diff --git a/.eslintrc.yaml b/.eslintrc.yaml deleted file mode 100644 index 1bbbbd09e38e..000000000000 --- a/.eslintrc.yaml +++ /dev/null @@ -1,43 +0,0 @@ -parser: "@typescript-eslint/parser" -env: - browser: true - es6: true # Map, etc. - jest: true - node: true - -parserOptions: - ecmaVersion: 2018 - sourceType: module - -extends: - - eslint:recommended - - plugin:@typescript-eslint/recommended - - plugin:import/recommended - - plugin:import/typescript - - plugin:prettier/recommended - # Prettier should always be last - # Removes eslint rules that conflict with prettier. - - prettier - -rules: - # Sometimes you need to add args to implement a function signature even - # if they are unused. - "@typescript-eslint/no-unused-vars": ["error", { "args": "none" }] - # For overloads. - no-dupe-class-members: off - "@typescript-eslint/no-use-before-define": off - "@typescript-eslint/no-non-null-assertion": off - "@typescript-eslint/ban-types": off - "@typescript-eslint/no-var-requires": off - "@typescript-eslint/explicit-module-boundary-types": off - "@typescript-eslint/no-explicit-any": off - "@typescript-eslint/no-extra-semi": off - eqeqeq: error - import/order: - [error, { alphabetize: { order: "asc" }, groups: [["builtin", "external", "internal"], "parent", "sibling"] }] - no-async-promise-executor: off - -settings: - import/resolver: - typescript: - alwaysTryTypes: true diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs new file mode 100644 index 000000000000..793a923d16eb --- /dev/null +++ b/.git-blame-ignore-revs @@ -0,0 +1,2 @@ +# Prettier 3.4.2 +9b0340a09276f93c054d705d1b9a5f24cc5dbc97 \ No newline at end of file diff --git a/.github/ISSUE_TEMPLATE/bug-report.yml b/.github/ISSUE_TEMPLATE/bug-report.yml index 38ea630d6ecf..c43d5c65e23b 100644 --- a/.github/ISSUE_TEMPLATE/bug-report.yml +++ b/.github/ISSUE_TEMPLATE/bug-report.yml @@ -20,6 +20,8 @@ body: - **Remote OS**: Ubuntu - **Remote Architecture**: amd64 - **`code-server --version`**: 4.0.1 + + Please do not just put "latest" for the version. value: | - Web Browser: - Local OS: @@ -62,7 +64,7 @@ body: id: logs attributes: label: Logs - description: Run code-server with the --verbose flag and then paste any relevant logs from the server, from the browser console and/or the browser network tab. For issues with installation, include installation logs (i.e. output of `yarn global add code-server`). + description: Run code-server with the --verbose flag and then paste any relevant logs from the server, from the browser console and/or the browser network tab. For issues with installation, include installation logs (i.e. output of `npm install -g code-server`). render: shell - type: textarea @@ -84,6 +86,18 @@ body: validations: required: true + - type: dropdown + attributes: + label: Does this bug reproduce in VS Code web? + description: If the bug reproduces in VS Code web, submit the issue upstream instead (https://github.com/microsoft/vscode). You can run VS Code web with `code serve-web` (this is not the same as vscode.dev). + options: + - Yes, this is also broken in VS Code web + - No, this works as expected in VS Code web + - This cannot be tested in VS Code web + - I did not test VS Code web + validations: + required: true + - type: dropdown attributes: label: Does this bug reproduce in GitHub Codespaces? diff --git a/.github/PULL_REQUEST_TEMPLATE/release_template.md b/.github/PULL_REQUEST_TEMPLATE/release_template.md deleted file mode 100644 index b4d29aaca692..000000000000 --- a/.github/PULL_REQUEST_TEMPLATE/release_template.md +++ /dev/null @@ -1,17 +0,0 @@ - - -This PR is to generate a new release of `code-server` at `$CODE_SERVER_VERSION_TO_UPDATE` - -## Screenshot - -TODO - -## TODOs - -Follow "Publishing a release" steps in `ci/README.md` - - - -- [ ] update `CHANGELOG.md` -- [ ] manually run "Draft release" workflow after merging this PR -- [ ] merge PR opened in [code-server-aur](https://github.com/coder/code-server-aur) diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index 87513b7cee1d..d39541471001 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -6,9 +6,9 @@ updates: interval: "monthly" time: "06:00" timezone: "America/Chicago" + cooldown: + default-days: 7 labels: [] - commit-message: - prefix: "chore" - package-ecosystem: "npm" directory: "/" @@ -16,8 +16,8 @@ updates: interval: "monthly" time: "06:00" timezone: "America/Chicago" - commit-message: - prefix: "chore" + cooldown: + default-days: 7 labels: [] ignore: # Ignore patch updates for all dependencies diff --git a/.github/ranger.yml b/.github/ranger.yml deleted file mode 100644 index 4a7044e4d5e4..000000000000 --- a/.github/ranger.yml +++ /dev/null @@ -1,29 +0,0 @@ -# Configuration for the repo ranger bot -# See docs: https://www.notion.so/Documentation-8d7627bb1f3c42b7b1820e8d6f157a57#9879d1374fab4d1f9c607c230fd5123d -default: - close: - # Default time to wait before closing the label. Can either be a number in milliseconds - # or a string specified by the `ms` package (https://www.npmjs.com/package/ms) - delay: "2 days" - - # Default comment to post when an issue is first marked with a closing label - comment: "⚠️ This issue has been marked $LABEL and will be closed in $DELAY." - -labels: - duplicate: close - wontfix: close - "squash when passing": merge - "rebase when passing": merge - "merge when passing": merge - "new contributor": - action: comment - delay: 5s - message: "Thanks for making your first contribution! :slightly_smiling_face:" - "upstream:vscode": - action: close - delay: 5s - comment: > - This issue has been marked as 'upstream:vscode'. - Please file this upstream: [link to open issue](https://github.com/microsoft/vscode/issues/new/choose) - - This issue will automatically close in $DELAY. diff --git a/.github/semantic.yaml b/.github/semantic.yaml deleted file mode 100644 index 55d345cc2ac9..000000000000 --- a/.github/semantic.yaml +++ /dev/null @@ -1,66 +0,0 @@ -############################################################################### -# This file configures "Semantic Pull Requests", which is documented here: -# https://github.com/zeke/semantic-pull-requests -############################################################################### - -# Scopes are optionally supplied after a 'type'. For example, in -# -# feat(docs): autostart ui -# -# '(docs)' is the scope. Scopes are used to signify where the change occurred. -scopes: - # docs: changes to the code-server documentation. - - docs - - # vendor: changes to vendored dependencies. - - vendor - - # deps: changes to code-server's dependencies. - - deps - - # cs: changes to code specific to code-server. - - cs - - # cli: changes to the command-line interface. - - cli - -# We only check that the PR title is semantic. The PR title is automatically -# applied to the "Squash & Merge" flow as the suggested commit message, so this -# should suffice unless someone drastically alters the message in that flow. -titleOnly: true - -# Types are the 'tag' types in a commit or PR title. For example, in -# -# chore: fix thing -# -# 'chore' is the type. -types: - # A build of any kind. - - build - - # A user-facing change that corrects a defect in code-server. - - fix - - # Any code task that is ignored for changelog purposes. Examples include - # devbin scripts and internal-only configurations. - - chore - - # Any work performed on CI. - - ci - - # Work that directly implements or supports the implementation of a feature. - - feat - - # A refactor changes code structure without any behavioral change. - - refactor - - # A git revert for any style of commit. - - revert - - # Adding tests of any kind. Should be separate from feature or fix - # implementations. For example, if a commit adds a fix + test, it's a fix - # commit. If a commit is simply bumping coverage, it's a test commit. - - test - - # A new release. - - release diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index bc777401a0cb..22d27335ab8e 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -15,242 +15,171 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} -# Note: if: success() is used in several jobs - -# this ensures that it only executes if all previous jobs succeeded. - -# if: steps.cache-node-modules.outputs.cache-hit != 'true' -# will skip running `yarn install` if it successfully fetched from cache - jobs: - prettier: - name: Format with Prettier - runs-on: ubuntu-20.04 - timeout-minutes: 5 + changes: + runs-on: ubuntu-latest + outputs: + ci: ${{ steps.filter.outputs.ci }} + code: ${{ steps.filter.outputs.code }} + npm: ${{ steps.filter.outputs.npm }} + vscode: ${{ steps.filter.outputs.vscode }} + docs: ${{ steps.filter.outputs.docs }} + helm: ${{ steps.filter.outputs.helm }} steps: - - name: Checkout repo - uses: actions/checkout@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 + id: filter + with: + filters: | + ci: + - ".github/**" + - "ci/**" + docs: + - "docs/**" + - "README.md" + - "CHANGELOG.md" + helm: + - "ci/helm-chart/**" + code: + - "src/**" + - "test/**" + npm: + - "package-lock.json" + - "test/package-lock.json" + vscode: + - "lib/**" + - "patches/**" + - id: debug + run: | + echo "${{ toJSON(steps.filter )}}" - - name: Run prettier with actionsx/prettier - uses: actionsx/prettier@v3 + prettier: + name: Run prettier check + runs-on: ubuntu-22.04 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: - args: --check --loglevel=warn . + node-version-file: .node-version + cache: npm + cache-dependency-path: | + package-lock.json + test/package-lock.json + - run: SKIP_SUBMODULE_DEPS=1 npm ci + - run: npx prettier --check . doctoc: name: Doctoc markdown files - runs-on: ubuntu-20.04 - timeout-minutes: 5 + runs-on: ubuntu-22.04 + needs: changes + if: needs.changes.outputs.docs == 'true' steps: - - name: Checkout repo - uses: actions/checkout@v4 - - - name: Get changed files - id: changed-files - uses: tj-actions/changed-files@v44 - with: - files: | - docs/** - - - name: Install Node.js - if: steps.changed-files.outputs.any_changed == 'true' - uses: actions/setup-node@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: node-version-file: .node-version - cache: "yarn" - - - name: Install doctoc - run: yarn global add doctoc@2.2.1 - - - name: Run doctoc - if: steps.changed-files.outputs.any_changed == 'true' - run: yarn doctoc + cache: npm + cache-dependency-path: | + package-lock.json + test/package-lock.json + - run: SKIP_SUBMODULE_DEPS=1 npm ci + - run: npm run doctoc lint-helm: name: Lint Helm chart - runs-on: ubuntu-20.04 - timeout-minutes: 5 + runs-on: ubuntu-22.04 + needs: changes + if: needs.changes.outputs.helm == 'true' steps: - - name: Checkout repo - uses: actions/checkout@v4 - with: - fetch-depth: 2 - - - name: Get changed files - id: changed-files - uses: tj-actions/changed-files@v44 - with: - files: | - ci/helm-chart/** - - - name: Install helm - if: steps.changed-files.outputs.any_changed == 'true' - uses: azure/setup-helm@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: bmuschko/setup-kubeconform@e5d264ec1eafe2314e750c429a9da7639dd5a003 # v1.1.0 with: - token: ${{ secrets.GITHUB_TOKEN }} - - - name: Install helm kubeval plugin - if: steps.changed-files.outputs.any_changed == 'true' - run: helm plugin install https://github.com/instrumenta/helm-kubeval - - - name: Lint Helm chart - if: steps.changed-files.outputs.any_changed == 'true' - run: helm kubeval ci/helm-chart + kubeconform-version: "0.8.0" + - run: kubeconform ci/helm-chart lint-ts: name: Lint TypeScript files - runs-on: ubuntu-20.04 - timeout-minutes: 5 + runs-on: ubuntu-22.04 + needs: changes + if: needs.changes.outputs.code == 'true' || needs.changes.outputs.ci == 'true' || needs.changes.outputs.npm == 'true' steps: - - name: Checkout repo - uses: actions/checkout@v4 - with: - fetch-depth: 2 - - - name: Get changed files - id: changed-files - uses: tj-actions/changed-files@v44 - with: - files: | - **/*.ts - **/*.js - files_ignore: | - lib/vscode/** - - - name: Install Node.js - if: steps.changed-files.outputs.any_changed == 'true' - uses: actions/setup-node@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: node-version-file: .node-version - - - name: Fetch dependencies from cache - if: steps.changed-files.outputs.any_changed == 'true' - id: cache-node-modules - uses: actions/cache@v4 - with: - path: "**/node_modules" - key: yarn-build-${{ hashFiles('**/yarn.lock') }} - restore-keys: | - yarn-build- - - - name: Install dependencies - if: steps.changed-files.outputs.any_changed == 'true' && steps.cache-node-modules.outputs.cache-hit != 'true' - run: SKIP_SUBMODULE_DEPS=1 yarn --frozen-lockfile - - - name: Lint TypeScript files - if: steps.changed-files.outputs.any_changed == 'true' - run: yarn lint:ts + cache: npm + cache-dependency-path: | + package-lock.json + test/package-lock.json + - run: SKIP_SUBMODULE_DEPS=1 npm ci + - run: npm run lint:ts lint-actions: name: Lint GitHub Actions runs-on: ubuntu-latest + needs: changes + if: needs.changes.outputs.ci == 'true' steps: - name: Checkout repo - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Check workflow files run: | - bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/7fdc9630cc360ea1a469eed64ac6d78caeda1234/scripts/download-actionlint.bash) - ./actionlint -color -shellcheck= -ignore "set-output" + bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.7.9 + ./actionlint -color -shellcheck= -ignore "softprops/action-gh-release" shell: bash test-unit: name: Run unit tests - runs-on: ubuntu-20.04 - timeout-minutes: 5 + runs-on: ubuntu-22.04 + needs: changes + if: needs.changes.outputs.code == 'true' || needs.changes.outputs.npm == 'true' steps: - - name: Checkout repo - uses: actions/checkout@v4 - with: - fetch-depth: 2 - - - name: Get changed files - id: changed-files - uses: tj-actions/changed-files@v44 - with: - files: | - **/*.ts - files_ignore: | - lib/vscode/** - - - name: Install Node.js - if: steps.changed-files.outputs.any_changed == 'true' - uses: actions/setup-node@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: node-version-file: .node-version - - - name: Fetch dependencies from cache - if: steps.changed-files.outputs.any_changed == 'true' - id: cache-node-modules - uses: actions/cache@v4 - with: - path: "**/node_modules" - key: yarn-build-${{ hashFiles('**/yarn.lock') }} - restore-keys: | - yarn-build- - - - name: Install dependencies - if: steps.changed-files.outputs.any_changed == 'true' && steps.cache-node-modules.outputs.cache-hit != 'true' - run: SKIP_SUBMODULE_DEPS=1 yarn --frozen-lockfile - - - name: Run unit tests - if: steps.changed-files.outputs.any_changed == 'true' - run: yarn test:unit - - - name: Upload coverage report to Codecov - uses: codecov/codecov-action@v4 + cache: npm + cache-dependency-path: | + package-lock.json + test/package-lock.json + - run: SKIP_SUBMODULE_DEPS=1 npm ci + - run: npm run test:unit + - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 + if: success() with: token: ${{ secrets.CODECOV_TOKEN }} - if: success() build: - name: Build code-server - runs-on: ubuntu-20.04 - timeout-minutes: 60 + name: linux-x64 + runs-on: ubuntu-22.04 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - steps: - - name: Checkout repo - uses: actions/checkout@v4 - with: - submodules: true - - - name: Install system dependencies - run: sudo apt update && sudo apt install -y libkrb5-dev + DISABLE_V8_COMPILE_CACHE: 1 + VERSION: 0.0.0 + VSCODE_ARCH: x64 + VSCODE_TARGET: linux-x64 + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + ELECTRON_SKIP_BINARY_DOWNLOAD: 1 + PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1 - - name: Install quilt - uses: awalsh128/cache-apt-pkgs-action@latest + steps: + - run: sudo apt update && sudo apt install -y libkrb5-dev + - uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest with: packages: quilt version: 1.0 - - name: Patch Code - run: quilt push -a - - - name: Install Node.js - uses: actions/setup-node@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: - node-version-file: .node-version - - # node-gyp is missing in (at least) npm 9.8.1. - # TODO: Remove once we update to npm>=10? - - name: Install node-gyp - run: npm install -g node-gyp - - - name: Fetch dependencies from cache - id: cache-node-modules - uses: actions/cache@v4 + submodules: true + - run: quilt push -a + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: - path: "**/node_modules" - key: yarn-build-code-server-${{ hashFiles('**/yarn.lock') }} - restore-keys: | - yarn-build-code-server- - - - name: Install dependencies - if: steps.cache-node-modules.outputs.cache-hit != 'true' - run: yarn --frozen-lockfile - - - name: Build code-server - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: yarn build + node-version-file: .node-version + cache: npm + cache-dependency-path: | + package-lock.json + test/package-lock.json # Get Code's git hash. When this changes it means the content is # different and we need to rebuild. @@ -258,177 +187,125 @@ jobs: id: vscode-rev run: echo "rev=$(git rev-parse HEAD:./lib/vscode)" >> $GITHUB_OUTPUT - # We need to rebuild when we have a new version of Code, when any of - # the patches changed, or when the code-server version changes (since - # it gets embedded into the code). Use VSCODE_CACHE_VERSION to - # force a rebuild. - - name: Fetch prebuilt Code package from cache + # We need to rebuild when we have a new version of Code, when any of the + # patches changed, or when the code-server version changes (since it gets + # embedded into the code). Use VSCODE_CACHE_VERSION to force a rebuild. + - name: Fetch prebuilt linux-x64 Code package from cache id: cache-vscode - uses: actions/cache@v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: - path: lib/vscode-reh-web-* - key: vscode-reh-package-${{ secrets.VSCODE_CACHE_VERSION }}-${{ steps.vscode-rev.outputs.rev }}-${{ hashFiles('patches/*.diff', 'ci/build/build-vscode.sh') }} - + path: lib/vscode-reh-web-linux-x64 + key: vscode-linux-x64-package-${{ secrets.VSCODE_CACHE_VERSION }}-${{ steps.vscode-rev.outputs.rev }}-${{ hashFiles('patches/*.diff', 'ci/build/build-vscode.sh') }} - name: Build vscode - env: - VERSION: "0.0.0" if: steps.cache-vscode.outputs.cache-hit != 'true' - run: yarn build:vscode - - # The release package does not contain any native modules - # and is neutral to architecture/os/libc version. - - name: Create release package - run: yarn release - if: success() - - # https://github.com/actions/upload-artifact/issues/38 - - name: Compress release package - run: tar -czf package.tar.gz release - - - name: Upload npm package artifact - uses: actions/upload-artifact@v4 + run: | + cd lib/vscode/build + npm ci + cd .. + source ./build/azure-pipelines/linux/setup-env.sh + # Run preinstall script before root dependencies are installed + # so that v8 headers are patched correctly for native modules. + node build/npm/preinstall.ts + npm ci + cd ../.. + npm run build:vscode + + # Build the code-server wrapper. + - run: SKIP_SUBMODULE_DEPS=1 npm ci + - run: npm run build + + # Push up an artifact containing the linux-x64 release. + - run: KEEP_MODULES=1 npm run release + - run: tar -czf package.tar.gz release + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: - name: npm-package + name: linux-x64-package path: ./package.tar.gz test-e2e: name: Run e2e tests - needs: build - runs-on: ubuntu-20.04 - timeout-minutes: 25 - steps: - - name: Checkout repo - uses: actions/checkout@v4 - - - name: Install system dependencies - run: sudo apt update && sudo apt install -y libkrb5-dev + runs-on: ubuntu-22.04 + env: + LOG_LEVEL: debug + needs: [changes, build] + if: needs.changes.outputs.code == 'true' || needs.changes.outputs.npm == 'true' || needs.changes.outputs.vscode == 'true' || needs.changes.outputs.ci == 'true' - - name: Install Node.js - uses: actions/setup-node@v4 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: node-version-file: .node-version - - - name: Fetch dependencies from cache - id: cache-node-modules - uses: actions/cache@v4 - with: - path: "**/node_modules" - key: yarn-build-${{ hashFiles('**/yarn.lock') }} - restore-keys: | - yarn-build- - - - name: Download npm package - uses: actions/download-artifact@v4 - with: - name: npm-package - - - name: Decompress npm package - run: tar -xzf package.tar.gz - - - name: Install release package dependencies - run: cd release && npm install --unsafe-perm --omit=dev - - - name: Install dependencies - if: steps.cache-node-modules.outputs.cache-hit != 'true' - run: SKIP_SUBMODULE_DEPS=1 yarn --frozen-lockfile - + cache: npm + cache-dependency-path: | + package-lock.json + test/package-lock.json + - run: SKIP_SUBMODULE_DEPS=1 npm ci - name: Install Playwright OS dependencies run: | ./test/node_modules/.bin/playwright install-deps ./test/node_modules/.bin/playwright install - - name: Run end-to-end tests - run: CODE_SERVER_TEST_ENTRY=./release yarn test:e2e + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + with: + name: linux-x64-package + - run: tar -xzf package.tar.gz - - name: Upload test artifacts + - run: CODE_SERVER_TEST_ENTRY=./release npm run test:e2e + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: always() - uses: actions/upload-artifact@v4 with: name: failed-test-videos path: ./test/test-results - - name: Remove release packages and test artifacts - run: rm -rf ./release ./test/test-results - test-e2e-proxy: name: Run e2e tests behind proxy - needs: build - runs-on: ubuntu-20.04 - timeout-minutes: 25 - steps: - - name: Checkout repo - uses: actions/checkout@v4 - - - name: Install system dependencies - run: sudo apt update && sudo apt install -y libkrb5-dev - - - name: Install Node.js - uses: actions/setup-node@v4 - with: - node-version-file: .node-version - - - name: Fetch dependencies from cache - id: cache-node-modules - uses: actions/cache@v4 - with: - path: "**/node_modules" - key: yarn-build-${{ hashFiles('**/yarn.lock') }} - restore-keys: | - yarn-build- - - - name: Download npm package - uses: actions/download-artifact@v4 - with: - name: npm-package - - - name: Decompress npm package - run: tar -xzf package.tar.gz - - - name: Install release package dependencies - run: cd release && npm install --unsafe-perm --omit=dev - - - name: Install dependencies - if: steps.cache-node-modules.outputs.cache-hit != 'true' - run: SKIP_SUBMODULE_DEPS=1 yarn --frozen-lockfile - - - name: Install Playwright OS dependencies - run: | - ./test/node_modules/.bin/playwright install-deps - ./test/node_modules/.bin/playwright install + runs-on: ubuntu-22.04 + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + LOG_LEVEL: debug + needs: [changes, build] + if: needs.changes.outputs.code == 'true' || needs.changes.outputs.npm == 'true' || needs.changes.outputs.vscode == 'true' || needs.changes.outputs.ci == 'true' + steps: - name: Cache Caddy - uses: actions/cache@v4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 id: caddy-cache with: path: | ~/.cache/caddy key: cache-caddy-2.5.2 - - name: Install Caddy - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} if: steps.caddy-cache.outputs.cache-hit != 'true' run: | gh release download v2.5.2 --repo caddyserver/caddy --pattern "caddy_2.5.2_linux_amd64.tar.gz" mkdir -p ~/.cache/caddy tar -xzf caddy_2.5.2_linux_amd64.tar.gz --directory ~/.cache/caddy - - name: Start Caddy - run: sudo ~/.cache/caddy/caddy start --config ./ci/Caddyfile + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 + with: + node-version-file: .node-version + cache: npm + cache-dependency-path: | + package-lock.json + test/package-lock.json + - run: SKIP_SUBMODULE_DEPS=1 npm ci + - name: Install Playwright OS dependencies + run: | + ./test/node_modules/.bin/playwright install-deps + ./test/node_modules/.bin/playwright install - - name: Run end-to-end tests - run: CODE_SERVER_TEST_ENTRY=./release yarn test:e2e:proxy --global-timeout 840000 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 + with: + name: linux-x64-package + - run: tar -xzf package.tar.gz - - name: Stop Caddy + - run: ~/.cache/caddy/caddy start --config ./ci/Caddyfile + - run: CODE_SERVER_TEST_ENTRY=./release npm run test:e2e:proxy + - run: ~/.cache/caddy/caddy stop --config ./ci/Caddyfile if: always() - run: sudo ~/.cache/caddy/caddy stop --config ./ci/Caddyfile - - - name: Upload test artifacts + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: always() - uses: actions/upload-artifact@v4 with: name: failed-test-videos-proxy path: ./test/test-results - - - name: Remove release packages and test artifacts - run: rm -rf ./release ./test/test-results diff --git a/.github/workflows/installer.yaml b/.github/workflows/installer.yaml index e8b04453dcfc..1777844dd11b 100644 --- a/.github/workflows/installer.yaml +++ b/.github/workflows/installer.yaml @@ -30,7 +30,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repo - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Install code-server run: ./install.sh @@ -44,7 +44,7 @@ jobs: container: "alpine:3.17" steps: - name: Checkout repo - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Install curl run: apk add curl @@ -67,7 +67,7 @@ jobs: steps: - name: Checkout repo - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Install code-server run: ./install.sh diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 0ec6126d9733..32cf8370e817 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -6,7 +6,6 @@ on: workflow_dispatch: inputs: version: - description: The version to publish (include "v", i.e. "v4.9.1"). type: string required: true @@ -21,186 +20,148 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: - # NOTE: this job requires curl, jq and yarn - # All of them are included in ubuntu-latest. npm: runs-on: ubuntu-latest + env: + TAG: ${{ inputs.version || github.ref_name }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + NPM_ENVIRONMENT: "production" + steps: - - name: Checkout code-server - uses: actions/checkout@v4 + - name: Set version to tag without leading v + run: | + echo "VERSION=${TAG#v}" >> $GITHUB_ENV - - name: Install Node.js - uses: actions/setup-node@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: node-version-file: .node-version - cache: "yarn" - - name: Download npm package from release artifacts - uses: robinraju/release-downloader@v1.10 + - uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13 with: repository: "coder/code-server" - tag: ${{ github.event.inputs.version || github.ref_name }} + tag: ${{ env.TAG }} fileName: "package.tar.gz" out-file-path: "release-npm-package" - # NOTE@jsjoeio - we do this so we can strip out the v - # i.e. v4.9.1 -> 4.9.1 - - name: Get and set VERSION - run: | - TAG="${{ github.event.inputs.version || github.ref_name }}" - echo "VERSION=${TAG#v}" >> $GITHUB_ENV - - - name: Publish npm package and tag with "latest" - run: yarn publish:npm - env: - VERSION: ${{ env.VERSION }} - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - NPM_ENVIRONMENT: "production" - - homebrew: - needs: npm - runs-on: ubuntu-latest - steps: - # Ensure things are up to date - # Suggested by homebrew maintainers - # https://github.com/Homebrew/discussions/discussions/1532#discussioncomment-782633 - - name: Set up Homebrew - id: set-up-homebrew - uses: Homebrew/actions/setup-homebrew@master - - - name: Checkout code-server - uses: actions/checkout@v4 - - - name: Configure git - run: | - git config --global user.name cdrci - git config --global user.email opensource@coder.com - - # NOTE@jsjoeio - we do this so we can strip out the v - # i.e. v4.9.1 -> 4.9.1 - - name: Get and set VERSION - run: | - TAG="${{ github.event.inputs.version || github.ref_name }}" - echo "VERSION=${TAG#v}" >> $GITHUB_ENV - - - name: Bump code-server homebrew version - env: - VERSION: ${{ env.VERSION }} - HOMEBREW_GITHUB_API_TOKEN: ${{secrets.HOMEBREW_GITHUB_API_TOKEN}} - - run: ./ci/steps/brew-bump.sh + - run: tar -xzf