feat: group vs code extension updates in a single pull request - #1439
Merged
Conversation
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Max errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 23 | 0 | 0 | 0.15s | ||
| ✅ DOCKERFILE | hadolint | 4 | 0 | 0 | 0.13s | ||
| ✅ JSON | npm-package-json-lint | yes | no | no | 0.27s | ||
| ✅ JSON | prettier | 46 | 8 | 0 | 0 | 1.11s | |
| ✅ JSON | v8r | 46 | 0 | 0 | 11.43s | ||
| ✅ MARKDOWN | markdownlint | 13 | 0 | 0 | 0 | 0.58s | |
| ✅ MARKDOWN | markdown-table-formatter | 13 | 0 | 0 | 0 | 0.15s | |
| ✅ REPOSITORY | betterleaks | yes | no | no | 0.91s | ||
| ✅ REPOSITORY | checkov | yes | no | no | 22.48s | ||
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | ||
| ✅ REPOSITORY | grype | yes | no | no | 59.03s | ||
| osv-scanner | yes | 2 | no | 1.57s | |||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.82s | ||
| ✅ REPOSITORY | syft | yes | no | no | 1.91s | ||
| ✅ REPOSITORY | trivy | yes | no | no | 9.44s | ||
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.32s | ||
| ✅ REPOSITORY | trufflehog | yes | no | no | 4.17s | ||
| lychee | 118 | 1 | 0 | 160.19s | |||
| ✅ YAML | prettier | 36 | 0 | 0 | 0 | 0.62s | |
| ✅ YAML | v8r | 36 | 0 | 0 | 6.93s | ||
| ✅ YAML | yamllint | 36 | 0 | 0 | 0.65s |
Detailed Issues
⚠️ SPELL / lychee - 1 error
📝 Summary
---------------------
🔍 Total..........154
🔗 Unique.........126
✅ Successful.....146
⏳ Timeouts.........2
🔀 Redirected......19
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........1
⛔ Unsupported......1
Errors in .github/TOOL_VERSION_ISSUE_TEMPLATE.md
[403] https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads (at 38:7) | Rejected status code: 403 Forbidden
Errors in test/cpp/features/security.feature
[TIMEOUT] https://slsa.dev/spec/v1.0/threats (at 28:19) | Request timed out
[TIMEOUT] https://slsa.dev/spec/v1.0/threats (at 42:44) | Request timed out
Hint: Followed 19 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ REPOSITORY / osv-scanner - 2 errors
Scanning dir .
Starting filesystem walk for root: /
Scanned .devcontainer/cpp/requirements.txt file and found 20 packages
Scanned .devcontainer/docs/requirements.txt file and found 14 packages
Scanned package-lock.json file and found 73 packages
Scanned test/embedded-rust/workspace/cortex-mf/Cargo.lock file and found 20 packages
Scanned test/embedded-rust/workspace/cortex-m/Cargo.lock file and found 20 packages
Scanned test/rust/workspace/cargo/Cargo.lock file and found 1 package
Scanned test/rust/workspace/clippy/Cargo.lock file and found 1 package
Scanned test/rust/workspace/test/Cargo.lock file and found 1 package
Scanned .github/actions/update-vscode-extensions/package-lock.json file and found 288 packages
End status: 83 dirs visited, 280 inodes visited, 9 Extract calls, 33.139784ms elapsed, 33.139931ms wall time
Total 3 packages affected by 4 known vulnerabilities (0 Critical, 2 High, 0 Medium, 0 Low, 2 Unknown) from 2 ecosystems.
2 vulnerabilities can be fixed.
