Merge pull request #53 from ShortArrow/feat/panel-toggles #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Tag push `vX.Y.Z` → run the extension tests on three OSes → package the | |
| # VSIX → attach a build-provenance attestation → publish a GitHub Release | |
| # with generated notes → publish to the VS Code Marketplace when a VSCE_PAT | |
| # secret exists. | |
| # | |
| # The X.Y.Z part of the tag has to equal `version` in package.json (checked | |
| # in the test job) so a release never ships a VSIX whose manifest disagrees | |
| # with its tag. A tag with a suffix — `v0.0.10-beta.1` — is a pre-release: | |
| # the same checks run, the GitHub Release is marked pre-release, and the | |
| # Marketplace step is skipped. The suffix never reaches the manifest, | |
| # because the Marketplace rejects prerelease version strings. | |
| # Put `[skip publish]` in the tagged commit's message to skip the | |
| # Marketplace step while still creating the GitHub Release. | |
| on: | |
| push: | |
| tags: ["v*"] | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| name: Test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Check tag matches package.json version | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| tag="${GITHUB_REF_NAME#v}" | |
| base="${tag%%-*}" | |
| manifest="$(node -p "require('./package.json').version")" | |
| if [ "$base" != "$manifest" ]; then | |
| echo "::error::tag v$tag does not match package.json version $manifest" | |
| exit 1 | |
| fi | |
| - run: pnpm install --frozen-lockfile | |
| - name: Test (Linux, under Xvfb) | |
| if: runner.os == 'Linux' | |
| run: xvfb-run -a pnpm test | |
| - name: Test | |
| if: runner.os != 'Linux' | |
| run: pnpm test | |
| build: | |
| name: Package VSIX | |
| needs: test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Package | |
| # All dependencies are devDependencies, so nothing from node_modules | |
| # belongs in the VSIX; --no-dependencies also keeps vsce away from | |
| # pnpm's non-hoisted node_modules layout. | |
| run: pnpm exec vsce package --no-dependencies | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: vsix | |
| path: "*.vsix" | |
| if-no-files-found: error | |
| smoke: | |
| name: Smoke test the VSIX | |
| # Runs on a fresh runner with only smoke/ checked out (sparse, cone | |
| # mode — root-level files come along, src/ and out/ do not), so the | |
| # only copy of the extension that can be found is the artifact. The | |
| # negative control proves the same assertions fail when the VSIX is | |
| # not installed; without it a green smoke run says nothing. | |
| needs: build | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| working-directory: smoke | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| sparse-checkout: smoke | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| cache-dependency-path: smoke/pnpm-lock.yaml | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: vsix | |
| path: artifacts | |
| - name: Derive the manifest version from the tag | |
| run: | | |
| set -euo pipefail | |
| tag="${GITHUB_REF_NAME#v}" | |
| echo "MANIFEST_VERSION=${tag%%-*}" >> "$GITHUB_ENV" | |
| - name: Structural check | |
| run: | | |
| set -euo pipefail | |
| vsix="$(ls "$GITHUB_WORKSPACE"/artifacts/*.vsix)" | |
| unzip -q "$vsix" -d "$RUNNER_TEMP/vsix-contents" | |
| node inspect-vsix.js "$RUNNER_TEMP/vsix-contents" "$MANIFEST_VERSION" | |
| - run: pnpm install --frozen-lockfile | |
| - name: Negative control (must fail without the VSIX) | |
| run: | | |
| set +e | |
| xvfb-run -a node run.js --expect-version "$MANIFEST_VERSION" | |
| rc=$? | |
| set -e | |
| if [ "$rc" -ne 1 ]; then | |
| echo "::error::expected the smoke test to fail with exit 1 when no VSIX is installed, got $rc" | |
| exit 1 | |
| fi | |
| - name: Activation smoke | |
| run: | | |
| set -euo pipefail | |
| vsix="$(ls "$GITHUB_WORKSPACE"/artifacts/*.vsix)" | |
| xvfb-run -a node run.js --vsix "$vsix" --expect-version "$MANIFEST_VERSION" | |
| release: | |
| name: Create Release | |
| needs: smoke | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| # Required for actions/attest-build-provenance to mint a Sigstore | |
| # signing certificate via the GitHub OIDC provider. | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: vsix | |
| path: artifacts | |
| - name: Attest build provenance | |
| uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 | |
| with: | |
| subject-path: artifacts/*.vsix | |
| - name: Create release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TAG: ${{ github.ref_name }} | |
| run: | | |
| set -euo pipefail | |
| prerelease=() | |
| case "$TAG" in *-*) prerelease=(--prerelease) ;; esac | |
| gh release create "$TAG" \ | |
| --repo "$GITHUB_REPOSITORY" \ | |
| --title "$TAG" \ | |
| --generate-notes \ | |
| "${prerelease[@]}" \ | |
| artifacts/*.vsix | |
| publish-marketplace: | |
| name: Publish to VS Code Marketplace | |
| needs: release | |
| # Pre-release tags (with a suffix) never go to the Marketplace. | |
| if: ${{ !contains(github.event.head_commit.message, '[skip publish]') && !contains(github.ref_name, '-') }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| env: | |
| VSCE_PAT: ${{ secrets.VSCE_PAT }} | |
| steps: | |
| - name: Skip when VSCE_PAT is not configured | |
| if: env.VSCE_PAT == '' | |
| run: echo "VSCE_PAT secret is not set; skipping Marketplace publish." >> "$GITHUB_STEP_SUMMARY" | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| if: env.VSCE_PAT != '' | |
| with: | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| if: env.VSCE_PAT != '' | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| if: env.VSCE_PAT != '' | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| if: env.VSCE_PAT != '' | |
| with: | |
| name: vsix | |
| path: artifacts | |
| - run: pnpm install --frozen-lockfile | |
| if: env.VSCE_PAT != '' | |
| - name: Publish | |
| if: env.VSCE_PAT != '' | |
| run: pnpm exec vsce publish --packagePath artifacts/*.vsix |