Add Taskfile.yaml and CI workflow by philpennock · Pull Request #2 · synadia-labs/treesitter-nats-server

philpennock · 2026-03-13T20:37:43Z

I wanted CI tests for protecting merges to main, so asked Claude to write, using Taskfile.

My "bright idea" of task install:$editor_name for editors where we could drop in a single file or not do complicated edits resulted in: 0 editors in task, they all require edits which couldn't be safely made.

But this has advanced things to where the README docs actually work for dev, not just for install, and made the process more robust, removing an npx layer which just created problems.

Taskfile provides tasks for building, testing, generating, and system-installing the grammar, plus ci: targets for automated checks. Editor install tasks are intentionally omitted — all supported editors require editing user config files, which cannot be done safely or idempotently by automation. See docs/editors/ for manual instructions. The GitHub Actions workflow runs the tree-sitter test corpus and example parsing on push/PR to main, and validates workflow files with zizmor. All action references are pinned to commit SHAs per security best practice. https://claude.ai/code/session_01B9bVHXAhzTQ1kzF9CDj8nq

tree-sitter-cli 0.25.x has native addon issues with Node 24+. Add .tool-versions pinning nodejs 22.16.0 for asdf/mise users, a _check-node internal task that gates generate/test targets on Node >=22 <24, and point the CI workflow at .tool-versions instead of hardcoding lts/*. https://claude.ai/code/session_01B9bVHXAhzTQ1kzF9CDj8nq

The tree-sitter-cli package downloads its binary via a postinstall script. Without an explicit npm ci step, npx finds the package but the binary is missing, causing ENOENT. Add an internal _npm-deps task (with source/generates caching) as a dependency of generate, test, and test:parse-examples. https://claude.ai/code/session_01B9bVHXAhzTQ1kzF9CDj8nq

The tree-sitter-cli npm wrapper downloads a platform-specific binary as a postinstall step. When that download fails silently the binary is missing and every `npx tree-sitter` invocation fails with ENOENT. Instead, require tree-sitter to be installed via `cargo install tree-sitter-cli` (or any other method that puts it in $PATH). The Taskfile now checks for both node and tree-sitter before running tasks. Changes: - Taskfile.yaml: remove TS_NPX var, rename _check-node → _check-tools, add tree-sitter precondition, use bare `tree-sitter` in all commands - package.json: remove tree-sitter-cli devDependency - README.md / docs/editors/vscode.md: replace npx invocations with bare tree-sitter commands https://claude.ai/code/session_01B9bVHXAhzTQ1kzF9CDj8nq

Now that tree-sitter-cli is no longer an npm devDependency, the CI runner needs the binary installed separately. Use the official tree-sitter/setup-action (CLI only, no lib needed). https://claude.ai/code/session_01B9bVHXAhzTQ1kzF9CDj8nq

Copilot

Pull request overview

This PR introduces a Taskfile-driven developer workflow and adds GitHub Actions CI for tests, while shifting from npx tree-sitter ... to invoking the tree-sitter CLI directly.

Changes:

Add Taskfile.yaml with build/test/CI tasks and tool precondition checks.
Add GitHub Actions workflow to run tests and validate workflows with zizmor.
Remove tree-sitter-cli from npm devDependencies and update docs/README to stop using npx tree-sitter.

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
`package.json`	Removes `tree-sitter-cli` from devDependencies (impacts how `tree-sitter` is provided).
`package-lock.json`	Lockfile updates reflecting removal of `tree-sitter-cli`.
`README.md`	Updates Quick Start commands to call `tree-sitter` directly.
`docs/editors/vscode.md`	Updates WASM build command to call `tree-sitter` directly.
`Taskfile.yaml`	Adds task automation for generate/build/test/CI checks with preconditions.
`.tool-versions`	Pins Node.js version for consistent dev/CI environments.
`.gitignore`	Ignores Task’s working directory `.task/`.
`.github/workflows/ci.yaml`	Adds CI workflow running Taskfile targets and zizmor.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

philpennock · 2026-03-13T20:54:13Z

Taskfile.yaml

+    desc: Validate GitHub Actions workflows with zizmor
+    preconditions:
+      - sh: command -v zizmor
+        msg: "zizmor is not installed — pip install zizmor"


The means for a human to install are not those that the CI system should use.

