pr.yml

name: Code OSS

on:
  pull_request:
    branches:
      - main
      - 'release/*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: read

env:
  VSCODE_QUALITY: 'oss'

jobs:
  # Lists the files changed by the pull request so that jobs can skip checks the
  # changes cannot affect (see .github/actions/detect-changes/detect.ts).
  # Skip with a job-level `if:` (inside the reusable workflow when the job calls
  # one): a skipped job still reports its check, which satisfies required status
  # checks. Jobs also run when change detection fails.
  changes:
    name: Detect Changes
    runs-on: ubuntu-24.04
    outputs:
      cli: ${{ steps.detect.outputs.cli }}
      copilot-shim: ${{ steps.detect.outputs.copilot-shim }}
      copilot: ${{ steps.detect.outputs.copilot }}
    steps:
      - name: Checkout microsoft/vscode
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          sparse-checkout: .github/actions/detect-changes

      - name: Detect changes
        id: detect
        uses: ./.github/actions/detect-changes
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  compile:
    name: Compile & Hygiene
    runs-on: [ self-hosted, 1ES.Pool=1es-vscode-oss-ubuntu-22.04-x64, "JobId=compile-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}" ]
    steps:
      - name: Checkout microsoft/vscode
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc

      - name: Restore node_modules cache
        id: cache-node-modules
        uses: ./.github/actions/restore-node-modules
        with:
          key-prefix: node_modules-compile
          key-args: "compile $(node -p process.arch)"

      - name: Install build tools
        if: steps.cache-node-modules.outputs.cache-hit != 'true'
        run: sudo apt update -y && sudo apt install -y build-essential pkg-config libx11-dev libx11-xcb-dev libxkbfile-dev libnotify-bin libkrb5-dev

      - name: Install Electron headers
        if: steps.cache-node-modules.outputs.cache-hit != 'true'
        run: node build/npm/preinstall.ts

      - name: Install dependencies
        if: steps.cache-node-modules.outputs.cache-hit != 'true'
        run: |
          set -e

          for i in {1..5}; do # try 5 times
            npm ci && break
            if [ $i -eq 5 ]; then
              echo "Npm install failed too many times" >&2
              exit 1
            fi
            echo "Npm install failed $i, trying again..."
          done
        env:
          ELECTRON_SKIP_BINARY_DOWNLOAD: 1
          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Prepare Electron types
        run: node build/npm/electronTypes.ts

      - name: Type check /build/ scripts
        run: npm run typecheck
        working-directory: build

      - name: Prepare built-in extensions cache key
        shell: pwsh
        run: node build/azure-pipelines/common/computeBuiltInDepsCacheKey.ts > .build/builtindepshash

      - name: Restore built-in extensions cache
        id: cache-builtin-extensions
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          enableCrossOsArchive: true
          path: .build/builtInExtensions
          key: "builtin-extensions-${{ hashFiles('.build/builtindepshash') }}"

      - name: Download built-in extensions
        if: steps.cache-builtin-extensions.outputs.cache-hit != 'true'
        run: node build/lib/builtInExtensions.ts
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check Markdown editor manifests and clipboard
        run: |
          npm run markdown-editor-package-json-check
          npm --prefix extensions/markdown-language-features run test-markdown-editor-package-json
          npm --prefix extensions/markdown-language-features run test-markdown-editor-clipboard

      - name: Compile & Hygiene
        run: npm exec -- npm-run-all2 -lp core-ci hygiene valid-layers-check define-class-fields-check vscode-dts-compile-check tsec-compile-check test-build-scripts
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # Avoid overlapping ESLint's worker memory with the parallel compilation checks.
      - name: ESLint
        run: npm run eslint

      - name: Check Codex protocol client is in sync
        run: |
          git fetch --no-tags --depth=1 origin "$CODEX_SYNC_BASE" || true
          node build/codex/check-protocol-sync.ts --if-changed --base "$CODEX_SYNC_BASE"
        env:
          CODEX_SYNC_BASE: ${{ github.event.pull_request.base.sha }}

