oxe-cc 1.12.0 → 1.16.0

package/.github/dependabot.yml

@@ -0,0 +1,31 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: America/Sao_Paulo
+    groups:
+      github-actions:
+        patterns: ["*"]
+    labels: [dependencies, github-actions]
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:30"
+      timezone: America/Sao_Paulo
+    groups:
+      npm-development:
+        dependency-type: development
+        patterns: ["*"]
+      npm-production:
+        dependency-type: production
+        patterns: ["*"]
+    labels: [dependencies, npm]
+    open-pull-requests-limit: 10

package/.github/workflows/ci.yml

@@ -1,57 +1,142 @@
-name: CI
-
-on:
-  push:
-    branches: [main, master]
-  pull_request:
-    branches: [main, master]
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: npm
-      - run: npm ci
-      - run: npm test
-      - run: npm run scan:assets
-      - run: npm run release:doctor
-
-  doctor:
-    runs-on: ubuntu-latest
-    needs: test
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: npm
-      - run: npm ci
-      - name: OXE Doctor
-        run: node bin/oxe-cc.js doctor
-
-  wrapper-audit:
-    runs-on: ubuntu-latest
-    needs: test
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: npm
-      - run: npm ci
-      - name: Audit runtime wrappers
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  workflow-lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - name: Install immutable actionlint
+        run: go install github.com/rhysd/actionlint/cmd/actionlint@03d0035246f3e81f36aed592ffb4bebf33a03106 # v1.7.7
+      - name: Validate GitHub Actions workflows
         run: |
-          node -e "
-            const rs = require('./bin/lib/oxe-runtime-semantics.cjs');
-            const r = rs.auditRuntimeTargets('.');
-            if (!r.ok) {
-              console.error('Wrapper audit failed:');
-              console.error(JSON.stringify(r.mismatches, null, 2));
-              process.exit(1);
-            }
-            console.log('Wrapper audit passed — all targets in sync');
-          "
+          ACTIONLINT="$(go env GOPATH)/bin/actionlint"
+          "$ACTIONLINT"
+
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '20'
+          cache: npm
+      - run: npm ci
+      - name: Reset quality telemetry
+        run: node scripts/quality-report.cjs reset
+      - name: Lint
+        run: node scripts/quality-report.cjs exec --name lint -- npm run lint
+      - name: Formatting
+        run: node scripts/quality-report.cjs exec --name format -- npm run format:check
+      - name: SDK type contract
+        run: node scripts/quality-report.cjs exec --name sdk-types -- npm run test:sdk-types
+      - name: Full test and coverage gate
+        run: node scripts/quality-report.cjs exec --name coverage -- npm run test:coverage
+      - name: Extension Host integration
+        run: node scripts/quality-report.cjs exec --name extension-host -- xvfb-run -a npm test --workspace oxe-agents
+      - name: Production dependency audit
+        run: node scripts/quality-report.cjs exec --name npm-audit -- npm audit
+      - name: Canonical assets
+        run: node scripts/quality-report.cjs exec --name assets -- npm run scan:assets
+      - name: Build VSIX
+        run: node scripts/quality-report.cjs exec --name vsix -- npm run build:vscode-ext
+      - name: npm package contract
+        run: node scripts/quality-report.cjs exec --name pack -- npm run release:pack-check
+      - name: Release manifest
+        run: node scripts/quality-report.cjs exec --name release-manifest -- npm run release:manifest
+      - name: Build quality report
+        if: always()
+        run: |
+          node scripts/quality-report.cjs finalize
+          cat .oxe/release/quality-gates-report.md >> "$GITHUB_STEP_SUMMARY"
+      - name: Upload quality evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: oxe-quality-gates
+          path: |
+            .oxe/release/quality-gates-report.json
+            .oxe/release/quality-gates-report.md
+            coverage/coverage-summary.json
+          if-no-files-found: error
+          retention-days: 30
+
+  node-compatibility:
+    name: Node ${{ matrix.node-version }} compatibility
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ['18', '22']
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+      - run: npm ci
+      - run: npm run build:runtime
+      - run: npm run test:root
+
+  doctor:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: test
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '20'
+          cache: npm
+      - run: npm ci
+      - name: OXE Doctor
+        run: node bin/oxe-cc.js doctor
+
+  wrapper-audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: test
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '20'
+          cache: npm
+      - run: npm ci
+      - name: Audit runtime wrappers
+        run: |
+          node -e "
+            const rs = require('./bin/lib/oxe-runtime-semantics.cjs');
+            const r = rs.auditRuntimeTargets('.');
+            if (!r.ok) {
+              console.error('Wrapper audit failed:');
+              console.error(JSON.stringify(r.mismatches, null, 2));
+              process.exit(1);
+            }
+            console.log('Wrapper audit passed — all targets in sync');
+          "

package/.github/workflows/release.yml

@@ -1,94 +1,119 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*.*.*'
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: npm
-      - run: npm ci
-      - run: npm test
-      - run: npm run scan:assets
-      - run: npm run release:doctor
-      - run: node bin/oxe-cc.js --version
-
-  publish-npm:
-    needs: validate
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: npm
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm ci
-      - run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-  build-vsix:
-    needs: validate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: npm
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '20'
+          cache: npm
+      - run: npm ci
+      - name: Validate release tag against package version
+        run: test "${GITHUB_REF_NAME#v}" = "$(node -p "require('./package.json').version")"
+      - run: node scripts/quality-report.cjs reset
+      - run: node scripts/quality-report.cjs exec --name lint -- npm run lint
+      - run: node scripts/quality-report.cjs exec --name format -- npm run format:check
+      - run: node scripts/quality-report.cjs exec --name sdk-types -- npm run test:sdk-types
+      - run: node scripts/quality-report.cjs exec --name coverage -- npm run test:coverage
+      - run: node scripts/quality-report.cjs exec --name extension-host -- xvfb-run -a npm test --workspace oxe-agents
+      - run: node scripts/quality-report.cjs exec --name npm-audit -- npm audit
+      - run: node scripts/quality-report.cjs exec --name assets -- npm run scan:assets
+      - run: node scripts/quality-report.cjs exec --name vsix -- npm run build:vscode-ext
+      - run: node scripts/quality-report.cjs exec --name pack -- npm run release:pack-check
+      - run: node scripts/quality-report.cjs exec --name release-manifest -- npm run release:manifest
+      - name: Build quality report
+        if: always()
+        run: |
+          node scripts/quality-report.cjs finalize
+          cat .oxe/release/quality-gates-report.md >> "$GITHUB_STEP_SUMMARY"
+      - name: Upload quality evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: oxe-release-quality-gates
+          path: |
+            .oxe/release/quality-gates-report.json
+            .oxe/release/quality-gates-report.md
+            coverage/coverage-summary.json
+          if-no-files-found: error
+          retention-days: 90
+
+  build-vsix:
+    needs: validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '20'
+          cache: npm
       - run: npm ci
       - run: npm run build:vscode-ext
-      - uses: actions/upload-artifact@v4
-        with:
-          name: oxe-agents-vsix
-          path: '*.vsix'
-          if-no-files-found: warn
-
-  create-release:
-    needs: [publish-npm, build-vsix]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-      - name: Extract changelog entry
-        id: changelog
+      - name: Resolve current VSIX
+        id: current-vsix
         run: |
-          TAG="${{ github.ref_name }}"
-          VERSION="${TAG#v}"
-          # Extract the block for this version from CHANGELOG.md
-          awk "/^## \[${VERSION}\]/{found=1; next} found && /^## \[/{exit} found{print}" CHANGELOG.md > CHANGELOG_EXTRACT.md
-          echo "Extracted changelog for ${VERSION}"
-          cat CHANGELOG_EXTRACT.md
-      - uses: actions/download-artifact@v4
+          VERSION="$(node -p "require('./vscode-extension/package.json').version")"
+          FILE="vscode-extension/oxe-agents-${VERSION}.vsix"
+          test -f "$FILE"
+          echo "path=$FILE" >> "$GITHUB_OUTPUT"
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: oxe-agents-vsix
-          path: dist/
-        continue-on-error: true
-      - name: Create GitHub Release
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          TAG="${{ github.ref_name }}"
-          VSIX_FILES=$(find dist/ -name "*.vsix" 2>/dev/null || true)
-          if [ -n "$VSIX_FILES" ]; then
-            gh release create "$TAG" \
-              --title "oxe-cc $TAG" \
-              --notes-file CHANGELOG_EXTRACT.md \
-              $VSIX_FILES
-          else
-            gh release create "$TAG" \
-              --title "oxe-cc $TAG" \
-              --notes-file CHANGELOG_EXTRACT.md
-          fi
+          path: ${{ steps.current-vsix.outputs.path }}
+          if-no-files-found: error
+          retention-days: 30
+
+  create-release:
+    needs: [validate, build-vsix]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - name: Extract changelog entry
+        run: |
+          TAG="${{ github.ref_name }}"
+          VERSION="${TAG#v}"
+          awk "/^## \[${VERSION}\]/{found=1; next} found && /^## \[/{exit} found{print}" CHANGELOG.md > CHANGELOG_EXTRACT.md
+          test -s CHANGELOG_EXTRACT.md
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: oxe-agents-vsix
+          path: dist/
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${{ github.ref_name }}"
+          mapfile -t VSIX_FILES < <(find dist/ -type f -name "*.vsix")
+          if [ "${#VSIX_FILES[@]}" -eq 0 ]; then
+            echo "VSIX obrigatório não encontrado no artefato oxe-agents-vsix" >&2
+            exit 1
+          fi
+          gh release create "$TAG" \
+            --title "oxe-cc $TAG" \
+            --notes-file CHANGELOG_EXTRACT.md \
+            "${VSIX_FILES[@]}"