@zibby/bin-oxlint

Zibby-owned, self-vendored oxlint binary — the supply-chain-hardened way the code-scan skill gets oxlint into a run container without trusting an upstream npm package at run time.

Why

The upstream oxlint npm package pulls its platform binaries (@oxlint/binding-*) from the oxc project, and they auto-update within a caret. A compromised upstream publish would reach Zibby's run containers. Instead, Zibby fetches the binary from oxc's official GitHub release once — at Zibby's publish time — sha256-verifies it against a pinned digest (fail-closed), and vendors it into the per-platform package as a plain file. Run containers install Zibby's exact, pinned, vendored package. No upstream-npm binary trust, no run-time binary fetch.

Layout

| Package | Role | |---|---| | @zibby/bin-oxlint (this) | dispatcher — binPath() resolves the host's vendored binary | | @zibby/bin-oxlint-linux-x64 | vendored binary, os:[linux] cpu:[x64] (the prod run container) | | @zibby/bin-oxlint-linux-arm64 | vendored binary, os:[linux] cpu:[arm64] | | @zibby/bin-oxlint-darwin-arm64 | vendored binary, os:[darwin] cpu:[arm64] (local dev, Apple Silicon) | | @zibby/bin-oxlint-darwin-x64 | vendored binary, os:[darwin] cpu:[x64] (local dev, Intel) |

The dispatcher lists the four platform packages as optionalDependencies, so npm installs only the one matching the host os/cpu.

Usage

import { binPath } from '@zibby/bin-oxlint';
const oxlint = binPath();   // absolute path, or null if unsupported/not vendored

Versioning

Package versions mirror the oxlint version they vendor — @zibby/[email protected] == oxlint 1.73.0, Zibby-vendored. A dispatcher-only fix carrying the same oxlint bumps the patch and is noted in the commit/changelog.

Building / publishing (release owner)

Binaries are never committed to git (they're ~7 MB) but do ship in the npm tarball. The per-platform package.json / LICENSE / NOTICE are committed; the oxlint binary is gitignored and fetched+verified at build time:

# from packages/bin-oxlint
npm run build            # vendor + sha-verify ALL four platforms (no publish)
npm run build:host       # vendor only this host's platform (fast local check)
node ../scripts/publish-bin-tool.mjs --config ./tool.config.mjs --publish   # release only

tool.config.mjs is the single source of truth for the oxlint version + the four pinned sha256 digests. To bump oxlint: edit it, re-run npm run build, republish.