release: prepare Samsarix 1.1.0 - #13
Conversation
Summary by CodeRabbit
WalkthroughThe PR productizes version 1.1.0 with VS Code integration smoke tests, versioned VSIX validation, CI updates, tag-based draft release automation, and updated release documentation. Changes1.1.0 productization
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant CI as GitHub Actions
participant Runner as run-integration-tests.mjs
participant Host as VS Code Extension Development Host
participant Test as src/integration/run.ts
CI->>Runner: Start integration test for VS Code version
Runner->>Host: Launch workspace and fixture
Host->>Test: Execute compiled smoke test
Test->>Test: Verify activation and commands
Test-->>CI: Return pass or failure status
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 20: Update every actions/checkout step in the CI and release workflows,
including the steps near the specified checkout references, to set
persist-credentials to false while preserving the existing pinned action
versions and workflow behavior.
In @.github/workflows/release.yml:
- Line 17: Update the actions/checkout step in the release workflow to set
persist-credentials to false, while leaving the existing explicit GH_TOKEN
authentication for gh release create unchanged.
- Around line 42-49: Update the release workflow before the gh release create
command to read package.json.version and validate that GITHUB_REF_NAME exactly
equals v${package.json.version}; fail the job with a clear error when they
differ, and only continue to create the release after validation succeeds.
In `@scripts/run-integration-tests.mjs`:
- Around line 21-22: Replace the console.error calls in the integration-test
failure handler with the imported process.stderr.write API, preserving both the
descriptive failure message and error details while removing the ESLint no-undef
violations.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 7d3fa104-3e7c-4ea0-9e6b-7385b21ae499
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (17)
.github/workflows/ci.yml.github/workflows/release.yml.vscodeignoreCHANGELOG.mdREADME.mdROADMAP.mddocs/PRODUCTIZATION.mddocs/RELEASING.mddocs/TESTING.mddocs/getting-started.mdintegration-fixture/sample.tspackage.jsonscripts/inspect-package.mjsscripts/run-integration-tests.mjssrc/integration/run.tssrc/local/__tests__/release-surface.test.tstsconfig.integration.json
|
|
||
| steps: | ||
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow structure ---'
sed -n '1,130p' .github/workflows/ci.yml
printf '%s\n' '--- checkout and git-related workflow usage ---'
rg -n -C 3 'actions/checkout|persist-credentials|git (clone|fetch|pull|push)|npm (install|ci|run)|pnpm|yarn' .github/workflows/ci.yml
printf '%s\n' '--- repository scripts referenced by the workflow ---'
rg -n -C 3 '"(integration|test|lint|build|compile|prepare|preinstall|postinstall)[^"]*":|run-integration-tests|GITHUB_TOKEN|github.token|git config|git remote' package.json package-lock.json scripts .github 2>/dev/null || true
printf '%s\n' '--- tracked workflow and package files ---'
git ls-files .github/workflows/ci.yml package.json package-lock.json scriptsRepository: Deathcharge/samsarix-vscode
Length of output: 5677
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- package scripts and lifecycle hooks ---'
sed -n '210,245p' package.json
rg -n -C 4 '"(preinstall|install|postinstall|prepare|prepublish|audit:prod|package|test:integration)"' package.json
printf '%s\n' '--- repository-controlled commands and credential references ---'
rg -n -C 3 'process\.env|GITHUB_TOKEN|github\.token|GH_TOKEN|git config|git remote|git (clone|fetch|pull|push)|https://[^ ]+@' --glob '!package-lock.json' --glob '!dist/**' .
printf '%s\n' '--- all workflow permissions and checkout options ---'
rg -n -C 5 '^(permissions:| [A-Za-z_-]+: (read|write|none)| - uses: actions/checkout|persist-credentials|run:)' .github/workflowsRepository: Deathcharge/samsarix-vscode
Length of output: 6100
🌐 Web query:
GitHub actions/checkout persist-credentials default true local git config README
💡 Result:
The persist-credentials input for the GitHub actions/checkout action has a default value of true [1][2][3]. When set to true, the action configures the authentication token or SSH key within the local Git configuration of the checked-out repository, allowing subsequent scripts to execute authenticated Git commands [1][4]. In recent versions of actions/checkout, credential security has been improved: instead of writing directly to the repository's.git/config, credentials are stored in a separate file under the runner's temporary directory ($RUNNER_TEMP) and included conditionally using Git's includeIf mechanism [1][2][5]. This sensitive data is automatically removed during the post-job cleanup process [1][3][4]. Users who wish to prevent the action from configuring these credentials in the local Git configuration can explicitly set persist-credentials to false [1][2].
