ci: stop installing vsce and ovsx unpinned - #1004
Merged
Merged
Conversation
Collaborator
Author
|
Dropped the |
lukecotter
force-pushed
the
bug-ci-vsce-pinning
branch
from
September 3, 2026 15:20
2afb14f to
825490c
Compare
lcottercertinia
approved these changes
Sep 3, 2026
All three workflows installed vsce globally at run time, so the published VSIX was built with whatever version was latest that day. The @vscode/vsce devDep that certinia#957 pinned in lana was reachable only from build:vsix, which nothing in CI called. ci.yml and publish.yml now run that same script. cd-prerelease.yml needs --pre-release, so it calls the pinned binary directly.
pnpm add --global ovsx installed whatever the registry served that day. Run it through pnpm dlx at a fixed version instead: ovsx only uploads at release time, so a devDependency would put its native keyring binaries in every install for no gain.
lcottercertinia
previously approved these changes
Sep 3, 2026
lukecotter
force-pushed
the
bug-ci-vsce-pinning
branch
from
September 3, 2026 16:42
eccb1f4 to
00fd80f
Compare
lukecotter
changed the title
lcottercertinia
approved these changes
Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR overview
Every publish path installed its own tooling with
pnpm add --global @vscode/vsceandpnpm add --global ovsx, which takes whatever the registry serves that day. The pre-releasejob runs unattended every Tuesday, so nobody sees what version it picked.
lanadevDependency, so it is already in the lockfile. Call it throughpnpm exec/ the existingbuild:vsixscript instead of a global install.it as
pnpm dlx ovsx@1.1.1pins the version without putting its native keyring binaries intoevery CI job and every developer's install.
No
package.jsonor lockfile change, sopnpm install --frozen-lockfileis unaffected.Trade-off worth knowing
Dependabot cannot see a version inside a
run:block, so theovsxpin will not be bumpedautomatically the way
vsceis. A stale pin fails loudly atverify-pat, before anything ispublished. The alternative —
ovsxas a devDependency — costs 56 extra packages(
@napi-rs/keyring,@node-rs/crc32and the inquirer tree) on every install, for a tool usedtwice a release.
Type of change
Validation
pnpm install --frozen-lockfilepasses against the unchanged lockfile.pnpm --filter lana exec vsce package --pre-release --no-dependenciesruns inlana/with theflags passed through unchanged.
ovsx@1.1.1is current latest and still takesverify-pat,--no-dependencies,--pre-releaseand--skip-duplicate.dlxfetch happens atverify-pat, before any upload, so a download failure cannot landmid-publish.
Known gap
cd-prerelease.ymlstill packages inline (vsce package --pre-release) whileci.ymlandpublish.ymlcall thebuild:vsixscript, becausebuild:vsixhas no--pre-releaseflag.Unifying them needs a second script in
lana/package.json; left out to keep this PR toworkflows only.