Repository navigation
build: lock release tooling and harden dependency security - #135
Conversation
Keep VSCE/OVSX and their transitive dependencies in a separate audited lock, remove runtime npx resolution from delivery paths, and preserve historical release recovery using tooling from the exact trusted workflow revision. Move primary CI to Node 24, pin action/image identities, update compatible test dependencies, and cover fail-closed audits and bootstrap regressions. The extension version, VS Code API floor and runtime dependencies stay unchanged. Co-authored-by: OpenAI Codex <215057067+openai-codex[bot]@users.noreply.github.com>
The Node 24 hosted run exposed the fixture's fixed 50-event-loop-turn wait racing actual filesystem completion. Wait for explicit admission milestones instead and retain the eight-worker ceiling, inverse completion order, exact file census and final discovery-order assertions. Production scanning is unchanged. Co-authored-by: OpenAI Codex <215057067+openai-codex[bot]@users.noreply.github.com>
Axe 4.14 exposes label-content-name-mismatch on existing achievement controls. Retain the audited 4.12.1 baseline rather than disabling the new rule or mixing production UI changes into this build-security PR. Document the focused accessibility and native acceptance required before that separate upgrade. Co-authored-by: OpenAI Codex <215057067+openai-codex[bot]@users.noreply.github.com>
Carl723000
left a comment
There was a problem hiding this comment.
复核提交：b67f532f829f2c33521e49d4e4c939f26ac4e08b，基线：e0917c170f458ef887f234fcf03454c062c42ec4。
未发现当前改动的阻塞问题。已核对锁文件与清单一致、无新增插件运行时依赖、构建工具不进入 VSIX、发布工具关闭安装脚本且审计失败即停止、历史 tag 重试读取精确工作流提交、独立交付及重复安全重试保持不变。最终头的 Node、四个完整 UI 分片、UI 汇总、Release Package 均通过。本轮重跑聚焦测试 42 通过／1 跳过，两套锁文件审计均为 0 已知漏洞。
独立限定复核还验证了 TypeScript 无输出检查、13 项依赖安全守卫及 30 次随机调度的并发夹具。非阻塞后续项：安全守卫可进一步拒绝审计步骤的错误 working-directory，防止将来两个审计误指向同一目录；当前工作流目录正确。Axe 4.14 的既有无障碍问题继续按 PR 记录暂缓，未关闭规则或修改视觉基线。
维护者已在本轮明确授权 Squash 合并；不发布新版本。此复核不声称运行了真实注册表上传、原生 F5 或日常实例安装测试。
Reviewed the exact head above: no blocking finding. Manifests/locks, shipping boundaries, fail-closed tooling installs/audits, exact-workflow historical recovery and independent duplicate-safe delivery remain sound in the reviewed scope. Required CI is green; fresh focused tests and both audits pass. The optional future working-directory mutation guard is not a defect in the current workflow. The maintainer has authorized squash merge only, not publication.
🤖 Generated by OpenAI Codex as an automated first pass — not a maintainer decision.
中文审阅
本 PR 只处理依赖和构建／发布工具安全，不修改产品版本号或最低 VS Code 兼容门槛。
.github/build-tools，移除 OVSX 1.2.0 带入的braces高危依赖链。根依赖和构建工具审计均为 0 已知漏洞。最终验证
b67f532f829f2c33521e49d4e4c939f26ac4e08b的 完整 CI 已通过：Node Tests、四个完整 Linux UI 分片、UI Test 汇总和 Release Package 全部成功。未修改视觉基线。用户原始日志、凭据和正常应用状态未用于测试。label-content-name-mismatch（可见等级／进度未完整进入可访问名称），属于后续产品无障碍修正范围。本次不关闭该规则来升级、不混入生产 UI 修改；保留无已知漏洞的 4.12.1，并在 CONTRIBUTING 中说明升级前的浏览器及原生验收要求。相关旧头运行已取消，保留失败记录，不冒充通过。Summary
Lock the complete build-only VSCE/OVSX graph, remove the vulnerable OVSX 1.2 dependency chain, and make delivery installs/audits fail closed without execution-time downloads. Keep exact-tag rebuilds, verified-asset retries and independent delivery sinks, while using current trusted workflow tooling outside the package tree.
Use Node 24 for primary CI, retain Node 22 native-Zstd coverage, pin action SHAs and the Playwright image digest, and update compatible development tools. Product version/API floor/runtime dependencies remain unchanged. Retain Release Drafter 6.4.0 because v7 separates autolabeling and requires a separate workflow migration.
Deferred optional upgrade: retain audited Axe 4.12.1. Version 4.14 exposes existing achievement-button
label-content-name-mismatchfindings; address those in a separate product accessibility change with focused browser/native acceptance before upgrading. No new Axe rule is disabled and no production UI is changed in this PR.Linked issues
None. This follows the maintainer's dependency/build audit; it does not claim to resolve #99 or incorporate #128.
Type of change
Visual design
N/A — no production UI or visual-system changes.
User-facing release note
N/A — internal build/test maintenance;
skip-changelog. No release requested.How was this tested?
npm test: 2,675 passed, 2 skipped, 0 failed. Focused security/automation suites: 31 passed. Both root and build-tool npm audits returned zero known advisories. Locked local CLI startup/help, VSIX packaging and package-safety verification passed. Independent review found a missing-workflow-object retry case; it was reproduced with an actual shallow clone, fixed with an exact-SHA fetch, and rerun green.Final head
b67f532f829f2c33521e49d4e4c939f26ac4e08bpassed the complete hosted run: Node Tests, all four full Linux UI shards, UI Test and Release Package. No visual baselines changed. No native F5/installed-instance test or registry upload was performed: runtime/production UI are unchanged and this is not a release candidate. Test inputs are synthetic; no normal provider logs or credentials were read. Known-advisory checks are not proof against all supply-chain compromise or a claim of demonstrated exploitability in the old publish path.The first hosted run exposed the existing manifest concurrency fixture racing fixed event-loop turns against actual I/O. A follow-up commit uses worker-admission events instead, retaining concurrency, reverse completion, exact census and ordering assertions. Focused and full local reruns passed; production scanning is unchanged. Only superseded runs were cancelled; the final head received and passed every required check again.
Checklist
🤖 Generated by OpenAI Codex as an automated first pass — not a maintainer decision.