[yocaba]

What

Pass the tools.lock OCM version to install.sh as OCM_VERSION (without the v prefix), so the pinned version is installed.

Why

The ocm target set VERSION_OCM, but install.sh reads OCM_VERSION. The pin was ignored and every install resolved releases/latest, so consumers silently got whatever OCM version was newest, and the .ocm-version check never matched the installed binary.

See https://github.com/opendefensecloud/solution-arsenal/actions/runs/42020550629/job/127225217814#step:5:518.

Testing

Ran make test in solution-arsenal (dev-kit v4.0.0) with this common.mk: the install resolved releases/tags/v0.51.0 from tools.lock, ocm version reports 0.51.0, and all suites pass.

Checklist

• Tests added/updated, or confirmed that no tests are required
• No breaking changes, or upgrade path documented above
• Readable commit history (squashed and cleaned up as desired)
• AI code review considered and comments resolved

Summary by CodeRabbit

• Chores
  • Updated how the installer receives the OCM version. The version continues to be provided without its leading “v,” and the recorded version marker remains unchanged.
  • No changes to the available features or the version users receive.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The OCM installer invocation now passes the version through OCM_VERSION instead of VERSION_OCM. The install path and recorded version marker remain unchanged.

Changes: OCM installer

Layer / File(s)	Summary
Pass version to installer common.mk	The installer receives the version through OCM_VERSION. The version value remains stripped of its leading v, and .ocm-version continues to record the full version.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested reviewers: cbrgm

Merge Risk: Minimal · up to fe679

The pinned OCM version is passed through the installer’s expected variable, with no actionable merge risk identified.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: pinning the OCM CLI version from tools.lock.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description follows the repository template. It has What, Why, Testing, and Checklist sections, and the Notes for reviewers section is omitted. The What section states the change: the tools.lock O…

Full details: Description check

Explanation

The description follows the repository template. It has What, Why, Testing, and Checklist sections, and the Notes for reviewers section is omitted. The What section states the change: the tools.lock OCM version is passed to install.sh as OCM_VERSION without the v prefix. The Why section explains the root cause: the target set VERSION_OCM while install.sh reads OCM_VERSION, so the pin was ignored and installs resolved releases/latest. The Testing section gives concrete evidence: make test ran with dev-kit v4.0.0, the install resolved releases/tags/v0.51.0, ocm version reported 0.51.0, and all suites passed. The Closes # line in the What section has no issue number, which is a minor gap. The Notes for reviewers section is optional and can be deleted when not applicable, so its absence is acceptable. All checklist items are ticked.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Git: CodeRabbit could not clone the repository, so clone-backed analysis was skipped and this review may be incomplete. Verify repository clone access, such as SSH credentials, before requesting another full review. If clone access is intentionally unavailable, use path_filters to narrow the review scope.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5a5df4d7-c988-48e7-9443-7d5517af81f4

Commits

Reviewing files that changed from the base of the PR and between 983ddfc and fe67902.

Files selected for processing: 1

• common.mk

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[yocaba]

@coderabbitai review

[coderabbitai]

Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.