release-npm-package/package.tar.gz + - run: | + echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc + pushd release + npm publish --tag latest --access public aur: - needs: npm runs-on: ubuntu-latest timeout-minutes: 10 env: GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }} + TAG: ${{ inputs.version || github.ref_name }} steps: - # We need to checkout code-server so we can get the version - - name: Checkout code-server - uses: actions/checkout@v4 - with: - fetch-depth: 0 - path: "./code-server" + - name: Set version to tag without leading v + run: | + echo "VERSION=${TAG#v}" >> $GITHUB_ENV - name: Checkout code-server-aur repo - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: repository: "cdrci/code-server-aur" token: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }} ref: "master" - - name: Merge in master - run: | - git remote add upstream https://github.com/coder/code-server-aur.git - git fetch upstream - git merge upstream/master - - name: Configure git run: | git config --global user.name cdrci git config --global user.email opensource@coder.com - # NOTE@jsjoeio - we do this so we can strip out the v - # i.e. v4.9.1 -> 4.9.1 - - name: Get and set VERSION + - name: Fetch and reset master run: | - TAG="${{ github.event.inputs.version || github.ref_name }}" - echo "VERSION=${TAG#v}" >> $GITHUB_ENV + git remote add upstream https://github.com/coder/code-server-aur.git + git fetch upstream + git reset --hard upstream/master + git push --force - name: Validate package - uses: heyhusen/archlinux-package-action@v2.2.1 - env: - VERSION: ${{ env.VERSION }} + uses: heyhusen/archlinux-package-action@3f7aaada28c782497bfe02d6d6ea365b25fdea12 # v3.0.1 with: pkgver: ${{ env.VERSION }} updpkgsums: true srcinfo: true - name: Open PR - # We need to git push -u otherwise gh will prompt - # asking where to push the branch. - env: - VERSION: ${{ env.VERSION }} run: | git checkout -b update-version-${{ env.VERSION }} git add . - git commit -m "chore: updating version to ${{ env.VERSION }}" + git commit -m "Update to ${{ env.VERSION }}" git push -u origin $(git branch --show) - gh pr create --repo coder/code-server-aur --title "chore: bump version to ${{ env.VERSION }}" --body "PR opened by @$GITHUB_ACTOR" --assignee $GITHUB_ACTOR + gh pr create --repo coder/code-server-aur --title "Update to ${{ env.VERSION }}" --body "PR opened by @$GITHUB_ACTOR" --assignee $GITHUB_ACTOR + docker: - runs-on: ubuntu-20.04 - steps: - - name: Checkout code-server - uses: actions/checkout@v4 + runs-on: ubuntu-latest + env: + GITHUB_TOKEN: ${{ github.token }} + TAG: ${{ inputs.version || github.ref_name }} - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + steps: + - name: Set version to tag without leading v + run: | + echo "VERSION=${TAG#v}" >> $GITHUB_ENV - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 + - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - - name: Login to Docker Hub - uses: docker/login-action@v3 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - - - name: Login to GHCR - uses: docker/login-action@v3 + - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - # NOTE@jsjoeio - we do this so we can strip out the v - # i.e. v4.9.1 -> 4.9.1 - - name: Get and set VERSION - run: | - TAG="${{ github.event.inputs.version || github.ref_name }}" - echo "VERSION=${TAG#v}" >> $GITHUB_ENV - - - name: Download deb artifacts - uses: robinraju/release-downloader@v1.10 + - uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13 with: repository: "coder/code-server" tag: v${{ env.VERSION }} fileName: "*.deb" out-file-path: "release-packages" - - - name: Download rpm artifacts - uses: robinraju/release-downloader@v1.10 + - uses: robinraju/release-downloader@28fc21f50d76778e7023361aa1f863e717d3d56f # v1.13 with: repository: "coder/code-server" tag: v${{ env.VERSION }} fileName: "*.rpm" out-file-path: "release-packages" - - name: Publish to Docker - run: ./ci/steps/docker-buildx-push.sh - env: - VERSION: ${{ env.VERSION }} - GITHUB_TOKEN: ${{ github.token }} + - run: npm run publish:docker + + repo: + runs-on: ubuntu-latest + env: + GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }} + TAG: ${{ inputs.version || github.ref_name }} + needs: docker + + steps: + - name: Set version to tag without leading v + run: | + echo "VERSION=${TAG#v}" >> $GITHUB_ENV + + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + + - run: ./ci/build/update-repo.sh + + - name: Open PR + run: | + git config --global user.name cdrci + git config --global user.email opensource@coder.com + git checkout -b "helm/$VERSION" + git add . + git commit -m "Update Helm chart and changelog with $VERSION" + git push -u origin "$(git branch --show)" + gh pr create \ + --repo coder/code-server \ + --body-file .cache/checklist \ + --title "Update Helm chart and changelog with $VERSION" diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 90f08eae4cab..7d24603a9ae6 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -4,9 +4,13 @@ on: workflow_dispatch: inputs: version: - description: The version to publish (include "v", i.e. "v4.9.1"). type: string required: true + pull_request_target: + types: + - closed + branches: + - main permissions: contents: write # For creating releases. @@ -19,307 +23,334 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: - # TODO: cache building yarn --production - # possibly 2m30s of savings(?) - # this requires refactoring our release scripts - package-linux-amd64: - name: x86-64 Linux build - runs-on: ubuntu-latest - timeout-minutes: 15 - needs: npm-version - container: "centos:8" + package-linux: + name: ${{ format('linux-{0}', matrix.vscode_arch) }} + runs-on: ubuntu-22.04 + if: >- + (github.event_name == 'workflow_dispatch') || + (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true && startsWith(github.head_ref, 'update/')) + + strategy: + matrix: + include: + - npm_arch: x64 + vscode_arch: x64 + package_arch: amd64 + - npm_arch: arm64 + vscode_arch: arm64 + package_arch: arm64 + env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + ELECTRON_SKIP_BINARY_DOWNLOAD: 1 + PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1 + TAG: ${{ inputs.version || github.event.pull_request.head.ref || github.ref_name }} + # Set release package name. + ARCH: ${{ matrix.package_arch }} + # Cross-compile target. + VSCODE_ARCH: ${{ matrix.vscode_arch }} + npm_config_arch: ${{ matrix.npm_arch }} + # Ensure native modules are built from source to avoid prebuilds and use + # the correct version of glibc. + npm_config_build_from_source: true + # Gulp target name. + # TODO: Pull from VSCODE_ARCH instead. + VSCODE_TARGET: ${{ format('linux-{0}', matrix.vscode_arch) }} steps: - - name: Checkout repo - uses: actions/checkout@v4 - - - name: Install Node.js - uses: actions/setup-node@v4 + - run: sudo apt update && sudo apt install -y libkrb5-dev + - uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest with: - node-version-file: .node-version - - - name: Install development tools - run: | - cd /etc/yum.repos.d/ - sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-* - sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-* - yum install -y gcc-c++ make jq rsync python3 libsecret-devel krb5-devel - - - name: Install nfpm and envsubst + packages: quilt + version: 1.0 + - name: Install nfpm run: | mkdir -p ~/.local/bin - curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.22.2/nfpm_2.22.2_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm - curl -sSfL https://github.com/a8m/envsubst/releases/download/v1.1.0/envsubst-`uname -s`-`uname -m` -o envsubst - chmod +x envsubst - mv envsubst ~/.local/bin + curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.3.1/nfpm_2.3.1_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm echo "$HOME/.local/bin" >> $GITHUB_PATH - - name: Install yarn - run: npm install -g yarn + - name: Strip update/ and v from tag and set major version + run: | + version=${TAG#update/} + version=${version#v} + version=4${version:1} + echo "VERSION=$version" >> $GITHUB_ENV - - name: Download npm package - uses: actions/download-artifact@v4 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: - name: npm-release-package - - - name: Decompress npm package - run: tar -xzf package.tar.gz - - - name: Build standalone release - run: npm run release:standalone - - - name: Install test dependencies - run: SKIP_SUBMODULE_DEPS=1 yarn --frozen-lockfile - - - name: Run integration tests on standalone release - run: yarn test:integration - - - name: Upload coverage report to Codecov - uses: codecov/codecov-action@v4 + submodules: true + # When an update/ branch is merged, a release is automatically created + # which requires secrets. + allow-unsafe-pr-checkout: true + - run: quilt push -a + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: - token: ${{ secrets.CODECOV_TOKEN }} - if: success() - continue-on-error: true + node-version-file: .node-version + cache: npm + cache-dependency-path: | + package-lock.json + test/package-lock.json - # NOTE@jsjoeio - we do this so we can strip out the v - # i.e. v4.9.1 -> 4.9.1 - - name: Get and set VERSION + - name: Build run: | - TAG="${{ inputs.version || github.ref_name }}" - echo "VERSION=${TAG#v}" >> $GITHUB_ENV - - - name: Build packages with nfpm - env: - VERSION: ${{ env.VERSION }} - run: yarn package - - - uses: softprops/action-gh-release@v2 + cd lib/vscode/build + npm ci + cd .. + source ./build/azure-pipelines/linux/setup-env.sh + # Run preinstall script before root dependencies are installed + # so that v8 headers are patched correctly for native modules. + node build/npm/preinstall.ts + cd ../.. + npm ci + npm run build + npm run build:vscode + + # Platform-agnostic NPM package. + - run: npm run release + if: ${{ matrix.vscode_arch == 'x64' }} + - run: tar -czf package.tar.gz release + if: ${{ matrix.vscode_arch == 'x64' }} + - run: | + sed "/^## Unreleased/,/^## / ! d" CHANGELOG.md | head -n -2 | tail -n +3 > .cache/release-notes + if: ${{ matrix.vscode_arch == 'x64' }} + - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 + if: ${{ matrix.vscode_arch == 'x64' }} + with: + draft: true + discussion_category_name: "📣 Announcements" + files: package.tar.gz + tag_name: v${{ env.VERSION }} + name: v${{ env.VERSION }} + body_path: .cache/release-notes + + # Platform-specific release. + - run: KEEP_MODULES=1 npm run release + - run: npm run package + - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: draft: true discussion_category_name: "📣 Announcements" files: ./release-packages/* - - package-linux-cross: - name: Linux cross-compile builds - runs-on: ubuntu-latest - timeout-minutes: 15 - needs: npm-version - container: "debian:buster" + tag_name: v${{ env.VERSION }} + name: v${{ env.VERSION }} + + package-macos: + name: ${{ matrix.vscode_target }} + runs-on: ${{ matrix.os }} + if: >- + (github.event_name == 'workflow_dispatch') || + (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true && startsWith(github.head_ref, 'update/')) strategy: matrix: include: - - prefix: aarch64-linux-gnu - npm_arch: arm64 - apt_arch: arm64 - - prefix: arm-linux-gnueabihf - npm_arch: armv7l - apt_arch: armhf - + - os: macos-15-intel + vscode_target: darwin-x64 + - os: macos-latest + vscode_target: darwin-arm64 env: - AR: ${{ format('{0}-ar', matrix.prefix) }} - AS: ${{ format('{0}-as', matrix.prefix) }} - CC: ${{ format('{0}-gcc', matrix.prefix) }} - CPP: ${{ format('{0}-cpp', matrix.prefix) }} - CXX: ${{ format('{0}-g++', matrix.prefix) }} - FC: ${{ format('{0}-gfortran', matrix.prefix) }} - LD: ${{ format('{0}-ld', matrix.prefix) }} - STRIP: ${{ format('{0}-strip', matrix.prefix) }} - PKG_CONFIG_PATH: ${{ format('/usr/lib/{0}/pkgconfig', matrix.prefix) }} - TARGET_ARCH: ${{ matrix.apt_arch }} - npm_config_arch: ${{ matrix.npm_arch }} - # Not building from source results in an x86_64 argon2, as if - # npm_config_arch is being ignored. + VSCODE_TARGET: ${{ matrix.vscode_target }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ inputs.version || github.event.pull_request.head.ref || github.ref_name }} + # Ensure native modules are built from source to avoid prebuilds. npm_config_build_from_source: true steps: - - name: Checkout repo - uses: actions/checkout@v4 - - - name: Install Node.js - uses: actions/setup-node@v4 - with: - node-version-file: .node-version - - - name: Install cross-compiler and system dependencies - run: | - dpkg --add-architecture $TARGET_ARCH - apt-get update && apt-get install -y --no-install-recommends \ - crossbuild-essential-$TARGET_ARCH \ - libx11-dev:$TARGET_ARCH \ - libx11-xcb-dev:$TARGET_ARCH \ - libxkbfile-dev:$TARGET_ARCH \ - libsecret-1-dev:$TARGET_ARCH \ - libkrb5-dev:$TARGET_ARCH \ - ca-certificates \ - curl wget rsync gettext-base - + # The version of node-gyp we use depends on distutils but it was removed + # in Python 3.12. It seems to be fixed in the latest node-gyp so when we + # next update Node we can probably remove this. For now, install + # setuptools since it contains distutils. + - run: brew install python-setuptools quilt - name: Install nfpm run: | mkdir -p ~/.local/bin curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.3.1/nfpm_2.3.1_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm echo "$HOME/.local/bin" >> $GITHUB_PATH - - name: Download npm package - uses: actions/download-artifact@v4 - with: - name: npm-release-package - - - name: Decompress npm package - run: tar -xzf package.tar.gz - - - name: Build standalone release - run: npm run release:standalone - - - name: Replace node with cross-compile equivalent - run: | - node_version=$(node --version) - wget https://nodejs.org/dist/${node_version}/node-${node_version}-linux-${npm_config_arch}.tar.xz - tar -xf node-${node_version}-linux-${npm_config_arch}.tar.xz node-${node_version}-linux-${npm_config_arch}/bin/node --strip-components=2 - mv ./node ./release-standalone/lib/node - - # NOTE@jsjoeio - we do this so