Files
vscode/.github/workflows/pr-node-modules.yml
T
e4124f7635 Pin GitHub Actions to full-length commit SHAs (#329034)
* Pin GitHub Actions to full-length commit SHAs

* chore: attest to third-party action pinning changes

I have reviewed the action-pinning diff authored by OssSecurityBot and
verified that each pinned SHA resolves to the same commit the tag it
replaces pointed at, and that no workflow logic was altered beyond the
`uses:` references.

This commit is signed with my key from security/trusted-signing-keys.csv
so the attestation is bound to my identity and to this exact tree. Any
subsequent push replaces the head and invalidates it.

Refs #328868

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: OssSecurityBot <oss-security-bot@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-08-06 11:22:51 +02:00

329 lines
12 KiB
YAML

name: Code OSS (node_modules)
on:
push:
branches:
- main
permissions: {}
jobs:
compile:
name: Compile
runs-on: [ self-hosted, 1ES.Pool=1es-vscode-oss-ubuntu-22.04-x64, "JobId=compile-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}" ]
steps:
- name: Checkout microsoft/vscode
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Setup Node.js
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version-file: .nvmrc
- name: Restore node_modules cache
id: cache-node-modules
uses: ./.github/actions/restore-node-modules
with:
key-prefix: node_modules-compile
key-args: "compile $(node -p process.arch)"
- name: Install build tools
if: steps.cache-node-modules.outputs.cache-hit != 'true'
run: sudo apt update -y && sudo apt install -y build-essential pkg-config libx11-dev libx11-xcb-dev libxkbfile-dev libnotify-bin libkrb5-dev
- name: Install dependencies
if: steps.cache-node-modules.outputs.cache-hit != 'true'
run: |
set -e
for i in {1..5}; do # try 5 times
npm ci && break
if [ $i -eq 5 ]; then
echo "Npm install failed too many times" >&2
exit 1
fi
echo "Npm install failed $i, trying again..."
done
env:
ELECTRON_SKIP_BINARY_DOWNLOAD: 1
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
GITHUB_TOKEN: ${{ secrets.VSCODE_OSS }}
- name: Save node_modules cache
if: steps.cache-node-modules.outputs.cache-hit != 'true'
uses: ./.github/actions/save-node-modules
- name: Prepare built-in extensions cache key
run: |
set -e
mkdir -p .build
node build/azure-pipelines/common/computeBuiltInDepsCacheKey.ts > .build/builtindepshash
- name: Restore built-in extensions cache
id: cache-builtin-extensions
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
with:
enableCrossOsArchive: true
path: .build/builtInExtensions
key: "builtin-extensions-${{ hashFiles('.build/builtindepshash') }}"
- name: Download built-in extensions
if: steps.cache-builtin-extensions.outputs.cache-hit != 'true'
run: node build/lib/builtInExtensions.ts
env:
GITHUB_TOKEN: ${{ secrets.VSCODE_OSS }}
linux:
name: Linux
runs-on: [ self-hosted, 1ES.Pool=1es-vscode-oss-ubuntu-22.04-x64, "JobId=linux-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}" ]
env:
NPM_ARCH: x64
VSCODE_ARCH: x64
steps:
- name: Checkout microsoft/vscode
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Setup Node.js
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version-file: .nvmrc
- name: Restore node_modules cache
id: cache-node-modules
uses: ./.github/actions/restore-node-modules
with:
key-prefix: node_modules-linux
key-args: "linux ${{ env.VSCODE_ARCH }} $(node -p process.arch)"
lookup-only: 'true'
- name: Install build dependencies
if: steps.cache-node-modules.outputs.cache-hit != 'true'
working-directory: build
run: |
set -e
for i in {1..5}; do # try 5 times
npm ci && break
if [ $i -eq 5 ]; then
echo "Npm install failed too many times" >&2
exit 1
fi
echo "Npm install failed $i, trying again..."
done
env:
GITHUB_TOKEN: ${{ secrets.VSCODE_OSS }}
- name: Install dependencies
if: steps.cache-node-modules.outputs.cache-hit != 'true'
run: |
set -e
source ./build/azure-pipelines/linux/setup-env.sh
for i in {1..5}; do # try 5 times
npm ci && break
if [ $i -eq 5 ]; then
echo "Npm install failed too many times" >&2
exit 1
fi
echo "Npm install failed $i, trying again..."
done
env:
npm_config_arch: ${{ env.NPM_ARCH }}
VSCODE_ARCH: ${{ env.VSCODE_ARCH }}
ELECTRON_SKIP_BINARY_DOWNLOAD: 1
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
GITHUB_TOKEN: ${{ secrets.VSCODE_OSS }}
- name: Verify native optional dependency binaries
if: steps.cache-node-modules.outputs.cache-hit != 'true'
run: node build/azure-pipelines/common/checkNativeOptionalDeps.ts
- name: Save node_modules cache
if: steps.cache-node-modules.outputs.cache-hit != 'true'
uses: ./.github/actions/save-node-modules
macOS:
name: macOS
runs-on: macos-26-xlarge
env:
NPM_ARCH: arm64
VSCODE_ARCH: arm64
steps:
- name: Checkout microsoft/vscode
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Setup Node.js
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version-file: .nvmrc
- name: Restore node_modules cache
id: cache-node-modules
