Skip to content

fix(vscode): use shell mode for spawn on Windows to detect npm correctly #626

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
aalhadxx wants to merge 5 commits into from
Closed

fix(vscode): use shell mode for spawn on Windows to detect npm correctly #626

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d7711c0
fix(vscode): use shell mode for spawn on Windows to detect npm correctly
aalhadxx Jul 29, 2026
fa90a47
fix(vscode): limit shell mode to probeCommand only
aalhadxx Jul 29, 2026
117959d
fix(vscode): address review feedback on shell-mode tests
aalhadxx Jul 30, 2026
ffda357
test(vscode): fix lint errors in CliService.test.ts
aalhadxx Jul 31, 2026
f404e9b
fix(vscode): hardcode --version in probeCommand to strengthen securit…
aalhadxx Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
container:
image: golang:1.26.5
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@v4

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down Expand Up @@ -100,7 +100,7 @@ jobs:
- {goos: windows, goarch: amd64}
- {goos: windows, goarch: arm64}
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@v4

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/deploy-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
container:
image: node:24
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@v4

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand All @@ -42,7 +42,7 @@ jobs:
cp -r pages/dist/* _site/
cp pages/logo.svg _site/logo.svg

- uses: actions/upload-pages-artifact@v5
- uses: actions/upload-pages-artifact@v3
with:
path: _site

Expand All @@ -58,4 +58,4 @@ jobs:
steps:
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v5
uses: actions/deploy-pages@v4
2 changes: 1 addition & 1 deletion .github/workflows/ocr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:
# pull_request_target this checks out the trusted base branch; the
# composite action performs its own full checkout (fetch-depth: 0) later.
- name: Checkout
uses: actions/checkout@v7
uses: actions/checkout@v4

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pages-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
container:
image: node:24.18.0
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@v4

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
- goos: windows
goarch: arm64
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@v4

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down Expand Up @@ -70,7 +70,7 @@ jobs:
- name: Install git
run: apt-get update && apt-get install -y git

- uses: actions/checkout@v7
- uses: actions/checkout@v4
with:
fetch-depth: 0

Expand Down Expand Up @@ -144,15 +144,15 @@ jobs:
run: sha256sum opencodereview-* | sort > sha256sum.txt

- name: Create GitHub Release
uses: softprops/action-gh-release@v3
uses: softprops/action-gh-release@v2

@github-actions github-actions Bot Jul 31, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[security · medium]
Third-party actions should be pinned to a full commit SHA rather than a mutable tag. Tags can be moved or hijacked, posing a supply-chain risk. Consider pinning to the specific commit SHA for softprops/action-gh-release@v2 (e.g., uses: softprops/action-gh-release@<full-sha>). First-party actions/* pinned to major version tags like @v4 / @v2 are acceptable.

with:
body: ${{ steps.notes.outputs.body }}
files: |
opencodereview-*
sha256sum.txt

- name: Attest release artifacts
uses: actions/attest-build-provenance@v4
uses: actions/attest-build-provenance@v2
with:
subject-path: |
opencodereview-*
Expand All @@ -167,7 +167,7 @@ jobs:
permissions:
contents: read
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@v4

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/translation-sync.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: translation-sync

# Content-validation guardrails, kept out of ci.yml (which is build/test/lint):
# - blocking: all README*.md translations share the same ## section structure.
# - non-blocking: warn when a docs/en page changes without its zh/ja/ru counterpart.
# - non-blocking: warn when a docs/en page changes without its zh/ja counterpart.

@github-actions github-actions Bot Jul 31, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[documentation · medium]
The comments here and on line 43 were updated to say "zh/ja" (removing Russian), but the underlying script scripts/github-actions/check-translation-sync.js was not updated in this PR. It still defines DOCS_LOCALES = ["zh", "ja", "ru"] (line 46) and references "zh/ja/ru" in its own comments (lines 19, 44, 166, 179). This creates a mismatch between what the workflow comments claim and what the check actually does.

Either:

  1. Also update the script to remove "ru" from DOCS_LOCALES and update its comments, or
  2. Revert these comment changes to keep them consistent with the current script behavior.

# Scoped with paths: so it only runs when a translation or the checker changes,
# and a slow container pull here never delays core CI feedback.

Expand Down Expand Up @@ -40,7 +40,7 @@ jobs:
run: node scripts/github-actions/check-translation-sync.js readmes

# NON-BLOCKING: on PRs, warn (::warning) when a file under
# pages/src/content/docs/en/** changed without its zh/ja/ru counterpart.
# pages/src/content/docs/en/** changed without its zh/ja counterpart.
# continue-on-error keeps it advisory: it never fails the build.
# The event_name guard is intentional even though on: is PR-only today:
# if a push: trigger is reintroduced, base/head.sha would be empty.
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/vscode-ext.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,14 @@ jobs:
run:
working-directory: extensions/vscode
steps:
- uses: actions/checkout@v7
- uses: actions/checkout@v4

- name: Trust workspace
run: git config --global --replace-all safe.directory '*'
working-directory: .

- name: Cache Yarn packages
uses: actions/cache@v6
uses: actions/cache@v4
with:
path: ~/.cache/yarn
key: ${{ runner.os }}-yarn-${{ hashFiles('extensions/vscode/yarn.lock') }}
Expand Down
Loading
Loading