release: beta → main (next stable) - #271
Draft
eFAILution wants to merge 35 commits into
Draft
eFAILution wants to merge 35 commits into
eFAILution wants to merge 35 commits into
Conversation
…ut completion (#263) * fix(completion): a !reference tag anywhere in the file suppresses all input completion * Fix referenceTag --------- Co-authored-by: Simon Heather <simon.heather@yulife.com>
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.2.0...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the dev-dependencies group with 9 updates: | Package | From | To | | --- | --- | --- | | [@octokit/core](https://github.com/octokit/core.js) | `7.0.7` | `7.0.8` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.4.1` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.67.0` | `8.69.0` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.67.0` | `8.69.0` | | [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.9.1` | | [globals](https://github.com/sindresorhus/globals) | `17.11.0` | `17.12.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.3.0` | `5.4.1` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.13` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.67.0` | `8.69.0` | Updates `@octokit/core` from 7.0.7 to 7.0.8 - [Release notes](https://github.com/octokit/core.js/releases) - [Commits](octokit/core.js@v7.0.7...v7.0.8) Updates `@types/node` from 26.2.0 to 26.4.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@typescript-eslint/eslint-plugin` from 8.67.0 to 8.69.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.69.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.67.0 to 8.69.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.69.0/packages/parser) Updates `eslint` from 10.8.1 to 10.9.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.8.1...v10.9.1) Updates `globals` from 17.11.0 to 17.12.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.11.0...v17.12.0) Updates `js-yaml` from 5.3.0 to 5.4.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.3.0...5.4.1) Updates `tsx` from 4.23.12 to 4.23.13 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.12...v4.23.13) Updates `typescript-eslint` from 8.67.0 to 8.69.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.69.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@octokit/core" dependency-version: 7.0.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@types/node" dependency-version: 26.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.69.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@typescript-eslint/parser" dependency-version: 8.69.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: eslint dependency-version: 10.9.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: globals dependency-version: 17.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: js-yaml dependency-version: 5.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: tsx dependency-version: 4.23.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: typescript-eslint dependency-version: 8.69.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [mocha](https://github.com/mochajs/mocha) from 11.8.0 to 12.0.0. - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md) - [Commits](mochajs/mocha@v11.8.0...v12.0.0) --- updated-dependencies: - dependency-name: mocha dependency-version: 12.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
eFAILution
had a problem deploying
to
publish-beta
September 8, 2026 12:33 — with 
GitHub Actions
Failure
GitHub Actions
Failure
eFAILution
had a problem deploying
to
publish-beta
September 8, 2026 12:43 — with
GitHub Actions
Failure
GitHub Actions
Failure
eFAILution
had a problem deploying
to
publish-beta
September 8, 2026 12:53 — with
GitHub Actions
Failure
GitHub Actions
Failure
eFAILution
had a problem deploying
to
publish-beta
September 8, 2026 12:59 — with
GitHub Actions
Failure
GitHub Actions
Failure
#273) Co-authored-by: Simon Heather <simon.heather@yulife.com>
Contributor
🛡️ Security Hardening Pipeline ResultsBranch: Workflow Run: 463 Scan Status
Summaries Collected: 4 Scanner Results🔬 CodeQL SAST (Javascript)Status: Completed Findings Summary
No security findings detected for Javascript. Artifacts: CodeQL Reports (Javascript) 🔗 Dependency ReviewStatus: ✅ No issues found No vulnerable or license-violating dependencies detected in this PR. 🔑 Gitleaks (Secrets)No 🔑 Gitleaks (Secrets) findings summary was produced. 📦 OSV (Dependencies)No 📦 OSV (Dependencies) findings summary was produced. Generated by Argus Generated by Argus |
Co-authored-by: Simon Heather <simon.heather@yulife.com> Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
…s panel (#280) * fix(details): make Refresh Versions work in the browser-opened details panel * Fix test * fix(browser): label monorepo versions and surface version-change failures Ports the two gaps #281 caught into this branch. - The browser details panel's fetchVersions never sent versionLabels, so a refresh reverted the dropdown from '1.0.0' back to 'deploy-1.0.0' on a tag-per-component source. It now sends them like the detached panel does. - versionChangeError still hid the spinner and said nothing, the same silent failure this branch fixes one case block over. It now reports in the same slot, and both entry points clear a stale error before retrying. Rather than copy the label loop a third time, it moves to buildVersionLabels in tagScoping (pure, unit-tested) and the two existing copies collapse onto it. That also compiles the tag template once per list instead of once per tag. Co-authored-by: Cid-oe <cid066a86@gmail.com> --------- Co-authored-by: Simon Heather <simon.heather@yulife.com> Co-authored-by: eFAILution <eFAILution@users.noreply.github.com> Co-authored-by: Cid-oe <cid066a86@gmail.com>
…nder CSP (#275) * refactor(webview): serve loading-view CSS from linted external file under CSP * Bump stylelint version * Fix review comments --------- Co-authored-by: Simon Heather <simon.heather@yulife.com>
…ity-hardening.yml (#293) Bumps [huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml](https://github.com/huntridge-labs/argus) from 1.12.3 to 1.12.4. - [Release notes](https://github.com/huntridge-labs/argus/releases) - [Changelog](https://github.com/huntridge-labs/argus/blob/main/CHANGELOG.md) - [Commits](huntridge-labs/argus@9b444d8...cc7ef8e) --- updated-dependencies: - dependency-name: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml dependency-version: 1.12.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Sep 15, 2026
* chore(ci): point Dependabot at beta Dependabot had no target-branch, so every ecosystem opened against the default branch. main is the stable release line: a push there cuts a stable GitHub release via release-it, so a routine dependency bump would ship one out of band. main also trails beta by everything not yet released, so bumps opened against it re-proposed versions beta already carried (#291, #292, #295 all duplicated bumps merged weeks earlier) and conflicted on the lockfile when retargeted. Updates now reach main the way everything else does, through the beta -> main release PR. * docs(ci): correct the stale Argus workflow pin comment The comment claimed the SHA was Argus v1.11.0. It has been wrong since 1.12.0: the pin is now 1.12.4 (cc7ef8e), and v1.11.0 is 295eea9. A hand-written version next to a SHA drifts every time Dependabot bumps the SHA and nobody edits the line above it, so the comment now explains why the pin is a SHA and points at the PR title for the version instead of restating one. --------- Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
Rebuilds #294 against beta. That PR was opened against main and its lockfile no longer applies; four of its ten bumps (@octokit/core, globals, js-yaml, tsx) already landed on beta, so only six remain: @types/node ^26.4.1 -> ^26.5.1 @typescript-eslint/eslint-plugin ^8.69.0 -> ^8.70.0 @typescript-eslint/parser ^8.69.0 -> ^8.70.0 typescript-eslint ^8.69.0 -> ^8.70.0 cz-emoji-conventional ^1.1.0 -> ^1.3.0 eslint ^10.9.1 -> ^10.10.0 All dev-only. None is imported from src/, so none reaches the bundle esbuild produces. npm refused to re-resolve the typescript-eslint trio out of the existing lock (ERESOLVE, reporting a peer conflict that does not reproduce in a clean tree), so the twelve @typescript-eslint/* lock entries were dropped and re-resolved rather than regenerating the whole file, which would have floated every other caret range at the same time. Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
…details panel (#290) Co-authored-by: Simon Heather <simon.heather@yulife.com>
eFAILution
added a commit
that referenced
this pull request
Sep 15, 2026
The AICaC Adoption check has been failing since #275: architecture.yaml[providers].depends_on references unknown component 'templates' #275 correctly renamed the 'templates' component to 'webview' when src/templates/ was removed, but left providers.depends_on pointing at the old name. Repointed at 'webview', which is what the providers actually import (componentBrowserProvider pulls in inlineMarkdown, scriptData, webviewHtml and clientInlineMarkdown). aicac.yml triggers only on main, so no beta PR runs it. The failures surface on the open release PR #271 (beta -> main), which re-runs on every push to beta, and would follow onto main itself on merge. Two adjacent staleness issues the checker does not catch, fixed while here: - providers.files listed componentHtmlRenderer.ts, deleted as dead code in #158. Replaced with hoverContentBuilder.ts, which holds that role now. - The hover_documentation data flow named the same deleted file and claimed it renders HTML 'using templates/helpers'. Hover builds a MarkdownString; there are no HTML templates in that path and no src/templates/ directory. Also lists clientInlineMarkdown.ts under the webview component, added in #290.
