feat(actions): add shared VS Code extension CI actions

[madhur310]

Add three reusable composite actions for VS Code extension workflows:

• check-ci-status: Validates CI checks passed before promotion
• calculate-artifact-name: Generates unique artifact names with run isolation
• publish-vsix: Publishes VSIX to VS Code Marketplace and Open VSX

These actions are shared across apex-language-support and salesforcedx-vscode to reduce duplication and prevent version drift.

Source: salesforcedx-vscode @ ms/prerelease (commit 05aedfed9)

[peternhale]

✅ Approved with Suggestions

Great work on extracting these reusable actions! The code is well-structured with good error handling, dry-run support, and audit logging. The actions are already working in production workflows.

Key Suggestions

Before Merge:

1. Add missing newline at end of calculate-artifact-name/action.yml
2. Clarify purpose of calculate-artifact-name action (it's defined but not used in this repo's workflows)
3. Fix dry-run command preview to show --skip-duplicate flag

Post-Merge Improvements:
4. Add README.md files with usage examples for each action
5. Consider test workflows to validate success/failure paths
6. Upload audit logs as workflow artifacts (currently hardcoded to /tmp)
7. Standardize YAML quote style across actions

See inline comments for specific details.

[peternhale]

✅ Approved with Suggestions

Great work on extracting these reusable actions! The code is well-structured with good error handling, dry-run support, and audit logging. The actions are already working in production workflows.

Suggestions

Before Merge:

1. Add missing newline at end of .github/actions/calculate-artifact-name/action.yml (POSIX standard)
2. Clarify calculate-artifact-name purpose - It's defined but not used in this repo's workflows. Document if it's for consuming repos like apex-language-support, or refactor vscode-publish-extensions.yml:515-539 to use it.
3. Fix dry-run preview in publish-vsix/action.yml:106 - Missing --skip-duplicate flag that appears in actual command at line 125

Post-Merge Improvements:

4. Add README.md files with usage examples for each action (like prNotification and determineNodeVersions have)
5. Add test workflows to validate success/failure paths and dry-run behavior
6. Upload audit logs as workflow artifacts (currently hardcoded to /tmp/publish_audit.log which gets wiped)
7. Standardize YAML quote style (currently mixed single/double quotes)
8. Add set -euo pipefail to bash scripts for robust error handling

Additional Notes

.github/actions/calculate-artifact-name/action.yml:

• Line 29: Pattern matching (=~ -dry-run$ or =~ -release$) is fragile - add comment explaining the convention
• Line 34: Missing trailing newline

.github/actions/check-ci-status/action.yml:

• Line 40: Good fail-safe behavior when no check-runs exist, but consider documenting this in the action description
• Consider validating commit-sha format before API call

.github/actions/publish-vsix/action.yml:

• Line 49 & 141: Hardcoded /tmp/publish_audit.log - make configurable or use $GITHUB_STEP_SUMMARY
• Line 106: Dry-run preview missing --skip-duplicate flag
• Line 116-118: Token error messages are safe but could leak secret names in public repos (acceptable for internal use)

.github/workflows/vscode-publish-extensions.yml:

• Lines 430, 432, 435-436: Good fix to skip GitHub auth validation in dry-run mode ✅

Risk Assessment

• Breaking changes: 🟢 Low (net-new actions, already integrated)
• Security: 🟢 Low (proper token handling, audit logging)
• Reliability: 🟡 Medium (unused action, no tests, hardcoded paths)
• Maintainability: 🟡 Medium (missing docs, inconsistent style)

Overall: Strong foundation, ready to merge with minor cleanup.