mirror of
https://github.com/microsoft/vscode.git
synced 2026-08-14 01:34:20 +01:00
* Pin GitHub Actions to full-length commit SHAs * chore: attest to third-party action pinning changes I have reviewed the action-pinning diff authored by OssSecurityBot and verified that each pinned SHA resolves to the same commit the tag it replaces pointed at, and that no workflow logic was altered beyond the `uses:` references. This commit is signed with my key from security/trusted-signing-keys.csv so the attestation is bound to my identity and to this exact tree. Any subsequent push replaces the head and invalidates it. Refs #328868 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: OssSecurityBot <oss-security-bot@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
139 lines
4.8 KiB
YAML
139 lines
4.8 KiB
YAML
name: "Copilot Setup Steps"
|
|
|
|
# Automatically run the setup steps when they are changed to allow for easy validation, and
|
|
# allow manual testing through the repository's "Actions" tab
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
paths:
|
|
- .github/workflows/copilot-setup-steps.yml
|
|
pull_request:
|
|
paths:
|
|
- .github/workflows/copilot-setup-steps.yml
|
|
|
|
jobs:
|
|
# The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
|
|
copilot-setup-steps:
|
|
runs-on: vscode-large-runners
|
|
|
|
# Set the permissions to the lowest permissions possible needed for your steps.
|
|
# Copilot will be given its own token for its operations.
|
|
permissions:
|
|
# If you want to clone the repository as part of your setup steps, for example to install dependencies, you'll need the `contents: read` permission. If you don't clone the repository in your setup steps, Copilot will do this for you automatically after the steps complete.
|
|
contents: read
|
|
|
|
# You can define any steps you want, and they will run before the agent starts.
|
|
# If you do not check out your code, Copilot will do this for you.
|
|
steps:
|
|
- name: Checkout microsoft/vscode
|
|
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
|
|
with:
|
|
node-version-file: .nvmrc
|
|
|
|
- name: Setup system services
|
|
run: |
|
|
set -e
|
|
# Start X server
|
|
./build/azure-pipelines/linux/apt-retry.sh sudo apt-get update
|
|
./build/azure-pipelines/linux/apt-retry.sh sudo apt-get install -y pkg-config \
|
|
xvfb \
|
|
libgtk-3-0 \
|
|
libxkbfile-dev \
|
|
libkrb5-dev \
|
|
libgbm1 \
|
|
rpm
|
|
sudo cp build/azure-pipelines/linux/xvfb.init /etc/init.d/xvfb
|
|
sudo chmod +x /etc/init.d/xvfb
|
|
sudo update-rc.d xvfb defaults
|
|
sudo service xvfb start
|
|
|
|
- name: Restore node_modules cache
|
|
id: cache-node-modules
|
|
uses: ./.github/actions/restore-node-modules
|
|
with:
|
|
key-prefix: node_modules-linux
|
|
key-args: "linux x64 $(node -p process.arch)"
|
|
|
|
- name: Install build dependencies
|
|
if: steps.cache-node-modules.outputs.cache-hit != 'true'
|
|
working-directory: build
|
|
run: |
|
|
set -e
|
|
|
|
for i in {1..5}; do # try 5 times
|
|
npm ci && break
|
|
if [ $i -eq 5 ]; then
|
|
echo "Npm install failed too many times" >&2
|
|
exit 1
|
|
fi
|
|
echo "Npm install failed $i, trying again..."
|
|
done
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Install dependencies
|
|
if: steps.cache-node-modules.outputs.cache-hit != 'true'
|
|
run: |
|
|
set -e
|
|
|
|
source ./build/azure-pipelines/linux/setup-env.sh
|
|
|
|
for i in {1..5}; do # try 5 times
|
|
npm ci && break
|
|
if [ $i -eq 5 ]; then
|
|
echo "Npm install failed too many times" >&2
|
|
exit 1
|
|
fi
|
|
echo "Npm install failed $i, trying again..."
|
|
done
|
|
env:
|
|
npm_config_arch: x64
|
|
VSCODE_ARCH: x64
|
|
ELECTRON_SKIP_BINARY_DOWNLOAD: 1
|
|
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Create .build folder
|
|
run: mkdir -p .build
|
|
|
|
- name: Prepare built-in extensions cache key
|
|
run: node build/azure-pipelines/common/computeBuiltInDepsCacheKey.ts > .build/builtindepshash
|
|
|
|
- name: Restore built-in extensions cache
|
|
id: cache-builtin-extensions
|
|
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
|
|
with:
|
|
enableCrossOsArchive: true
|
|
path: .build/builtInExtensions
|
|
key: "builtin-extensions-${{ hashFiles('.build/builtindepshash') }}"
|
|
|
|
- name: Download built-in extensions
|
|
if: steps.cache-builtin-extensions.outputs.cache-hit != 'true'
|
|
run: node build/lib/builtInExtensions.ts
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Download Electron and Playwright
|
|
run: |
|
|
set -e
|
|
|
|
for i in {1..3}; do # try 3 times (matching retryCountOnTaskFailure: 3)
|
|
if npm exec -- npm-run-all2 -lp "electron x64" "playwright-install"; then
|
|
echo "Download successful on attempt $i"
|
|
break
|
|
fi
|
|
|
|
if [ $i -eq 3 ]; then
|
|
echo "Download failed after 3 attempts" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Download failed on attempt $i, retrying..."
|
|
sleep 5 # optional: add a small delay between retries
|
|
done
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|