9 tasks
) The AICaC Adoption check has been failing since #275: architecture.yaml[providers].depends_on references unknown component 'templates' #275 correctly renamed the 'templates' component to 'webview' when src/templates/ was removed, but left providers.depends_on pointing at the old name. Repointed at 'webview', which is what the providers actually import (componentBrowserProvider pulls in inlineMarkdown, scriptData, webviewHtml and clientInlineMarkdown). aicac.yml triggers only on main, so no beta PR runs it. The failures surface on the open release PR #271 (beta -> main), which re-runs on every push to beta, and would follow onto main itself on merge. Two adjacent staleness issues the checker does not catch, fixed while here: - providers.files listed componentHtmlRenderer.ts, deleted as dead code in #158. Replaced with hoverContentBuilder.ts, which holds that role now. - The hover_documentation data flow named the same deleted file and claimed it renders HTML 'using templates/helpers'. Hover builds a MarkdownString; there are no HTML templates in that path and no src/templates/ directory. Also lists clientInlineMarkdown.ts under the webview component, added in #290. Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
…#283) * fix(completion): treat boolean inputs as booleans, not quoted strings * Fix review comments * fix(parser): tell input names from input keys by depth, not by name The reserved-key set added for the phantom-`default`-input fix drops any input actually named `type`, `default`, `options`, `description` or `regex` — all legal GitLab input names, and `type` a plausible one (deployment type, runner type). The input vanished from completion, hover and validation with no diagnostic. Anchors on the indentation of the first input name instead: siblings share it, and an input's own keys are always deeper. That settles the shallow layout the set was added for (`inputs:` at column 0 puts both input names and their keys at four spaces) without reserving any name. The property branch keys off the same anchor rather than a fixed four spaces, so the two halves can no longer disagree about which is which. --------- Co-authored-by: Simon Heather <simon.heather@yulife.com> Co-authored-by: eFAILution <collin.pesicka1@huntridgelabs.com>
…ry points (#300) * fix(details): share one message handler across both details-panel entry points * docs(details): correct what detachedFrom actually controls The option's doc said its presence makes an insert refocus the target editor, and that the Component Browser's panel does not. Both paths refocus: insertComponent calls showTextDocument on originalEditor, and editExistingComponentFromDetached opens and focuses the hover's own document. Neither is conditional on the option. What the option does control is adopting the editor as the insertion target at registration (the detached entry point builds its own provider, so nothing else populates it) and disposing the panel after an insert. --------- Co-authored-by: Simon Heather <simon.heather@yulife.com> Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
…lpers (#305) Co-authored-by: Simon Heather <simon.heather@yulife.com>
Rebuilds #301 against beta, which is already on 1.12.4 (#293) while main is still on 1.12.3, so the one-line change conflicted on retarget. SHA 6040db47 verified as the 1.12.5 tag in huntridge-labs/argus. The reusable workflow's own diff across 1.12.4..1.12.5 is only its internal @1.12.4 -> @1.12.5 job references; the release otherwise carries dependency bumps and a clamav digest re-pin (argus#426). Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
Rebuilds #302, #303 and #304 against beta. All three were opened against main, whose package.json trails beta by everything in #297, so most of what they propose is already here and their lockfiles no longer apply. @release-it/conventional-changelog ^12.0.0 -> ^12.0.2 @types/node ^26.5.1 -> ^26.6.1 dotenv ^17.4.2 -> ^18.0.0 js-yaml ^5.4.1 -> ^5.4.2 mocha ^12.0.0 -> ^12.0.2 release-it ^21.0.2 -> ^21.1.0 js-yaml is the only one that reaches the packaged extension — src imports it and esbuild bundles it — and it is a patch. The rest are tooling. The root conventional-changelog-conventionalcommits pin stays at 9.3.1; the 10.x that moves in the lockfile is release-it's own nested copy, already on 10.x before this change. dotenv is declared but imported nowhere in the repo, so its major bump is inert — worth removing rather than tracking, separately. release-it 21.1.0 pulls in one new transitive package, verkit@0.4.0 (MIT). Every version here was published at least three days ago. Co-authored-by: eFAILution <eFAILution@users.noreply.github.com>
eFAILution
had a problem deploying
to
publish-beta
September 21, 2026 19:56 — with
GitHub Actions
Error
GitHub Actions
Error
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rolling integration PR for the next stable release. It stays open while
betais refined, and picks up every new commit merged tobetaautomatically. Do not merge until the release is ready — merging tomaincuts a stable GitHub Release straight away.What is on
betatodayfix(completion): a!referencetag anywhere in the file broke all input completionchore(deps): js-yaml 4.2.0 → 4.3.2 (transitive)chore(deps-dev): fast-uri 3.1.5 → 3.1.7chore(deps-dev): dev-dependencies group, 9 updateschore(deps-dev): mocha 11.8.0 → 12.0.0Plus the
chore(release)bumps to 0.17.0 and 0.17.1.Headline change
#263 fixes a total-parse-failure bug. GitLab's
!reference [.job, key]tag belongs to no YAML schema, so js-yaml threw on it and the parse returned nothing for the entire file —include:block included — even when the tag sat in an unrelated job further down. Completion, hover and validation all went silent, and deleting the!referenceline was the only workaround. A newGITLAB_CI_SCHEMAteaches the parser the tag.Known gaps in that schema are tracked separately in #268, #269 and #270; none of them blocks this release.
Security
#267 is not just a version bump. mocha 11 carried
diffandserialize-javascriptadvisories;npm auditonbetanow reports 0 vulnerabilities, down from 3 (1 low, 1 moderate, 1 high).Versioning
betasits at 0.17.1. Odd minor is the pre-release channel, per the repo's even/odd convention. On merge,.release-it.json'srequireEvenMinorrolls this forward to an even minor (0.18.0) for the stable channel. Nothing to do by hand.Note that the VS Code Marketplace publish is still a separate manual
workflow_dispatch; a GitHub Release from this merge does not by itself ship anything to users.Verification on
betanpm ciclean, lockfile in sync withpackage.jsonnpm run lintclean (eslint --max-warnings 0)node esbuild.jsandtsc --noEmitclean on both tsconfigsnpm audit: 0 vulnerabilitiesBefore merging
betais feature-complete for this releasebetatip<<:) #268 (YAML merge keys) should land first