chore: remove dead binary-build and unused config files

[davidfirst]

Removes leftovers from the old bit-bin standalone-binary distribution era and other unreferenced files. Verified none are referenced by the active .circleci/config.yml or GitHub workflows.

Unused config / CI

• .circleci/config.yml.bak — stale 58 KB backup of config.yml
• Jenkinsfile — last touched 2017; CI runs entirely on CircleCI
• .snyk — 2019 policy file; vulnerability scanning is handled by Dependabot

Dead native-binary / installer flow

Bit ships via npm + BVM now; the team confirmed BVM doesn't use any of these.

• scripts/linux/ + the build-centos-image/build-debian-image npm scripts — fpm/rpm/deb packaging
• scripts/macos/ (Homebrew formula) and scripts/windows/ (WiX MSI installer)
• build-{tar,deb,dist,chocolatey}, build-windows-installer.bat, copyArtifacts.ps1, deploy-windows.ps1, node-installer.{sh,ps1}
• install.js (old postinstall that downloaded the bit-bin executable) + its only consumer scripts-constants.js
• set-installation-method.js (only used by the build/installer scripts) and bootstrap-env-ubuntu.sh (installed fpm + global bit-bin)

Kept: scripts/docker-teambit-bit/ (used by active CI), scripts/package-utils.js (used by cleanup-node-modules.js), and all dev/validate/generate scripts.

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0)

1. Dangling packaging hook refs ✓ Resolved 🐞 Bug ☼ Reliability

Description

scripts/build-deb.sh still passes ../../scripts/linux/postInstall.sh and
../../scripts/linux/postRemove.sh to fpm via --after-install/--after-remove, but this PR
deletes those hook scripts. Running scripts/build-deb.sh will now fail because the referenced hook
files no longer exist.

Code

scripts/linux/postInstall.sh[L1-5]

-#!/usr/bin/env bash
-
-ln -sf /usr/share/bit/bin/bit /usr/local/bin/bit
-ln -sf /usr/share/bit/bin/bit.js /usr/local/bin/bit.js
-ln -sf /usr/share/bit/bin/node /usr/local/bin/bitNode

Evidence

The PR deletes the hook script(s), while scripts/build-deb.sh in the PR branch still hard-codes
their paths in the fpm command, making the script invalid when executed.

scripts/build-deb.sh[42-63]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
This PR removes `scripts/linux/postInstall.sh` / `scripts/linux/postRemove.sh`, but `scripts/build-deb.sh` still references them as `fpm` lifecycle hooks. As a result, invoking `scripts/build-deb.sh` will break.
## Issue Context
Even if this packaging path is considered “dead”, leaving a broken script in-repo creates a maintenance trap and can break any ad-hoc/manual packaging workflows.
## Fix Focus Areas
- Update or remove dangling `fpm` hook references:
- scripts/build-deb.sh[42-63]
## Suggested fix options (pick one)
1) **If DEB/RPM packaging is truly deprecated**: delete `scripts/build-deb.sh` (and any other remaining entrypoints) to avoid a broken script.
2) **If DEB/RPM packaging is still needed**: re-introduce equivalent hook scripts in a supported location and update `scripts/build-deb.sh` to reference them (or inline the hook behavior).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Previous review results

Review updated until commit eeea332

Results up to commit N/A

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0)

1. Dangling packaging hook refs ✓ Resolved 🐞 Bug ☼ Reliability

Description

scripts/build-deb.sh still passes ../../scripts/linux/postInstall.sh and
../../scripts/linux/postRemove.sh to fpm via --after-install/--after-remove, but this PR
deletes those hook scripts. Running scripts/build-deb.sh will now fail because the referenced hook
files no longer exist.

Code

scripts/linux/postInstall.sh[L1-5]

-#!/usr/bin/env bash
-
-ln -sf /usr/share/bit/bin/bit /usr/local/bin/bit
-ln -sf /usr/share/bit/bin/bit.js /usr/local/bin/bit.js
-ln -sf /usr/share/bit/bin/node /usr/local/bin/bitNode

Evidence

The PR deletes the hook script(s), while scripts/build-deb.sh in the PR branch still hard-codes
their paths in the fpm command, making the script invalid when executed.

scripts/build-deb.sh[42-63]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
This PR removes `scripts/linux/postInstall.sh` / `scripts/linux/postRemove.sh`, but `scripts/build-deb.sh` still references them as `fpm` lifecycle hooks. As a result, invoking `scripts/build-deb.sh` will break.
## Issue Context
Even if this packaging path is considered “dead”, leaving a broken script in-repo creates a maintenance trap and can break any ad-hoc/manual packaging workflows.
## Fix Focus Areas
- Update or remove dangling `fpm` hook references:
- scripts/build-deb.sh[42-63]
## Suggested fix options (pick one)
1) **If DEB/RPM packaging is truly deprecated**: delete `scripts/build-deb.sh` (and any other remaining entrypoints) to avoid a broken script.
2) **If DEB/RPM packaging is still needed**: re-introduce equivalent hook scripts in a supported location and update `scripts/build-deb.sh` to reference them (or inline the hook behavior).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Remove obsolete CI and Linux packaging artifacts
⚙️ Configuration changes 🕐 10-20 Minutes

Walkthroughs

Description

• Delete unreferenced CI/security config leftovers (.circleci backup, Jenkinsfile, .snyk).
• Remove deprecated Linux packaging toolchain under scripts/linux.
• Drop unused npm scripts that built legacy CentOS/Debian packaging images.

Diagram

graph TD
  A["Repo automation"] --> B["CircleCI config"] --> C["package.json scripts"] --> D["scripts/linux packaging"]
  A --> E["Jenkinsfile (removed)"]
  A --> F[".snyk policy (removed)"]
  A --> G["config.yml.bak (removed)"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Archive legacy assets (e.g., in docs/ or .archive/)

• ➕ Keeps historical context for release/packaging without cluttering active paths
• ➕ Lower risk if an undiscovered workflow still depends on files
• ➖ Still carries maintenance/attack surface concerns (stale scripts/configs)
• ➖ Can encourage accidental reuse of outdated pipelines

2. Deprecate first, delete later (two-step removal)

• ➕ Provides a grace period to catch any hidden consumers
• ➕ Allows teams to coordinate across CI/release owners
• ➖ Prolongs repository clutter and confusion
• ➖ Requires follow-up work to complete the cleanup

Recommendation: Proceed with deletion as implemented since the removed files/scripts are explicitly unreferenced by active CI, and the package.json entries were unused. The only caveat is release automation: consider doing a quick repo-wide search in CI/release docs and GitHub workflows for any remaining references to scripts/linux (or related installer scripts) before merging, but the PR’s approach is the cleanest end state.

File Changes

Other (1)

package.json Remove unused Linux image build npm scripts +0/-2

Remove unused Linux image build npm scripts

• Drops the build-centos-image and build-debian-image npm scripts that pointed to the deleted scripts/linux docker build contexts. This aligns package.json with the current CI/release flow and avoids advertising dead commands.

package.json

---

[qodo-free-for-open-source-projects]

Code review by qodo was updated up to the latest commit 104179a

[qodo-free-for-open-source-projects]

Code review by qodo was updated up to the latest commit eeea332