ci: use runner temp for VS Code profile

Author: TheStreamCode

.github/workflows/ci.yml

@@ -26,7 +26,6 @@ jobs:
 
     env:
       VSCODE_TEST_VERSION: stable
-      VSCODE_TEST_USER_DATA_DIR: ${{ runner.temp }}/kimi-vscode-test
 
     steps:
       - name: Checkout repository
@@ -64,7 +63,6 @@ jobs:
 
     env:
       VSCODE_TEST_VERSION: ${{ matrix.vscode }}
-      VSCODE_TEST_USER_DATA_DIR: ${{ runner.temp }}/kimi-vscode-test
 
     steps:
       - name: Checkout repository

.github/workflows/release.yml

@@ -13,8 +13,6 @@ jobs:
     name: Package GitHub release
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    env:
-      VSCODE_TEST_USER_DATA_DIR: ${{ runner.temp }}/kimi-vscode-test
     permissions:
       contents: write
 

docs/SECURITY_REVIEW.md

@@ -26,7 +26,7 @@ Resolution:
 - `brace-expansion` is locked to 5.0.9 (`package-lock.json:1510`).
 - `fast-uri` is locked to 3.1.5 (`package-lock.json:2167`).
 - `npm run check:security` now audits the lockfile at high severity (`package.json:127`).
-- CI and release jobs run the audit before accepting or publishing artifacts (`.github/workflows/ci.yml:106`, `.github/workflows/release.yml:44`).
+- CI and release jobs run the audit before accepting or publishing artifacts (`.github/workflows/ci.yml:104`, `.github/workflows/release.yml:42`).
 
 ## Medium-Severity Findings
 
@@ -36,8 +36,8 @@ The CI workflow referenced `actions/checkout@v7` and `actions/setup-node@v6`. Ma
 
 Resolution:
 
-- All checkout and Node setup steps are pinned to verified full commit SHAs, with their major release retained in same-line comments for maintainability (`.github/workflows/ci.yml:33`, `.github/workflows/ci.yml:36`, `.github/workflows/release.yml:23`, `.github/workflows/release.yml:26`).
-- Default workflow permissions remain read-only; only the release job receives scoped `contents: write` permission (`.github/workflows/release.yml:8`, `.github/workflows/release.yml:18`).
+- All checkout and Node setup steps are pinned to verified full commit SHAs, with their major release retained in same-line comments for maintainability (`.github/workflows/ci.yml:32`, `.github/workflows/ci.yml:35`, `.github/workflows/release.yml:21`, `.github/workflows/release.yml:24`).
+- Default workflow permissions remain read-only; only the release job receives scoped `contents: write` permission (`.github/workflows/release.yml:8`, `.github/workflows/release.yml:16`).
 
 ## Low-Severity Findings
 

test/integration/runTest.js

@@ -5,7 +5,9 @@ async function main() {
   const extensionDevelopmentPath = path.resolve(__dirname, '..', '..');
   const extensionTestsPath = path.resolve(__dirname, 'suite');
   const launchArgs = ['--disable-extensions'];
-  const userDataDir = process.env.VSCODE_TEST_USER_DATA_DIR;
+  const userDataDir =
+    process.env.VSCODE_TEST_USER_DATA_DIR ||
+    (process.env.RUNNER_TEMP ? path.join(process.env.RUNNER_TEMP, 'kimi-vscode-test') : undefined);
 
   if (userDataDir) {
     launchArgs.push(`--user-data-dir=${userDataDir}`);

test/metadata.test.js

@@ -156,7 +156,6 @@ test('CI validates securely across supported platforms and editor versions', ()
   assert.match(workflow, /ubuntu-latest/);
   assert.match(workflow, /macos-latest/);
   assert.match(workflow, /vscode: '1\.103\.0'/);
-  assert.match(workflow, /VSCODE_TEST_USER_DATA_DIR: \$\{\{ runner\.temp \}\}\/kimi-vscode-test/);
   assert.match(workflow, /cache: npm/);
   assert.match(workflow, /npm ci --ignore-scripts/);
   assert.match(workflow, /npm run check/);
@@ -171,6 +170,7 @@ test('integration runner supports a short isolated VS Code profile path', () =>
   const runner = readText('test/integration/runTest.js');
 
   assert.match(runner, /process\.env\.VSCODE_TEST_USER_DATA_DIR/);
+  assert.match(runner, /process\.env\.RUNNER_TEMP/);
   assert.match(runner, /--user-data-dir=\$\{userDataDir\}/);
 });