Copilot/add mise and oxlint

[danielbodnar]

No description provided.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	cloudx-sh	65949e1	Dec 24 2025, 01:08 AM

[Copilot]

Pull request overview

This pull request adds development tooling improvements and creates new template packages for a Cloudflare Workers/Sandbox SDK project.

Changes:

• Migrated from npm to bun for package management and replaced prettier/eslint with oxlint
• Added mise for tool version management with configuration in .mise.toml
• Created three new template packages: template (containers), minimal (sandbox), and claude-code (Claude Code integration)

Reviewed changes

Copilot reviewed 32 out of 41 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
package.json	Migrated scripts to use bun and oxlint instead of npm/prettier/eslint
package-lock.json	Updated dependencies including @cloudflare/sandbox to 0.6.7 and added oxlint
.mise.toml	New mise configuration defining tool versions and common tasks
Dockerfile	Added mise installation to container image
README.md, CLAUDE.md	Updated documentation to reflect bun/mise usage
packages/template/*	New template package for Cloudflare containers with Go backend
packages/minimal/*	New minimal sandbox SDK example package
packages/claude-code/*	New Claude Code integration example package

Files not reviewed (1)

• packages/template/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The documentation refers to executing Python code in the example, but the actual implementation in src/index.ts shows shell commands using echo. The documentation should be updated to accurately reflect that the example executes shell commands, not Python code.

[Copilot]

The documentation states the example runs Python code, but the actual implementation uses a shell command with echo. This inconsistency should be corrected to match the actual implementation.

[Copilot]

The RUN npm install -g @anthropic-ai/claude-code line pulls and executes a globally installed CLI from the npm registry without pinning a specific version or verifying integrity, creating a supply-chain risk. If the package or the npm distribution channel is compromised, a rebuild of this image would silently bake an attacker-controlled binary into the container, which would then run inside your sandbox with access to code and potentially secrets. To mitigate this, pin @anthropic-ai/claude-code to a specific, reviewed version and/or enforce integrity verification (for example via a lockfile, checksum, or signature validation) as part of the image build.