we can strip out the v - # i.e. v4.9.1 -> 4.9.1 - - name: Get and set VERSION + - name: Strip update/ and v from tag and set major version run: | - TAG="${{ inputs.version || github.ref_name }}" - echo "VERSION=${TAG#v}" >> $GITHUB_ENV + version=${TAG#update/} + version=${version#v} + version=4${version:1} + echo "VERSION=$version" >> $GITHUB_ENV - - name: Build packages with nfpm - env: - VERSION: ${{ env.VERSION }} - run: npm run package ${npm_config_arch} - - - uses: softprops/action-gh-release@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: - draft: true - discussion_category_name: "📣 Announcements" - files: ./release-packages/* - - package-macos-amd64: - name: x86-64 macOS build - runs-on: macos-latest - timeout-minutes: 15 - needs: npm-version - steps: - - name: Checkout repo - uses: actions/checkout@v4 - - - name: Install Node.js - uses: actions/setup-node@v4 + submodules: true + # When an update/ branch is merged, a release is automatically created + # which requires secrets. + allow-unsafe-pr-checkout: true + - run: quilt push -a + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: node-version-file: .node-version - - - name: Install nfpm - run: | - mkdir -p ~/.local/bin - curl -sSfL https://github.com/goreleaser/nfpm/releases/download/v2.3.1/nfpm_2.3.1_`uname -s`_`uname -m`.tar.gz | tar -C ~/.local/bin -zxv nfpm - echo "$HOME/.local/bin" >> $GITHUB_PATH - - # The version of node-gyp we use depends on distutils but it was removed - # in Python 3.12. It seems to be fixed in the latest node-gyp so when we - # next update Node we can probably remove this. For now, install - # setuptools since it contains distutils. - - name: Install Python utilities - run: brew install python-setuptools - - - name: Download npm package - uses: actions/download-artifact@v4 + cache: npm + cache-dependency-path: | + package-lock.json + test/package-lock.json + + - run: npm ci + - run: npm run build + - run: npm run build:vscode + - run: KEEP_MODULES=1 npm run release + - run: npm run test:native + + - run: npm run package + - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: - name: npm-release-package + draft: true + discussion_category_name: "📣 Announcements" + files: ./release-packages/* + tag_name: v${{ env.VERSION }} + name: v${{ env.VERSION }} - - name: Decompress npm package - run: tar -xzf package.tar.gz + package-windows: + name: win32-x64 + runs-on: windows-2022 + if: >- + (github.event_name == 'workflow_dispatch') || + (github.event_name == 'pull_request_target' && github.event.pull_request.merged == true && startsWith(github.head_ref, 'update/')) - - name: Build standalone release - run: npm run release:standalone + defaults: + run: + shell: bash - - name: Install test dependencies - run: SKIP_SUBMODULE_DEPS=1 yarn install + env: + VSCODE_TARGET: win32-x64 + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ inputs.version || github.event.pull_request.head.ref || github.ref_name }} + # Ensure native modules are built from source to avoid prebuilds. + npm_config_build_from_source: true + OS: windows - - name: Run native module tests on standalone release - run: yarn test:native + steps: + # Git rewrites line endings on windows by default, which turns every + # shell script the build is made of into one bash cannot read, and + # every name in patches/series into one with a stray return. + - name: Keep line endings as they are in the repository + run: git config --global core.autocrlf false - # NOTE@jsjoeio - we do this so we can strip out the v - # i.e. v4.9.1 -> 4.9.1 - - name: Get and set VERSION + - name: Strip update/ and v from tag and set major version run: | - TAG="${{ inputs.version || github.ref_name }}" - echo "VERSION=${TAG#v}" >> $GITHUB_ENV + version=${TAG#update/} + version=${version#v} + version=4${version:1} + echo "VERSION=$version" >> $GITHUB_ENV - - name: Build packages with nfpm - env: - VERSION: ${{ env.VERSION }} - run: yarn package - - - uses: softprops/action-gh-release@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: - draft: true - discussion_category_name: "📣 Announcements" - files: ./release-packages/* - - npm-package: - name: Upload npm package - runs-on: ubuntu-latest - timeout-minutes: 15 - needs: npm-version - steps: - - name: Download npm package - uses: actions/download-artifact@v4 - with: - name: npm-release-package - - - uses: softprops/action-gh-release@v2 - with: - draft: true - discussion_category_name: "📣 Announcements" - files: ./package.tar.gz + submodules: true + # When an update/ branch is merged, a release is automatically created + # which requires secrets. + allow-unsafe-pr-checkout: true + + # quilt has no windows build. The patches are ordinary -p1 diffs + # against the repository root, so git applies them in series order. + - name: Apply patches + run: | + while read -r patch; do + case "$patch" in '' | '#'*) continue ;; esac + echo "applying $patch" + git apply --whitespace=nowarn "patches/$patch" + done < patches/series - npm-version: - name: Modify package.json version - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Download artifacts - uses: dawidd6/action-download-artifact@v3 - id: download + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: - branch: ${{ github.ref }} - workflow: build.yaml - workflow_conclusion: completed - name: npm-package - check_artifacts: false - if_no_artifact_found: fail - - - name: Decompress npm package - run: tar -xzf package.tar.gz - - # NOTE@jsjoeio - we do this so we can strip out the v - # i.e. v4.9.1 -> 4.9.1 - - name: Get and set VERSION + node-version-file: .node-version + cache: npm + cache-dependency-path: | + package-lock.json + test/package-lock.json + + # npm hands every script it runs to cmd, which cannot run the shell + # scripts this repository is built out of. Point it at the same bash + # the steps here use rather than at a path, which moves between + # images. + - name: Let npm run shell scripts + run: echo "npm_config_script_shell=$(cygpath -w "$(command -v bash)")" >> $GITHUB_ENV + + # The build merges json by handing jq a process substitution, which + # bash presents as a file under /dev/fd. The jq on this image is a + # windows program and cannot open those, so it reads the second input + # as nothing and the merge fails. Both the product and the package + # merge go through here. + - name: Let jq read what bash hands it run: | - TAG="${{ inputs.version || github.ref_name }}" - echo "VERSION=${TAG#v}" >> $GITHUB_ENV - - - name: Modify version - env: - VERSION: ${{ env.VERSION }} + mkdir -p "$RUNNER_TEMP/shim" + cat > "$RUNNER_TEMP/shim/jq" <<'SHIM' + #!/usr/bin/env bash + set -euo pipefail + args=() + for arg in "$@"; do + case $arg in + /dev/fd/* | /proc/*/fd/*) + copy=$(mktemp) + cat "$arg" > "$copy" + args+=("$copy") + ;; + *) args+=("$arg") ;; + esac + done + exec jq.exe "${args[@]}" + SHIM + chmod +x "$RUNNER_TEMP/shim/jq" + echo "$RUNNER_TEMP/shim" >> $GITHUB_PATH + + # Stamping version details into the native binaries clears any + # signature they arrived with and asks signtool whether there is one. + # That only reads and removes, so it wants no certificate and signs + # nothing. It just has to be findable, and the sdk carrying it is not + # on the path. + - name: Put signtool on the path run: | - echo "Updating version in root package.json" - npm version --prefix release "$VERSION" - - echo "Updating version in lib/vscode/product.json" - tmp=$(mktemp) - jq ".codeServerVersion = \"$VERSION\"" release/lib/vscode/product.json > "$tmp" && mv "$tmp" release/lib/vscode/product.json - # Ensure it has the same permissions as before - chmod 644 release/lib/vscode/product.json - - - name: Compress release package - run: tar -czf package.tar.gz release + sdk=$(ls -d "/c/Program Files (x86)/Windows Kits/10/bin"/*/x64 | sort -V | tail -1) + test -x "$sdk/signtool.exe" + cygpath -w "$sdk" >> $GITHUB_PATH + + # build-release.sh copies the tree with rsync, which neither windows + # nor the git bash on this image has. MSYS2 is already here, just not + # on the path. + - name: Install rsync + shell: cmd + run: C:\msys64\usr\bin\pacman -Sy --noconfirm --needed rsync + + # Only rsync crosses over. Putting msys2's /usr/bin in front instead + # breaks the release step: npm on the path is a shell script whose + # shebang reads /usr/bin/env bash, so with msys2 first it is msys2's + # bash that runs it, and crossing into a second msys runtime does not + # carry the environment. npm then sees no script-shell and falls back + # to cmd, which cannot run ./ci/build/build-release.sh, and + # KEEP_MODULES is dropped on the way. A forwarder avoids the whole + # class: rsync is a native exe that loads its runtime from beside + # itself, and nothing else on the path moves. + - name: Reach rsync without moving the path + run: | + cat > "$RUNNER_TEMP/shim/rsync" <<'SHIM' + #!/usr/bin/env bash + exec /c/msys64/usr/bin/rsync.exe "$@" + SHIM + chmod +x "$RUNNER_TEMP/shim/rsync" + + - run: npm ci + - run: npm run build + - run: npm run build:vscode + - run: KEEP_MODULES=1 npm run release + + # Of the two tars on this image it is git bash's GNU one that can + # rename the tree's top directory as it archives; the windows bsdtar + # is built without substitution support. Asserted rather than + # assumed, since the two are interchangeable everywhere except here. + - name: Package + run: | + case "$(tar --version | head -1)" in + *GNU*) ;; + *) echo "expected GNU tar for --transform, got $(tar --version | head -1)" >&2; exit 1 ;; + esac + npm run package - - name: Upload npm package artifact - uses: actions/upload-artifact@v4 + - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 with: - name: npm-release-package - path: ./package.tar.gz + draft: true + discussion_category_name: "📣 Announcements" + files: ./release-packages/* + tag_name: v${{ env.VERSION }} + name: v${{ env.VERSION }} diff --git a/.github/workflows/scripts.yaml b/.github/workflows/scripts.yaml index d3ca65cbc548..180975866b12 100644 --- a/.github/workflows/scripts.yaml +++ b/.github/workflows/scripts.yaml @@ -41,7 +41,7 @@ jobs: container: "alpine:3.17" steps: - name: Checkout repo - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Install test utilities run: apk add bats checkbashisms @@ -58,7 +58,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout repo - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Install lint utilities run: sudo apt install shellcheck diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index f381cf3330b2..362b68a9dccb 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -19,27 +19,23 @@ concurrency: cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: - audit-ci: + audit: name: Audit node modules runs-on: ubuntu-latest timeout-minutes: 15 steps: - name: Checkout repo - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: fetch-depth: 0 - name: Install Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 with: node-version-file: .node-version - - name: Audit yarn for vulnerabilities - run: yarn audit - if: success() - - name: Audit npm for vulnerabilities - run: npm shrinkwrap && npm audit + run: npm audit if: success() trivy-scan-repo: @@ -47,15 +43,15 @@ jobs: permissions: contents: read # for actions/checkout to fetch code security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 steps: - name: Checkout repo - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 with: fetch-depth: 0 - name: Run Trivy vulnerability scanner in repo mode - uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 + uses: aquasecurity/trivy-action@d2a0b60797ff03db6132bd4e2b293f9b37081297 # latest with: scan-type: "fs" scan-ref: "." @@ -66,7 +62,7 @@ jobs: severity: "HIGH,CRITICAL" - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 with: sarif_file: "trivy-repo-results.sarif" @@ -76,21 +72,21 @@ jobs: contents: read # for actions/checkout to fetch code security-events: write # for github/codeql-action/autobuild to send a status report name: Analyze with CodeQL - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: config-file: ./.github/codeql-config.yml languages: javascript - name: Autobuild - uses: github/codeql-action/autobuild@v3 + uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 diff --git a/.github/workflows/trivy-docker.yaml b/.github/workflows/trivy-docker.yaml index 9b26df3f13bd..7ad57f8dc34f 100644 --- a/.github/workflows/trivy-docker.yaml +++ b/.github/workflows/trivy-docker.yaml @@ -18,8 +18,6 @@ on: - .github/workflows/trivy-docker.yaml schedule: - # Run at 10:15 am UTC (3:15am PT/5:15am CT) - # Run at 0 minutes 0 hours of every day. - cron: "15 10 * * *" workflow_dispatch: @@ -44,14 +42,14 @@ concurrency: jobs: trivy-scan-image: - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 - name: Run Trivy vulnerability scanner in image mode - uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 + uses: aquasecurity/trivy-action@d2a0b60797ff03db6132bd4e2b293f9b37081297 # latest with: image-ref: "docker.io/codercom/code-server:latest" ignore-unfixed: true @@ -60,6 +58,6 @@ jobs: severity: "HIGH,CRITICAL" - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 with: sarif_file: "trivy-image-results.sarif" diff --git a/.github/workflows/update.yaml b/.github/workflows/update.yaml new file mode 100644 index 000000000000..b54826c79f70 --- /dev/null +++ b/.github/workflows/update.yaml @@ -0,0 +1,72 @@ +name: Update code-server + +on: + workflow_dispatch: + inputs: + version: + type: string + required: true + schedule: + - cron: "0 16,21 * * *" + +jobs: + update: + runs-on: ubuntu-latest + env: + TAG: ${{ inputs.version }} + GH_TOKEN: ${{ secrets.HOMEBREW_GITHUB_API_TOKEN }} + + steps: + - name: Fetch latest tag + if: env.TAG == '' + run: | + tag=$(curl -fsSLI -o /dev/null -w "%{url_effective}" https://github.com/microsoft/vscode/releases/latest) + tag="${tag#https://github.com/microsoft/vscode/releases/tag/}" + echo "TAG=$tag" >> $GITHUB_ENV + + - name: Remove leading