From 5002e13a1a896f2511cb08842a7fd94075697e7f Mon Sep 17 00:00:00 2001 From: Rob Reed Date: Thu, 27 Aug 2026 23:41:32 -0700 Subject: [PATCH 1/2] Depend on the published @plexinc packages. Point brighterscript and brighterscript-formatter at the GitHub Packages releases rather than git tags, so a checkout no longer clones those two repositories and no longer needs SSH access to GitHub to resolve them. The .npmrc tells npm where the @plexinc scope lives, matching the other Plex client repos. Both workflows that install dependencies now pass a token, since the registry requires one. The shadow release already declared a permissions block, which sets everything it does not list to none, so it needed packages: read adding explicitly or the install would have failed there. The shadow release is otherwise unchanged. It builds a VSIX rather than an npm package, so it has nothing to publish to the registry and stays as it is. The swap was made with a targeted npm install rather than by regenerating the lockfile, which changed two entries out of 1156. Co-Authored-By: Claude --- .github/workflows/build.yml | 12 +++++++++++- .github/workflows/xelp_shadow_release.yml | 8 ++++++++ .npmrc | 3 +++ package-lock.json | 18 +++++++++++------- package.json | 4 ++-- 5 files changed, 35 insertions(+), 10 deletions(-) create mode 100644 .npmrc diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 783541de6..1c3a76650 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -8,6 +8,11 @@ on: jobs: ci: runs-on: ${{ matrix.os }} + # npm ci reads @plexinc packages, so do not rely on the repository + # default, which an organization can tighten without warning. + permissions: + contents: read + packages: read strategy: matrix: os: [ubuntu-latest, macos-latest] @@ -16,7 +21,12 @@ jobs: - uses: actions/setup-node@master with: node-version: "18.18.2" - - run: npm ci + registry-url: 'https://npm.pkg.github.com' + scope: '@plexinc' + - name: npm ci + env: + NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: npm ci - run: npm run build - run: npm run lint - run: npm run test diff --git a/.github/workflows/xelp_shadow_release.yml b/.github/workflows/xelp_shadow_release.yml index 70ea13147..1499fd74f 100644 --- a/.github/workflows/xelp_shadow_release.yml +++ b/.github/workflows/xelp_shadow_release.yml @@ -8,6 +8,10 @@ jobs: runs-on: ubuntu-latest permissions: contents: write + # The install pulls @plexinc packages, and an explicit permissions block + # sets everything it does not list to none. + # + packages: read steps: - name: Checkout xelp/main uses: actions/checkout@v4 @@ -19,6 +23,8 @@ jobs: uses: actions/setup-node@v4 with: node-version: '22.12.0' + registry-url: 'https://npm.pkg.github.com' + scope: '@plexinc' - name: Configure Git run: | @@ -68,6 +74,8 @@ jobs: echo "tag_version=$TAG_VERSION" >> $GITHUB_OUTPUT echo "metadata_version=$METADATA_VERSION" >> $GITHUB_OUTPUT - name: Install dependencies + env: + NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: npm ci - name: Update package.json version diff --git a/.npmrc b/.npmrc new file mode 100644 index 000000000..3ccf31e4c --- /dev/null +++ b/.npmrc @@ -0,0 +1,3 @@ +# Use GitHub for @plexinc packages. +@plexinc:registry=https://npm.pkg.github.com/ +//npm.pkg.github.com/:always-auth=true diff --git a/package-lock.json b/package-lock.json index 700463672..eee7c8d9e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -14,8 +14,8 @@ "@vscode/extension-telemetry": "^0.4.7", "array-sort": "^1.0.0", "backoff": "^2.5.0", - "brighterscript": "https://github.com/plexinc/brighterscript.git#0.70.202603123", - "brighterscript-formatter": "https://github.com/plexinc/brighterscript-formatter.git#1.7.2026031221", + "brighterscript": "npm:@plexinc/brighterscript@0.70.202608283", + "brighterscript-formatter": "npm:@plexinc/brighterscript-formatter@1.7.2026082821", "clone-deep": "^4.0.1", "debounce": "^1.2.0", "dotenv": "^6.2.0", @@ -3298,8 +3298,10 @@ } }, "node_modules/brighterscript": { - "version": "0.70.202603123", - "resolved": "git+ssh://git@github.com/plexinc/brighterscript.git#b1c0191837cb61b938015f9ba086348820513f97", + "name": "@plexinc/brighterscript", + "version": "0.70.202608283", + "resolved": "https://npm.pkg.github.com/download/@plexinc/brighterscript/0.70.202608283/f0a4be489585bc03e84d8e3a012494f4872fc347", + "integrity": "sha512-ixJVQQmh1UO1th6/0p8Sh9yg1hXctWyK328o5Oi0gi1UhtuWIUftrwtLXRks3ZSpSAgf+Wsb+XoRY65N79cDeQ==", "license": "MIT", "dependencies": { "@rokucommunity/bslib": "^0.1.1", @@ -3347,11 +3349,13 @@ } }, "node_modules/brighterscript-formatter": { - "version": "1.7.2026031221", - "resolved": "git+ssh://git@github.com/plexinc/brighterscript-formatter.git#69df9bc239cd5853d687bbc478ab9b37f178f552", + "name": "@plexinc/brighterscript-formatter", + "version": "1.7.2026082821", + "resolved": "https://npm.pkg.github.com/download/@plexinc/brighterscript-formatter/1.7.2026082821/3062dd562afea9f8886628d5af8d3237f44debb5", + "integrity": "sha512-aRiSDXs3mj5F1FcCLUiDBRzTvBEu71/U/FL8DR+kX5haBRsEa5nMj6cZ8jOXtVLFgsesym7J1AGqiJqba6MgRA==", "license": "MIT", "dependencies": { - "brighterscript": "https://github.com/plexinc/brighterscript.git#0.70.202603123", + "brighterscript": "npm:@plexinc/brighterscript@^0.70.0", "glob-all": "^3.3.0", "jsonc-parser": "^3.0.0", "source-map": "0.7.4", diff --git a/package.json b/package.json index 3a687f749..7fad1463e 100644 --- a/package.json +++ b/package.json @@ -56,8 +56,8 @@ "@vscode/extension-telemetry": "^0.4.7", "array-sort": "^1.0.0", "backoff": "^2.5.0", - "brighterscript": "https://github.com/plexinc/brighterscript.git#0.70.202603123", - "brighterscript-formatter": "https://github.com/plexinc/brighterscript-formatter.git#1.7.2026031221", + "brighterscript": "npm:@plexinc/brighterscript@0.70.202608283", + "brighterscript-formatter": "npm:@plexinc/brighterscript-formatter@1.7.2026082821", "clone-deep": "^4.0.1", "debounce": "^1.2.0", "dotenv": "^6.2.0", From 4bdba9f7fc7c49f0e745f18aea973decd644cdda Mon Sep 17 00:00:00 2001 From: Rob Reed Date: Thu, 27 Aug 2026 23:46:09 -0700 Subject: [PATCH 2/2] Run CI on Node 20, matching upstream. Packaging the extension calls the File global, which Node 18 does not provide, so npm run create-package fails with "ReferenceError: File is not defined". The job has been failing on that since the lockfile was last regenerated in March, and went unnoticed because build.yml only runs on pull requests and pushes to master, neither of which has happened on this fork since November. Upstream already runs 20.19.4, so this picks up a version the fork was left behind on rather than diverging further. The shadow release, which is what actually produces the VSIX, already runs 22.12.0 and was unaffected. --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1c3a76650..474b4d6bb 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -20,7 +20,7 @@ jobs: - uses: actions/checkout@master - uses: actions/setup-node@master with: - node-version: "18.18.2" + node-version: "20.19.4" registry-url: 'https://npm.pkg.github.com' scope: '@plexinc' - name: npm ci