Volta in a CI Environment

[bpmooch]

I feel a bit uncomfortable running curl https://get.volta.sh | bash to install Volta in a CI or Docker environment. Am I misguided in this discomfort? Is there any text in the docs or website that cover Volta usage in a CI or containerized environment?

[charlespierce]

Hi @chrism00ch, thanks for asking! While in this case there isn't anything to be concerned about with running the installer in CI*, it's still probably overkill to use the general-purpose installer. We don't currently have docs specifically aimed at CI / containers, however the Advanced > Installers section of the documentation contains a section "Custom Installers" that goes over the specific steps needed to get Volta working. So you should be able to adapt your Dockerfile (for example) to perform those steps directly, instead of using the installer. Please let us know if there's something unclear or where we could expand, we'd be happy to improve the documentation in that area.

In addition, if you're using GitHub actions, we have an action published on the GitHub Actions Marketplace which you can use directly.

*For more details, the redirect rule for get.volta.sh is defined in https://github.com/volta-cli/get and the actual file that is served is https://github.com/volta-cli/volta/blob/main/dev/unix/volta-install.sh if you want to inspect what it does.

[rwjblue]

FWIW, how the action works is pretty simple:

• download tarball (picking the right one for you platform)
• extract tarball
• add the ./bin folder from the extracted tarball to $PATH
• setup $VOLTA_HOME pointing at that extracted tarball location
• invoke volta setup to create the required directory structures

Maybe we should make some sort of page in the guides mentioning ^ (since its so easy now that we can leverage volta setup for most of the hard work)?

[charlespierce]

I missed this connection initially, but while they're not specifically about CI environments, we do have docs about what steps are needed to get Volta working. See the "Custom Installers" section here: https://docs.volta.sh/advanced/installers

Nevertheless, we can probably create a section about CI specifically that replicates (or links to) the above instructions, along with any other considerations that are needed for using Volta in CI.

[scinos]

To make volta safer for CI, I think it should include an official debian package, or at least a GPG key that can be verified. Examples:

• yarn: https://classic.yarnpkg.com/en/docs/install#debian-stable
• node: https://github.com/nodesource/distributions#manual-installation