Skip to content

Conversation

@gagik
Copy link
Contributor

@gagik gagik commented Jan 28, 2026

This includes some of the refactoring from #1133 and adds the VSIX test script from #1188

There's a few CI follows up I want to do:

  • make sure PNPM is properly caching
  • cache builds between these runs

run: pnpm run check-vsix-size
shell: bash

- name: Run VSIX Install Test
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we run this on forks? I was thinking this has some potential security risks because of this installation being a rather odd thing.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure of this thread is new or old but I guess after Slack discussion, you'd wanna add the install tests for forked PRs? Also fine if you wish to do that in a follow up PR.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps one thing to note - this action is now only used in draft-release workflow.

@gagik gagik marked this pull request as ready for review January 28, 2026 15:51
@gagik gagik requested a review from a team as a code owner January 28, 2026 15:51
Copilot AI review requested due to automatic review settings January 28, 2026 15:51
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds VSIX installation testing to ensure the extension package can be successfully installed and uninstalled across different operating systems (macOS, Windows, Linux).

Changes:

  • Added a new bash script to test VSIX installation and uninstallation
  • Integrated the test into the package.json scripts and GitHub Actions workflow

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File Description
scripts/test-vsix-install.sh New script that finds, installs, verifies, and uninstalls the VSIX extension on different operating systems
package.json Added new test-install script command to run the VSIX installation test
.github/workflows/actions/test-and-build/action.yaml Added workflow step to execute VSIX installation tests in CI/CD pipeline

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copy link
Contributor

@himanshusinghs himanshusinghs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is looking good. I flagged small things to consider.

run: pnpm run check-vsix-size
shell: bash

- name: Run VSIX Install Test
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure of this thread is new or old but I guess after Slack discussion, you'd wanna add the install tests for forked PRs? Also fine if you wish to do that in a follow up PR.

run: pnpm run check-vsix-size
shell: bash

- name: Run VSIX Install Test
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps one thing to note - this action is now only used in draft-release workflow.

Comment on lines 127 to 147
finalize:
name: Sign and Upload
needs: [test, test-install]

runs-on: ubuntu-latest

steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Setup Node environment
uses: ./.github/workflows/actions/setup-node-environment

- name: Download .vsix
uses: actions/download-artifact@v4
with:
name: vsix

- name: Sign .vsix
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small nit: One thing I just now realised that the "Sign .vsix" is relevant only at the time of releasing (in draft-release workflow) so if you wish to further simplify, very likely we could skip the VSIX signing and uploading here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah fair

@gagik
Copy link
Contributor Author

gagik commented Jan 29, 2026

@himanshusinghs added draft + fork adjustments. Snyk will be separated in the next PR and I might turn each job into actions as well as another follow-up

@semgrep-code-mongodb
Copy link

Semgrep found 1 run-shell-injection finding:

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

🛟 Help? Slack #semgrep-help or go/semgrep-help.

Resolution Options:

  • Fix the code
  • Reply /fp $reason (if security gap doesn’t exist)
  • Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
  • Reply /other $reason (e.g., test-only)

@gagik gagik enabled auto-merge (squash) January 30, 2026 10:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants