Skip to content

Commit 532791a

Browse files
data-douserdata-douser
authored
Add vscode-codeql-development-mcp-server.vsix extension for "bridge" to GitHub.vscode-codeql extension's databases, query results, and MRVA results (#61)
1 parent f8b63a3 commit 532791a

File tree

142 files changed

+16011
-957
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

142 files changed

+16011
-957
lines changed

‎.github/dependabot.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,8 @@ updates:
3131
ignore:
3232
- dependency-name: 'zod'
3333
versioning-strategy: 'increase'
34+
- package-ecosystem: 'npm'
35+
directory: '/extensions/vscode/'
36+
schedule:
37+
interval: 'weekly'
38+
versioning-strategy: 'increase'

‎.github/dependency-review-config.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Dependency Review Configuration
2+
# https://github.com/actions/dependency-review-action?tab=readme-ov-file#configuration-options
3+
#
4+
# All allowed packages are transitive devDependencies that cannot be directly
5+
# controlled. They come from:
6+
# - @vscode/vsce (VS Code extension packaging tool) — 16 packages
7+
# - mocha (VS Code integration test runner) — 1 package
8+
#
9+
# None of these packages are bundled into the published extension (.vsix) or
10+
# the published npm package (codeql-development-mcp-server). They are only
11+
# present during development and CI builds.
12+
13+
# Fail only on critical/high severity vulnerabilities in production dependencies.
14+
fail-on-severity: 'high'
15+
16+
# Allow specific transitive devDependencies with OpenSSF Scorecard below
17+
# the repository threshold of 3. Each is a transitive dependency of either
18+
# @vscode/vsce or mocha and cannot be removed or replaced.
19+
allow-packages:
20+
# @vscode/vsce → form-data → asynckit
21+
- 'pkg:npm/asynckit'
22+
# @vscode/vsce → keytar → prebuild-install → tar-fs → tar-stream → bl → buffer → base64-js
23+
- 'pkg:npm/base64-js'
24+
# @vscode/vsce → form-data → combined-stream
25+
- 'pkg:npm/combined-stream'
26+
# @vscode/vsce → form-data → combined-stream → delayed-stream
27+
- 'pkg:npm/delayed-stream'
28+
# @vscode/vsce → @azure/identity → @azure/msal-node → jsonwebtoken → jws → jwa → ecdsa-sig-formatter
29+
- 'pkg:npm/ecdsa-sig-formatter'
30+
# @vscode/vsce → yauzl → fd-slicer
31+
- 'pkg:npm/fd-slicer'
32+
# mocha → yargs → get-caller-file
33+
- 'pkg:npm/get-caller-file'
34+
# @vscode/vsce → keytar → prebuild-install → tar-fs → tar-stream → bl → buffer → ieee754
35+
- 'pkg:npm/ieee754'
36+
# @vscode/vsce → secretlint → globby → fast-glob → merge2
37+
- 'pkg:npm/merge2'
38+
# @vscode/vsce → yauzl → fd-slicer → pend
39+
- 'pkg:npm/pend'
40+
# @vscode/vsce → keytar → prebuild-install → rc
41+
- 'pkg:npm/rc'
42+
# @vscode/vsce → keytar/jsonwebtoken chains → safe-buffer
43+
- 'pkg:npm/safe-buffer'
44+
# @vscode/vsce → keytar → prebuild-install → simple-get → simple-concat
45+
- 'pkg:npm/simple-concat'
46+
# @vscode/vsce → azure-devops-node-api/typed-rest-client → tunnel
47+
- 'pkg:npm/tunnel'
48+
# @vscode/vsce → @secretlint/secretlint-formatter-sarif → node-sarif-builder → fs-extra → universalify
49+
- 'pkg:npm/universalify'
50+
# @vscode/vsce → keytar → prebuild-install → tar-fs → tar-stream → readable-stream → util-deprecate
51+
- 'pkg:npm/util-deprecate'
52+
# @vscode/vsce → xml2js → xmlbuilder
53+
- 'pkg:npm/xmlbuilder'

‎.github/workflows/build-extension.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
name: Build Extension - CodeQL Development MCP Server
2+
3+
on:
4+
pull_request:
5+
branches: ['main']
6+
paths:
7+
- '.github/workflows/build-extension.yml'
8+
- '.node-version'
9+
- 'extensions/vscode/**'
10+
- 'server/dist/**'
11+
- 'server/ql/*/tools/src/**'
12+
push:
13+
branches: ['main']
14+
paths:
15+
- '.github/workflows/build-extension.yml'
16+
- '.node-version'
17+
- 'extensions/vscode/**'
18+
- 'server/dist/**'
19+
- 'server/ql/*/tools/src/**'
20+
workflow_dispatch:
21+
22+
permissions:
23+
contents: read
24+
25+
jobs:
26+
build-extension:
27+
name: Build Extension
28+
runs-on: ubuntu-latest
29+
30+
steps:
31+
- name: Build Extension - Checkout repository
32+
uses: actions/checkout@v6
33+
34+
- name: Build Extension - Setup Node.js environment
35+
uses: actions/setup-node@v6
36+
with:
37+
cache: 'npm'
38+
node-version-file: '.node-version'
39+
40+
- name: Build Extension - Install dependencies
41+
run: npm ci --include=optional
42+
43+
- name: Build Extension - Build server (dependency)
44+
run: npm run build -w server
45+
46+
- name: Build Extension - Run extension tests with coverage
47+
working-directory: extensions/vscode
48+
run: npm run test:coverage
49+
50+
- name: Build Extension - Bundle extension and server
51+
working-directory: extensions/vscode
52+
run: |
53+
npm run clean
54+
npm run lint
55+
npm run bundle
56+
npm run bundle:server
57+
58+
- name: Build Extension - Verify VSIX packaging
59+
working-directory: extensions/vscode
60+
run: npx @vscode/vsce package --no-dependencies --out codeql-development-mcp-server.vsix
61+
62+
- name: Build Extension - Verify VSIX contents
63+
working-directory: extensions/vscode
64+
run: |
65+
echo "## VSIX Contents" >> $GITHUB_STEP_SUMMARY
66+
echo '```' >> $GITHUB_STEP_SUMMARY
67+
npx @vscode/vsce ls --no-dependencies --tree 2>&1 | head -50 >> $GITHUB_STEP_SUMMARY
68+
echo '```' >> $GITHUB_STEP_SUMMARY
69+
70+
- name: Build Extension - Check for uncommitted changes
71+
run: |
72+
if [ -n "$(git status --porcelain)" ]; then
73+
echo "❌ Uncommitted changes detected after build:"
74+
git status --porcelain
75+
git diff
76+
exit 1
77+
else
78+
echo "✅ No uncommitted changes after build"
79+
fi
80+
81+
- name: Build Extension - Summary
82+
run: |
83+
echo "## Build Extension Summary" >> $GITHUB_STEP_SUMMARY
84+
echo "✅ ESLint checks completed" >> $GITHUB_STEP_SUMMARY
85+
echo "✅ All tests passed with coverage" >> $GITHUB_STEP_SUMMARY
86+
echo "✅ Extension bundled successfully" >> $GITHUB_STEP_SUMMARY
87+
echo "✅ Server bundled into extension" >> $GITHUB_STEP_SUMMARY
88+
echo "✅ VSIX packaging verified" >> $GITHUB_STEP_SUMMARY
89+
echo "✅ No uncommitted changes detected" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/dependency-review.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Dependency Review
2+
3+
on:
4+
pull_request:
5+
branches: ['main']
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
dependency-review:
12+
name: Dependency Review
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout repository
16+
uses: actions/checkout@v6
17+
18+
- name: Dependency Review
19+
uses: actions/dependency-review-action@v4
20+
with:
21+
config-file: '.github/dependency-review-config.yml'

