feat: Add VS Code Extension CI/CD Infrastructure

.github/actions/ctcOpen/action.yml

@@ -15,7 +15,7 @@ inputs:
     description: Github token
     required: true
   githubTag:
-    description: 'The semver tag of the GitHub Release'
+    description: "The semver tag of the GitHub Release"
     required: false
   nodeVersion:
     description: version of node to use.  It's better to specify latest, lts/* or lts/-1 than to hardcode numbers

.github/actions/vscode/check-ci-status/action.yml

@@ -0,0 +1,100 @@
+name: Check CI Status
+description: >
+  Verifies that CI checks passed for a given commit SHA before promotion.
+  Fails if any required check did not succeed.
+
+inputs:
+  commit-sha:
+    description: 'Commit SHA to check CI status for'
+    required: true
+  token:
+    description: 'GitHub token with repo read access'
+    required: true
+  required-checks:
+    description: >
+      Comma-separated list of check names that must have succeeded.
+      If empty, all non-skipped check-runs must have conclusion "success".
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Verify CI checks passed
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        COMMIT_SHA: ${{ inputs.commit-sha }}
+        REQUIRED_CHECKS: ${{ inputs.required-checks }}
+        REPO: ${{ github.repository }}
+      run: |
+        echo "Checking CI status for commit $COMMIT_SHA in $REPO..."
+
+        # Fetch all check-runs for the commit (paginate up to 100)
+        CHECK_RUNS=$(gh api \
+          "repos/$REPO/commits/$COMMIT_SHA/check-runs" \
+          --paginate \
+          --jq '.check_runs[] | {name: .name, status: .status, conclusion: .conclusion}' \
+          2>&1)
+
+        if [ -z "$CHECK_RUNS" ]; then
+          echo "No check-runs found for commit $COMMIT_SHA"
+          echo "Cannot verify CI status — failing to prevent untested promotion"
+          exit 1
+        fi
+
+        echo "Check-runs found:"
+        echo "$CHECK_RUNS" | jq -r '"  \(.name): status=\(.status) conclusion=\(.conclusion)"'
+
+        FAILED=0
+
+        if [ -n "$REQUIRED_CHECKS" ]; then
+          # Only validate the specified checks
+          IFS=',' read -ra CHECKS <<< "$REQUIRED_CHECKS"
+          for CHECK in "${CHECKS[@]}"; do
+            CHECK=$(echo "$CHECK" | xargs)  # trim whitespace
+            CONCLUSION=$(echo "$CHECK_RUNS" | jq -r --arg name "$CHECK" \
+              'select(.name == $name) | .conclusion' | head -1)
+            if [ "$CONCLUSION" != "success" ]; then
+              echo "FAIL: required check '$CHECK' has conclusion '$CONCLUSION' (expected 'success')"
+              FAILED=1
+            else
+              echo "PASS: required check '$CHECK' succeeded"
+            fi
+          done
+        else
+          # Validate all non-skipped check-runs
+          while IFS= read -r RUN; do
+            NAME=$(echo "$RUN" | jq -r '.name')
+            STATUS=$(echo "$RUN" | jq -r '.status')
+            CONCLUSION=$(echo "$RUN" | jq -r '.conclusion')
+
+            # Skip queued/in-progress (treat as not-yet-run, which is a failure)
+            if [ "$STATUS" != "completed" ]; then
+              echo "FAIL: check '$NAME' is not completed (status=$STATUS)"
+              FAILED=1
+              continue
+            fi
+
+            # Allow skipped checks (neutral conclusion)
+            if [ "$CONCLUSION" = "skipped" ] || [ "$CONCLUSION" = "neutral" ]; then
+              echo "SKIP: check '$NAME' was skipped — ignoring"
+              continue
+            fi
+
+            if [ "$CONCLUSION" != "success" ]; then
+              echo "FAIL: check '$NAME' has conclusion '$CONCLUSION'"
+              FAILED=1
+            fi
+          done < <(echo "$CHECK_RUNS" | jq -c '.')
+        fi
+
+        if [ "$FAILED" -eq 1 ]; then
+          echo ""
+          echo "CI quality gate FAILED for commit $COMMIT_SHA"
+          echo "Promotion blocked. Fix failing checks before retrying."
+          exit 1
+        fi
+
+        echo ""
+        echo "CI quality gate PASSED for commit $COMMIT_SHA"

.github/actions/vscode/publish-vsix/action.yml

@@ -0,0 +1,147 @@
+name: "Publish VSIX"
+description: "Publishes VSIX files to a marketplace with dry-run support"
+
+inputs:
+  vsix-path:
+    description: "Path to the VSIX file to publish"
+    required: true
+  publish-tool:
+    description: "Publishing tool to use"
+    required: true
+  pre-release:
+    description: "Publish as pre-release version"
+    required: false
+    default: "false"
+  dry-run:
+    description: "Run in dry-run mode"
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Validate inputs
+      shell: bash
+      run: |
+        # Validate VSIX path exists
+        if [ ! -f "${{ inputs.vsix-path }}" ]; then
+          echo "❌ Error: VSIX file not found at ${{ inputs.vsix-path }}"
+          exit 1
+        fi
+
+        # Validate VSIX file extension
+        if [[ ! "${{ inputs.vsix-path }}" =~ \.vsix$ ]]; then
+          echo "❌ Error: File must have .vsix extension"
+          exit 1
+        fi
+
+        # Validate publish tool
+        if [[ ! "${{ inputs.publish-tool }}" =~ ^(ovsx|vsce)$ ]]; then
+          echo "❌ Error: Invalid publish tool: ${{ inputs.publish-tool }}"
+          exit 1
+        fi
+
+        echo "✅ Input validation passed"
+
+    - name: Audit publish attempt
+      shell: bash
+      run: |
+        # Create audit log entry
+        AUDIT_LOG="/tmp/publish_audit.log"
+        TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+        ACTOR="${{ github.actor }}"
+        REPO="${{ github.repository }}"
+        RUN_ID="${{ github.run_id }}"
+        WORKFLOW="${{ github.workflow }}"
+
+        # Get file info for audit
+        FILE_SIZE=$(stat -c%s "${{ inputs.vsix-path }}" 2>/dev/null || stat -f%z "${{ inputs.vsix-path }}" 2>/dev/null || echo "unknown")
+        FILE_HASH=$(sha256sum "${{ inputs.vsix-path }}" 2>/dev/null | cut -d' ' -f1 || echo "unknown")
+
+        # Log audit information
+        echo "[$TIMESTAMP] PUBLISH_ATTEMPT: actor=$ACTOR, repo=$REPO, run_id=$RUN_ID, workflow=$WORKFLOW, tool=${{ inputs.publish-tool }}, file=${{ inputs.vsix-path }}, size=$FILE_SIZE, hash=$FILE_HASH, pre_release=${{ inputs.pre-release }}, dry_run=${{ inputs.dry-run }}" >> "$AUDIT_LOG"
+
+        # Also log to GitHub Actions output for visibility
+        echo "🔍 AUDIT: Publish attempt logged - $TIMESTAMP"
+        echo "  Actor: $ACTOR"
+        echo "  Repository: $REPO"
+        echo "  Run ID: $RUN_ID"
+        echo "  Workflow: $WORKFLOW"
+        echo "  Tool: ${{ inputs.publish-tool }}"
+        echo "  File: ${{ inputs.vsix-path }}"
+        echo "  Size: $FILE_SIZE bytes"
+        echo "  Hash: $FILE_HASH"
+        echo "  Pre-release: ${{ inputs.pre-release }}"
+        echo "  Dry-run: ${{ inputs.dry-run }}"
+
+    - name: Publish VSIX
+      shell: bash
+      run: |
+        echo "Publishing ${{ inputs.vsix-path }}"
+
+        # Calculate marketplace name based on publish tool
+        if [ "${{ inputs.publish-tool }}" = "ovsx" ]; then
+          MARKETPLACE_NAME="Open VSX Registry"
+          TOKEN_ENV="OVSX_PAT"
+        else
+          MARKETPLACE_NAME="Visual Studio Marketplace"
+          TOKEN_ENV="VSCE_PERSONAL_ACCESS_TOKEN"
+        fi
+
+        PRE_RELEASE_FLAG=""
+        if [ "${{ inputs.pre-release }}" = "true" ]; then
+          PRE_RELEASE_FLAG="--pre-release"
+          echo "Would publish as pre-release version"
+        fi
+
+        # Mask token in logs for security
+        TOKEN_MASK="***"
+
+        if [ "${{ inputs.dry-run }}" = "true" ]; then
+          echo "🔍 DRY RUN MODE - Would publish to $MARKETPLACE_NAME:"
+          echo "  VSIX: ${{ inputs.vsix-path }}"
+          echo "  Pre-release: ${{ inputs.pre-release }}"
+
+          if [ "${{ inputs.publish-tool }}" = "ovsx" ]; then
+            echo "  Command: npx ovsx publish \"${{ inputs.vsix-path }}\" -p $TOKEN_MASK $PRE_RELEASE_FLAG"
+          else
+            echo "  Command: npx @vscode/vsce publish --packagePath \"${{ inputs.vsix-path }}\" --skip-duplicate $PRE_RELEASE_FLAG"
+          fi
+          echo "✅ Dry run completed - no actual publish performed"
+        else
+          echo "Publishing VSIX: ${{ inputs.vsix-path }}"
+
+          # Verify token is available
+          if [ -z "${!TOKEN_ENV}" ]; then
+            echo "❌ Error: $TOKEN_ENV environment variable is not set"
+            exit 1
+          fi
+
+          if [ "${{ inputs.publish-tool }}" = "vsce" ]; then
+            export VSCE_PAT="${!TOKEN_ENV}"  # ensure the expected env var is set
+            npx @vscode/vsce publish --packagePath "${{ inputs.vsix-path }}" --skip-duplicate $PRE_RELEASE_FLAG
+          else
+            npx ovsx publish "${{ inputs.vsix-path }}" -p "${!TOKEN_ENV}" --skip-duplicate $PRE_RELEASE_FLAG
+          fi
+
+          echo "✅ Successfully published to $MARKETPLACE_NAME"
+        fi
+
+    - name: Audit publish result
+      shell: bash
+      if: inputs.dry-run != 'true'
+      run: |
+        # Log the result of the publish attempt
+        AUDIT_LOG="/tmp/publish_audit.log"
+        TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+        ACTOR="${{ github.actor }}"
+        REPO="${{ github.repository }}"
+        RUN_ID="${{ github.run_id }}"
+
+        if [ $? -eq 0 ]; then
+          echo "[$TIMESTAMP] PUBLISH_SUCCESS: actor=$ACTOR, repo=$REPO, run_id=$RUN_ID, tool=${{ inputs.publish-tool }}, file=${{ inputs.vsix-path }}" >> "$AUDIT_LOG"
+          echo "✅ AUDIT: Publish successful - $TIMESTAMP"
+        else
+          echo "[$TIMESTAMP] PUBLISH_FAILURE: actor=$ACTOR, repo=$REPO, run_id=$RUN_ID, tool=${{ inputs.publish-tool }}, file=${{ inputs.vsix-path }}" >> "$AUDIT_LOG"
+          echo "❌ AUDIT: Publish failed - $TIMESTAMP"
+        fi