      - name: Check cyclic dependencies
        run: node build/lib/checkCyclicDependencies.ts out-build

  linux-cli-tests:
    name: Linux
    needs: changes
    if: ${{ !cancelled() }}
    uses: ./.github/workflows/pr-linux-cli-test.yml
    with:
      rustup_toolchain: 1.88
      affected: ${{ needs.changes.result != 'success' || needs.changes.outputs.cli == 'true' }}

  linux-copilot-shim-tests:
    name: Linux Copilot Shim
    needs: changes
    if: ${{ !cancelled() }}
    uses: ./.github/workflows/pr-linux-cli-test.yml
    with:
      rustup_toolchain: 1.88
      working_directory: copilot_shim
      format: true
      locked: true
      all_targets: true
      affected: ${{ needs.changes.result != 'success' || needs.changes.outputs.copilot-shim == 'true' }}

  linux-electron-unit-tests:
    name: Linux
    uses: ./.github/workflows/pr-linux-test.yml
    with:
      job_name: Electron-Unit
      electron_tests: true
      integration_tests: false
      smoke_tests: false

  linux-electron-tests:
    name: Linux
    uses: ./.github/workflows/pr-linux-test.yml
    with:
      job_name: Electron
      electron_tests: true
      unit_tests: false
      smoke_tests: false

  linux-electron-smoke-test-shards:
    name: Linux (shard ${{ matrix.shard }}/${{ strategy.job-total }})
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2]
    uses: ./.github/workflows/pr-linux-test.yml
    with:
      job_name: Electron-Smoke
      electron_tests: true
      unit_tests: false
      integration_tests: false
      smoke_shard_index: ${{ matrix.shard }}
      smoke_shard_total: ${{ strategy.job-total }}

  linux-browser-test-parts:
    name: Linux (${{ matrix.part }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - part: unit
            unit: true
          - part: integration & smoke
            unit: false
    uses: ./.github/workflows/pr-linux-test.yml
    with:
      job_name: Browser
      browser_tests: true
      unit_tests: ${{ matrix.unit }}
      integration_tests: ${{ !matrix.unit }}
      smoke_tests: ${{ !matrix.unit }}

  linux-remote-tests:
    name: Linux
    uses: ./.github/workflows/pr-linux-test.yml
    with:
      job_name: Remote
      remote_tests: true

  macos-electron-unit-tests:
    name: macOS
    uses: ./.github/workflows/pr-darwin-test.yml
    with:
      job_name: Electron-Unit
      electron_tests: true
      integration_tests: false
      smoke_tests: false

  macos-electron-tests:
    name: macOS
    uses: ./.github/workflows/pr-darwin-test.yml
    with:
      job_name: Electron
      electron_tests: true
      unit_tests: false
      smoke_tests: false

  macos-electron-smoke-test-shards:
    name: macOS (shard ${{ matrix.shard }}/${{ strategy.job-total }})
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2]
    uses: ./.github/workflows/pr-darwin-test.yml
    with:
      job_name: Electron-Smoke
      electron_tests: true
      unit_tests: false
      integration_tests: false
      smoke_shard_index: ${{ matrix.shard }}
      smoke_shard_total: ${{ strategy.job-total }}

  macos-browser-test-parts:
    name: macOS (${{ matrix.part }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - part: unit
            unit: true
          - part: integration & smoke
            unit: false
    uses: ./.github/workflows/pr-darwin-test.yml
    with:
      job_name: Browser
      browser_tests: true
      unit_tests: ${{ matrix.unit }}
      integration_tests: ${{ !matrix.unit }}
      smoke_tests: ${{ !matrix.unit }}

  macos-remote-tests:
    name: macOS
    uses: ./.github/workflows/pr-darwin-test.yml
    with:
      job_name: Remote
      remote_tests: true

  windows-electron-unit-tests:
    name: Windows
    uses: ./.github/workflows/pr-win32-test.yml
    with:
      job_name: Electron-Unit
      electron_tests: true
      integration_tests: false
      smoke_tests: false

  windows-electron-tests:
    name: Windows
    uses: ./.github/workflows/pr-win32-test.yml
    with:
      job_name: Electron
      electron_tests: true
      unit_tests: false
      smoke_tests: false

  windows-electron-smoke-test-shards:
    name: Windows (shard ${{ matrix.shard }}/${{ strategy.job-total }})
    strategy:
      fail-fast: false
      matrix:
        shard: [1, 2]
    uses: ./.github/workflows/pr-win32-test.yml
    with:
      job_name: Electron-Smoke
      electron_tests: true
      unit_tests: false
      integration_tests: false
      smoke_shard_index: ${{ matrix.shard }}
      smoke_shard_total: ${{ strategy.job-total }}

  windows-browser-test-parts:
    name: Windows (${{ matrix.part }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - part: unit
            unit: true
          - part: integration & smoke
            unit: false
    uses: ./.github/workflows/pr-win32-test.yml
    with:
      job_name: Browser
      browser_tests: true
      unit_tests: ${{ matrix.unit }}
      integration_tests: ${{ !matrix.unit }}
      smoke_tests: ${{ !matrix.unit }}

  windows-remote-tests:
    name: Windows
    uses: ./.github/workflows/pr-win32-test.yml
    with:
      job_name: Remote
      remote_tests: true

  # Reports the required "<OS> / Electron-Smoke" checks from the smoke test shards.
  # Uses always() because a skipped job counts as passing for required checks.
  electron-smoke-checks:
    name: ${{ matrix.check }}
    needs: [linux-electron-smoke-test-shards, macos-electron-smoke-test-shards, windows-electron-smoke-test-shards]
    if: ${{ always() }}
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - check: Linux / Electron-Smoke
            shards: linux-electron-smoke-test-shards
          - check: macOS / Electron-Smoke
            shards: macos-electron-smoke-test-shards
          - check: Windows / Electron-Smoke
            shards: windows-electron-smoke-test-shards
    steps:
      - name: Check shard result (${{ needs[matrix.shards].result }})
        run: exit ${{ needs[matrix.shards].result == 'success' && '0' || '1' }}

  # Reports the required "<OS> / Browser" checks from the browser test parts.
  # Uses always() because a skipped job counts as passing for required checks.
  browser-checks:
    name: ${{ matrix.check }}
    needs: [linux-browser-test-parts, macos-browser-test-parts, windows-browser-test-parts]
    if: ${{ always() }}
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - check: Linux / Browser
            parts: linux-browser-test-parts
          - check: macOS / Browser
            parts: macos-browser-test-parts
          - check: Windows / Browser
            parts: windows-browser-test-parts
    steps:
      - name: Check parts result (${{ needs[matrix.parts].result }})
        run: exit ${{ needs[matrix.parts].result == 'success' && '0' || '1' }}

  copilot-check-test-cache:
    name: Copilot - Check Test Cache
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.copilot == 'true') }}
    runs-on: [ self-hosted, 1ES.Pool=1es-vscode-oss-ubuntu-22.04-x64, "JobId=copilot-check-test-cache-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}" ]
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          lfs: true

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: extensions/copilot/.nvmrc

      - name: Restore node_modules cache
        id: cache-node-modules
        uses: ./.github/actions/restore-node-modules
        with:
          key-prefix: copilot-node_modules-linux
          key-args: "$(node -p process.platform) $(node -p process.arch)"

      - name: Install root dependencies
        if: steps.cache-node-modules.outputs.cache-hit != 'true'
        run: npm ci --ignore-scripts --no-workspaces

      - name: Install copilot dependencies
        if: steps.cache-node-modules.outputs.cache-hit != 'true'
        working-directory: extensions/copilot
        run: npm ci

      - name: Ensure no duplicate cache keys
        working-directory: extensions/copilot
        run: npx tsx test/base/cache-cli check

      - name: Ensure no untrusted cache changes
        if: github.event_name == 'pull_request'
        working-directory: extensions/copilot
        run: npx tsx build/pr-check-cache-files.ts
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPOSITORY: ${{ github.repository }}
          PULL_REQUEST: ${{ github.event.pull_request.number }}

  copilot-check-telemetry:
    name: Copilot - Check Telemetry
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.copilot == 'true') }}
    runs-on: [ self-hosted, 1ES.Pool=1es-vscode-oss-ubuntu-22.04-x64, "JobId=copilot-check-telemetry-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}" ]
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: extensions/copilot/.nvmrc

      - name: Validate telemetry events
        working-directory: extensions/copilot
        run: |
          version=$(node -p "require('../../package-lock.json').packages['node_modules/@vscode/telemetry-extractor'].version")
          npx --package="@vscode/telemetry-extractor@$version" --yes vscode-telemetry-extractor -s . > /dev/null

  copilot-linux-tests:
    name: Copilot - Test (Linux)
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.copilot == 'true') }}
    runs-on: [ self-hosted, 1ES.Pool=1es-vscode-oss-ubuntu-22.04-x64, "JobId=copilot-linux-tests-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}" ]
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          lfs: true

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: extensions/copilot/.nvmrc

      - name: Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.12'
          architecture: 'x64'