‎.github/workflows/release-vsix.yml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
name: Release VSIX - Build and Package VS Code Extension
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
version:
7+
description: 'Release version tag (e.g., vX.Y.Z). Must start with "v".'
8+
required: true
9+
type: string
10+
outputs:
11+
release_name:
12+
description: 'The release name without "v" prefix (e.g., X.Y.Z)'
13+
value: ${{ jobs.publish-vsix.outputs.release_name }}
14+
version:
15+
description: 'The full version string with "v" prefix (e.g., vX.Y.Z)'
16+
value: ${{ jobs.publish-vsix.outputs.version }}
17+
vsix_name:
18+
description: 'The VSIX filename (e.g., codeql-development-mcp-server.vsix)'
19+
value: ${{ jobs.publish-vsix.outputs.vsix_name }}
20+
21+
# Note: This workflow is called exclusively via workflow_call from release.yml.
22+
# It does NOT have a workflow_dispatch trigger to keep release.yml as the single
23+
# entry point for all release operations. To re-build the VSIX standalone,
24+
# use workflow_dispatch on release.yml with publish_npm=false and
25+
# publish_codeql_packs=false.
26+
27+
permissions:
28+
contents: read
29+
30+
jobs:
31+
publish-vsix:
32+
name: Build and Package VSIX Extension
33+
runs-on: ubuntu-latest
34+
35+
environment: release-vsix
36+
37+
permissions:
38+
contents: read
39+
40+
outputs:
41+
release_name: ${{ steps.version.outputs.release_name }}
42+
version: ${{ steps.version.outputs.version }}
43+
vsix_name: ${{ steps.package.outputs.vsix_name }}
44+
45+
steps:
46+
- name: VSIX - Validate and parse version
47+
id: version
48+
run: |
49+
VERSION="${{ inputs.version }}"
50+
if [[ ! "${VERSION}" =~ ^v ]]; then
51+
echo "::error::Version '${VERSION}' must start with 'v'"
52+
exit 1
53+
fi
54+
echo "version=${VERSION}" >> $GITHUB_OUTPUT
55+
echo "release_name=${VERSION#v}" >> $GITHUB_OUTPUT
56+
57+
- name: VSIX - Checkout tag
58+
uses: actions/checkout@v6
59+
with:
60+
ref: refs/tags/${{ steps.version.outputs.version }}
61+
62+
- name: VSIX - Setup Node.js
63+
uses: actions/setup-node@v6
64+
with:
65+
cache: 'npm'
66+
node-version-file: '.node-version'
67+
68+
- name: VSIX - Install dependencies
69+
run: npm ci --include=optional
70+
71+
- name: VSIX - Validate version consistency
72+
run: |
73+
RELEASE_NAME="${{ steps.version.outputs.release_name }}"
74+
EXTENSION_VERSION=$(node -e "console.log(require('./extensions/vscode/package.json').version)")
75+
if [ "${EXTENSION_VERSION}" != "${RELEASE_NAME}" ]; then
76+
echo "::error::Extension version (${EXTENSION_VERSION}) does not match release (${RELEASE_NAME})"
77+
exit 1
78+
fi
79+
echo "✅ Extension version matches release: ${RELEASE_NAME}"
80+
81+
- name: VSIX - Build server
82+
run: npm run build -w server
83+
84+
- name: VSIX - Package VSIX
85+
id: package
86+
working-directory: extensions/vscode
87+
run: |
88+
VSIX_NAME="codeql-development-mcp-server.vsix"
89+
npx @vscode/vsce package --no-dependencies --out "${VSIX_NAME}"
90+
echo "vsix_name=${VSIX_NAME}" >> $GITHUB_OUTPUT
91+
echo "✅ Packaged ${VSIX_NAME}"
92+
93+
- name: VSIX - Verify VSIX contents
94+
working-directory: extensions/vscode
95+
run: |
96+
echo "Verifying bundled server and tool query packs..."
97+
npx @vscode/vsce ls --no-dependencies 2>&1 | tee /tmp/vsix-contents.txt
98+
99+
# Verify critical files are included
100+
for required in \
101+
"dist/extension.cjs" \
102+
"server/dist/codeql-development-mcp-server.js" \
103+
"server/package.json" \
104+
"server/ql/javascript/tools/src/PrintAST/PrintAST.ql"; do
105+
if grep -q "${required}" /tmp/vsix-contents.txt; then
106+
echo " ✅ ${required}"
107+
else
108+
echo " ❌ Missing: ${required}"
109+
exit 1
110+
fi
111+
done
112+
113+
- name: VSIX - Upload artifact
114+
uses: actions/upload-artifact@v6
115+
with:
116+
name: codeql-development-mcp-server-vsix-${{ steps.version.outputs.version }}
117+
path: extensions/vscode/${{ steps.package.outputs.vsix_name }}
118+
119+
- name: VSIX - Summary
120+
run: |
121+
VERSION="${{ steps.version.outputs.version }}"
122+
VSIX_NAME="${{ steps.package.outputs.vsix_name }}"
123+
VSIX_SIZE=$(du -h "extensions/vscode/${VSIX_NAME}" | cut -f1)
124+
echo "## VSIX Build Summary" >> $GITHUB_STEP_SUMMARY
125+
echo "" >> $GITHUB_STEP_SUMMARY
126+
echo "| Property | Value |" >> $GITHUB_STEP_SUMMARY
127+
echo "| -------- | ----- |" >> $GITHUB_STEP_SUMMARY
128+
echo "| Version | ${VERSION} |" >> $GITHUB_STEP_SUMMARY
129+
echo "| VSIX | \`${VSIX_NAME}\` |" >> $GITHUB_STEP_SUMMARY
130+
echo "| Size | ${VSIX_SIZE} |" >> $GITHUB_STEP_SUMMARY
131+
echo "" >> $GITHUB_STEP_SUMMARY
132+
echo "### Bundled Contents" >> $GITHUB_STEP_SUMMARY
133+
echo "- \`dist/extension.cjs\` — Extension entry point" >> $GITHUB_STEP_SUMMARY
134+
echo "- \`server/dist/\` — Bundled MCP server" >> $GITHUB_STEP_SUMMARY
135+
echo "- \`server/ql/*/tools/src/\` — CodeQL tool query packs" >> $GITHUB_STEP_SUMMARY
136+
echo "- \`server/package.json\` — Server package metadata" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/release.yml‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,22 @@ jobs:
138138
publish_codeql_packs: ${{ needs.resolve-version.outputs.publish_codeql_packs == 'true' }}
139139
version: ${{ needs.resolve-version.outputs.version }}
140140