.github/scripts/README.md

@@ -0,0 +1,79 @@
+# GitHub Workflows Scripts
+
+This directory contains TypeScript scripts used by the reusable workflows in this repository.
+
+## Scripts
+
+### ext-change-detector.ts
+
+Detects which VS Code extensions have changed since their last release and determines the appropriate version bump type.
+
+**Features:**
+- Discovers all VS Code extensions in the `packages/` directory (packages with a `publisher` field)
+- Supports special values for extension selection:
+  - `'all'` - selects all available extensions
+  - `'changed'` - detects extensions with changes via git diff against per-extension tags
+  - `'none'` - skips all extensions
+  - Specific names - validates and uses the specified extensions
+- Git-based change detection:
+  - Finds last release tag per extension (pattern: `{extension-name}-v{version}`)
+  - Runs `git diff {lastTag}..HEAD -- {extensionPath}`
+  - Returns extensions with changes since their last tag
+- Conventional commit analysis for `version-bump: 'auto'`:
+  - Detects `BREAKING CHANGE` → major bump
+  - Detects `feat:` → minor bump
+  - Default → patch bump
+
+**Usage in workflows:**
+```yaml
+- name: Detect changes and version bumps
+  id: changes
+  env:
+    IS_NIGHTLY: 'true'
+    VERSION_BUMP: 'auto'
+    PRE_RELEASE: 'true'
+    IS_PROMOTION: 'false'
+    SELECTED_EXTENSIONS: 'changed'  # or 'all', 'none', or comma-separated names
+  run: |
+    npx tsx .github/scripts/index.ts ext-change-detector
+```
+
+**Outputs:**
+- `selected-extensions` - Comma-separated list of extensions to release
+- `version-bumps` - Determined version bump type (major, minor, patch)
+
+## Dependencies
+
+The scripts require the following npm packages:
+- `simple-git` - Git operations
+- `chalk` - Terminal output formatting
+- `semver` - Semantic version parsing and comparison
+- `zod` - Schema validation
+- `tsx` - TypeScript execution
+
+## Local Development
+
+Install dependencies:
+```bash
+npm install
+```
+
+Run a script:
+```bash
+npm run ext-change-detector
+```
+
+Or directly with tsx:
+```bash
+npx tsx .github/scripts/index.ts ext-change-detector
+```
+
+## Integration with Consuming Repositories
+
+These scripts are automatically downloaded and executed by the reusable workflows in this repository. Consuming repositories do not need to copy these scripts - they are fetched at runtime from the main branch of this repository.
+
+The `vscode-publish-extensions.yml` workflow automatically:
+1. Downloads the scripts from GitHub
+2. Installs required dependencies
+3. Executes the change detection
+4. Uses the outputs to determine which extensions to publish