+-------------------------------------+------+-----------+-----------------------+---------+---------------+---------------------------------------------------+
| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+---------------------------------------------------+
| https://osv.dev/RUSTSEC-2026-0110 | | crates.io | bare-metal | 0.2.5 | -- | test/embedded-rust/workspace/cortex-m/Cargo.lock |
| https://osv.dev/RUSTSEC-2026-0110 | | crates.io | bare-metal | 0.2.5 | -- | test/embedded-rust/workspace/cortex-mf/Cargo.lock |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5 | npm | brace-expansion (dev) | 5.0.7 | 5.0.8 | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5 | npm | brace-expansion (dev) | 5.0.7 | 5.0.9 | package-lock.json |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+---------------------------------------------------+
See detailed reports in MegaLinter artifacts
You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:
- oxsecurity/megalinter/flavors/salesforce@v10.0.0 (57 linters)
- oxsecurity/megalinter/flavors/javascript@v10.0.0 (62 linters)
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@10.0.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The workflow/action changes introduce concrete failure-mode and runtime-compatibility risks (PR creation despite update failures, and Node engine requirements not being enforced) that should be addressed before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR refactors the VS Code extension update automation to update all devcontainer configs in one run/PR, adds a cooldown window before adopting newly-published extension versions, and introduces a dedicated npm dependency set for the update action itself.
Changes:
- Consolidate VS Code extension updates across multiple devcontainer JSON files into a single workflow job and a single generated PR.
- Extend the
update-vscode-extensionscomposite action/script to accept multiple input files and enforce a version “cooldown” period. - Add Dependabot tracking for the composite action’s npm dependencies (introducing
package.json/package-lock.json).
File summaries
| File | Description |
|---|---|
| .github/workflows/update-dependencies.yml | Switch VS Code extension updates from matrix-per-file to a single consolidated update run/PR. |
| .github/dependabot.yml | Add a new npm update entry for the update-vscode-extensions action’s own dependencies. |
| .github/actions/update-vscode-extensions/update-vscode-extensions.sh | Add multi-file processing, cooldown logic, and per-file failure aggregation for extension updates. |
| .github/actions/update-vscode-extensions/action.yml | Replace global vsce install with npm ci and pass cooldown + local vsce path into the script. |
| .github/actions/update-vscode-extensions/package.json | Introduce pinned @vscode/vsce dev dependency for the composite action. |
| .github/actions/update-vscode-extensions/package-lock.json | Lock the composite action’s npm dependency tree for reproducible installs. |
Review details
- Files reviewed: 5/6 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Contributor
Contributor
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
Ron (rjaegers)
had a problem deploying
to
acceptance-testing
September 7, 2026 05:52 — with 
GitHub Actions
Failure
GitHub Actions
Failure
André Jordan (andjordan)
approved these changes
Sep 7, 2026
Ron (rjaegers)
force-pushed
the
feature/group-vs-code-extension-updates
branch
from
September 7, 2026 07:42
0492cbf to
ea79d93
Compare
|
Contributor
Pull Request Report (#1439)Static measures
Time related measures
Status check related measures
|
This was referenced Sep 7, 2026
Contributor
|
🎉 Hooray! The changes in this pull request went live with the release of actions: v1.2.0 🎉 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Hey, I have created a Pull Request
Description of changes
This pull request refactors and enhances the automation for updating version-pinned VS Code extensions across multiple devcontainer files. The main improvements include supporting batch updates across all devcontainer flavors, introducing a cooldown period for adopting new extension versions, and improving reliability and reporting in the update process.
Batch update and workflow improvements:
.github/workflows/update-dependencies.yml) now processes all devcontainer extension files in a single job, removing the matrix strategy and allowing for batch updates. The workflow will not fail entirely if a single file update fails, but will report the failure at the end. Commit messages and PR titles have been generalized to reflect updates across all devcontainers. [1] [2] [3]Extension update logic enhancements:
update-vscode-extensions.sh) now accepts multiple input files, processes each, and caches marketplace queries for efficiency. It introduces a cooldown period (default 7 days, configurable) so only extension versions that have been available for at least this period are adopted. [1] [2]Action and dependency management:
action.yml) now supports multiple input files, exposes the cooldown period as an input, and ensures Node.js dependencies are installed locally rather than globally.package.jsonis added to manage the@vscode/vscedependency, and Dependabot is configured to keep it up to date. [1] [2]These changes make the extension update process more reliable, scalable, and maintainable, while reducing the risk of adopting problematic extension releases too soon.
✔️ Checklist