ci: migrate to pnpm/setup and vendor the Coder API client (#1148)

Replace pnpm/action-setup, actions/setup-node, and the install step in
the shared setup action with a single pnpm/setup step. It installs
Node 22 through `pnpm runtime set`, runs a frozen install, and keeps the
platform fallback for the store cache. Only the default branch saves the
store. publish-extension.yaml keeps actions/setup-node, since its jobs
need only Node and a global vsce or ovsx install.

Add `pnpm clean` to delete installs, build output, and caches from an
explicit list, and have `pnpm package` clean and reinstall first.
Webviews build into `dist/webviews/<name>`, so a webview from another
branch otherwise ships in the package.

Vendor the five files the extension imports from coder/coder instead of
downloading the whole 125 MB repository on every cold install.
`pnpm sync:coder` fetches them into `vendor/coder` at a pinned release
commit, and `coder` links to that folder so imports stay
`coder/site/src/...`. The Lint job runs the sync and fails on any diff.
With no git dependencies left, CI setup drops the HTTPS rewrite.

Closes #1119

Author: EhabY

.gitattributes

@@ -1,3 +1,4 @@
 * text=auto eol=lf
 pnpm-lock.yaml linguist-generated=true
 flake.lock linguist-generated=true
+vendor/coder/site/** linguist-generated=true

.github/actions/setup/action.yml

@@ -4,22 +4,10 @@ description: Install pnpm, Node.js, and project dependencies.
 runs:
   using: composite
   steps:
-    - name: Use HTTPS for GitHub git clones
-      shell: bash
-      # Needed for git-based deps (e.g. github:coder/coder) so pnpm can clone without SSH.
-      run: git config --global url."https://github.com/".insteadOf "git@github.com:"
-
-    - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+    - uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
       with:
-        # Caches the pnpm store, keyed by lockfile hash with a prefix fallback,
-        # so a dependency bump reuses the rest of the store. setup-node's own
-        # pnpm cache restores on an exact hash only.
+        runtime: node@22
+        require-lockfile: true
+        # Falls back to the platform's last store, so a bump fetches only the diff.
         cache: true
-
-    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-      with:
-        node-version: "22"
-
-    - name: Install dependencies
-      shell: bash
-      run: pnpm install --frozen-lockfile
+        save-cache: ${{ github.ref == 'refs/heads/main' }}

.github/workflows/ci.yaml

@@ -28,6 +28,9 @@ jobs:
 
       - run: pnpm format:check
 
+      - name: Check vendored Coder client
+        run: pnpm sync:coder && git diff --exit-code vendor/coder
+
       - run: pnpm lint
 
       - run: pnpm build

.oxfmtrc.jsonc

@@ -7,9 +7,10 @@
 	"ignorePatterns": [
 		"flake.lock",
 		"pnpm-lock.yaml",
-		// Golden snapshots and generated VS Code theme dumps are written verbatim.
+		// Golden snapshots, VS Code theme dumps, and the vendored Coder client are written verbatim.
 		"**/__golden__/",
-		".storybook/themes/generated/"
+		".storybook/themes/generated/",
+		"vendor/coder/site/"
 	],
 	"overrides": [
 		{

.oxlintrc.jsonc

@@ -17,7 +17,8 @@
 		"**/vite.config*.ts",
 		".vscode-test/**",
 		"test/fixtures/scripts/**",
-		"storybook-static/**"
+		"storybook-static/**",
+		"vendor/coder/site/**"
 	],
 	"overrides": [
 		{

docs/TOOLING.md

@@ -64,6 +64,7 @@ When updating the minimum Node.js version, update these files:
 - **tsconfig.json**: `extends` (the `@tsconfig/nodeXX` package), `lib` (match base ESNext version)
 - **scripts/esbuild.mjs**: `target`
 - **.github/workflows/ci.yaml**: `electron-version` and `vscode-version` matrices
+- **.github/actions/setup/action.yml**: `runtime`
 
 ## Dependencies
 
@@ -73,11 +74,9 @@ Some dependencies are not directly used in the source but are required anyway.
   builds are off, so Windows on ARM64 uses their JavaScript fallback.
 - `ua-parser-js` and `dayjs` are used by the Coder API client.
 
