Skip to content

Commit d069a41

Browse files
rajbosrajbos
authored
Merge branch 'main' into copilot/fix-837b14b1-ba8e-4021-9f6b-eccbd8253e82
2 parents 45a28c0 + 0e705f5 commit d069a41

File tree

10 files changed

+676
-361
lines changed

10 files changed

+676
-361
lines changed

‎.github/workflows/build.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ on:
66
pull_request:
77
branches: [ main, develop ]
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
build-and-test:
1114
runs-on: ${{ matrix.os }}
@@ -16,11 +19,16 @@ jobs:
1619
node-version: [18.x, 20.x]
1720

1821
steps:
22+
- name: Harden the runner (Audit all outbound calls)
23+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
24+
with:
25+
egress-policy: audit
26+
1927
- name: Checkout code
20-
uses: actions/checkout@v4
28+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2129

2230
- name: Setup Node.js ${{ matrix.node-version }}
23-
uses: actions/setup-node@v4
31+
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
2432
with:
2533
node-version: ${{ matrix.node-version }}
2634
cache: 'npm'
@@ -57,7 +65,7 @@ jobs:
5765
echo "✅ Build outputs verified"
5866
5967
- name: Upload build artifacts
60-
uses: actions/upload-artifact@v4
68+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
6169
if: matrix.os == 'ubuntu-latest' && matrix.node-version == '20.x'
6270
with:
6371
name: build-artifacts

‎.github/workflows/ci.yml‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,16 @@ jobs:
1515
node-version: [18.x, 20.x]
1616

1717
steps:
18+
- name: Harden the runner (Audit all outbound calls)
19+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
20+
with:
21+
egress-policy: audit
22+
1823
- name: Checkout code
19-
uses: actions/checkout@v4
24+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2025

2126
- name: Setup Node.js ${{ matrix.node-version }}
22-
uses: actions/setup-node@v4
27+
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
2328
with:
2429
node-version: ${{ matrix.node-version }}
2530
cache: 'npm'
@@ -43,14 +48,14 @@ jobs:
4348
run: npm run compile-tests
4449

4550
- name: Run tests
46-
uses: coactions/setup-xvfb@v1
51+
uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1
4752
with:
4853
run: npm test
4954
options: -screen 0 1024x768x24
5055
continue-on-error: true # VS Code extension tests can be flaky in CI
5156

5257
- name: Upload build artifacts
53-
uses: actions/upload-artifact@v4
58+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
5459
if: matrix.node-version == '20.x'
5560
with:
5661
name: extension-build
@@ -65,11 +70,16 @@ jobs:
6570
if: github.ref == 'refs/heads/main'
6671

6772
steps:
73+
- name: Harden the runner (Audit all outbound calls)
74+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
75+
with:
76+
egress-policy: audit
77+
6878
- name: Checkout code
69-
uses: actions/checkout@v4
79+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
7080

7181
- name: Setup Node.js
72-
uses: actions/setup-node@v4
82+
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
7383
with:
7484
node-version: '20.x'
7585
cache: 'npm'
@@ -84,7 +94,7 @@ jobs:
8494
run: npx vsce package
8595

8696
- name: Upload VSIX package
87-
uses: actions/upload-artifact@v4
97+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
8898
with:
8999
name: vsix-package
90100
path: '*.vsix'

‎.github/workflows/codeql.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: ["main"]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: ["main"]
20+
schedule:
21+
- cron: "0 0 * * 1"
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
analyze:
28+
name: Analyze
29+
runs-on: ubuntu-latest
30+
permissions:
31+
actions: read
32+
contents: read
33+
security-events: write
34+
35+
strategy:
36+
fail-fast: false
37+
matrix:
38+
language: ["javascript", "typescript"]
39+
# CodeQL supports [ $supported-codeql-languages ]
40+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
41+
42+
steps:
43+
- name: Harden the runner (Audit all outbound calls)
44+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
45+
with:
46+
egress-policy: audit
47+
48+
- name: Checkout repository
49+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
50+
51+
# Initializes the CodeQL tools for scanning.
52+
- name: Initialize CodeQL
53+
uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
54+
with:
55+
languages: ${{ matrix.language }}
56+
# If you wish to specify custom queries, you can do so here or in a config file.
57+
# By default, queries listed here will override any specified in a config file.
58+
# Prefix the list here with "+" to use these queries and those in the config file.
59+
60+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
61+
# If this step fails, then you should remove it and run the build manually (see below)
62+
- name: Autobuild
63+
uses: github/codeql-action/autobuild@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
64+
65+
# ℹ️ Command-line programs to run using the OS shell.
66+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
67+
68+
# If the Autobuild fails above, remove it and uncomment the following three lines.
69+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
70+
71+
# - run: |
72+
# echo "Run, Build Application using script"
73+
# ./location_of_script_within_repo/buildscript.sh
74+
75+
- name: Perform CodeQL Analysis
76+
uses: github/codeql-action/analyze@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
77+
with:
78+
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Dependency Review Action
2+
#
3+
# This Action will scan dependency manifest files that change as part of a Pull Request,
4+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
5+
# Once installed, if the workflow run is marked as required,
6+
# PRs introducing known-vulnerable packages will be blocked from merging.
7+
#
8+
# Source repository: https://github.com/actions/dependency-review-action
9+
name: 'Dependency Review'
10+
on: [pull_request]
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
dependency-review:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Harden the runner (Audit all outbound calls)
20+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
21+
with:
22+
egress-policy: audit
23+
24+
- name: 'Checkout Repository'
25+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
26+
- name: 'Dependency Review'
27+
uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1

