Skip to content

feat: group vs code extension updates in a single pull request - #1439

Open
Ron (rjaegers) wants to merge 1 commit into
mainfrom
feature/group-vs-code-extension-updates
Open

feat: group vs code extension updates in a single pull request#1439
Ron (rjaegers) wants to merge 1 commit into
mainfrom
feature/group-vs-code-extension-updates

Conversation

@rjaegers

Copy link
Copy Markdown
Member

🚀 Hey, I have created a Pull Request

Description of changes

✔️ Checklist

  • I have followed the contribution guidelines for this repository
  • I have added tests for new behavior, and have not broken any existing tests
  • I have added or updated relevant documentation
  • I have verified that all added components are accounted for in the SBOM
  • I understand the image size delta and agree the functionality justifies it

Copilot AI lite review requested due to automatic review settings September 4, 2026 18:09
@rjaegers
Ron (rjaegers) requested a review from a team as a code owner September 4, 2026 18:09
@sonarqubecloud

sonarqubecloud Bot commented Sep 4, 2026

Copy link
Copy Markdown

@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-base:edgeghcr.io/philips-software/amp-devcontainer-base:pr-1439

📈 Size Comparison Table

OS/Platform Previous Current Change Trend
linux/amd64 83.72 MB 83.72 MB 76 B (0%) 🔽
linux/arm64 82.5 MB 82.49 MB 523 B (0%) 🔽

@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Max errors Warnings Elapsed time
✅ ACTION actionlint 23 0 0 0.1s
✅ DOCKERFILE hadolint 4 0 0 0.13s
✅ JSON npm-package-json-lint yes no no 0.38s
✅ JSON prettier 46 8 0 0 1.49s
✅ JSON v8r 46 0 0 13.95s
✅ MARKDOWN markdownlint 13 0 0 0 0.7s
✅ MARKDOWN markdown-table-formatter 13 0 0 0 0.21s
✅ REPOSITORY betterleaks yes no no 0.87s
✅ REPOSITORY checkov yes no no 25.83s
✅ REPOSITORY git_diff yes no no 0.02s
✅ REPOSITORY grype yes no no 63.59s
⚠️ REPOSITORY osv-scanner yes 2 no 1.71s
✅ REPOSITORY secretlint yes no no 1.81s
✅ REPOSITORY syft yes no no 2.75s
✅ REPOSITORY trivy yes no no 12.06s
✅ REPOSITORY trivy-sbom yes no no 0.28s
✅ REPOSITORY trufflehog yes no no 2.38s
⚠️ SPELL lychee 118 1 0 10.37s
✅ YAML prettier 36 0 0 0 0.88s
❌ YAML v8r 36 1 0 10.6s
✅ YAML yamllint 36 0 0 1.22s

Detailed Issues

❌ YAML / v8r - 1 error
✖ .github/actions/update-vscode-extensions/action.yml is invalid

.github/actions/update-vscode-extensions/action.yml#/inputs/cooldown-days/default must be string
⚠️ SPELL / lychee - 1 error
📝 Summary
---------------------
🔍 Total..........154
🔗 Unique.........126
✅ Successful.....148
⏳ Timeouts.........0
🔀 Redirected......19
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1

Errors in .github/TOOL_VERSION_ISSUE_TEMPLATE.md
[403] https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads (at 38:7) | Rejected status code: 403 Forbidden

Hint: Followed 19 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ REPOSITORY / osv-scanner - 2 errors
Scanning dir .
Starting filesystem walk for root: /
Scanned .devcontainer/cpp/requirements.txt file and found 20 packages
Scanned .devcontainer/docs/requirements.txt file and found 14 packages
Scanned package-lock.json file and found 73 packages
Scanned test/embedded-rust/workspace/cortex-mf/Cargo.lock file and found 20 packages
Scanned test/embedded-rust/workspace/cortex-m/Cargo.lock file and found 20 packages
Scanned test/rust/workspace/cargo/Cargo.lock file and found 1 package
Scanned test/rust/workspace/clippy/Cargo.lock file and found 1 package
Scanned test/rust/workspace/test/Cargo.lock file and found 1 package
Scanned .github/actions/update-vscode-extensions/package-lock.json file and found 288 packages
End status: 83 dirs visited, 280 inodes visited, 9 Extract calls, 92.360259ms elapsed, 92.36046ms wall time

