ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

# Least privilege by default. No job here writes to the repo; a job that ever needs
# to should raise its own `permissions:` block rather than widening this one.
permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Build & headless tests (node ${{ matrix.node }})
    runs-on: ubuntu-latest
    timeout-minutes: 15

    strategy:
      fail-fast: false
      matrix:
        # 20 is what the extension host ships today; 22 is the forward check, so a
        # toolchain break on a newer Node surfaces here rather than on a dev machine.
        node: [ 20, 22 ]

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: npm

      - name: Install dependencies
        run: npm ci

      # This repo's definition of green: check-types + lint + esbuild
      # (both targets — the node bundle AND the browser bundle).
      - name: Compile
        run: npm run compile

      # The vscode-free areas run under plain mocha, no Extension Host needed.
      # The glob is deliberately NOT widened to `**`: extension.test.ts and
      # commands/ import `vscode` and fail under plain node.
      - name: Headless unit tests
        run: |
          npm run compile-tests
          npx mocha "out/test/{quote,config,catalog,engine,format,record,prompted,custom,randomize}/*.test.js"

      # Exactly what `vscode:prepublish` runs before every publish.
      - name: Production bundle
        run: npm run package

      # The browser bundle is the web-cleanliness gate — esbuild hard-fails it
      # on any Node built-in. Assert it actually landed rather than trusting it.
      - name: Assert both bundles exist
        run: test -f dist/extension.js && test -f dist/web/extension.js

      # The full Extension Host suite (`npm test`) is deliberately not wired
      # here — it needs a virtual display on Linux runners. Run it locally
      # before cutting a release.

  localization:
    name: Localization bundles
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      # No `npm ci` — the gate is dependency-free on purpose, so a broken lockfile
      # can never mask a broken translation. It decides everything from the files
      # on disk: unresolved %key% placeholders, keys missing from a locale, keys
      # localized in runtime-matched positions (enum values, defaults, command ids).
      - name: Verify package.nls bundles
        run: node .github/scripts/check-nls.js

  package:
    name: VSIX packages
    runs-on: ubuntu-latest
    timeout-minutes: 15
    needs: [ build, localization ]

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - name: Install dependencies
        run: npm ci

      # The release gate CI was missing. `npm run compile` can pass while the VSIX
      # still fails to build — a bad .vscodeignore, an invalid `contributes` block,
      # or a missing icon only surface here.
      #
      # Invoked by explicit path, NOT `npx vsce` or `npm exec -- vsce`. Both of those
      # fall back to the registry when the binary is absent, and the unscoped `vsce`
      # package there is DEPRECATED and frozen at 2.15.0 — which rejects a manifest
      # that omits `activationEvents`, something VS Code has auto-generated since
      # 1.74. This repo omits it deliberately, so that stale binary fails here with
      # an error that reads like a manifest bug and is not one. This path resolves
      # only to the `@vscode/vsce` version in package-lock.json.
      - name: Build the VSIX
        run: ./node_modules/.bin/vsce package --out extension.vsix

      # Authoritative shipping check: inspect the archive itself rather than
      # reasoning about .vscodeignore globs.
      - name: Assert the VSIX contents are correct
        run: |
          unzip -l extension.vsix > listing.txt
          fail=0

          for loc in "" .zh-cn .es .fr .pt-br .ru .de .ja .tr; do
            if ! grep -q "package.nls${loc}.json" listing.txt; then
              echo "MISSING from VSIX: package.nls${loc}.json"
              fail=1
            fi
          done

          # Maintainer-only trees must never ship. Each is excluded deliberately
          # in .vscodeignore; this is what proves the exclusion still holds.
          for leak in "extension/src/" "CLAUDE.md" "extension/.github/" "SPEC.md" "extension/qa/" "extension/docs/"; do
            if grep -q "$leak" listing.txt; then
              echo "LEAKED into VSIX: $leak"
              fail=1
            fi
          done

          # This extension bundles @faker-js/faker; the size gate is a real one.
          size=$(stat -c%s extension.vsix)
          echo "VSIX size: $size bytes"
          if [ "$size" -gt 1572864 ]; then
            echo "VSIX exceeds the ~1.5 MB budget — check that only the shipped faker locales are bundled"
            fail=1
          fi

          echo "--- VSIX contents ---"
          cat listing.txt
          exit $fail

      - uses: actions/upload-artifact@v4
        with:
          name: vsix
          path: extension.vsix
          retention-days: 14