build.yml

name: Build

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

jobs:
  build:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
    permissions:
      actions: read
      contents: read
      deployments: read
      packages: none
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
      with:
        egress-policy: audit

    - name: Checkout Branch
      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
    - name: Setup Node.js
      uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
      with:
        version: 20
    - name: Build Extension
      run: |
        npm run install:all
    - name: Smoke test (Linux)
      run: xvfb-run -a npm run test
      if: runner.os == 'Linux'
    - name: Smoke test (Mac, Windows)
      run: npm run test
      if: runner.os != 'Linux'
    - name: Package Extension
      if: matrix.os == 'ubuntu-latest'
      run: |
        npm run package
        mkdir vsix
        mv *.vsix vsix
    - name: Archive Extension
      if: matrix.os == 'ubuntu-latest'
      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
      with:
        name: vsix
        path: vsix