I will push an update which switches GH Actions to use the zizmorcore/zizmor-action action instead.

philpennock · 2026-03-13T20:57:04Z

.github/workflows/ci.yaml

+        with:
+          node-version-file: .tool-versions
+          cache: npm
+      - run: npm ci


No: the Taskfile is used by humans, not just by the GH Actions setup, as humans might want to debug what's going on. The GH Actions step does the install as a separate isolation step for better isolation of what's going on, and should ensure that the subsequent task invocation effectively no-ops the npm ci invocation -- all downloads will already be present.

The duplicated invocation, as long as it does not delete and re-download, is absolutely fine.

philpennock · 2026-03-13T20:57:26Z

.github/workflows/ci.yaml

+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - run: pipx run zizmor --format plain .github/workflows/


As above: switching to the official Action instead.

philpennock · 2026-03-13T20:59:28Z

package.json

  },
  "devDependencies": {
-    "tree-sitter-cli": "^0.25.3",
    "prebuildify": "^6.0.1"


NO. The tree-sitter-cli dep is broken; instead we (1) install tree-sitter in the GH workflow, and (2) have the _check-tools Task check that the tool is installed.

This removal was deliberate and improves reliability and reproducibility.

philpennock · 2026-03-13T21:00:15Z

README.md

 ```bash
 # Install dependencies
 npm install

 # Generate the parser
-npx tree-sitter generate
+tree-sitter generate

 # Run tests
-npx tree-sitter test
+tree-sitter test

 # Parse a file
-npx tree-sitter parse examples/basic.conf
+tree-sitter parse examples/basic.conf


Fair: I will make such a change locally, better.

philpennock · 2026-03-13T21:09:20Z

docs/editors/vscode.md

   git clone https://github.com/synadia-labs/treesitter-nats-server.git
   ```
 3. Build the WASM module:
   ```bash
   cd tree-sitter-nats-server-conf
-   npx tree-sitter build --wasm
+   tree-sitter build --wasm
   ```


Will address with my own phrasing.

philpennock · 2026-03-13T21:15:40Z

Taskfile.yaml

+        msg: "node is not installed — install Node.js 22 LTS (see .tool-versions)"
+      - sh: |
+          major=$(node -p "process.versions.node.split(\".\")[0]")
+          test "$major" -ge 22 -a "$major" -lt 24


NO: this is taskfile.dev which uses mvdan.cc/sh/v3 to embed an interpreter which implements much of bash. Part of the point here is to avoid the chaos of a bazillion different sh implementations with incompatible subsets of functionality, and instead have a reliable sh.

The task sh: implementation handles this fine and does not need work-arounds.

We now install zizmor via the official `zizmorcore/zizmor-action` action, properly pinned. Update various docs around how the tree-sitter command is installed. Testing the vscode steps created a .wasm file which was not being gitignored, so update `.gitignore` with patterns to match all build artifacts and not assume a sane user/global gitignore.

github-advanced-security · 2026-03-13T21:19:49Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Phil's Claude AI Account and others added 5 commits March 13, 2026 16:00

Add tree-sitter/setup-action to CI workflow

e2e137f

Now that tree-sitter-cli is no longer an npm devDependency, the CI runner needs the binary installed separately. Use the official tree-sitter/setup-action (CLI only, no lib needed). https://claude.ai/code/session_01B9bVHXAhzTQ1kzF9CDj8nq

philpennock self-assigned this Mar 13, 2026

philpennock requested a review from Copilot March 13, 2026 20:37

Copilot started reviewing on behalf of philpennock March 13, 2026 20:38 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

philpennock added this pull request to the merge queue Mar 13, 2026

Merged via the queue into main with commit de4641d Mar 13, 2026
3 checks passed

philpennock deleted the claude/add-taskfile-and-gh-actions-6mflx branch March 13, 2026 23:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Taskfile.yaml and CI workflow#2

Add Taskfile.yaml and CI workflow#2
philpennock merged 6 commits intomainfrom
claude/add-taskfile-and-gh-actions-6mflx

philpennock commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

philpennock Mar 13, 2026

Uh oh!

philpennock Mar 13, 2026

Uh oh!

philpennock Mar 13, 2026

Uh oh!

philpennock Mar 13, 2026

Uh oh!

philpennock Mar 13, 2026

Uh oh!

philpennock Mar 13, 2026

Uh oh!

philpennock Mar 13, 2026

Uh oh!

github-advanced-security bot commented Mar 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

philpennock commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

philpennock Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

philpennock Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

philpennock Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

philpennock Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

philpennock Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

philpennock Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

philpennock Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

github-advanced-security bot commented Mar 13, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants