Skip to content

Harden release workflows and refresh repository presentation - #16

Merged
TheStreamCode merged 1 commit into
mainfrom
audit/full-review-2026-08-08
Aug 8, 2026
Merged

TheStreamCode merged 1 commit into
mainfrom
audit/full-review-2026-08-08

Conversation

@TheStreamCode

Copy link
Copy Markdown
Owner

Summary

  • harden CI installs and Open VSX release-asset verification
  • update vulnerable development-tooling transitive dependencies
  • reorganize the README around installation, compatibility, security, and privacy
  • move detailed diagnostics into a dedicated troubleshooting guide
  • fix npm 11 argument forwarding for release-candidate packaging
  • extend metadata regression coverage for the new guarantees

Why

The full repository audit found high-severity development-tooling advisories, an Open VSX asset-verification gap, and presentation content that made the primary README harder to scan. The documented VSIX output command also did not forward --out correctly under the pinned npm 11 toolchain.

Validation

  • npm ci --strict-allow-scripts
  • npm run check: 68/68 tests, VS Code integration smoke test, and vsce ls
  • npm run audit: 0 vulnerabilities
  • packaged and inspected the VSIX: 13 expected files only

@TheStreamCode
TheStreamCode enabled auto-merge (squash) August 8, 2026 19:54
@TheStreamCode
TheStreamCode merged commit b754dc7 into main Aug 8, 2026
5 checks passed
@TheStreamCode
TheStreamCode deleted the audit/full-review-2026-08-08 branch August 8, 2026 20:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant