Release 0.16.0 — integrate beta → main - #208
Merged
Merged
Conversation
Contributor
🛡️ Security Hardening Pipeline ResultsBranch: Workflow Run: 304 Scan Status
Summaries Collected: 2 Scanner Results🔬 CodeQL SAST (Javascript)Status: Completed Findings Summary
No security findings detected for Javascript. Artifacts: CodeQL Reports (Javascript) 🔗 Dependency ReviewStatus: ✅ No issues found No vulnerable or license-violating dependencies detected in this PR. Generated by Argus Generated by Argus |
This was referenced Jul 1, 2026
Co-authored-by: Simon Heather <simon.heather@yulife.com>
GitLab component input names are commonly hyphenated (e.g. `job-name`, `skip-find-images`), but parseInputsSection's input-key regex only allowed `[a-zA-Z0-9_]`. Hyphenated keys weren't detected as new inputs, so their `description:`/`default:` lines bled onto the previous non-hyphenated input and every field after it shifted (e.g. `architecture` showed a later input's description). Add `-` to the name class so each input maps to its own fields. Comments and blank lines were already filtered and are unaffected. Adds a regression test with hyphenated names interspersed with comment and blank lines. Fixes #211 Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
8 tasks
…mantic-release) (#213) The docs claimed releases run via semantic-release on merge. That's inaccurate — semantic-release isn't a dependency. The actual flow: - Versioning is release-it: ci.yml's `release` job runs `release-it --ci` on push to beta/main to bump the version, update CHANGELOG, and push a `chore(release): <version> [skip ci]` commit + tag. - Publishing is a manual `workflow_dispatch` (Publish / Publish Beta), gated by branch, version-match, release-commit HEAD, tests, npm audit, gitleaks, and the even(stable)/odd(pre-release) minor convention, then `vsce publish`. Changes: - replace docs/SEMANTIC_RELEASE.md with docs/RELEASING.md (the old file documented non-existent `semantic-release:*` npm scripts) - fix the README Contributing paragraph, AGENTS.md tech-stack + release lines, and the .ai/workflows.yaml release steps Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
The pre-commit suite (wired into husky's prepare-commit-msg) failed on
tests/fixtures/** — intentionally-crafted GitLab CI parser inputs. yamllint
flagged flow-style braces ({ job_name: deploy }) and empty values (region:),
while trailing-whitespace/end-of-file-fixer rewrote the deliberate trailing
whitespace and blank lines those completion/parser tests depend on.
- .yamllint.yml: ignore tests/fixtures/** (braces reverted to default enable)
- .pre-commit-config.yaml: exclude tests/fixtures/ from trailing-whitespace,
end-of-file-fixer, and mixed-line-ending
- tsconfig.tests.json: conform to pretty-format-json (real file that had drifted)
Fixtures are validated by the mocha suite (306 passing), not by style linters.
Note: yamllint/pre-commit run only in the local hook, not in GitHub Actions CI.
Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
…redentials cross-origin (#222) Previously any 3xx was treated as an error, so moved GitLab component projects failed to fetch. Add a credential-safe redirect policy: follow only same-origin redirects with headers intact, strip Authorization/PRIVATE-TOKEN/Cookie on cross-origin hops, refuse HTTPS->HTTP downgrades, and cap the chain at MAX_REDIRECTS. This prevents the user's GitLab token from being replayed to an attacker-controlled Location (e.g. after a moved project's old path is reclaimed). The policy lives in a new pure, unit-tested src/utils/redirectPolicy.ts (httpClient was already over the file-size limit). Refs #221. Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
Owner
Author
|
@X-Guardian are you seeing any issues with the latest pre-release? I had to reset the cache to gain back full functionality. The new blob settings are working great. |
Contributor
|
I've got a couple of minor issues that I was intending to sort out, but I don't think they are worth holding up the next release.
|
Removing the custom gitlab-ci language (#210) dropped recognition of files like deploy.gitlab-ci.yml: the old language matched them via its extensions (a filename-suffix match), but the replacement path globs only matched a file named exactly .gitlab-ci.yml. Such files opened as yaml and fell out of scope, so hover/completion stopped firing and the isCiFile-gated Browse Components menu was hidden. Restore the suffix by adding **/*.gitlab-ci.yml and **/*.gitlab-ci.yaml to the defaults; add regression tests plus an over-match guard. Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Target
Next stable: 0.16.0 — the
0.15.xbeta pre-release line promotes to the next even (stable) minor on merge. Per repo convention (publish-main.ymlguardrail 7 /docs/RELEASING.md): odd minors are beta-only, even minors are stable.Status
betais 10 substantive commits ahead ofmain(plus the0.15.0→0.15.6release bumps).mainis0.14.5; merging cuts 0.16.0. Integratedbetabuild is green (lint + 329 unit tests + extension-host).What's in this release
✨ Features
Authorization/PRIVATE-TOKEN/Cookie, HTTPS→HTTP downgrades are refused, and the chain is capped at 5 hops. Previously any 3xx was surfaced as an error.gitlab-cilanguage contribution (feat: remove custom gitlab-ci language contribution #210) —.gitlab-ci.ymlnow uses the standardyamllanguage (withredhat.vscode-yamladded to the extension pack) instead of a bespoke language + TextMate grammar; providers match by path glob /shellscript. Canonical.gitlab-ci.yml/.gitlab-ci.yaml,*.gitlab-ci.{yml,yaml}suffix files, and files under.gitlab/**match by default (see fix(matcher): recognize *.gitlab-ci.{yml,yaml} suffix-named files #223); other paths are configurable viagitlabComponentHelper.additionalFileGlobs.🐛 Bug Fixes
*.gitlab-ci.{yml,yaml}suffix-named files (fix(matcher): recognize *.gitlab-ci.{yml,yaml} suffix-named files #223) — restores hover/completion and the Browse Components menu for files likedeploy.gitlab-ci.yml, which regressed when feat: remove custom gitlab-ci language contribution #210 removed the suffix-matching custom language. Suffix files now match by default again.default:shows its dropdown (fix: enum input values aren't offered, and an enum input with a default never shows its dropdown #205) — completion now distinguishes the input-name slot from the value slot.findIncludeLine, shared across completion/hover/validation via theincludeMatcherutil.job-name,skip-find-images) (fix(spec-parser): recognise hyphenated input names (#211) #212) — the input-key regex previously dropped hyphenated keys, shifting every subsequent field.🧹 Chores · CI · Docs
docs/, removed stale/dead files.tests/fixtures/**are intentionally-malformed parser inputs; excluded from yamllint + the text-mutating pre-commit hooks (local-hook-only, not a CI gate).workflow_dispatch), not semantic-release; replacedSEMANTIC_RELEASE.mdwithdocs/RELEASING.md.🧪 Tests
slotdiscriminator.Validation
test (22.x)+extension-host. Integratedbetare-verified: lint + 329 unit tests + extension-host green.npm run release:main:drybefore merge to confirm the computed 0.16.0 version + changelog onmain.Merge checklist
0.15.6) validatedrelease-it --dry-runpreviews 0.16.0 version + changelog onmainbeta(feat(httpClient): follow GitLab redirects safely (same-origin only, strip credentials cross-origin) #222, fix(matcher): recognize *.gitlab-ci.{yml,yaml} suffix-named files #223 merged intobeta; feat(parser): add pipeline parser and CLI commands #199 targetsmain)main, head isbeta