v from tag + run: | + echo "VERSION=${TAG#v}" >> $GITHUB_ENV + + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + with: + submodules: true + + - name: Check current version + id: check + run: | + commit="$(git -C lib/vscode rev-parse HEAD)" + if [[ $(git -C lib/vscode ls-remote --tags | grep "$commit") == */"$VERSION" ]] ; then + echo "$VERSION update has already been merged into $(git rev-parse --abbrev-ref HEAD)" + echo done=true >> $GITHUB_OUTPUT + elif git ls-remote --exit-code --heads origin "update/$VERSION" ; then + echo "There is already a PR for updating to $VERSION" + echo done=true >> $GITHUB_OUTPUT + else + echo "$VERSION update has not started yet" + echo done=false >> $GITHUB_OUTPUT + fi + + - uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest + if: steps.check.outputs.done == 'false' + with: + packages: quilt + version: 1.0 + + - run: ./ci/build/update-vscode.sh + if: steps.check.outputs.done == 'false' + + - name: Open PR + if: steps.check.outputs.done == 'false' + run: | + git config --global user.name cdrci + git config --global user.email opensource@coder.com + git checkout -b "update/$VERSION" + git add . + git commit -m "Update Code to $VERSION" + git push -u origin "$(git branch --show)" + gh pr create \ + --repo coder/code-server \ + --title "Update Code to $VERSION" \ + --body-file .cache/checklist \ + --draft diff --git a/.gitignore b/.gitignore index d453ee2e969f..7fea491b82ac 100644 --- a/.gitignore +++ b/.gitignore @@ -2,8 +2,6 @@ .cache /out*/ release/ -release-npm-package/ -release-standalone/ release-packages/ release-gcp/ release-images/ @@ -13,6 +11,7 @@ node_modules .home coverage **/.DS_Store +*.bak # Code packages itself here. /lib/vscode-reh-web-* diff --git a/.node-version b/.node-version index 87ec8842b158..ce62013c39ae 100644 --- a/.node-version +++ b/.node-version @@ -1 +1 @@ -18.18.2 +24.22.1 diff --git a/.prettierignore b/.prettierignore index b9056e145fb7..40cfb028f4d0 100644 --- a/.prettierignore +++ b/.prettierignore @@ -1,9 +1,8 @@ -lib/vscode -lib/vscode-reh-web-linux-x64 -release-standalone +lib release-packages release helm-chart test/scripts test/e2e/extensions/test-extension .pc +package-lock.json diff --git a/.tours/start-development.tour b/.tours/start-development.tour index 8ce815c5a4a1..999adba06125 100644 --- a/.tours/start-development.tour +++ b/.tours/start-development.tour @@ -5,7 +5,7 @@ { "file": "package.json", "line": 31, - "description": "## Commands\n\nTo start developing, make sure you have Node 16+ and the [required dependencies](https://github.com/Microsoft/vscode/wiki/How-to-Contribute#prerequisites) installed. Then, run the following commands:\n\n1. Install dependencies:\n>> yarn\n\n3. Start development mode (and watch for changes):\n>> yarn watch" + "description": "## Commands\n\nTo start developing, make sure you have Node 16+ and the [required dependencies](https://github.com/Microsoft/vscode/wiki/How-to-Contribute#prerequisites) installed. Then, run the following commands:\n\n1. Install dependencies:\n>> npm\n\n3. Start development mode (and watch for changes):\n>> npm run watch" }, { "file": "src/node/app.ts", @@ -20,7 +20,7 @@ { "file": "src/node/app.ts", "line": 62, - "description": "## That's it!\n\n\nThat's all there is to it! When this tour ends, your terminal session may stop, but just use `yarn watch` to start developing from here on out!\n\n\nIf you haven't already, be sure to check out these resources:\n- [Tour: Contributing](command:codetour.startTourByTitle?[\"Contributing\"])\n- [Docs: FAQ.md](https://github.com/coder/code-server/blob/main/docs/FAQ.md)\n- [Docs: CONTRIBUTING.md](https://github.com/coder/code-server/blob/main/docs/CONTRIBUTING.md)\n- [Community: GitHub Discussions](https://github.com/coder/code-server/discussions)\n- [Community: Slack](https://community.coder.com)" + "description": "## That's it!\n\n\nThat's all there is to it! When this tour ends, your terminal session may stop, but just use `npm run watch` to start developing from here on out!\n\n\nIf you haven't already, be sure to check out these resources:\n- [Tour: Contributing](command:codetour.startTourByTitle?[\"Contributing\"])\n- [Docs: FAQ.md](https://github.com/coder/code-server/blob/main/docs/FAQ.md)\n- [Docs: CONTRIBUTING.md](https://github.com/coder/code-server/blob/main/docs/CONTRIBUTING.md)\n- [Community: GitHub Discussions](https://github.com/coder/code-server/discussions)\n- [Community: Slack](https://community.coder.com)" } ] -} \ No newline at end of file +} diff --git a/CHANGELOG.md b/CHANGELOG.md index 5a0e9cfb932e..056a1c5051a1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,11 +22,893 @@ Code v99.99.999 ## Unreleased +## [4.144.0](https://github.com/coder/code-server/releases/tag/v4.144.0) - 2026-10-29 + +Code v1.144.0 + +### Changed + +- Update to Code 1.144.0 + +### Fixed + +- `--socket-fd` now works: the inherited socket is passed on to the process + that listens, and the address is logged as `fd:`. Previously code-server + failed with `listen EEXIST` or `Server has no address`. +- The cookie domain was not being set against the shared root host of proxy + domains when proxy domains contained template variables like `{{port}}`, + resulting in having to sign in multiple times per domain instead of only once + as originally intended. +- When doing the web socket origin check, if the host does not already contain a + port, fall back to `X-Forwarded-Port`. +- Fix default ports not matching in the web socket origin check (for example + `https://coder.com` will now match `https://coder.com:443`). + +## [4.143.1](https://github.com/coder/code-server/releases/tag/v4.143.1) - 2026-10-23 + +Code v1.143.1 + +### Changed + +- Update to Code 1.143.1 + +## [4.141.1](https://github.com/coder/code-server/releases/tag/v4.141.1) - 2026-10-23 + +### Security + +- Update bundled Node.js to 24.22.1 to fix a remote code execution bug in the + Brotli decoder (CVE-2026-111497). +- Reject compressed request bodies (`Content-Encoding: br`, `gzip`, or + `deflate`) instead of decompressing them. + +### Fixed + +- Boolean flags in the `--flag=false` form and in the config file now respect + being set to false. + +### Added + +- Turkish locale. + +### Changed + +- Expand values from path options in the config file that start with a tilde. + +## [4.141.0](https://github.com/coder/code-server/releases/tag/v4.141.0) - 2026-10-08 + +Code v1.141.0 + +### Added + +- A new `--enable-remote-storage` flag can be used to make code-server persist + workbench storage on the remote server instead of browser storage. Use this if + you want to share storage between multiple devices. + +### Fixed + +- The Typescript extension was trying to load as a browser extension even though + we build the remote server version, causing it to fail to activate. + +### Changed + +- Update to Code 1.141.0 + +## [4.140.0](https://github.com/coder/code-server/releases/tag/v4.140.0) - 2026-10-02 + +Code v1.140.0 + +### Changed + +- Update to Code 1.140.0 + +## [4.139.1](https://github.com/coder/code-server/releases/tag/v4.139.1) - 2026-09-26 + +Code v1.139.1 + +### Changed + +- Update to Code 1.139.1 + +### Fixed + +- `--idle-timeout-seconds` was only validated when passed as + `--idle-timeout-seconds=`; values of 60 or less passed as + `--idle-timeout-seconds ` were silently accepted. + +## [4.138.0](https://github.com/coder/code-server/releases/tag/v4.138.0) - 2026-09-19 + +Code v1.138.0 + +### Changed + +- Update to Code 1.138.0 + +### Fixed + +- Preserve the original path, query parameters, and fragment when rewriting + localhost URLs through the port proxy. If `VSCODE_PROXY_URI` has any query + parameters or fragments, those will be lost. + +## [4.137.0](https://github.com/coder/code-server/releases/tag/v4.137.0) - 2026-09-11 + +Code v1.137.0 + +### Changed + +- Update to Code 1.137.0 + +## [4.136.2](https://github.com/coder/code-server/releases/tag/v4.136.2) - 2026-09-08 + +Code v1.136.1 + +### Changed + +- Update to Code 1.136.1 + +### Fixed + +- 4.136.2 replaces a removed 4.136.1 release that had the data path incorrectly + being set to `~/.vscode-server-oss/data`. + +## [4.135.0](https://github.com/coder/code-server/releases/tag/v4.135.0) - 2026-08-27 + +Code v1.135.0 + +### Changed + +- Update to Code 1.135.0 + +## [4.134.0](https://github.com/coder/code-server/releases/tag/v4.134.0) - 2026-08-24 + +Code v1.134.0 + +### Added + +- New `--socket-fd` flag that can be used to listen on a file descriptor. In + particular, this allows using code-server with systemd's socket activation. +- New `--vscode-option` repeatable flag that can be used to pass through options + to VS Code. It requires `flag=value` or simply `flag` for booleans. For + example: `--vscode-option enable-sandbox --vscode-option agents=true`. The + `VSCODE_OPTIONS` environment variable may also be used. For example: + `VSCODE_OPTIONS="enable-sandbox agents=true"`. Note that code-server simply + splits this variable on spaces and is not aware of quoting. + +### Changed + +- Update to Code 1.134.0 +- Remove `--unsafe-perm` from installation scripts. This flag results in an + error when used with npm since v12 and has been a no-op since v7. If you are + installing with a version of npm older than v7 as root, installation may not + work correctly. + +## [4.133.0](https://github.com/coder/code-server/releases/tag/v4.133.0) - 2026-08-17 + +Code v1.133.0 + +### Changed + +- Update to Code 1.133.0 + +## [4.132.0](https://github.com/coder/code-server/releases/tag/v4.132.0) - 2026-08-10 + +Code v1.132.0 + +### Changed + +- Update to Code 1.132.0 + +### Fixed + +- When proxying, cookies were being decoded and re-encoded, which could cause + issues for applications that encode differently. Cookies are now passed + through unchanged (aside from stripping out code-server's session token). + +## [4.131.0](https://github.com/coder/code-server/releases/tag/v4.131.0) - 2026-07-30 + +Code v1.131.0 + +### Changed + +- Update to Code 1.131.0 + +## [4.130.0](https://github.com/coder/code-server/releases/tag/v4.130.0) - 2026-07-24 + +Code v1.130.0 + +### Changed + +- Update to Code 1.130.0 + +## [4.129.0](https://github.com/coder/code-server/releases/tag/v4.129.0) - 2026-07-17 + +Code v1.129.0 + +### Changed + +- Update to Code 1.129.0 + +## [4.128.0](https://github.com/coder/code-server/releases/tag/v4.128.0) - 2026-07-11 + +Code v1.128.0 + +### Changed + +- Update to Code 1.128.0 + +## [4.127.0](https://github.com/coder/code-server/releases/tag/v4.127.0) - 2026-07-02 + +Code v1.127.0 + +### Changed + +- Update to Code 1.127.0 + +## [4.126.0](https://github.com/coder/code-server/releases/tag/v4.126.0) - 2026-06-24 + +Code v1.126.0 + +### Changed + +- Update to Code 1.126.0 + +## [4.125.0](https://github.com/coder/code-server/releases/tag/v4.125.0) - 2026-06-18 + +Code v1.125.0 + +### Changed + +- Update to Code 1.125.0 + +## [4.124.2](https://github.com/coder/code-server/releases/tag/v4.124.2) - 2026-06-16 + +Code v1.124.2 + +### Security + +- Strip code-server's session token from the cookie before proxying to a local + port. Previously, when you used built-in password authentication, the cookie + would be sent to the local proxied port, which meant if the service was + malicious and not already running as your code-server user it could use the + cookie to log into code-server and execute commands as your code-server user. + +### Changed + +- Update to Code 1.124.2 + +## [4.123.0](https://github.com/coder/code-server/releases/tag/v4.123.0) - 2026-06-03 + +Code v1.123.0 + +### Changed + +- Update to Code 1.123.0 +- Microsoft dropped support for armhf remotes so there will no longer be any + builds for armhf. + +## [4.122.1](https://github.com/coder/code-server/releases/tag/v4.122.1) - 2026-06-02 + +Code v1.122.1 + +### Changed + +- Update to Code 1.122.1 + +## [4.122.0](https://github.com/coder/code-server/releases/tag/v4.122.0) - 2026-05-29 + +Code v1.122.0 + +### Changed + +- Update to Code 1.122.0 + +### Fixed + +- `--app-name` will now affect window titles within the editor (it is now used + as the value for `${appName}` in the title template) as well as some other + places like the help > about dialog. + +### Added + +- App name can now be set with the `CODE_SERVER_APP_NAME` environment variable. + +## [4.121.0](https://github.com/coder/code-server/releases/tag/v4.121.0) - 2026-05-20 + +Code v1.121.0 + +### Changed + +- Update to Code 1.121.0 + +## [4.118.0](https://github.com/coder/code-server/releases/tag/v4.118.0) - 2026-05-06 + +Code v1.118.0 + +### Changed + +- Update to Code 1.118.0 + +## [4.117.0](https://github.com/coder/code-server/releases/tag/v4.117.0) - 2026-04-22 + +Code v1.117.0 + +### Changed + +- Update to Code 1.117.0 + +## [4.116.0](https://github.com/coder/code-server/releases/tag/v4.116.0) - 2026-04-16 + +Code v1.116.0 + +### Changed + +- Update to Code 1.116.0 + +## [4.115.0](https://github.com/coder/code-server/releases/tag/v4.115.0) - 2026-04-08 + +Code v1.115.0 + +### Changed + +- Update to Code 1.115.0 + +## [4.114.1](https://github.com/coder/code-server/releases/tag/v4.114.1) - 2026-04-06 + +Code v1.114.0 + +### Changed + +- Ensure native modules are built from source so they use the correct version of + glibc. This should bring down the requirement from 2.34 back down to 2.28. + +## [4.114.0](https://github.com/coder/code-server/releases/tag/v4.114.0) - 2026-04-04 + +Code v1.114.0 + +### Changed + +- Update to Code 1.114.0. + +## [4.113.1](https://github.com/coder/code-server/releases/tag/v4.113.1) - 2026-04-03 + +Code v1.113.0 + +This is a re-release of v4.113.0 but with the correct Node binaries for arm64 +and armv7l. Previously they were packaging the amd64 Node binary due to a +mistake while refactoring CI to use more of the upstream build scripts. + +## [4.113.0](https://github.com/coder/code-server/releases/tag/v4.113.0) - 2026-04-02 + +Code v1.113.0 + +### Changed + +- Update to Code 1.113.0 + +## [4.112.0](https://github.com/coder/code-server/releases/tag/v4.112.0) - 2026-03-19 + +Code v1.112.0 + +### Changed + +- Update to Code 1.112.0 + +## [4.111.0](https://github.com/coder/code-server/releases/tag/v4.111.0) - 2026-03-11 + +Code v1.111.0 + +### Changed + +- Update to Code 1.111.0 +- `--app-name` now affects the error page title. + +## [4.110.1](https://github.com/coder/code-server/releases/tag/v4.110.1) - 2026-03-10 + +Code v1.110.1 + +### Changed + +- Update to Code 1.110.1 + +## [4.110.0](https://github.com/coder/code-server/releases/tag/v4.110.0) - 2026-03-09 + +Code v1.110.0 + +### Changed + +- Update to Code 1.110.0 + +## [4.109.5](https://github.com/coder/code-server/releases/tag/v4.109.5) - 2026-03-02 + +Code v1.109.5 + +### Changed + +- Update to Code 1.109.5 + +## [4.109.2](https://github.com/coder/code-server/releases/tag/v4.109.2) - 2026-02-12 + +Code v1.109.2 + +### Changed + +- Update to Code 1.109.2 + +## [4.109.0](https://github.com/coder/code-server/releases/tag/v4.109.0) - 2026-02-12 + +Code v1.109.0 + +### Changed + +- Update to Code 1.109.0 + +## [4.108.2](https://github.com/coder/code-server/releases/tag/v4.108.2) - 2026-01-26 + +Code v1.108.2 + +### Changed + +- Update to Code 1.108.2 + +## [4.108.1](https://github.com/coder/code-server/releases/tag/v4.108.1) - 2026-01-16 + +Code v1.108.1 + +### Changed + +- Update to Code 1.108.1 + +## [4.108.0](https://github.com/coder/code-server/releases/tag/v4.108.0) - 2026-01-12 + +Code v1.108.0 + +### Changed + +- Update to Code 1.108.0 + +## [4.107.1](https://github.com/coder/code-server/releases/tag/v4.107.1) - 2026-01-09 + +Code v1.107.1 + +### Changed + +- Update to Code 1.107.1 + +## [4.107.0](https://github.com/coder/code-server/releases/tag/v4.107.0) - 2026-12-17 + +Code v1.107.0 + +### Changed + +- Update to Code 1.107.0 + +### Added + +- New `--cookie-suffix` flag that can be used to add a suffix to the cookie when + using the built-in password authentication. You can use this to avoid + collisions with other instances of code-server. +- Support a new property `authorizationHeaderToken` on the extension gallery + configuration. This will be added to marketplace requests as a bearer token + using the `Authorization` header. + +## [4.106.3](https://github.com/coder/code-server/releases/tag/v4.106.3) - 2025-12-01 + +Code v1.106.3 + +### Changed + +- Update to Code 1.106.3 + +## [4.106.2](https://github.com/coder/code-server/releases/tag/v4.106.2) - 2025-11-19 + +Code v1.106.2 + +### Changed + +- Update to Code 1.106.2 + +## [4.106.0](https://github.com/coder/code-server/releases/tag/v4.106.0) - 2025-11-19 + +Code v1.106.0 + +### Changed + +- Update to Code 1.106.0 + +## [4.105.1](https://github.com/coder/code-server/releases/tag/v4.105.1) - 2025-10-20 + +Code v1.105.1 + +### Changed + +- Update to Code 1.105.1 + +## [4.105.0](https://github.com/coder/code-server/releases/tag/v4.105.0) - 2025-10-17 + +Code v1.105.0 + +### Changed + +- Update to Code 1.105.0 + +## [4.104.3](https://github.com/coder/code-server/releases/tag/v4.104.3) - 2025-10-07 + +Code v1.104.3 + +### Changed + +- Update to Code 1.104.3. + +## [4.104.2](https://github.com/coder/code-server/releases/tag/v4.104.2) - 2025-09-26 + +Code v1.104.2 + +### Changed + +- Update to Code 1.104.2. + +## [4.104.1](https://github.com/coder/code-server/releases/tag/v4.104.1) - 2025-09-19 + +Code v1.104.1 + +### Changed + +- Update to Code 1.104.1. + +## [4.104.0](https://github.com/coder/code-server/releases/tag/v4.104.0) - 2025-09-15 + +Code v1.104.0 + +### Fixed + +- Fix "extension not found" errors from Open VSX when trying to install the + latest version of an extension. + +### Changed + +- Update to Code 1.104.0. + +## [4.103.2](https://github.com/coder/code-server/releases/tag/v4.103.2) - 2025-08-25 + +Code v1.103.2 + +### Changed + +- Update to Code 1.103.2. + +## [4.103.1](https://github.com/coder/code-server/releases/tag/v4.103.1) - 2025-08-15 + +Code v1.103.1 + +### Changed + +- Update to Code 1.103.1. + +## [4.103.0](https://github.com/coder/code-server/releases/tag/v4.103.0) - 2025-08-12 + +Code v1.103.0 + +### Changed + +- Update to Code 1.103.0. + +## [4.102.2](https://github.com/coder/code-server/releases/tag/v4.102.2) - 2025-07-24 + +Code v1.102.2 + +### Changed + +- Update to Code 1.102.2. + +## [4.102.1](https://github.com/coder/code-server/releases/tag/v4.102.1) - 2025-07-17 + +Code v1.102.1 + +### Changed + +- Update to Code 1.102.1. + +## [4.102.0](https://github.com/coder/code-server/releases/tag/v4.102.0) - 2025-07-16 + +Code v1.102.0 + +### Changed + +- Update to Code 1.102.0. + +### Added + +- Custom strings can be configured using the `--i18n` flag set to a JSON + file. This can be used for either translation (and can be used alongside + `--locale`) or for customizing the strings. See + [./src/node/i18n/locales/en.json](./src/node/i18n/locales/en.json) for the + available keys. + +## [4.101.2](https://github.com/coder/code-server/releases/tag/v4.101.2) - 2025-06-25 + +Code v1.101.2 + +### Changed + +- Update to Code 1.101.2. + +### Fixed + +- Fix web views not loading due to 401 when requesting the service worker. + +## [4.101.1](https://github.com/coder/code-server/releases/tag/v4.101.1) - 2025-06-20 + +Code v1.101.1 + +### Changed + +- Update to Code 1.101.1. + +## [4.101.0](https://github.com/coder/code-server/releases/tag/v4.101.0) - 2025-06-20 + +Code v1.101.0 + +### Changed + +- Update to Code 1.101.0. + +## [4.100.3](https://github.com/coder/code-server/releases/tag/v4.100.3) - 2025-06-03 + +Code v1.100.3 + +### Changed + +- Update to Code 1.100.3. + +## [4.100.2](https://github.com/coder/code-server/releases/tag/v4.100.2) - 2025-05-15 + +Code v1.100.2 + +### Changed + +- Update to Code 1.100.2. + +## [4.100.1](https://github.com/coder/code-server/releases/tag/v4.100.1) - 2025-05-13 + +Code v1.100.1 + +### Changed + +- Update to Code 1.100.1. + +## [4.100.0](https://github.com/coder/code-server/releases/tag/v4.100.0) - 2025-05-12 + +Code v1.100.0 + +### Added + +- Trusted domains for links can now be set at run-time by configuring + `linkProtectionTrustedDomains` in the `lib/vscode/product.json` file or via + the `--link-protection-trusted-domains` flag. + +### Changed + +- Update to Code 1.100.0. +- Disable extension signature verification, which previously was skipped by + default (the package used for verification is not available to OSS builds of + VS Code) but now reportedly throws hard errors making it impossible to install + extensions. + +### Fixed + +- Flags with repeatable options now work via the config file. + +## [4.99.4](https://github.com/coder/code-server/releases/tag/v4.99.4) - 2025-05-02 + +Code v1.99.3 + +### Security + +- Validate that ports in the path proxy are numbers, to prevent proxying to + arbitrary domains. + +## [4.99.3](https://github.com/coder/code-server/releases/tag/v4.99.3) - 2025-04-17 + +Code v1.99.3 + +### Added + +- Added `--skip-auth-preflight` flag to let preflight requests through the + proxy. + +### Changed + +- Update to Code 1.99.3. + +## [4.99.2](https://github.com/coder/code-server/releases/tag/v4.99.2) - 2025-04-10 + +Code v1.99.2 + +### Changed + +- Update to Code 1.99.2. + +## [4.99.1](https://github.com/coder/code-server/releases/tag/v4.99.1) - 2025-04-08 + +Code v1.99.1 + +### Changed + +- Update to Code 1.99.1. + +## [4.99.0](https://github.com/coder/code-server/releases/tag/v4.99.0) - 2025-04-07 + +Code v1.99.0 + +### Changed + +- Update to Code 1.99.0. + +## [4.98.0](https://github.com/coder/code-server/releases/tag/v4.98.0) - 2025-03-07 + +Code v1.98.0 + +### Changed + +- Update to Code 1.98.0. + +## [4.97.2](https://github.com/coder/code-server/releases/tag/v4.96.4) - 2025-02-18 + +Code v1.97.2 + +### Added + +- Added back macOS amd64 builds. + +### Changed + +- Update to Code 1.97.2. +- Softened dark mode login page colors. + +## [4.96.4](https://github.com/coder/code-server/releases/tag/v4.96.4) - 2025-01-20 + +Code v1.96.4 + +### Changed + +- Update to Code 1.96.4. + +## [4.96.2](https://github.com/coder/code-server/releases/tag/v4.96.2) - 2024-12-20 + +Code v1.96.2 + +### Changed + +- Update to Code 1.96.2. + +## [4.96.1](https://github.com/coder/code-server/releases/tag/v4.96.1) - 2024-12-18 + +Code v1.96.1 + +### Added + +- Dark color scheme for login and error pages. + +### Changed + +- Update to Code 1.96.1. + +## [4.95.3](https://github.com/coder/code-server/releases/tag/v4.95.3) - 2024-11-18 + +Code v1.95.3 + +### Changed + +- Update to Code 1.95.3. + +## [4.95.2](https://github.com/coder/code-server/releases/tag/v4.95.2) - 2024-11-12 + +Code v1.95.2 + +### Changed + +- Update to Code 1.95.2. + +## [4.95.1](https://github.com/coder/code-server/releases/tag/v4.95.1) - 2024-11-06 + +Code v1.95.1 + +### Changed + +- Update to Code 1.95.1. + +## [4.93.1](https://github.com/coder/code-server/releases/tag/v4.93.1) - 2024-09-23 + +Code v1.93.1 + +### Changed + +- Updated to Code 1.93.1. + +### Added + +- Added `--abs-proxy-base-path` flag for when code-server is not at the root. + +## [4.92.2](https://github.com/coder/code-server/releases/tag/v4.92.2) - 2024-08-19 + +Code v1.92.2 + +### Breaking changes + +- Dropped a patch that changed the compile target from es2022 to es2020 because + it no longer works with the way VS Code uses static properties. This may break + older browsers, so those browsers will either have to be updated or use an + older version of code-server. + +### Changed + +- Updated to Code 1.92.2. + +## [4.91.0](https://github.com/coder/code-server/releases/tag/v4.91.0) - 2024-07-10 + +Code v1.91.0 + +### Changed + +- Updated to Code 1.91.0. + +## [4.90.3](https://github.com/coder/code-server/releases/tag/v4.90.3) - 2024-06-21 + +Code v1.90.2 + +### Changed + +- Updated to Code 1.90.2. + +### Fixed + +- When the log gets rotated it will no longer incorrectly be moved to a new + directory created in the current working directory named with a date. + Instead, the file itself is prepended with the date and kept in the same + directory, as originally intended. + +## [4.90.2](https://github.com/coder/code-server/releases/tag/v4.90.2) - 2024-06-14 + +Code v1.90.1 + +### Changed + +- Updated to Code 1.90.1. + +## [4.90.1](https://github.com/coder/code-server/releases/tag/v4.90.1) - 2024-06-12 + +Code v1.90.0 + +### Fixed + +- Cache a call to get CPU information used in telemetry that could result in a + lack responsiveness if it was particularly slow. + +## [4.90.0](https://github.com/coder/code-server/releases/tag/v4.90.0) - 2024-06-11 + +Code v1.90.0 + +### Changed + +- Updated to Code 1.90.0. +- Updated Node to 20.11.1. + +### Added + +- Send contents to the clipboard in the integrated terminal by piping to + `code-server --stdin-to-clipboard` or `code-server -c`. + + You may want to make this an alias: + + ``` + alias xclip="code-server --stdin-to-clipboard" + echo -n "hello world" | xclip + ``` + ## [4.89.1](https://github.com/coder/code-server/releases/tag/v4.89.1) - 2024-04-14 Code v1.89.1 -## Changed +### Changed - Updated to Code 1.89.1. @@ -34,7 +916,7 @@ Code v1.89.1 Code v1.89.0 -## Changed +### Changed - Updated to Code 1.89.0. @@ -42,7 +924,7 @@ Code v1.89.0 Code v1.88.1 -## Changed +### Changed - Updated to Code 1.88.1. @@ -50,12 +932,12 @@ Code v1.88.1 Code v1.88.0 -## Changed +### Changed - Updated to Code 1.88.0. - Updated Node to 18.18.2. -## Fixed +### Fixed - Fix masking the exit code when failing to install extensions on the command line outside the integrated terminal. Installing extensions inside the @@ -65,7 +947,7 @@ Code v1.88.0 Code v1.87.2 -## Changed +### Changed - Updated to Code 1.87.2. - Enable keep-alive for proxy agent. @@ -74,7 +956,7 @@ Code v1.87.2 Code v1.87.0 -## Changed +### Changed - Updated to Code 1.87.0. @@ -82,7 +964,7 @@ Code v1.87.0 Code v1.86.2 -## Changed +### Changed - Updated to Code 1.86.2. @@ -90,12 +972,12 @@ Code v1.86.2 Code v1.86.1 -## Changed +### Changed - Updated to Code 1.86.1. - Updated to Node 18.17.1. -## Added +### Added - Docker images for Fedora and openSUSE. @@ -103,7 +985,7 @@ Code v1.86.1 Code v1.86.0 -## Changed +### Changed - Updated to Code 1.86.0. @@ -111,11 +993,11 @@ Code v1.86.0 Code v1.85.2 -## Changed +### Changed - Updated to Code 1.85.2. -## Fixed +### Fixed - Query variables are no longer double-encoded when going over the path proxy. @@ -497,7 +1379,6 @@ Code v1.68.1 would be accessible at `my.domain/proxy/8000/` without any authentication. If all of the following apply to you please update as soon as possible: - - You run code-server with the built-in password authentication. - You run unprotected HTTP services on ports accessible by code-server. diff --git a/ci/README.md b/ci/README.md deleted file mode 100644 index 4869d65a276b..000000000000 --- a/ci/README.md +++ /dev/null @@ -1,114 +0,0 @@ -# ci - -This directory contains scripts used for code-server's continuous integration infrastructure. - -Some of these scripts contain more detailed documentation and options -in header comments. - -Any file or directory in this subdirectory should be documented here. - -- [./ci/lib.sh](./lib.sh) - - Contains code duplicated across these scripts. - -## dev - -This directory contains scripts used for the development of code-server. - -- [./ci/dev/image](./dev/image) - - See [./docs/CONTRIBUTING.md](../docs/CONTRIBUTING.md) for docs on the development container. -- [./ci/dev/fmt.sh](./dev/fmt.sh) (`yarn fmt`) - - Runs formatters. -- [./ci/dev/lint.sh](./dev/lint.sh) (`yarn lint`) - - Runs linters. -- [./ci/dev/test-unit.sh](./dev/test-unit.sh) (`yarn test:unit`) - - Runs unit tests. -- [./ci/dev/test-e2e.sh](./dev/test-e2e.sh) (`yarn test:e2e`) - - Runs end-to-end tests. -- [./ci/dev/ci.sh](./dev/ci.sh) (`yarn ci`) - - Runs `yarn fmt`, `yarn lint` and `yarn test`. -- [./ci/dev/watch.ts](./dev/watch.ts) (`yarn watch`) - - Starts