fix(features): enforce dependsOn constraints in overrideFeatureInstallOrder

[skevetter]

Summary

• Enforce dependsOn constraints: overrideFeatureInstallOrder now returns an error if it places a feature before any of its dependsOn dependencies, rather than silently accepting the violation
• Spec-compliant round-based sorting: Replace the two-phase approach (Kahn topological sort + post-sort reorder) with a single priority-aware topological sort that integrates overrideFeatureInstallOrder priorities directly into each round of the algorithm
• New graph method: Add SortWithPriority() to the graph package, which performs topological sort with priority-based tie-breaking within each round of zero in-degree nodes
• Updated tests: Convert the existing override-violates-dependency test to expect an error, add new tests for valid overrides, priority building, and priority-influenced sort order

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	8d4355a
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/69ee87b2c0a9040008f6bc16

[coderabbitai]

Warning

Rate limit exceeded

@skevetter has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 58 minutes and 35 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 58 minutes and 35 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a7a8108e-5cd7-4fed-a474-d564aa3dc3e6

📥 Commits

Reviewing files that changed from the base of the PR and between e060069 and 8d4355a.

📒 Files selected for processing (16)

• e2e/tests/up-features/testdata/docker-features-override-violates-depends-on/.devcontainer.json
• e2e/tests/up-features/testdata/docker-features-override-violates-depends-on/features/base/devcontainer-feature.json
• e2e/tests/up-features/testdata/docker-features-override-violates-depends-on/features/base/install.sh
• e2e/tests/up-features/testdata/docker-features-override-violates-depends-on/features/consumer/devcontainer-feature.json
• e2e/tests/up-features/testdata/docker-features-override-violates-depends-on/features/consumer/install.sh
• e2e/tests/up-features/testdata/docker-features-valid-override/.devcontainer.json
• e2e/tests/up-features/testdata/docker-features-valid-override/features/alpha/devcontainer-feature.json
• e2e/tests/up-features/testdata/docker-features-valid-override/features/alpha/install.sh
• e2e/tests/up-features/testdata/docker-features-valid-override/features/base/devcontainer-feature.json
• e2e/tests/up-features/testdata/docker-features-valid-override/features/base/install.sh
• e2e/tests/up-features/testdata/docker-features-valid-override/features/consumer/devcontainer-feature.json
• e2e/tests/up-features/testdata/docker-features-valid-override/features/consumer/install.sh
• e2e/tests/up-features/up_features.go
• pkg/devcontainer/feature/extend.go
• pkg/devcontainer/feature/extend_test.go
• pkg/devcontainer/graph/graph.go

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

⚠️ This PR contains unsigned commits. To get your PR merged, please sign those commits (git rebase --exec 'git commit -S --amend --no-edit -n' @{upstream}) and force push them to this branch (git push --force-with-lease).

If you're new to commit signing, there are different ways to set it up:

Sign commits with gpg

Follow the steps below to set up commit signing with gpg:

1. Generate a GPG key
2. Add the GPG key to your GitHub account
3. Configure git to use your GPG key for commit signing

Sign commits with ssh-agent

Follow the steps below to set up commit signing with ssh-agent:

1. Generate an SSH key and add it to ssh-agent
2. Add the SSH key to your GitHub account
3. Configure git to use your SSH key for commit signing

Sign commits with 1Password

You can also sign commits using 1Password, which lets you sign commits with biometrics without the signing key leaving the local 1Password process.

Learn how to use 1Password to sign your commits.