build: bundle extension with esbuild (#55)

The extension shipped every tsc-emitted file plus the full
`node_modules` tree in the `.vsix` (198 files, 361KB). Bundling
`src/extension.ts` into a single minified `dist/extension.js` with
esbuild inlines the runtime deps (all pure JS, `vscode` left external)
and drops `node_modules` from the package entirely:

| | Before (tsc) | After (esbuild) |
|---|---|---|
| `.vsix` (compressed) | 361 KB | 75 KB (**-79%**) |
| Files | 198 | 7 |

Faster activation too: the host resolves one module instead of ~190.

`tsc` is kept for type-checking (`--noEmit`) and for compiling tests to
`out/`, so test coverage is unaffected. Nix (`vsix.nix`) already derives
deps via `importNpmLock`, so no hash to maintain; `vsce package` now
runs the esbuild-based `vscode:prepublish`.

Also fixes a pre-existing ordering-dependent flaky test in
`highlighters` (`highlightLayer` relied on `extension.activate()` having
run in another test file first, leaving `vulnTreeDataProvider` undefined
otherwise) by stubbing it locally in setup.

Note: the `pre-commit` lint hook also runs `npm audit`, which fails on a
pre-existing `serialize-javascript` advisory pulled in via
`@vscode/test-cli → mocha` (no fix available, unrelated to this change).
esbuild itself has zero dependencies.

Author: tembleking

.github/workflows/release.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 2 # We only need the current and the previous commit
 
@@ -30,33 +30,30 @@ jobs:
     runs-on: ubuntu-latest
     needs: check-changes
     if: needs.check-changes.outputs.changes == 'detected'
+    defaults:
+      run:
+        shell: nix develop --command bash -e {0}
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 22
-
-      - name: Install dependencies
-        run: |-
-          npm install
-          npm install -g vsce
+      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+      - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       # - name: Run tests
-      #   run: npm test
+      #   run: just test
 
       - name: Build VSIX file
-        run: vsce package -o sysdig-vscode-ext.vsix
+        run: just vsix
 
       - name: Get current version
         id: version
-        run: echo "version=$(jq -r '.version' package.json)" >> "$GITHUB_OUTPUT"
+        shell: bash
+        run: echo "version=$(jq --raw-output '.version' package.json)" >> "$GITHUB_OUTPUT"
 
       - name: Create release
         id: create_release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -66,7 +63,7 @@ jobs:
           prerelease: false
 
       - name: Upload VSIX file
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -76,11 +73,7 @@ jobs:
           asset_content_type: application/vsix
 
       - name: Publish VSIX to the marketplace
-        env:
-          VSCE_PAT: ${{ secrets.AZURE_DEVOPS_PAT }}
-        run: |
-          vsce publish
+        run: just publish-vscode-marketplace ${{ secrets.AZURE_DEVOPS_PAT }}
 
       - name: Publish VSIX to Open VSX
-        run: |
-          npx ovsx publish ./sysdig-vscode-ext.vsix -p ${{ secrets.OVSX_PAT }}
+        run: just publish-openvsx-registry ${{ secrets.OVSX_PAT }}

.github/workflows/test.yml

@@ -11,31 +11,24 @@ jobs:
       matrix:
         os: [macos-latest, ubuntu-latest]
     runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: nix develop --command bash -e {0}
     steps:
     - name: Checkout
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-    - name: Install Node.js
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-      with:
-        node-version: 18.x
-    - run: npm ci --include=dev
-    #- run: apt update && apt install -y libgtk2.0-0 libgtk-3-0 libgbm-dev libnotify-dev libnss3 libxss1 libasound2 libxtst6 xauth xvfb
-    #  if: runner.os == 'Linux'
-    #- run: service dbus start
-    #  if: runner.os == 'Linux'
-    - run: xvfb-run -a npm test
-      if: runner.os == 'Linux'
-    - run: npm test
-      if: runner.os != 'Linux'
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+    - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
+    - run: just test
 
   test-nix:
     strategy:
       matrix:
         os: [macos-latest, ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-    - uses: DeterminateSystems/nix-installer-action@v1
-    - uses: DeterminateSystems/magic-nix-cache-action@v1
-    - uses: DeterminateSystems/flake-checker-action@v1
-    - run: nix build -L
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+    - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
+    - uses: DeterminateSystems/flake-checker-action@3164002371bc90729c68af0e24d5aacf20d7c9f6 # v12
+    - run: nix build --print-build-logs

.vscode/launch.json

@@ -13,7 +13,7 @@
 				"--extensionDevelopmentPath=${workspaceFolder}"
 			],
 			"outFiles": [
-				"${workspaceFolder}/out/**/*.js"
+				"${workspaceFolder}/dist/**/*.js"
 			],
 			"preLaunchTask": "${defaultBuildTask}",
 		}