uses: ./.github/actions/restore-node-modules
with:
key-prefix: node_modules-macos
key-args: "darwin ${{ env.VSCODE_ARCH }} $(node -p process.arch)"
lookup-only: 'true'
- name: Install dependencies
if: steps.cache-node-modules.outputs.cache-hit != 'true'
run: |
set -e
c++ --version
xcode-select -print-path
python3 -m pip install --break-system-packages setuptools
for i in {1..5}; do # try 5 times
npm ci && break
if [ $i -eq 5 ]; then
echo "Npm install failed too many times" >&2
exit 1
fi
echo "Npm install failed $i, trying again..."
done
env:
npm_config_arch: ${{ env.NPM_ARCH }}
VSCODE_ARCH: ${{ env.VSCODE_ARCH }}
ELECTRON_SKIP_BINARY_DOWNLOAD: 1
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
GITHUB_TOKEN: ${{ secrets.VSCODE_OSS }}
# Avoid using dlopen to load Kerberos on macOS which can cause missing libraries
# https://github.com/mongodb-js/kerberos/commit/04044d2814ad1d01e77f1ce87f26b03d86692cf2
# flipped the default to support legacy linux distros which shouldn't happen
# on macOS.
GYP_DEFINES: "kerberos_use_rtld=false"
- name: Verify native optional dependency binaries
if: steps.cache-node-modules.outputs.cache-hit != 'true'
run: node build/azure-pipelines/common/checkNativeOptionalDeps.ts
- name: Save node_modules cache
if: steps.cache-node-modules.outputs.cache-hit != 'true'
uses: ./.github/actions/save-node-modules
windows:
name: Windows
runs-on: [ self-hosted, 1ES.Pool=1es-vscode-oss-windows-2022-x64, "JobId=windows-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}" ]
env:
NPM_ARCH: x64
VSCODE_ARCH: x64
steps:
- name: Checkout microsoft/vscode
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Setup Node.js
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version-file: .nvmrc
- name: Restore node_modules cache
id: node-modules-cache
uses: ./.github/actions/restore-node-modules
with:
key-prefix: node_modules-windows
key-args: "win32 ${{ env.VSCODE_ARCH }} $(node -p process.arch)"
lookup-only: 'true'
- name: Install dependencies
if: steps.node-modules-cache.outputs.cache-hit != 'true'
shell: pwsh
run: |
. build/azure-pipelines/win32/exec.ps1
$ErrorActionPreference = "Stop"
for ($i = 1; $i -le 5; $i++) {
try {
exec { npm ci }
break
}
catch {
if ($i -eq 5) {
Write-Error "npm ci failed after 5 attempts"
throw
}
Write-Host "npm ci failed attempt $i, retrying..."
Start-Sleep -Seconds 2
}
}
env:
npm_config_arch: ${{ env.NPM_ARCH }}
npm_config_foreground_scripts: "true"
VSCODE_ARCH: ${{ env.VSCODE_ARCH }}
ELECTRON_SKIP_BINARY_DOWNLOAD: 1
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
GITHUB_TOKEN: ${{ secrets.VSCODE_OSS }}
- name: Verify native optional dependency binaries
if: steps.node-modules-cache.outputs.cache-hit != 'true'
run: node build/azure-pipelines/common/checkNativeOptionalDeps.ts
- name: Save node_modules cache
if: steps.node-modules-cache.outputs.cache-hit != 'true'
uses: ./.github/actions/save-node-modules
copilot-linux:
name: Copilot (Linux)
runs-on: [ self-hosted, 1ES.Pool=1es-vscode-oss-ubuntu-22.04-x64, "JobId=copilot-linux-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}" ]
steps:
- name: Checkout microsoft/vscode
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Setup Node.js
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version-file: extensions/copilot/.nvmrc
- name: Restore node_modules cache
id: cache-node-modules
uses: ./.github/actions/restore-node-modules
with:
key-prefix: copilot-node_modules-linux
key-args: "$(node -p process.platform) $(node -p process.arch)"
lookup-only: 'true'
- name: Install root dependencies
if: steps.cache-node-modules.outputs.cache-hit != 'true'
run: npm ci --ignore-scripts --no-workspaces
- name: Install copilot dependencies
if: steps.cache-node-modules.outputs.cache-hit != 'true'
working-directory: extensions/copilot
run: npm ci
- name: Save node_modules cache
if: steps.cache-node-modules.outputs.cache-hit != 'true'
uses: ./.github/actions/save-node-modules
copilot-windows:
name: Copilot (Windows)
runs-on: [ self-hosted, 1ES.Pool=1es-vscode-oss-windows-2022-x64, "JobId=copilot-windows-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}" ]
steps:
- name: Checkout microsoft/vscode
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
- name: Setup Node.js
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
with:
node-version-file: extensions/copilot/.nvmrc
- name: Restore node_modules cache
id: cache-node-modules
uses: ./.github/actions/restore-node-modules
with:
key-prefix: copilot-node_modules-windows
key-args: "$(node -p process.platform) $(node -p process.arch)"
lookup-only: 'true'
- name: Install root dependencies
if: steps.cache-node-modules.outputs.cache-hit != 'true'
run: npm ci --ignore-scripts --no-workspaces
- name: Install copilot dependencies
if: steps.cache-node-modules.outputs.cache-hit != 'true'
working-directory: extensions/copilot
run: npm ci
- name: Save node_modules cache
if: steps.cache-node-modules.outputs.cache-hit != 'true'
uses: ./.github/actions/save-node-modules