141+
# ─────────────────────────────────────────────────────────────────────────────
142+
# Step 3c: Build the VS Code extension VSIX
143+
#
144+
# Checks out the clean tag, builds the server and extension (including the
145+
# bundled MCP server), and packages the self-contained VSIX. Runs in parallel
146+
# with npm/CodeQL publishing since it only needs the tag.
147+
# ─────────────────────────────────────────────────────────────────────────────
148+
build-vsix:
149+
name: Build VSIX Extension
150+
needs: [resolve-version, ensure-tag]
151+
permissions:
152+
contents: read
153+
uses: ./.github/workflows/release-vsix.yml
154+
with:
155+
version: ${{ needs.resolve-version.outputs.version }}
156+
141157
# ─────────────────────────────────────────────────────────────────────────────
142158
# Step 4: Create GitHub Release
143159
#
@@ -153,7 +169,7 @@ jobs:
153169
always() && !failure() && !cancelled()
154170
&& needs.resolve-version.outputs.create_github_release == 'true'
155171
&& needs.resolve-version.outputs.publish_npm == 'true'
156-
needs: [resolve-version, ensure-tag, publish-npm, publish-codeql]
172+
needs: [resolve-version, ensure-tag, publish-npm, publish-codeql, build-vsix]
157173
runs-on: ubuntu-latest
158174

159175
permissions:
@@ -171,6 +187,12 @@ jobs:
171187
name: codeql-tool-query-packs-${{ needs.resolve-version.outputs.version }}
172188
path: dist-packs
173189

190+
- name: Release - Download VSIX artifact
191+
uses: actions/download-artifact@v7
192+
with:
193+
name: codeql-development-mcp-server-vsix-${{ needs.resolve-version.outputs.version }}
194+
path: dist-vsix
195+
174196
- name: Release - Create distribution directory
175197
run: |
176198
mkdir -p dist-package/server
@@ -217,6 +239,7 @@ jobs:
217239
files: |
218240
codeql-development-mcp-server-${{ needs.resolve-version.outputs.version }}.tar.gz
219241
dist-packs/*.tar.gz
242+
dist-vsix/codeql-development-mcp-server.vsix
220243
generate_release_notes: true
221244
tag_name: ${{ needs.resolve-version.outputs.version }}
222245

@@ -238,6 +261,7 @@ jobs:
238261
echo "| CodeQL pack publish | ⏭️ Skipped (packs bundled only) |" >> $GITHUB_STEP_SUMMARY
239262
fi
240263
echo "| Distribution archive | ✅ Created |" >> $GITHUB_STEP_SUMMARY
264+
echo "| VSIX extension | ✅ Built |" >> $GITHUB_STEP_SUMMARY
241265
echo "| GitHub Release | ✅ Created |" >> $GITHUB_STEP_SUMMARY
242266
echo "" >> $GITHUB_STEP_SUMMARY
243267
echo "### Package Contents" >> $GITHUB_STEP_SUMMARY

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ codeql-development-mcp-server.code-workspace
2626
*.tar.gz
2727
*~
2828

29+
.vscode/mcp.json
2930
.vscode/settings.json
3031

3132
# Ignore state tracking for local, integration testing

0 commit comments

Comments
 (0)