a process to build and launch code-server and restart on any code changes. - - Example usage in [./docs/CONTRIBUTING.md](../docs/CONTRIBUTING.md). -- [./ci/dev/gen_icons.sh](./dev/gen_icons.sh) (`yarn icons`) - - Generates the various icons from a single `.svg` favicon in - `src/browser/media/favicon.svg`. - - Requires [imagemagick](https://imagemagick.org/index.php) - -## build - -This directory contains the scripts used to build and release code-server. -You can disable minification by setting `MINIFY=`. - -- [./ci/build/build-code-server.sh](./build/build-code-server.sh) (`yarn build`) - - Builds code-server into `./out` and bundles the frontend into `./dist`. -- [./ci/build/build-vscode.sh](./build/build-vscode.sh) (`yarn build:vscode`) - - Builds vscode into `./lib/vscode/out-vscode`. -- [./ci/build/build-release.sh](./build/build-release.sh) (`yarn release`) - - Bundles the output of the above two scripts into a single node module at `./release`. -- [./ci/build/clean.sh](./build/clean.sh) (`yarn clean`) - - Removes all build artifacts. - - Useful to do a clean build. -- [./ci/build/code-server.sh](./build/code-server.sh) - - Copied into standalone releases to run code-server with the bundled node binary. -- [./ci/build/test-standalone-release.sh](./build/test-standalone-release.sh) (`yarn test:standalone-release`) - - Ensures code-server in the `./release-standalone` directory works by installing an extension. -- [./ci/build/build-packages.sh](./build/build-packages.sh) (`yarn package`) - - Packages `./release-standalone` into a `.tar.gz` archive in `./release-packages`. - - If on linux, [nfpm](https://github.com/goreleaser/nfpm) is used to generate `.deb` and `.rpm`. -- [./ci/build/nfpm.yaml](./build/nfpm.yaml) - - Used to configure [nfpm](https://github.com/goreleaser/nfpm) to generate `.deb` and `.rpm`. -- [./ci/build/code-server-nfpm.sh](./build/code-server-nfpm.sh) - - Entrypoint script for code-server for `.deb` and `.rpm`. -- [./ci/build/code-server.service](./build/code-server.service) - - systemd user service packaged into the `.deb` and `.rpm`. -- [./ci/build/release-github-draft.sh](./build/release-github-draft.sh) (`yarn release:github-draft`) - - Uses [gh](https://github.com/cli/cli) to create a draft release with a template description. -- [./ci/build/release-github-assets.sh](./build/release-github-assets.sh) (`yarn release:github-assets`) - - Downloads the release-package artifacts for the current commit from CI. - - Uses [gh](https://github.com/cli/cli) to upload the artifacts to the release - specified in `package.json`. -- [./ci/build/npm-postinstall.sh](./build/npm-postinstall.sh) - - Post install script for the npm package. - - Bundled by`yarn release`. - -## release-image - -This directory contains the release docker container image. - -- [./ci/steps/build-docker-buildx-push.sh](./steps/docker-buildx-push.sh) - - Builds the release containers with tags `codercom/code-server-$ARCH:$VERSION` for amd64 and arm64 with `docker buildx` and pushes them. - - Assumes debian releases are ready in `./release-packages`. - -## images - -This directory contains the images for CI. - -## steps - -This directory contains the scripts used in CI. -Helps avoid clobbering the CI configuration. - -- [./steps/fmt.sh](./steps/fmt.sh) - - Runs `yarn fmt`. -- [./steps/lint.sh](./steps/lint.sh) - - Runs `yarn lint`. -- [./steps/test-unit.sh](./steps/test-unit.sh) - - Runs `yarn test:unit`. -- [./steps/test-integration.sh](./steps/test-integration.sh) - - Runs `yarn test:integration`. -- [./steps/test-e2e.sh](./steps/test-e2e.sh) - - Runs `yarn test:e2e`. -- [./steps/release.sh](./steps/release.sh) - - Runs the release process. - - Generates the npm package at `./release`. -- [./steps/release-packages.sh](./steps/release-packages.sh) - - Takes the output of the previous script and generates a standalone release and - release packages into `./release-packages`. -- [./steps/publish-npm.sh](./steps/publish-npm.sh) - - Grabs the `npm-package` release artifact for the current commit and publishes it on npm. -- [./steps/docker-buildx-push.sh](./steps/docker-buildx-push.sh) - - Builds the docker image and then pushes it. -- [./steps/push-docker-manifest.sh](./steps/push-docker-manifest.sh) - - Loads all images in `./release-images` and then builds and pushes a multi architecture - docker manifest for the amd64 and arm64 images to `codercom/code-server:$VERSION` and - `codercom/code-server:latest`. diff --git a/ci/build/build-packages.sh b/ci/build/build-packages.sh index 1844dc7410fd..dfd29dba20d3 100755 --- a/ci/build/build-packages.sh +++ b/ci/build/build-packages.sh @@ -1,19 +1,18 @@ #!/usr/bin/env bash set -euo pipefail -# Packages code-server for the current OS and architecture into ./release-packages. -# This script assumes that a standalone release is built already into ./release-standalone +# Given a release found in $RELEASE_PATH, generate a deb, rpm, and tarball each +# named after $ARCH (derived from uname -m but can be overridden for +# cross-compilation) and $OS (derived from uname and cannot be overridden) and +# place them in ./release-packages and ./release-gcp. main() { cd "$(dirname "${0}")/../.." source ./ci/lib.sh source ./ci/build/build-lib.sh - # Allow us to override architecture - # we use this for our Linux ARM64 cross compile builds - if [ "$#" -eq 1 ] && [ "$1" ]; then - ARCH=$1 - fi + VERSION=$(jq -r .version "$RELEASE_PATH/package.json") + export VERSION # for nfpm to use mkdir -p release-packages @@ -26,10 +25,10 @@ main() { release_archive() { local release_name="code-server-$VERSION-$OS-$ARCH" - if [[ $OS == "linux" ]]; then - tar -czf "release-packages/$release_name.tar.gz" --owner=0 --group=0 --transform "s/^\.\/release-standalone/$release_name/" ./release-standalone + if [[ $OS == "linux" || $OS == "windows" ]]; then + tar -czf "release-packages/$release_name.tar.gz" --owner=0 --group=0 --transform "s/^$RELEASE_PATH/$release_name/" "$RELEASE_PATH" else - tar -czf "release-packages/$release_name.tar.gz" -s "/^release-standalone/$release_name/" release-standalone + tar -czf "release-packages/$release_name.tar.gz" -s "/^$RELEASE_PATH/$release_name/" "$RELEASE_PATH" fi echo "done (release-packages/$release_name)" @@ -50,20 +49,13 @@ release_nfpm() { export NFPM_ARCH - # Code deletes some files from the extension node_modules directory which - # leaves broken symlinks in the corresponding .bin directory. nfpm will fail - # on these broken symlinks so clean them up. - rm -fr "./release-standalone/lib/vscode/extensions/node_modules/.bin" - - PKG_FORMAT="deb" - NFPM_ARCH="$(get_nfpm_arch $PKG_FORMAT "$ARCH")" + NFPM_ARCH="$(get_nfpm_arch deb "$ARCH")" nfpm_config="$(envsubst < ./ci/build/nfpm.yaml)" echo "Building deb" echo "$nfpm_config" | head --lines=4 nfpm pkg -f <(echo "$nfpm_config") --target "release-packages/code-server_${VERSION}_${NFPM_ARCH}.deb" - PKG_FORMAT="rpm" - NFPM_ARCH="$(get_nfpm_arch $PKG_FORMAT "$ARCH")" + NFPM_ARCH="$(get_nfpm_arch rpm "$ARCH")" nfpm_config="$(envsubst < ./ci/build/nfpm.yaml)" echo "Building rpm" echo "$nfpm_config" | head --lines=4 diff --git a/ci/build/build-release.sh b/ci/build/build-release.sh index ec5b3f4424bd..0b84dfdcd3f9 100755 --- a/ci/build/build-release.sh +++ b/ci/build/build-release.sh @@ -1,13 +1,19 @@ #!/usr/bin/env bash set -euo pipefail -# This script requires vscode to be built with matching MINIFY. +# Once both code-server and VS Code have been built, use this script to copy +# them into a single directory (./release), prepare the package.json and +# product.json, and add shrinkwraps. This results in a generic NPM package that +# we can publish to NPM. -# MINIFY controls whether minified vscode is bundled. +# MINIFY controls whether minified VS Code is bundled. It must match the value +# used when VS Code was built. MINIFY="${MINIFY-true}" -# KEEP_MODULES controls whether the script cleans all node_modules requiring a yarn install -# to run first. +# node_modules are not copied by default. Set KEEP_MODULES=1 to copy them. +# Note these modules will be for the platform that built them, making the result +# no longer generic (it can still be published though as the modules will be +# ignored when pushing). KEEP_MODULES="${KEEP_MODULES-0}" main() { @@ -28,6 +34,28 @@ main() { rsync ./docs/README.md "$RELEASE_PATH" rsync LICENSE "$RELEASE_PATH" rsync ./lib/vscode/ThirdPartyNotices.txt "$RELEASE_PATH" + + if [ "$KEEP_MODULES" = 1 ]; then + # Copy the code-server launcher. + mkdir -p "$RELEASE_PATH/bin" + rsync ./ci/build/code-server.sh "$RELEASE_PATH/bin/code-server" + chmod 755 "$RELEASE_PATH/bin/code-server" + + # Windows cannot run the shell launcher, so it gets one of its own. + if [ "$OS" = windows ]; then + rsync ./ci/build/code-server.cmd "$RELEASE_PATH/bin/code-server.cmd" + fi + + # Delete the extra bin scripts. + rm "$RELEASE_PATH/lib/vscode/bin/remote-cli/code-darwin.sh" + rm "$RELEASE_PATH/lib/vscode/bin/remote-cli/code-linux.sh" + rm "$RELEASE_PATH/lib/vscode/bin/helpers/browser-darwin.sh" + rm "$RELEASE_PATH/lib/vscode/bin/helpers/browser-linux.sh" + if [ "$OS" != windows ] ; then + rm "$RELEASE_PATH/lib/vscode/bin/remote-cli/code.cmd" + rm "$RELEASE_PATH/lib/vscode/bin/helpers/browser.cmd" + fi + fi } bundle_code_server() { @@ -41,14 +69,11 @@ bundle_code_server() { rsync src/browser/pages/*.css "$RELEASE_PATH/src/browser/pages" rsync src/browser/robots.txt "$RELEASE_PATH/src/browser" - # Add typings for plugins - mkdir -p "$RELEASE_PATH/typings" - rsync typings/pluginapi.d.ts "$RELEASE_PATH/typings" - # Adds the commit to package.json - jq --slurp '.[0] * .[1]' package.json <( + jq --slurp '(.[0] | del(.scripts,.jest,.devDependencies)) * .[1]' package.json <( cat << EOF { + "version": "$(jq -r .codeServerVersion "./lib/vscode-reh-web-$VSCODE_TARGET/product.json")", "commit": "$(git rev-parse HEAD)", "scripts": { "postinstall": "sh ./postinstall.sh" @@ -58,17 +83,29 @@ EOF ) > "$RELEASE_PATH/package.json" mv npm-shrinkwrap.json "$RELEASE_PATH" - rsync ci/build/npm-postinstall.sh "$RELEASE_PATH/postinstall.sh" - if [ "$KEEP_MODULES" = 1 ]; then - rsync node_modules/ "$RELEASE_PATH/node_modules" + local rsync_opts=(-a) + if [[ ${DEBUG-} = 1 ]]; then + rsync_opts+=(-vh) + fi + # If we build from source, exclude the prebuilds. + if [[ ${npm_config_build_from_source-} = true ]]; then + rsync_opts+=(--exclude /argon2/prebuilds) + fi + rsync "${rsync_opts[@]}" node_modules/ "$RELEASE_PATH/node_modules" + # Remove dev dependencies. + pushd "$RELEASE_PATH" + npm prune --production + popd fi + + rsync ci/build/npm-postinstall.sh "$RELEASE_PATH/postinstall.sh" } bundle_vscode() { mkdir -p "$VSCODE_OUT_PATH" - local rsync_opts=() + local rsync_opts=(-a) if [[ ${DEBUG-} = 1 ]]; then rsync_opts+=(-vh) fi @@ -77,60 +114,74 @@ bundle_vscode() { # npm package so exclude any .gitignore files. rsync_opts+=(--exclude .gitignore) - # Exclude Node as we will add it ourselves for the standalone and will not - # need it for the npm package. + # Exclude Node since we want to place it in a directory above. rsync_opts+=(--exclude /node) + rsync_opts+=(--exclude /node.exe) - # Exclude Node modules. + # Exclude Node modules. Note that these will already only include production + # dependencies, so if we do keep them there is no need to do any + # post-processing to remove dev dependencies. if [[ $KEEP_MODULES = 0 ]]; then rsync_opts+=(--exclude node_modules) fi - rsync "${rsync_opts[@]}" ./lib/vscode-reh-web-*/ "$VSCODE_OUT_PATH" + rsync "${rsync_opts[@]}" "./lib/vscode-reh-web-$VSCODE_TARGET/" "$VSCODE_OUT_PATH" - # Use the package.json for the web/remote server. It does not have the right - # version though so pull that from the main package.json. - jq --slurp '.[0] * {version: .[1].version}' \ - "$VSCODE_SRC_PATH/remote/package.json" \ - "$VSCODE_SRC_PATH/package.json" > "$VSCODE_OUT_PATH/package.json" + # Copy the Node binary. + if [[ $KEEP_MODULES = 1 ]]; then + if [ "$OS" = windows ]; then + cp "./lib/vscode-reh-web-$VSCODE_TARGET/node.exe" "$RELEASE_PATH/lib" + else + cp "./lib/vscode-reh-web-$VSCODE_TARGET/node" "$RELEASE_PATH/lib" + fi + fi - mv "$VSCODE_SRC_PATH/remote/npm-shrinkwrap.json" "$VSCODE_OUT_PATH/npm-shrinkwrap.json" + # Merge the package.json for the web/remote server so we can include + # dependencies, since we want to ship this via NPM. + # Also override the name to prevent vulnerability scanners from + # misidentifying this package as VS Code (see #7071). + jq --slurp '.[0] * .