Repository navigation
feat: add a task that copies a package from a GitHub repository - #69
Merged
Merged
Conversation
Contributor
matbox.tasks.vendorPackage downloads a GitHub repository at a branch, tag or commit and copies one of its folders into a project, replacing the previous copy. A toolbox uses it to ship another package inside its own namespace instead of requiring a separate installation. When the source and target are namespace folders with different names, the references to the source namespace in the copied .m files are renamed, for example "webprogress.upload" to "mytoolbox.external.webprogress.upload", in code, strings and comments. Error identifiers keep the source name. Files are rewritten as bytes, so everything outside the renamed references is unchanged whatever the encoding of the file. The license file of the repository is copied along, and vendorinfo.json in the copy records the repository, the reference, the commit, the two namespace names and the excluded files. The reference is resolved to a commit before the download, so the recorded commit is the one the files come from. The copy is prepared in a temporary folder and replaces the target as the last step, so an error leaves an existing copy unchanged. A target folder without a vendorinfo.json file is never replaced, so a wrong target path cannot delete other source code. The copy itself is in matbox.tasks.internal.vendorPackageFromFolder, which needs no network access. VendorPackageTest tests it against a repository created on disk; one test downloads the v0.11.0 tag of MatBox. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
vendorPackageFromFolder deleted the target folder before moving the new copy in, and its cleanup then removed the staged copy, so an error in either step left no copy at all. The new copy is now first moved next to the target, which is the step that can copy between volumes. The old folder is then renamed aside, the new one renamed into place, and the old one deleted. If the second rename fails, the old folder is moved back. The guard against replacing other code only checked that the target had a vendorinfo.json file. It now also requires that file to record the same repository and source folder, so a wrong target path cannot replace a different vendored package. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ehennestad
force-pushed
the
add-vendor-package-task
branch
from
October 15, 2026 20:15
b97028e to
c0bf11e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A toolbox that ships another package inside its own namespace has so far needed a hand-made copy, which drifts from upstream and loses its edits on the next update.
matbox.tasks.vendorPackagemakes the copy mechanical.matbox.tasks.vendorPackage(projectRootDirectory, sourceUri, sourceFolder, targetFolder)downloads a GitHub repository at a branch, tag or commit and copies one of its folders into the project, replacing the previous copy.ExcludeFilesleaves out files, and a name that matches no file is an error..mfiles, for examplewebprogress.uploadtomytoolbox.external.webprogress.upload, in code, strings and comments. Error identifiers keep the source name. Files are rewritten as bytes, so everything outside the renamed references is unchanged whatever the file's encoding.vendorinfo.jsonin the copy records the repository, the reference, the commit, both namespace names and the excluded files.vendorinfo.jsonfile is never replaced, so a wrong target path cannot delete other source code.vendorinfo.jsonrecords another repository or source folder is not replaced either, so a wrong target path cannot replace another vendored package.The copy itself is in
matbox.tasks.internal.vendorPackageFromFolder, which needs no network access.VendorPackageTesttests it against a repository created on disk; one test downloads the v0.11.0 tag of MatBox.EBRAINS-MATLAB already uses the task to vendor http-progressbar-matlab v2.0.0.
🤖 Generated with Claude Code