.vscodeignore

@@ -1,6 +1,9 @@
 .vscode/**
 .vscode-test/**
 src/**
+out/**
+node_modules/**
+esbuild.js
 .gitignore
 .yarnrc
 vsc-extension-quickstart.md
@@ -9,3 +12,13 @@ vsc-extension-quickstart.md
 **/*.map
 **/*.ts
 **/.vscode-test.*
+.github/**
+.direnv/**
+.envrc
+.pre-commit-config.yaml
+justfile
+flake.nix
+flake.lock
+vsix.nix
+result
+*.vsix

Justfile

@@ -0,0 +1,53 @@
+const esbuild = require("esbuild");
+
+const production = process.argv.includes("--production");
+const watch = process.argv.includes("--watch");
+
+/**
+ * Logs esbuild errors/warnings in a format the VS Code problem matcher understands.
+ * @type {import('esbuild').Plugin}
+ */
+const esbuildProblemMatcherPlugin = {
+	name: "esbuild-problem-matcher",
+	setup(build) {
+		build.onStart(() => {
+			console.log("[watch] build started");
+		});
+		build.onEnd((result) => {
+			result.errors.forEach(({ text, location }) => {
+				console.error(`✘ [ERROR] ${text}`);
+				if (location) {
+					console.error(`    ${location.file}:${location.line}:${location.column}:`);
+				}
+			});
+			console.log("[watch] build finished");
+		});
+	},
+};
+
+async function main() {
+	const ctx = await esbuild.context({
+		entryPoints: ["src/extension.ts"],
+		bundle: true,
+		format: "cjs",
+		minify: production,
+		sourcemap: !production,
+		sourcesContent: false,
+		platform: "node",
+		outfile: "dist/extension.js",
+		external: ["vscode"],
+		logLevel: "silent",
+		plugins: [esbuildProblemMatcherPlugin],
+	});
+	if (watch) {
+		await ctx.watch();
+	} else {
+		await ctx.rebuild();
+		await ctx.dispose();
+	}
+}
+
+main().catch((e) => {
+	console.error(e);
+	process.exit(1);
+});

esbuild.js

@@ -69,9 +69,10 @@
             mkShell {
               shellHook = ''
                 npm ci
-                pre-commit install
+                prek install --overwrite
               '';
               packages = [
+                prek
                 just
                 nodejs
                 pinact

flake.nix

@@ -0,0 +1,73 @@
+
+# Show available recipes
+[private]
+default:
+    @just --list
+
+# Run while debugging; wired as the preLaunchTask for F5
+watch:
+    npm run watch
+
+# Build an installable .vsix (VS Code: "Install from VSIX…") into the repo root
+vsix:
+    nix build
+    install --mode=644 result sysdig-vscode-ext.vsix
+    rm result
+
+# Publish the built .vsix to the VS Code Marketplace
+publish-vscode-marketplace token: vsix
+    vsce publish --packagePath sysdig-vscode-ext.vsix --pat {{token}}
+
+# Publish the built .vsix to the Open VSX registry
+publish-openvsx-registry token: vsix
+    npx ovsx publish sysdig-vscode-ext.vsix --pat {{token}}
+
+# Clean up
+clean:
+    rm -f sysdig-vscode-ext.vsix
+    rm -rf out
+    rm -rf dist
+    rm -rf node_modules
+    rm -rf .vscode-test
+    rm -f result
+
+# Run tests
+[linux]
+test:
+    xvfb-run --auto-display npm test
+
+# Run tests
+[macos]
+test:
+    npm test
+
+# All static code checks, without running tests
+lint:
+    #!/usr/bin/env bash
+    set -o errexit -o nounset -o pipefail
+    npm run check-types
+    npm run lint
+    # Audit fails only when at least one vulnerability has a fix available
+    audit=$(npm audit --json) || true
+    if node -e 'const v=Object.values(JSON.parse(require("fs").readFileSync(0,"utf8")).vulnerabilities||{}); process.exit(v.some(x=>x.fixAvailable!==false)?0:1)' <<<"$audit"; then
+        npm audit
+        exit 1
+    fi
+
+# Bump all pinned dependencies to their latest versions
+update:
+    nix flake update
+    nix develop --command pre-commit autoupdate
+    nix develop --command npm update
+    nix develop --command just update-scanner-version
+    nix develop --command pinact run --update --diff
+
+# Bump the inner sysdig-cli-scanner to the latest version
+update-scanner-version:
+    #!/usr/bin/env bash
+    set -o errexit -o nounset -o pipefail
+    echo "Fetching latest sysdig-cli-scanner version…"
+    latest=$(curl --silent --show-error --fail --location https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt)
+    echo "Latest: $latest"
+    sd "(export const SCANNER_VERSION : string = ')[^']+(';)" "\${1}$latest\${2}" src/config/configScanner.ts
+    echo "Version updated"