-The coder client is vendored from coder/coder. Pin it to a release tag in
-`pnpm-workspace.yaml` (e.g. `coder: github:coder/coder#v2.33.1`), not `#main`.
-A tag gives reproducible builds and is not re-fetched on every `pnpm install`,
-unlike `#main` which can drift between installs. To update, bump the tag and
-run `pnpm install` (or `pnpm update coder`).
+The Coder API client is vendored from coder/coder into `vendor/coder/site`. To
+update it, set `CODER_COMMIT` in `vendor/coder/sync.mjs` to a release commit
+and run `pnpm sync:coder`.
 
 After running `pnpm update`, always run `pnpm dedupe` to consolidate duplicate
 package versions across the workspace. Without this, workspace packages can

eslint.config.mjs

@@ -25,6 +25,7 @@ export default defineConfig(
 		".vscode-test/**",
 		"test/fixtures/scripts/**",
 		"storybook-static/**",
+		"vendor/coder/site/**",
 	]),
 
 	// Parse TypeScript without the type-aware programs; Oxlint owns typed rules.
@@ -42,6 +43,7 @@ export default defineConfig(
 				createTypeScriptImportResolver({ project: "./tsconfig.json" }),
 			],
 			"import-x/internal-regex": "^@/",
+			"import-x/external-module-folders": ["node_modules", "vendor"],
 		},
 		rules: {
 			"import-x/order": [

package.json

@@ -29,17 +29,20 @@
 		"build:production": "cross-env NODE_ENV=production pnpm build",
 		"build:test": "tsc -p test/integration --outDir out --noCheck",
 		"build:webviews": "pnpm -r --filter \"./packages/*\" --parallel build",
+		"clean": "node scripts/clean.mjs",
 		"format": "node scripts/run-tool.mjs oxfmt --write .",
 		"format:check": "node scripts/run-tool.mjs oxfmt --check .",
 		"lint": "concurrently -g -n oxlint,eslint \"pnpm lint:oxlint\" \"pnpm lint:eslint\"",
 		"lint:eslint": "node scripts/run-tool.mjs eslint --cache --cache-strategy content --cache-location node_modules/.cache/eslint/ .",
 		"lint:fix": "pnpm lint:oxlint --fix && pnpm lint:eslint --fix",
 		"lint:oxlint": "node scripts/run-tool.mjs oxlint --type-aware .",
+		"prepackage": "pnpm clean && pnpm install --frozen-lockfile",
 		"package": "pnpm build:production && vsce package --no-dependencies",
 		"package:prerelease": "pnpm build:production && vsce package --pre-release --no-dependencies",
 		"storybook": "storybook dev -p 6006 --config-dir .storybook",
 		"storybook:build": "storybook build --config-dir .storybook",
 		"storybook:ci": "storybook build --test --config-dir .storybook",
+		"sync:coder": "node vendor/coder/sync.mjs",
 		"sync:vscode-themes": "node .storybook/themes/sync.mjs",
 		"test": "cross-env CI=true ELECTRON_RUN_AS_NODE=1 electron node_modules/vitest/vitest.mjs",
 		"test:extension": "cross-env ELECTRON_RUN_AS_NODE=1 electron node_modules/vitest/vitest.mjs --project extension",
@@ -850,7 +853,7 @@
 		"@vscode/vsce": "^4.0.0",
 		"babel-plugin-react-compiler": "catalog:",
 		"bufferutil": "^4.1.0",
-		"coder": "catalog:",
+		"coder": "link:vendor/coder",
 		"concurrently": "^10.0.6",
 		"cross-env": "^10.1.0",
 		"dayjs": "^1.11.23",

pnpm-lock.yaml

@@ -16,7 +16,6 @@ catalog:
   "@vscode-elements/react-elements": ^2.4.0
   "@vscode/codicons": 0.0.46-24
   babel-plugin-react-compiler: ^1.0.0
-  coder: github:coder/coder#22f4284f8fa67bc3af6fc38e0079616d39128566 # v2.37.1
   date-fns: ^4.4.0
   react: ^19.3.1
   react-dom: ^19.3.1