Use separate jobs instead of child_process

.github/workflows/publish-extension.yml

@@ -0,0 +1,132 @@
+name: Publish extension
+on:
+  workflow_dispatch:
+    inputs:
+      extension:
+        description: Extension JSON object
+        required: true
+        type: string
+      publishContext:
+        description: Publish context JSON object
+        required: true
+        type: string
+      skipPublish:
+        description: Skip publishing to Open VSX, only build extensions
+        required: true
+        type: boolean
+      force:
+        description: Force publish to Open VSX, even if version is already published
+        required: true
+        type: boolean
+jobs:
+  download_release:
+    name: Download latest release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      DO_DOWNLOAD: ${{ fromJSON(inputs.publishContext).files != null }}
+    steps:
+      - uses: actions/checkout@v4
+        if: ${{ env.DO_DOWNLOAD == 'true' }}
+      - uses: actions/[email protected]
+        if: ${{ env.DO_DOWNLOAD == 'true' }}
+        with:
+          node-version: "20.x"
+      - run: npm install
+        if: ${{ env.DO_DOWNLOAD == 'true' }}
+      - run: npm i -g @vscode/vsce pnpm
+        if: ${{ env.DO_DOWNLOAD == 'true' }}
+      - id: download_extension
+        uses: actions/github-script@v7
+        if: ${{ env.DO_DOWNLOAD == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EXTENSION: ${{ inputs.extension }}
+          PUBLISH_CONTEXT: ${{ inputs.publishContext }}
+        with:
+          script: |
+            const script = require('./scripts/download-extension.js');
+            await script();
+  build_extension:
+    name: Build Extension
+    runs-on: ubuntu-latest
+    needs: download_release
+    permissions:
+      actions: none
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/[email protected]
+        with:
+          node-version: "20.x"
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - name: Set up pyenv
+        uses: "gabrielfalcao/pyenv-action@32ef4d2c861170ce17ded56d10329d83f4c8f797"
+        with:
+            command: python --version
+      - name: Set default global version
+        run: |
+          pyenv install 3.8
+          pyenv global 3.8
+      - uses: actions/setup-java@v4
+        with:
+          distribution: "microsoft"
+          java-version: "21"
+      - name: Install dependencies for native modules
+        run: |
+          sudo apt-get update
+          sudo apt-get install libpango1.0-dev libgif-dev
+      - run: npm install
+      - run: npm i -g @vscode/vsce pnpm
+      - uses: actions/download-artifact@v4
+        with:
+          path: /tmp
+      - id: build_extension
+        name: Build extension
+        uses: actions/github-script@v7
+        env:
+          FORCE: ${{ inputs.force }}
+          SKIP_PUBLISH: ${{ inputs.skipPublish }}
+          EXTENSION: ${{ inputs.extension }}
+          PUBLISH_CONTEXT: ${{inputs.publishContext}}
+        with:
+          script: |
+            const extension = JSON.parse(process.env.EXTENSION);
+            const publishContext = JSON.parse(process.env.PUBLISH_CONTEXT);
+            const buildScript = require('./scripts/build-extension.js');
+            const extensionFiles = await buildScript(extension, publishContext);
+            const uploadScript = require('./scripts/upload-artifacts.js');
+            await uploadScript(extensionFiles);
+            core.setOutput("extensionFiles", JSON.stringify(extensionFiles));
+    outputs:
+      extensionFiles: ${{ steps.build_extension.outputs.extensionFiles }}
+  publish_extension:
+    name: Publish Extension
+    runs-on: ubuntu-latest
+    if: ${{ inputs.skipPublish != 'true' }}
+    needs: build_extension
+    permissions:
+      actions: none
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/[email protected]
+        with:
+          node-version: "20.x"
+      - run: npm install
+      - run: npm i -g @vscode/vsce pnpm
+      - uses: actions/download-artifact@v4
+        with:
+          path: /tmp
+      - uses: actions/github-script@v7
+        env:
+          OVSX_PAT: ${{ secrets.OVSX_PAT }}
+          EXTENSION_ID: ${{ fromJson(inputs.extension).id }}
+          EXTENSION_FILES: ${{needs.build_extension.outputs.extensionFiles}}
+        with:
+          script: |
+            const extensionId = process.env.EXTENSION_ID;
+            const extensionFiles = JSON.parse(process.env.EXTENSION_FILES);
+            const script = require('./scripts/publish-extension.js');
+            await script(extensionId, extensionFiles);