Total 3 packages affected by 4 known vulnerabilities (0 Critical, 2 High, 0 Medium, 0 Low, 2 Unknown) from 2 ecosystems.
2 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+-----------------------+---------+---------------+---------------------------------------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE               | VERSION | FIXED VERSION | SOURCE                                            |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+---------------------------------------------------+
| https://osv.dev/RUSTSEC-2026-0110   |      | crates.io | bare-metal            | 0.2.5   | --            | test/embedded-rust/workspace/cortex-m/Cargo.lock  |
| https://osv.dev/RUSTSEC-2026-0110   |      | crates.io | bare-metal            | 0.2.5   | --            | test/embedded-rust/workspace/cortex-mf/Cargo.lock |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev) | 5.0.7   | 5.0.8         | package-lock.json                                 |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev) | 5.0.7   | 5.0.9         | package-lock.json                                 |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+---------------------------------------------------+

See detailed reports in MegaLinter artifacts

You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@10.0.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The workflow/action changes introduce concrete failure-mode and runtime-compatibility risks (PR creation despite update failures, and Node engine requirements not being enforced) that should be addressed before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR refactors the VS Code extension update automation to update all devcontainer configs in one run/PR, adds a cooldown window before adopting newly-published extension versions, and introduces a dedicated npm dependency set for the update action itself.

Changes:

  • Consolidate VS Code extension updates across multiple devcontainer JSON files into a single workflow job and a single generated PR.
  • Extend the update-vscode-extensions composite action/script to accept multiple input files and enforce a version “cooldown” period.
  • Add Dependabot tracking for the composite action’s npm dependencies (introducing package.json/package-lock.json).
File summaries
File Description
.github/workflows/update-dependencies.yml Switch VS Code extension updates from matrix-per-file to a single consolidated update run/PR.
.github/dependabot.yml Add a new npm update entry for the update-vscode-extensions action’s own dependencies.
.github/actions/update-vscode-extensions/update-vscode-extensions.sh Add multi-file processing, cooldown logic, and per-file failure aggregation for extension updates.
.github/actions/update-vscode-extensions/action.yml Replace global vsce install with npm ci and pass cooldown + local vsce path into the script.
.github/actions/update-vscode-extensions/package.json Introduce pinned @vscode/vsce dev dependency for the composite action.
.github/actions/update-vscode-extensions/package-lock.json Lock the composite action’s npm dependency tree for reproducible installs.
Review details
  • Files reviewed: 5/6 changed files
  • Comments generated: 3
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines 25 to 29
- run: |
sudo apt-get update
sudo apt-get install --no-install-recommends -y jq
sudo npm install -g @vscode/vsce
npm ci --prefix "${GITHUB_ACTION_PATH}"
shell: bash
Comment on lines +11 to +12
COOLDOWN_DAYS="${COOLDOWN_DAYS:-7}"
COOLDOWN_CUTOFF=$(date -u -d "-${COOLDOWN_DAYS} days" +"%Y-%m-%dT%H:%M:%S.000Z")
@@ -93,10 +101,13 @@ jobs:
- uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
if: github.event_name != 'pull_request'
@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-rust:edgeghcr.io/philips-software/amp-devcontainer-rust:pr-1439

📈 Size Comparison Table

OS/Platform Previous Current Change Trend
linux/amd64 439.63 MB 439.63 MB 60 B (0%) 🔽
linux/arm64 390.35 MB 390.35 MB 629 B (0%) 🔽

@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-docs:edgeghcr.io/philips-software/amp-devcontainer-docs:pr-1439

📈 Size Comparison Table

OS/Platform Previous Current Change Trend
linux/amd64 215.24 MB 215.24 MB +135 B (+0%) 🔼
linux/arm64 212.21 MB 212.21 MB +84 B (+0%) 🔼

@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-embedded-rust:edgeghcr.io/philips-software/amp-devcontainer-embedded-rust:pr-1439

📈 Size Comparison Table

OS/Platform Previous Current Change Trend
linux/amd64 506.36 MB 506.36 MB 592 B (0%) 🔽
linux/arm64 456.66 MB 456.66 MB 733 B (0%) 🔽

@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-embedded-cpp:edgeghcr.io/philips-software/amp-devcontainer-embedded-cpp:pr-1439

📈 Size Comparison Table

OS/Platform Previous Current Change Trend
linux/amd64 606.21 MB 606.21 MB 2.08 kB (0%) 🔽
linux/arm64 586.57 MB 586.57 MB +561 B (+0%) 🔼

@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Test Results

12 files   -  13  12 suites   - 13   25s ⏱️ - 19m 36s
23 tests  -  25  23 ✅  -  25  0 💤 ±0  0 ❌ ±0 
92 runs   - 117  92 ✅  - 117  0 💤 ±0  0 ❌ ±0 

Results for commit 0b275fd. ± Comparison against base commit 5d4b2fb.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants