Repository navigation
feat(install): install and update devbox from GitHub only - #3048
Merged
Merged
Conversation
The installer and launcher no longer use releases.jetify.com or get.jetify.com. The latest stable version is the GitHub release marked "latest": both download releases/latest/download/checksums.txt and read the version from the archive name for their platform. No API token, rate limit, or extra release asset needed. - Move scripts/install.sh to install.sh and serve it from raw.githubusercontent.com; update README, docs, Dockerfile templates, and vercheck messages. - A channel file URL may return a bare version or a checksums.txt. - release.ts refuses to publish a release without checksums.txt, and cli-release uploads it after the archives. - Keep the S3 stable/edge version updates as non-blocking legacy steps for devbox 0.20.0 and older and the bash launcher. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Devbox Cloud and api.devbox.sh are shut down, and the flow relied on `devbox generate ssh-config`, which no longer exists. Also drops the old launcher download from releases.jetify.com and the `which` dependency. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. 🤖 Generated with Claude Code |
 [High impact] The PR appears safe to merge; no new actionable issues were found.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
The background version check runs in the front binary, so 1.0.0 launchers (devbox 0.19.0, 0.20.0) would keep reading releases.jetify.com after updating. Bumping to 1.1.0 makes devbox offer to replace them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…vinci-eb29de # Conflicts: # vscode-extension/package.json # vscode-extension/yarn.lock
greptile-apps
Bot
dismissed
their stale review
November 9, 2026 23:27
Dismissed because a newer commit was pushed; Greptile will re-review the current head.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Devbox no longer needs a Jetify (or any third-party) domain to install or update. Targets 0.21.0.
Latest stable version comes from GitHub. The installer and launcher download
https://github.com/jetify-com/devbox/releases/latest/download/checksums.txtand read the version from the archive name for their platform. GitHub's "latest" is never a draft or prerelease, so publishing a release as latest is the promotion step. This needs no API token or rate limit, no extra release asset, works for all existing releases, and gets the version and checksum in one request.scripts/install.sh→install.shat the repo root. New install command:curl -fsSL https://raw.githubusercontent.com/jetify-com/devbox/main/install.sh | bashvercheckmessages, and skills.internal/launcher/install.go): a singlereleasesURLon GitHub. A channel file URL may still return a bare version (like the old S3 files) or a release'schecksums.txt.release.tsrefuses to publish a release withoutchecksums.txt, andcli-releasenow uploadschecksums.txtafter the archives so it never points at a missing archive.releases.jetify.comhardcoded. The S3stable/version(cli-post-release) andedge/version(cli-release) updates stay, but ascontinue-on-errorlegacy steps. Delete them once those versions are gone.api.devbox.shand downloaded the old launcher fromreleases.jetify.com, and relied ondevbox generate ssh-config, which no longer exists. Also drops thewhichdependency.specs/native-launcher.md) and the release skill's troubleshooting table are updated.Not changed: docs links to
jetify.com/docs, and theDEVBOX_REGIONDevbox Cloud checks in the Go CLI (env-var only, no network calls).How was it tested?
install.shend to end against real GitHub (into a scratch install dir). It installed 0.19.0, which is GitHub's current latest (0.20.0 is still a draft) and matches S3.FetchLatestVersionanddownloadagainst live GitHub: it found 0.19.0 and downloaded it with the checksum verified.go test ./internal/launcher/ ./internal/vercheck/ ./internal/devbox/generate/...pass, including a newTestParseLatestVersion.go build ./...and golangci-lint on the launcher package are clean. Shellcheck reports nothing new ininstall.sh.tsc --noEmitandeslint srcare clean.Community Contribution License
All community contributions in this pull request are licensed to the project
maintainers under the terms of the
Apache 2 License.
By creating this pull request, I represent that I have the right to license the
contributions to the project maintainers under the Apache 2 License as stated in
the
Community Contribution License.
🤖 Generated with Claude Code