      - name: Setup .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: '10.0'

      - name: Install setuptools
        run: pip install setuptools

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y xvfb libgtk-3-0 libgbm1

      - name: Restore node_modules cache
        id: cache-node-modules
        uses: ./.github/actions/restore-node-modules
        with:
          key-prefix: copilot-node_modules-linux
          key-args: "$(node -p process.platform) $(node -p process.arch)"

      - name: Install root dependencies
        if: steps.cache-node-modules.outputs.cache-hit != 'true'
        run: npm ci --ignore-scripts --no-workspaces

      - name: Install copilot dependencies
        if: steps.cache-node-modules.outputs.cache-hit != 'true'
        working-directory: extensions/copilot
        run: npm ci

      - name: TypeScript type checking
        working-directory: extensions/copilot
        run: npm run typecheck

      - name: Lint
        working-directory: extensions/copilot
        run: npm run lint

      - name: Compile
        working-directory: extensions/copilot
        run: npm run compile

      - name: Run extension host tests
        working-directory: extensions/copilot
        run: xvfb-run -a npm run test:extension

      - name: Run vitest unit tests
        working-directory: extensions/copilot
        run: npm run test:unit

      - name: Run simulation tests with cache
        working-directory: extensions/copilot
        run: npm run simulate-ci

      - name: Run Completions Core prompt tests
        working-directory: extensions/copilot
        run: npm run test:prompt

      - name: Run Completions Core lib tests using VS Code
        working-directory: extensions/copilot
        run: xvfb-run -a npm run test:completions-core

      - name: Archive simulation output
        if: always()
        working-directory: extensions/copilot
        run: |
          set -e
          mkdir -p .simulation-archive
          tar -czf .simulation-archive/simulation.tgz -C .simulation .

      - name: Upload simulation output
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: copilot-simulation-output-linux-${{ github.run_attempt }}
          path: extensions/copilot/.simulation-archive/simulation.tgz

  copilot-windows-tests:
    name: Copilot - Test (Windows)
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.copilot == 'true') }}
    runs-on: [ self-hosted, 1ES.Pool=1es-vscode-oss-windows-2022-x64, "JobId=copilot-windows-tests-${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}" ]
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          lfs: true

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: extensions/copilot/.nvmrc

      - name: Setup Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.12'
          architecture: 'x64'

      - name: Setup .NET
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          dotnet-version: '10.0'

      - name: Install setuptools
        run: pip install setuptools

      - name: Restore node_modules cache
        id: cache-node-modules
        uses: ./.github/actions/restore-node-modules
        with:
          key-prefix: copilot-node_modules-windows
          key-args: "$(node -p process.platform) $(node -p process.arch)"

      - name: Install root dependencies
        if: steps.cache-node-modules.outputs.cache-hit != 'true'
        run: npm ci --ignore-scripts --no-workspaces

      - name: Install copilot dependencies
        if: steps.cache-node-modules.outputs.cache-hit != 'true'
        working-directory: extensions/copilot
        run: npm ci

      - name: Compile
        working-directory: extensions/copilot
        run: npm run compile

      - name: Run extension host tests
        working-directory: extensions/copilot
        run: npm run test:extension

      - name: Run vitest unit tests
        working-directory: extensions/copilot
        run: npm run test:unit

      - name: Run simulation tests with cache
        working-directory: extensions/copilot
        run: npm run simulate-ci

      - name: Run Completions Core prompt tests
        working-directory: extensions/copilot
        run: npm run test:prompt

      - name: Run Completions Core lib tests using VS Code
        working-directory: extensions/copilot
        run: npm run test:completions-core

  # The chat-lib jobs are separate jobs instead of a matrix: a matrix job skipped by
  # a job-level `if:` is never expanded, so the per-OS required checks would not report.
  chat-lib-linux-tests:
    name: chat-lib tests (ubuntu-latest)
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.copilot == 'true') }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Test chat-lib
        uses: ./.github/actions/test-chat-lib

  chat-lib-macos-tests:
    name: chat-lib tests (macos-latest)
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.copilot == 'true') }}
    runs-on: macos-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Test chat-lib
        uses: ./.github/actions/test-chat-lib

  chat-lib-windows-tests:
    name: chat-lib tests (windows-latest)
    needs: changes
    if: ${{ !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.copilot == 'true') }}
    runs-on: windows-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Test chat-lib
        uses: ./.github/actions/test-chat-lib