refs when re-resolving#37143robobun wants to merge 11 commits into
robobun wants to merge 11 commits into
Claude / Claude Code Review
completed
Aug 7, 2026 in 31m 39s
Code review found 1 important issue
Found 2 candidates, confirmed 3. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 2 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | src/install/PackageManager/PackageManagerEnqueue.rs:1986-2011 |
Changing an override/catalog git committish is silently ignored when multiple dependency slots share the name |
| 🟡 Nit | src/install/PackageManager/PackageManagerEnqueue.rs:2006-2008 |
SCP-style git URLs (git@host:path) are excluded from the lockfile reuse optimization |
Annotations
Check failure on line 2011 in src/install/PackageManager/PackageManagerEnqueue.rs
claude / Claude Code Review
Changing an override/catalog git committish is silently ignored when multiple dependency slots share the name
Changing an override or catalog entry's git committish (e.g. `#v1` → `#v2` on the same repo URL) is now silently ignored whenever ≥2 dependency slots carry that name: the override/catalog loops in `install_with_manager.rs:487-527` invalidate and re-enqueue **one slot at a time**, so when `find_locked_git_package` scans for slot *i* it finds sibling slot *j* still bound to the stale package — same pre-override `name_hash`/`version.tag`/`version.literal`, and the repo/owner check passes because on
Check warning on line 2008 in src/install/PackageManager/PackageManagerEnqueue.rs
claude / Claude Code Review
SCP-style git URLs (git@host:path) are excluded from the lockfile reuse optimization
Bare SCP-style git specifiers (`git@host:owner/repo.git#ref` — the default SSH remote form for private repos) don't benefit from this reuse: the lockfile Formatter prepends `ssh://` on write (repository.rs:1097) but `parse_append_git` doesn't strip it on read, so `locked.repo` = `"ssh://git@host:..."` never byte-equals the freshly-parsed `"git@host:..."` here and the guard falls through to the fetch task. Not a regression — behavior for these URLs is unchanged from before the PR — but stripping
Loading