Skip to content

Conversation

@tculig
Copy link
Contributor

@tculig tculig commented Nov 24, 2025

Description

Checklist

Motivation and Context

  • Bugfix
  • New feature
  • Dependency update
  • Misc

Open Questions

Dependents

Types of changes

  • Backport Needed
  • Patch (non-breaking change which fixes an issue)
  • Minor (non-breaking change which adds functionality)
  • Major (fix or feature that would cause existing functionality to change)

himanshusinghs and others added 28 commits September 25, 2025 16:16
Earlier snyk was never scanning the vscode project because of the
combination of project auto-detection and the presence of .vscode-test
folder which contains several directories with package.json files.

This commit disables the auto-detection so that snyk run tests on the
current project.

Additionally the current project was having a problem
with a package declaring optional dependencies. These optional
dependencies were platform specific so for any platform, all the
optional dependencies will never be installed, only the ones that are
platform compatible. Snyk requires what is declared in package-lock.json
to be also present in node_modules folder which is why it would've
failed. In the same commit, we added a pre and post test hook to remove
the identified problematic optional dependencies from package-lock file
before running the test and then restore it when the test is finished.
Earlier we were running check, build and tests on each OS in our matrix
which did not allow us to test whether a build on ubuntu would work fine
on Windows / MacOS or not.

With this commit we are re-organising to check and build once on ubuntu
and use the final artifact later in the test job to run tests against.

Accordingly the test-and-build-from-fork and draft-release workflows
have been modified to adapt the same change.
…ll-tests' into VSCODE-703-add-install-tests-for-VSCode-extension
@tculig tculig marked this pull request as ready for review December 10, 2025 11:15
@tculig tculig requested a review from a team as a code owner December 10, 2025 11:15
@tculig tculig changed the title Vscode 703 add install tests for vs code extension test: add install tests for vs code extension VSCODE-703 Dec 10, 2025
Comment on lines +29 to +36
SEGMENT_KEY: ${{ secrets.SEGMENT_KEY_DEV }}
ARTIFACTORY_HOST: ${{ secrets.ARTIFACTORY_HOST }}
ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
GARASIGN_PASSWORD: ${{ secrets.GARASIGN_PASSWORD }}
GARASIGN_USERNAME: ${{ secrets.GARASIGN_USERNAME }}
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these should be optional for fork
workflow should skip steps when not set

Comment on lines +141 to +165
- name: Run Snyk Test
shell: bash
env:
SNYK_TOKEN: ${{ inputs.SNYK_TOKEN }}
run: |
pnpm run snyk-test
- name: Create Jira Tickets
if: >
(
github.event_name == 'push' && github.ref == 'refs/heads/main' ||
github.event_name == 'workflow_dispatch' ||
github.event_name == 'schedule'
)
shell: bash
env:
JIRA_API_TOKEN: ${{ inputs.JIRA_API_TOKEN }}
JIRA_BASE_URL: "https://jira.mongodb.org"
JIRA_PROJECT: "VSCODE"
JIRA_VULNERABILITY_BUILD_INFO: "- [GitHub Run|https://github.com/mongodb-js/vscode/actions/runs/${{github.run_id}}/jobs/${{github.job}}]"
run: |
pnpm run create-vulnerability-tickets > /dev/null
- name: Generate Vulnerability Report (Fail on >= High)
continue-on-error: ${{ github.event_name == 'pull_request' }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

end of this file should match the new main:

- name: Upload Snyk Report
if: runner.os == 'Linux'
uses: actions/upload-artifact@v4
with:
name: Snyk Report - ${{ github.run_id }}
path: |
.sbom/snyk-test-result.html
.sbom/snyk-test-result.json
# TODO(VSCODE-706): Fix Snyk vuln ticket generation
# - name: Create Jira Tickets
# if: >
# runner.os == 'Linux' &&
# (
# github.event_name == 'push' && github.ref == 'refs/heads/main' ||
# github.event_name == 'workflow_dispatch' ||
# github.event_name == 'schedule'
# )
# shell: bash
# env:
# JIRA_API_TOKEN: ${{ inputs.JIRA_API_TOKEN }}
# JIRA_BASE_URL: "https://jira.mongodb.org"
# JIRA_PROJECT: "VSCODE"
# JIRA_VULNERABILITY_BUILD_INFO: "- [GitHub Run|https://github.com/mongodb-js/vscode/actions/runs/${{github.run_id}}/jobs/${{github.job}}]"
# run: |
# pnpm run create-vulnerability-tickets > /dev/null
- name: Generate Vulnerability Report (Fail on >= High)
if: runner.os == 'Linux'
continue-on-error: ${{ github.event_name == 'pull_request' }}
shell: bash
run: |
# The standard output is suppressed since Github Actions logs are
# available for everyone with read access to the repo, which is everyone that is
# logged in for public repos.
# This command is only here to fail on failures for `main` and tags.
pnpm run generate-vulnerability-report > /dev/null

@@ -1,3 +1,7 @@
# Run manually to prepare a draft release for the next version of the extension.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this file should be left unchanged

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants