Fixes a potential TOCTOU bug in the locking mechanism by restructuring
and using file moves which are atomic on both windows and unix.
FIXME: This commit introduces a bug where if there is are two concurrent
processes attempting to install a tool such that the tool has artifact
naming patterns that we understand (and hence do not need to download
every artifact for), the parent installation process (i.e., the one
which started first) yields indefinitely even after installing and
running the tool.
`os.time()` returns a timestamp in seconds, not milliseconds, but the
expiration time was adding 60,000 assuming it was in milliseconds. This
has now been corrected to only add 60 in seconds.
This allows for us to know whether a lock file is too old and hence
invalid, and perform a sanity check to ensure that the resource it is
meant to be protecting is the resource we are trying to access.
* Fixes an issue to do with multiple installation attempts trying
to access the same resources concurrently, causing installation
errors
* Made conditional progress bar a shared state among `__call` metamethod
shorthand and `installTool`, in order to prevent constructing it in
two different places
We did not correctly handle the case if the `gh` CLI was not present,
since `process.spawn` errors. We now wrap it in a `Result.try` and
handle that as required.
* Looks for `$GITHUB_TOKEN` env var, and if not found, tries to run `gh
auth token` to get the token from the GitHub CLI.
* Made a conditional `start` method for the bar, which was previously
missed.
Tools are now stored in the `~/.pesde/bin/.tool_storage` directory, in
order to prevent naming conflicts with other tool linkers. An old
tool_storage directory gets migrated to the new path if present.
* Made bar related conditional operations get constructed by a
`makeCondBar` which returns a table of functions to conditionally handle
a progress bar.
* Moved progress bar boolean out of function args for `installTool` into
global state.
Formerly, we used metatables to get custom `Option` and `Result` objects
which were difficult to type properly, leading to a lot of `unknown` and
`any` casts.
This refactor fixes it by making extensions opt-in, where we import the
extension methods separately from the original implementations, thereby
allowing us to not have to typecast things everywhere.
Previously, we assumed that the tools followed semver, and hence parsed
their versions for comparison. Some tools may not follow semver, and we
should not impose such a requirement as a toolchain management library.
Therefore, we now only check if the requested version string matches an
asset version tag. In order to ensure backwards compatibility, we strip
the leading `v` from the version if present.