graph-it-live

LOW

maintainer omgold 0 votes scanned 2026-10-25 09:42:04.970873

View on AUR

Why flagged

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: omgold@aur
    
      2
    
      3pkgname=graph-it-live
    
      4pkgver=1.21.0
    
      5pkgrel=1
    
      6pkgdesc='Local code dependency and call-graph analysis CLI and MCP server'
    
      7arch=('any')
    
      8url='https://github.com/magic5644/Graph-It-Live'
    
      9license=('MIT')
    
      10depends=('nodejs>=22')
    
      11makedepends=('npm')
    
      12optdepends=('git: analysis of changes against Git revisions')
    
      13options=('!strip' '!debug')
    
      14source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      15        'tree-sitter-compat.patch'
    
      16        'stage-runtime.cjs')
    
      17sha256sums=('c97085159641d75ef541ef88d3b68c353cae4dbad2abde6b9aa29c8d84c55a44'
    
      18            'fbd0302a4ccd6119d049314520a7525a748a77ccb613e67bc8413d5118cf0568'
    
      19            '61a7c67112bc8566efc783724021c11d579be21de702f87f8c328c8fbfb3eb82')
    
      20
    
      21prepare() {
    
      22  cd "Graph-It-Live-$pkgver"
    
      23  # 0.26 rejects the legacy dylink format in tree-sitter-wasms 0.1.13.
    
      24  # Pin 0.25.10 in both manifests, including its npm integrity checksum.
    
      25  patch -Np1 -i "$srcdir/tree-sitter-compat.patch"
    
      26  # The lockfile pins npm downloads and verifies their integrity. Keep npm's
    
      27  # cache in srcdir; neither building nor packaging needs network access.
    
      28  npm ci --ignore-scripts --no-audit --no-fund --cache "$srcdir/npm-cache"
    
      29  # Upstream keeps 0.0.1 in Git and stamps the release version before building.
    
      30  npm version "$pkgver" --no-git-tag-version --ignore-scripts --offline \
    
      31    --cache "$srcdir/npm-cache"
    
      32}
    
      33
    
      34build() {
    
      35  cd "Graph-It-Live-$pkgver"
    
      36  npm run build:cli -- --production
    
      37  node "$srcdir/stage-runtime.cjs" "$PWD" "$srcdir/runtime"
    
      38
    
      39  # Retain upstream's exact versions for the external runtime libraries and
    
      40  # their dependencies; everything needed is already in the prepare() cache.
    
      41  cd "$srcdir/runtime"
    
      42  npm install --package-lock-only --omit=dev --ignore-scripts --offline \
    
      43    --no-audit --no-fund --cache "$srcdir/npm-cache"
    
      44  npm ci --omit=dev --ignore-scripts --offline --no-audit --no-fund \
    
      45    --cache "$srcdir/npm-cache"
    
      46  node "$srcdir/stage-runtime.cjs" --verify \
    
      47    "$srcdir/Graph-It-Live-$pkgver" "$PWD"
    
      48  find node_modules -type f -name '*.map' -delete
    
      49}
    
      50
    
      51package() {
    
      52  install -dm755 "$pkgdir/usr/lib/$pkgname" "$pkgdir/usr/bin"
    
      53  cp -a "$srcdir/runtime/"{dist,node_modules,package.json} \
    
      54    "$pkgdir/usr/lib/$pkgname/"
    
      55  ln -s "/usr/lib/$pkgname/dist/graph-it.js" "$pkgdir/usr/bin/graph-it"
    
      56
    
      57  cd "Graph-It-Live-$pkgver"
    
      58  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      59  cp -a "$srcdir/runtime/licenses" "$pkgdir/usr/share/licenses/$pkgname/bundled"
    
      60  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      61  install -Dm644 docs/CLI.md "$pkgdir/usr/share/doc/$pkgname/CLI.md"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-25 09:42:04	Low	1