Spike building an executable version of the CLI

[yt-ms]

Feature Request

Description of Problem:

As discussed in Office Hours 2025-01-02, relying on users of the CALM CLI having an existing npm environment within which they're happy to install all our dependencies, or to be able to run an OCI image under Docker/Podman/etc may be too high a barrier to entry for some.

Potential Solutions:

There are mechanisms to build tree-shaken, minified versions of node-based executables (@willosborne has some examples), so we should try these out to see whether compiling a standalone executable is a feasible solution. Need to think about Windows as well as Linux support.

[grahampacker-ms]

Also need to consider mac support (intel and apple silicon)

[Budlee]

A fair bit of work but moving to a language like python or go which have great CLI support could be an idea

[jpgough-ms]

A fair bit of work but moving to a language like python or go which have great CLI support could be an idea

@Budlee the other challenge is that a lot of the JSON Schema tools and modules that we use are predominantly in JS/TS. Originally we did look at Python, but found the ecosystem to not be as supportive of the types of actions in the CLI. I definitely agree it is a lot of work.

relying on users of the CALM CLI having an existing npm environment within which they're happy to install all our dependencies, or to be able to run an OCI image under Docker/Podman/etc may be too high a barrier to entry for some.

I would add that we have feedback from a few organisations who have been able to use npm install fine. Organisations typically have this backed into an automated scanning tool for CVEs/licensing related issues.

@yt-ms / others, do we have anyone who is reporting that they can't use npm? It would be good to get some information about what they could use.

The other thing we have been discussing is #689, which would be the CLI running as a server-side application. A possible solution could be that we setup a SaaS/Self Hosted deployment of the tooling? This would definitely need more thought, but is why the feedback on what's blocking is important.

[Budlee]

Is there any work on this one at the moment?

[willosborne]

I mentioned a few options for compiling TS projects to executables on the office hours. This was based on some quick research I did but I haven't tried any of these yet.

The options I looked at are:

• pkg - first result on google, seems to be a library for just this similar to say pyinstaller. https://github.com/vercel/pkg.
  • Also says deprecated with a few forks, so not sure about this.
• bun - a very ambitious alternate runtime to node. 'bun build' can do executables but never tried it. It also seems to have cross compilation for different platforms - so this seems very promising indeed. https://bun.sh/docs/bundler/executables
• NodeJS itself has this built in as of Node 21, but it's a sort of preview feature. https://nodejs.org/api/single-executable-applications.html

[Budlee]

Thanks @willosborne,
With the node version we have as 22 meaning its compatible with the NodeJS single-executable I think this could be a good option for longer term support over bun.