pull-request.yml

name: Pull Request

on:
  pull_request:
    branches: [main]

# Declare default permissions as read only.
permissions: read-all

jobs:
  filter:
    name: Detect changes
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      code: ${{ steps.filter.outputs.code }}
    steps:
      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3.0.3
        id: filter
        with:
          filters: |
            code:
              - '!(.github/workflows/**)'

  ci:
    name: Lint, Test, Build & Security
    needs: filter
    if: needs.filter.outputs.code == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            cli.codecov.io:443
            github.com:443
            ingest.codecov.io:443
            keybase.io:443
            o26192.ingest.us.sentry.io:443
            registry.npmjs.org:443
            release-assets.githubusercontent.com:443
            storage.googleapis.com:443

      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: '.nvmrc'

      - name: Install pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
        with:
          version: 10.30.3

      - name: Get pnpm store directory
        id: pnpm-store
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - name: Cache pnpm store
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ${{ steps.pnpm-store.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm lint

      - name: Test with coverage
        run: pnpm test:coverage

      - name: Report coverage percentage
        run: |
          LINES=$(jq -r '.total.lines.pct' coverage/coverage-summary.json)
          STATEMENTS=$(jq -r '.total.statements.pct' coverage/coverage-summary.json)
          echo "## Test coverage" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Metric | Coverage |" >> $GITHUB_STEP_SUMMARY
          echo "|--------|----------|" >> $GITHUB_STEP_SUMMARY
          echo "| **Lines** | ${LINES}% |" >> $GITHUB_STEP_SUMMARY
          echo "| **Statements** | ${STATEMENTS}% |" >> $GITHUB_STEP_SUMMARY

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
        with:
          files: ./coverage/lcov.info
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Build extension
        run: |
          pnpm run compile
          pnpm run webpack

      - name: Package extension
        run: pnpm run package

      - name: Audit dependencies
        run: pnpm audit --audit-level=high
        continue-on-error: false

  e2e:
    name: E2E Tests
    runs-on: ubuntu-latest
    needs: ci
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            hosted-compute-request-orchestrator-prod-eus-02.githubapp.com:443
            main.vscode-cdn.net:443
            marketplace.visualstudio.com:443
            nodejs.org:443
            r3---sn-2imeyn7r.gvt1.com:443
            r3---sn-o097znz7.gvt1.com:443
            r3---sn-o097znze.gvt1.com:443
            r3---sn-vgqsknzy.gvt1.com:443
            r5---sn-2op5q5-58.gvt1.com:443
            r5---sn-vgqsrnll.gvt1.com:443
            redirector.gvt1.com:443
            registry.npmjs.org:443
            release-assets.githubusercontent.com:443
            update.code.visualstudio.com:443
            vscode.download.prss.microsoft.com:443
            www.vscode-unpkg.net:443

      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version-file: '.nvmrc'

      - name: Install pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
        with:
          version: 10.30.3

      - name: Get pnpm store directory
        id: pnpm-store
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

      - name: Cache pnpm store
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: ${{ steps.pnpm-store.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build extension + webview
        run: pnpm run compile && pnpm run webpack

      - name: Run E2E tests
        run: xvfb-run -a pnpm run test:e2e

  react-doctor:
    name: React Doctor
    needs: filter
    if: needs.filter.outputs.code == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0

      - name: React Doctor
        uses: millionco/react-doctor@547e1e4ecdb70315d81a91ec3605701d58616ee2
        with:
          blocking: none
          scope: changed