.github/workflows/publish-extensions.yml

@@ -29,67 +29,75 @@ jobs:
       FORCE: ${{ github.event.inputs.forcefullyPublish }}
     name: Publish Extensions
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/[email protected]
         with:
           node-version: "20.x"
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-      - name: Set up pyenv
-        uses: "gabrielfalcao/pyenv-action@32ef4d2c861170ce17ded56d10329d83f4c8f797"
-        with:
-            command: python --version
-      - name: Set default global version
-        run: |
-          pyenv install 3.8
-          pyenv global 3.8
-      - uses: actions/setup-java@v4
-        with:
-          distribution: "microsoft"
-          java-version: "21"
-      - name: Install dependencies for native modules
-        run: |
-          sudo apt-get update
-          sudo apt-get install libpango1.0-dev libgif-dev
       - run: npm install
       - run: npm i -g @vscode/vsce pnpm
-      - run: node publish-extensions
+      - uses: actions/github-script@v7
         env:
-          OVSX_PAT: ${{ secrets.OVSX_PAT }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Report results
-        run: bun run ./report-extensions.ts
-      - uses: actions/upload-artifact@v4
-        if: always()
+          REPOSITORY: ${{ github.repository }}
         with:
-          name: report
-          path: |
-            /tmp/stat.json
-            /tmp/result.md
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: artifacts
-          path: |
-            /tmp/artifacts/*.vsix
-      - name: Upload job summary
-        if: always()
-        run: cat /tmp/result.md >> $GITHUB_STEP_SUMMARY
-      - name: Get previous job's status
-        id: lastrun
-        uses: filiptronicek/get-last-job-status@main
-      - name: Slack Notification
-        if: ${{ !github.event.inputs.extensions && ((success() && steps.lastrun.outputs.status == 'failed') || failure()) }}
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_WEBHOOK: ${{ secrets.GITPOD_SLACK_WEBHOOK }}
-          SLACK_COLOR: ${{ job.status }}
+          script: |
+            const script = require('./scripts/publish-extensions.js');
+            await script(async (extension, context) => {
+              const [owner, repo] = process.env.REPOSITORY.split("/");
+              await github.request("POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches", {
+                  owner,
+                  repo,
+                  workflow_id: "publish-extension.yml",
+                  ref: "build-extension",
+                  inputs: {
+                      extension: JSON.stringify(extension),
+                      publishContext: JSON.stringify(context),
+                      force: process.env.FORCE,
+                      skipPublish: process.env.SKIP_PUBLISH,
+                  },
+                  headers: {
+                      "X-GitHub-Api-Version": "2022-11-28",
+                  },
+              });
+            });
+      # TODO fix reporting
+      # - name: Report results
+      #   run: bun run ./report-extensions.ts
+      # - uses: actions/upload-artifact@v4
+      #   if: always()
+      #   with:
+      #     name: report
+      #     path: |
+      #       /tmp/stat.json
+      #       /tmp/result.md
+      # - uses: actions/upload-artifact@v4
+      #   if: always()
+      #   with:
+      #     name: artifacts
+      #     path: |
+      #       /tmp/artifacts/*.vsix
+      # - name: Upload job summary
+      #   if: always()
+      #   run: cat /tmp/result.md >> $GITHUB_STEP_SUMMARY
+      # - name: Get previous job's status
+      #   id: lastrun
+      #   uses: filiptronicek/get-last-job-status@main
+      # - name: Slack Notification
+      #   if: ${{ !github.event.inputs.extensions && ((success() && steps.lastrun.outputs.status == 'failed') || failure()) }}
+      #   uses: rtCamp/action-slack-notify@v2
+      #   env:
+      #     SLACK_WEBHOOK: ${{ secrets.GITPOD_SLACK_WEBHOOK }}
+      #     SLACK_COLOR: ${{ job.status }}
   check_parity:
     name: Check MS parity
     runs-on: ubuntu-latest
     needs: publish_extensions
+    permissions:
+      actions: none
     if: ${{ !github.event.inputs.extensions }} # only run on full runs
     steps:
       - uses: actions/checkout@v4

.github/workflows/validate-pr.yml

@@ -30,9 +30,15 @@ jobs:
         run: |
           pyenv install 3.8
           pyenv global 3.8
-      - run: EXTENSIONS=$(node diff-extensions) node publish-extensions
+      - run: echo "EXTENSIONS=$(node diff-extensions)" >> $GITHUB_ENV
+      - uses: actions/github-script@v7
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+        with:
+          script: |
+            const script = require('./scripts/publish-extensions.js');
+            await script({github});
       - name: Report results
         run: bun run ./report-extensions.ts
       - uses: actions/upload-artifact@v4

local-workflow.js

@@ -0,0 +1,24 @@
+/********************************************************************************
+ * Copyright (c) 2025 Precies. Software OU and others
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ ********************************************************************************/
+
+// @ts-check
+const publishExtensionsScript = require("./scripts/publish-extensions");
+const buildExtensionScript = require("./scripts/build-extension");
+const publishExtensionScript = require("./scripts/publish-extension");
+
+(async () => {
+    process.env.SKIP_PUBLISH ??= "true";
+    process.env.FORCE ??= "true";
+
+    await publishExtensionsScript(async (extension, publishContext) => {
+        const extensionFiles = await buildExtensionScript(extension, publishContext);
+        await publishExtensionScript(extension.id, extensionFiles);
+    });
+})();

package.json

@@ -28,6 +28,7 @@
     "format": "prettier --write ."
   },
   "dependencies": {
+    "@actions/artifact": "^2.3.2",
     "@vscode/vsce": "^3.0.0",
     "ajv": "^8.8.1",
     "chai": "^5.1.0",
@@ -37,16 +38,22 @@
     "find-up": "^5.0.0",
     "human-number": "^2.0.0",
     "jest-diff": "^29.7.0",
+    "limiter": "^3.0.0",
     "minimist": "^1.2.5",
     "octokit": "^3.1.2",
     "ovsx": "latest",
     "prettier": "^3.2.5",
-    "semver": "^7.1.3"
+    "semver": "^7.1.3",
+    "xml2js": "^0.6.2",
+    "yauzl-promise": "^4.0.0"
   },
   "devDependencies": {
+    "@actions/github-script": "github:actions/github-script",
     "@types/human-number": "^1.0.0",
     "@types/node": "^22.2.0",
     "@types/unzipper": "^0.10.5",
+    "@types/xml2js": "^0.4.14",
+    "@types/yauzl-promise": "^4.0.1",
     "bun-types": "^1.0.1"
   }
 }