‎.github/workflows/release.yml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*' # Triggers on version tags like v1.0.0, v1.2.3, etc.
7+
8+
jobs:
9+
release:
10+
permissions:
11+
contents: write
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Harden the runner (Audit all outbound calls)
16+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
17+
with:
18+
egress-policy: audit
19+
20+
- name: Checkout code
21+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
22+
23+
- name: Setup Node.js
24+
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
25+
with:
26+
node-version: '20.x'
27+
cache: 'npm'
28+
29+
- name: Extract version from tag
30+
id: extract_version
31+
run: |
32+
TAG_VERSION=${GITHUB_REF#refs/tags/v}
33+
echo "tag_version=$TAG_VERSION" >> $GITHUB_OUTPUT
34+
echo "Tag version: $TAG_VERSION"
35+
36+
- name: Extract version from package.json
37+
id: package_version
38+
run: |
39+
PACKAGE_VERSION=$(node -p "require('./package.json').version")
40+
echo "package_version=$PACKAGE_VERSION" >> $GITHUB_OUTPUT
41+
echo "Package version: $PACKAGE_VERSION"
42+
43+
- name: Compare versions
44+
run: |
45+
if [ "${{ steps.extract_version.outputs.tag_version }}" != "${{ steps.package_version.outputs.package_version }}" ]; then
46+
echo "❌ Version mismatch!"
47+
echo "Tag version: ${{ steps.extract_version.outputs.tag_version }}"
48+
echo "Package.json version: ${{ steps.package_version.outputs.package_version }}"
49+
echo "Please ensure the tag version matches the version in package.json"
50+
exit 1
51+
fi
52+
echo "✅ Version check passed: ${{ steps.extract_version.outputs.tag_version }}"
53+
54+
- name: Install dependencies
55+
run: npm ci
56+
57+
- name: Run linting
58+
run: npm run lint
59+
60+
- name: Run type checking
61+
run: npm run check-types
62+
63+
- name: Compile extension
64+
run: npm run compile
65+
66+
- name: Build production package
67+
run: npm run package
68+
69+
- name: Compile tests
70+
run: npm run compile-tests
71+
72+
- name: Run tests
73+
uses: coactions/setup-xvfb@b6b4fcfb9f5a895edadc3bc76318fae0ac17c8b3 # v1.0.1
74+
with:
75+
run: npm test
76+
options: -screen 0 1024x768x24
77+
continue-on-error: false # Fail the release if tests fail
78+
79+
- name: Create VSIX package
80+
run: npx vsce package
81+
82+
- name: Get VSIX filename
83+
id: vsix_filename
84+
run: |
85+
VSIX_FILE=$(ls *.vsix | head -n 1)
86+
echo "vsix_file=$VSIX_FILE" >> $GITHUB_OUTPUT
87+
echo "VSIX file: $VSIX_FILE"
88+
89+
- name: Generate release notes
90+
id: release_notes
91+
run: |
92+
# Extract the latest changes from CHANGELOG.md if it has been updated
93+
# If not, create basic release notes
94+
if grep -q "## \[.*\]" CHANGELOG.md; then
95+
# Try to extract the latest version section from changelog
96+
NOTES=$(sed -n '/## \[.*\]/,/## \[.*\]/p' CHANGELOG.md | head -n -1 | tail -n +2)
97+
if [ -n "$NOTES" ]; then
98+
echo "notes<<EOF" >> $GITHUB_OUTPUT
99+
echo "$NOTES" >> $GITHUB_OUTPUT
100+
echo "EOF" >> $GITHUB_OUTPUT
101+
else
102+
echo "notes=Release ${{ steps.extract_version.outputs.tag_version }}" >> $GITHUB_OUTPUT
103+
fi
104+
else
105+
echo "notes=Release ${{ steps.extract_version.outputs.tag_version }}" >> $GITHUB_OUTPUT
106+
fi
107+
108+
- name: Create Release
109+
env:
110+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
111+
run: |
112+
# Create release with notes and upload VSIX file
113+
gh release create ${{ github.ref_name }} \
114+
--title "Release ${{ steps.extract_version.outputs.tag_version }}" \
115+
--notes "${{ steps.release_notes.outputs.notes }}" \
116+
./${{ steps.vsix_filename.outputs.vsix_file }}
117+
118+
- name: Release Summary
119+
run: |
120+
echo "🎉 Release ${{ steps.extract_version.outputs.tag_version }} created successfully!"
121+
echo "📦 VSIX package: ${{ steps.vsix_filename.outputs.vsix_file }}"
122+
echo "🔗 Release URL: https://github.com/${{ github.repository }}/releases/tag/${{ github.ref_name }}"

0 commit comments

Comments
 (0)