Citations:
- 1: https://github.com/actions/checkout
- 2: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 3: https://github.com/actions/checkout/?tab=readme-ov-file
- 4: https://github.com/actions/checkout/blob/25a956c84d5dd820d28caab9f86b8d183aeeff3d/README.md
- 5: https://github.com/actions/checkout/pull/2286/files
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import json
from pathlib import Path
for workflow in sorted(Path(".github/workflows").glob("*.yml")):
text = workflow.read_text()
lines = text.splitlines()
print(f"--- {workflow} ---")
for i, line in enumerate(lines):
if "actions/checkout@" not in line:
continue
indent = len(line) - len(line.lstrip())
has_persist_false = False
following = []
for candidate in lines[i + 1:]:
candidate_indent = len(candidate) - len(candidate.lstrip())
if candidate.strip() and candidate_indent <= indent:
break
if "persist-credentials:" in candidate:
has_persist_false = "false" in candidate.split("#", 1)[0].lower()
if candidate.lstrip().startswith("run:") or "uses:" in candidate:
following.append(candidate.strip())
print(f"checkout_line={i + 1} persist_credentials_false={has_persist_false}")
print("following_steps=" + repr(following))
package = json.loads(Path("package.json").read_text())
print("--- package scripts ---")
for name, command in package.get("scripts", {}).items():
print(f"{name}: {command}")
PYRepository: Deathcharge/samsarix-vscode
Length of output: 1175
🏁 Script executed:
#!/bin/bash
set -eu
sed -n '1,90p' .github/workflows/release.ymlRepository: Deathcharge/samsarix-vscode
Length of output: 1323
Disable checkout credential persistence in all workflows.
actions/checkout defaults persist-credentials to true and configures a credential helper for later Git commands. Both workflows run repository-controlled npm commands after checkout. The release workflow also grants contents: write.
Set persist-credentials: false on the checkout steps at .github/workflows/ci.yml:20, .github/workflows/ci.yml:68, and .github/workflows/release.yml:17.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 20-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 20, Update every actions/checkout step in
the CI and release workflows, including the steps near the specified checkout
references, to set persist-credentials to false while preserving the existing
pinned action versions and workflow behavior.
Source: Linters/SAST tools
| timeout-minutes: 25 | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable persisted checkout credentials.
Line 17 persists the write-capable checkout token in the Git remote configuration. npm ci runs after checkout and can execute dependency lifecycle scripts. A compromised dependency can use that credential to modify repository contents. Set persist-credentials: false. The final gh release create command already receives GH_TOKEN explicitly.
Proposed fix
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 17-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 17, Update the actions/checkout step
in the release workflow to set persist-credentials to false, while leaving the
existing explicit GH_TOKEN authentication for gh release create unchanged.
Source: Linters/SAST tools
| gh release create "${GITHUB_REF_NAME}" | ||
| dist/*.vsix | ||
| dist/*.sha256 | ||
| dist/*.contents.txt | ||
| --draft | ||
| --verify-tag | ||
| --generate-notes | ||
| --title "Samsarix ${GITHUB_REF_NAME}" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Validate the release tag against package.json.
Line 42 creates a release for every v* tag. The package tests require version 1.1.0, so a v1.1.1 tag can publish a release named v1.1.1 with 1.1.0 VSIX evidence. Fail the workflow unless GITHUB_REF_NAME equals v${package.json.version}.
Proposed fix
+ - name: Verify release tag version
+ run: |
+ expected_tag="v$(node -p "require('./package.json').version")"
+ test "${GITHUB_REF_NAME}" = "${expected_tag}"
+
- name: Create draft release with immutable evidence🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 42 - 49, Update the release
workflow before the gh release create command to read package.json.version and
validate that GITHUB_REF_NAME exactly equals v${package.json.version}; fail the
job with a clear error when they differ, and only continue to create the release
after validation succeeds.
| console.error(`Samsarix Extension Development Host test failed on VS Code ${version}.`); | ||
| console.error(error); |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Remove the ESLint no-undef errors.
Lines 21 and 22 use console, but the repository ESLint configuration does not define it. This causes lint to fail for this new script. Use the imported process.stderr.write() API, or configure the Node global for this file.
Proposed fix
- console.error(`Samsarix Extension Development Host test failed on VS Code ${version}.`);
- console.error(error);
+ process.stderr.write(
+ `Samsarix Extension Development Host test failed on VS Code ${version}.\n`
+ );
+ process.stderr.write(`${String(error)}\n`);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| console.error(`Samsarix Extension Development Host test failed on VS Code ${version}.`); | |
| console.error(error); | |
| process.stderr.write( | |
| `Samsarix Extension Development Host test failed on VS Code ${version}.\n` | |
| ); | |
| process.stderr.write(`${String(error)}\n`); |
🧰 Tools
🪛 ESLint
[error] 21-21: 'console' is not defined.
(no-undef)
[error] 22-22: 'console' is not defined.
(no-undef)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/run-integration-tests.mjs` around lines 21 - 22, Replace the
console.error calls in the integration-test failure handler with the imported
process.stderr.write API, preserving both the descriptive failure message and
error details while removing the ESLint no-undef violations.
Source: Linters/SAST tools
1 participant
What changed
1.1.0as the first productized Samsarix release line without rewriting the historicalv1.0.0tagWhy
The existing
v1.0.0tag points to a pre-productization commit, and the repository previously lacked real Extension Host coverage or an artifact-backed release workflow. This closes those technical release gaps while preserving the Marketplace, trademark, and real-Ollama checks as explicit owner gates.Verification
npm cinpm run check— 46 tests, coverage thresholds, 19-file VSIX allowlistnpm audit --audit-level=high— zero vulnerabilitiessamsarix.samsarix-vscode@1.1.094bbc5a489e91418d28d0585d90b39890578a0d1fc6cc46223f6581e0f3b9ed3