[1] | .name = "code-oss"' \ + "$VSCODE_SRC_PATH/remote/package.json" \ + "$VSCODE_OUT_PATH/package.json" > "$VSCODE_OUT_PATH/package.json.merged" + mv "$VSCODE_OUT_PATH/package.json.merged" "$VSCODE_OUT_PATH/package.json" + cp "$VSCODE_SRC_PATH/remote/npm-shrinkwrap.json" "$VSCODE_OUT_PATH/npm-shrinkwrap.json" # Include global extension dependencies as well. rsync "$VSCODE_SRC_PATH/extensions/package.json" "$VSCODE_OUT_PATH/extensions/package.json" - mv "$VSCODE_SRC_PATH/extensions/npm-shrinkwrap.json" "$VSCODE_OUT_PATH/extensions/npm-shrinkwrap.json" + cp "$VSCODE_SRC_PATH/extensions/npm-shrinkwrap.json" "$VSCODE_OUT_PATH/extensions/npm-shrinkwrap.json" rsync "$VSCODE_SRC_PATH/extensions/postinstall.mjs" "$VSCODE_OUT_PATH/extensions/postinstall.mjs" } create_shrinkwraps() { - # yarn.lock or package-lock.json files (used to ensure deterministic versions of dependencies) are - # not packaged when publishing to the NPM registry. - # To ensure deterministic dependency versions (even when code-server is installed with NPM), we create - # an npm-shrinkwrap.json file from the currently installed node_modules. This ensures the versions used - # from development (that the yarn.lock guarantees) are also the ones installed by end-users. - # These will include devDependencies, but those will be ignored when installing globally (for code-server), and - # because we use --omit=dev when installing vscode. - - # We first generate the shrinkwrap file for code-server itself - which is the current directory - create_shrinkwrap_keeping_yarn_lock - - # Then the shrinkwrap files for the bundled VSCode + # package-lock.json files (used to ensure deterministic versions of + # dependencies) are not packaged when publishing to the NPM registry. + # + # To ensure deterministic dependency versions (even when code-server is + # installed with NPM), we create an npm-shrinkwrap.json file from the + # currently installed node_modules. This ensures the versions used from + # development (that the package-lock.json guarantees) are also the ones + # installed by end-users. These will include devDependencies, but those will + # be ignored when installing globally (for code-server), and because we use + # --omit=dev (for VS Code). + + # We first generate the shrinkwrap file for code-server itself - which is the + # current directory. + cp package-lock.json package-lock.json.temp + npm shrinkwrap + mv package-lock.json.temp package-lock.json + + # Then the shrinkwrap files for the bundled VS Code. pushd "$VSCODE_SRC_PATH/remote/" - create_shrinkwrap_keeping_yarn_lock + cp package-lock.json package-lock.json.temp + npm shrinkwrap + mv package-lock.json.temp package-lock.json popd pushd "$VSCODE_SRC_PATH/extensions/" - create_shrinkwrap_keeping_yarn_lock - popd -} - -create_shrinkwrap_keeping_yarn_lock() { - # HACK@edvincent: Generating a shrinkwrap alters the yarn.lock which we don't want (with NPM URLs rather than the Yarn URLs) - # But to generate a valid shrinkwrap, it has to exist... So we copy it to then restore it - cp yarn.lock yarn.lock.temp + cp package-lock.json package-lock.json.temp npm shrinkwrap - cp yarn.lock.temp yarn.lock - rm yarn.lock.temp + mv package-lock.json.temp package-lock.json + popd } main "$@" diff --git a/ci/build/build-standalone-release.sh b/ci/build/build-standalone-release.sh deleted file mode 100755 index aed25ee3f3fc..000000000000 --- a/ci/build/build-standalone-release.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -main() { - cd "$(dirname "${0}")/../.." - - source ./ci/lib.sh - - rsync "$RELEASE_PATH/" "$RELEASE_PATH-standalone" - RELEASE_PATH+=-standalone - - # We cannot get the path to Node from $PATH (for example via `which node`) - # because Yarn shims a script called `node` and we would end up just copying - # that script. Instead we run Node and have it print its actual path. - local node_path - node_path="$(node <<< 'console.info(process.execPath)')" - - mkdir -p "$RELEASE_PATH/bin" - mkdir -p "$RELEASE_PATH/lib" - rsync ./ci/build/code-server.sh "$RELEASE_PATH/bin/code-server" - rsync "$node_path" "$RELEASE_PATH/lib/node" - - chmod 755 "$RELEASE_PATH/lib/node" - - pushd "$RELEASE_PATH" - npm install --unsafe-perm --omit=dev - popd -} - -main "$@" diff --git a/ci/build/build-vscode.sh b/ci/build/build-vscode.sh index 358d8d66c04f..c38b0ae22acc 100755 --- a/ci/build/build-vscode.sh +++ b/ci/build/build-vscode.sh @@ -6,33 +6,33 @@ set -euo pipefail # MINIFY controls whether a minified version of vscode is built. MINIFY=${MINIFY-true} -delete-bin-script() { - rm -f "lib/vscode-reh-web-linux-x64/bin/$1" -} - -copy-bin-script() { - local script="$1" - local dest="lib/vscode-reh-web-linux-x64/bin/$script" - cp "lib/vscode/resources/server/bin/$script" "$dest" - sed -i.bak "s/@@VERSION@@/$(vscode_version)/g" "$dest" - sed -i.bak "s/@@COMMIT@@/$BUILD_SOURCEVERSION/g" "$dest" - sed -i.bak "s/@@APPNAME@@/code-server/g" "$dest" +fix-bin-script() { + local script="lib/vscode-reh-web-$VSCODE_TARGET/bin/$1" + sed -i.bak "s/@@VERSION@@/$(vscode_version)/g" "$script" + sed -i.bak "s/@@COMMIT@@/$BUILD_SOURCEVERSION/g" "$script" + sed -i.bak "s/@@APPNAME@@/code-server/g" "$script" # Fix Node path on Darwin and Linux. # We do not want expansion here; this text should make it to the file as-is. # shellcheck disable=SC2016 - sed -i.bak 's/^ROOT=\(.*\)$/VSROOT=\1\nROOT="$(dirname "$(dirname "$VSROOT")")"/g' "$dest" - sed -i.bak 's/ROOT\/out/VSROOT\/out/g' "$dest" + sed -i.bak 's/^ROOT=\(.*\)$/VSROOT=\1\nROOT="$(dirname "$(dirname "$VSROOT")")"/g' "$script" + sed -i.bak 's/ROOT\/out/VSROOT\/out/g' "$script" # We do not want expansion here; this text should make it to the file as-is. # shellcheck disable=SC2016 - sed -i.bak 's/$ROOT\/node/${NODE_EXEC_PATH:-$ROOT\/lib\/node}/g' "$dest" + sed -i.bak 's/$ROOT\/node/${NODE_EXEC_PATH:-$ROOT\/lib\/node}/g' "$script" # Fix Node path on Windows. - sed -i.bak 's/^set ROOT_DIR=\(.*\)$/set ROOT_DIR=%~dp0..\\..\\..\\..\r\nset VSROOT_DIR=\1/g' "$dest" - sed -i.bak 's/%ROOT_DIR%\\out/%VSROOT_DIR%\\out/g' "$dest" + sed -i.bak 's/^set ROOT_DIR=\(.*\)$/set ROOT_DIR=%~dp0..\\..\\..\\..\r\nset VSROOT_DIR=\1/g' "$script" + sed -i.bak 's/%ROOT_DIR%\\out/%VSROOT_DIR%\\out/g' "$script" + sed -i.bak 's/%ROOT_DIR%\\node.exe/%ROOT_DIR%\\lib\\node.exe/g' "$script" - chmod +x "$dest" - rm "$dest.bak" + chmod +x "$script" + rm "$script.bak" +} + +copy-bin-script() { + cp "lib/vscode/resources/server/bin/$1" "lib/vscode-reh-web-$VSCODE_TARGET/bin/$1" + fix-bin-script "$1" } main() { @@ -54,14 +54,21 @@ main() { if [[ ! ${VERSION-} ]]; then echo "VERSION not set. Please set before running this script:" - echo "VERSION='0.0.0' yarn build:vscode" + echo "VERSION='0.0.0' npm run build:vscode" exit 1 fi - # Add the date, our name, links, enable telemetry (this just makes telemetry - # available; telemetry can still be disabled by flag or setting), and - # configure trusted extensions (since some, like github.copilot-chat, never - # ask to be trusted and this is the only way to get auth working). + # Modify the product.json: + # - Add the date + # - Set the code-server name. + # - Add our links + # - Enable telemetry (this just makes telemetry available; telemetry can still + # be disabled by flag or setting) + # - Configure trusted extensions (since some, like github.copilot-chat, never + # ask to be trusted and this is the only way to get auth working). + # - Make Typescript server plugins run in the workspace. We build the remote + # server version, so there is no browser distribution, and this key is not + # added automatically. # # This needs to be done before building as Code will read this file and embed # it into the client-side code. @@ -103,16 +110,19 @@ main() { ], "aiConfig": { "ariaKey": "code-server" + }, + "extensionPointExtensionKind": { + "typescriptServerPlugins": ["workspace"] } } EOF ) > product.json - # Any platform here works since we will do our own packaging. We have to do - # this because we have an NPM package that could be installed on any platform. - # The correct platform dependencies and scripts will be installed as part of - # the post-install during `npm install` or when building a standalone release. - yarn gulp "vscode-reh-web-linux-x64${MINIFY:+-min}" + + VSCODE_QUALITY=stable npm run gulp compile-copilot-extension-full-build + + npm run gulp core-ci + npm run gulp "vscode-reh-web-$VSCODE_TARGET${MINIFY:+-min}-ci" # Reset so if you develop after building you will not be stuck with the wrong # commit (the dev client will use `oss-dev` but the dev server will still use @@ -121,7 +131,7 @@ EOF popd - pushd lib/vscode-reh-web-linux-x64 + pushd "lib/vscode-reh-web-$VSCODE_TARGET" # Make sure Code took the version we set in the environment variable. Not # having a version will break display languages. if ! jq -e .commit product.json; then @@ -130,15 +140,28 @@ EOF fi popd + # Set vars and fix paths. + case $OS in + windows) + fix-bin-script remote-cli/code-server.cmd + fix-bin-script helpers/browser.cmd + ;; + *) + fix-bin-script remote-cli/code-server + fix-bin-script helpers/browser.sh + ;; + esac + + # Include bin scripts for other platforms so we can use the right one in the + # NPM post-install. + # These provide a `code-server` command in the integrated terminal to open # files in the current instance. - delete-bin-script remote-cli/code-server copy-bin-script remote-cli/code-darwin.sh copy-bin-script remote-cli/code-linux.sh copy-bin-script remote-cli/code.cmd # These provide a way for terminal applications to open browser windows. - delete-bin-script helpers/browser.sh copy-bin-script helpers/browser-darwin.sh copy-bin-script helpers/browser-linux.sh copy-bin-script helpers/browser.cmd diff --git a/ci/build/code-server.cmd b/ci/build/code-server.cmd new file mode 100644 index 000000000000..1b6a5b2ac1e5 --- /dev/null +++ b/ci/build/code-server.cmd @@ -0,0 +1,8 @@ +@echo off + +rem This script is intended to be bundled into the standalone releases. +rem Runs code-server with the bundled node binary. + +setlocal +set "ROOT=%~dp0.." +"%ROOT%\lib\node.exe" "%ROOT%" %* diff --git a/ci/build/nfpm.yaml b/ci/build/nfpm.yaml index 4a44df900c9b..4b0ee371a2eb 100644 --- a/ci/build/nfpm.yaml +++ b/ci/build/nfpm.yaml @@ -21,5 +21,5 @@ contents: - src: ./ci/build/code-server-user.service dst: /usr/lib/systemd/user/code-server.service - - src: ./release-standalone/* + - src: ./release/* dst: /usr/lib/code-server diff --git a/ci/build/npm-postinstall.sh b/ci/build/npm-postinstall.sh index 0f99a044950d..856f1acfa9eb 100755 --- a/ci/build/npm-postinstall.sh +++ b/ci/build/npm-postinstall.sh @@ -18,22 +18,11 @@ symlink() { dest="$2" rm -rf "$dest" case $OS in - windows) mklink /J "$dest" "$source" ;; + windows) cmd //c mklink //J "$dest" "$source" ;; *) ln -s "$source" "$dest" ;; esac } -# VS Code bundles some modules into an asar which is an archive format that -# works like tar. It then seems to get unpacked into node_modules.asar. -# -# I don't know why they do this but all the dependencies they bundle already -# exist in node_modules so just symlink it. We have to do this since not only -# Code itself but also extensions will look specifically in this directory for -# files (like the ripgrep binary or the oniguruma wasm). -symlink_asar() { - symlink node_modules node_modules.asar -} - # Make a symlink at bin/$1/$3 pointing to the platform-specific version of the # script in $2. The extension of the link will be .cmd for Windows otherwise it # will be whatever is in $4 (or no extension if $4 is not set). @@ -76,9 +65,9 @@ main() { echo "USE AT YOUR OWN RISK!" fi - if [ "$major_node_version" -ne "${FORCE_NODE_VERSION:-18}" ]; then - echo "ERROR: code-server currently requires node v18." - if [ -n "$FORCE_NODE_VERSION" ]; then + if [ "$major_node_version" -ne "${FORCE_NODE_VERSION:-24}" ]; then + echo "ERROR: code-server currently requires node v24." + if [ -n "${FORCE_NODE_VERSION:-}" ]; then echo "However, you have overrided the version check to use v$FORCE_NODE_VERSION." fi echo "We have detected that you are on node v$major_node_version" @@ -87,20 +76,6 @@ main() { exit 1 fi - # Under npm, if we are running as root, we need --unsafe-perm otherwise - # post-install scripts will not have sufficient permissions to do their thing. - if is_root; then - case "${npm_config_user_agent-}" in npm*) - if [ "${npm_config_unsafe_perm-}" != "true" ]; then - echo "Please pass --unsafe-perm to npm to install code-server" - echo "Otherwise post-install scripts will not have permissions to run" - echo "See https://docs.npmjs.com/misc/config#unsafe-perm" - echo "See https://stackoverflow.com/questions/49084929/npm-sudo-global-installation-unsafe-perm" - exit 1 - fi - ;; - esac - fi if ! vscode_install; then echo "You may not have the required dependencies to build the native modules." @@ -117,14 +92,11 @@ main() { install_with_yarn_or_npm() { echo "User agent: ${npm_config_user_agent-none}" - # NOTE@edvincent: We want to keep using the package manager that the end-user was using to install the package. - # This also ensures that when *we* run `yarn` in the development process, the yarn.lock file is used. + # For development we enforce npm, but for installing the package as an + # end-user we want to keep using whatever package manager is in use. case "${npm_config_user_agent-}" in npm*) - # HACK: NPM's use of semver doesn't like resolving some peerDependencies that vscode (upstream) brings in the form of pre-releases. - # The legacy behavior doesn't complain about pre-releases being used, falling back to that for now. - # See https://github.com//pull/5071 - if ! npm install --unsafe-perm --legacy-peer-deps --omit=dev; then + if ! npm install --omit=dev; then return 1 fi ;; @@ -148,7 +120,6 @@ vscode_install() { return 1 fi - symlink_asar symlink_bin_script remote-cli code code-server symlink_bin_script helpers browser browser .sh diff --git a/ci/build/update-repo.sh b/ci/build/update-repo.sh new file mode 100755 index 000000000000..0f1924fa91a4 --- /dev/null +++ b/ci/build/update-repo.sh @@ -0,0 +1,96 @@ +#!/usr/bin/env bash + +set -Eeuo pipefail + +# Given versions $1 and $2 figure out the first component that is different +# (major, minor, patch). +function find_version_diff() { + # shellcheck disable=SC2206 + local a=( ${1//./ } ) + # shellcheck disable=SC2206 + local b=( ${2//./ } ) + + if [[ ${a[0]} != "${b[0]}" ]] ; then + echo major + elif [[ ${a[1]} != "${b[1]}" ]] ; then + echo minor + else + echo patch + fi +} + +# Bump $1 by the bump type (major, minor, patch) in $2. +function bump_version() { + # shellcheck disable=SC2206 + local a=( ${1//./ } ) + case $2 in + major) + ((a[0]++)) + a[1]=0 + a[2]=0 + ;; + minor) + ((a[1]++)) + a[2]=0 + ;; + *) + ((a[2]++)) + ;; + esac + echo "${a[0]}.${a[1]}.${a[2]}" +} + +function update_helm() { + local chart_version + chart_version=$(yq .version ci/helm-chart/Chart.yaml) + local app_version + app_version=$(yq .appVersion ci/helm-chart/Chart.yaml) + local image_version + image_version=$(yq .image.tag ci/helm-chart/values.yaml) + + local bump_type + bump_type=$(find_version_diff "$app_version" "$version") + local chart_version_bump + chart_version_bump=$(bump_version "$chart_version" "$bump_type") + + # Use sed to replace because yq will reformat. + echo "Bumping version from $chart_version to $chart_version_bump..." + sed -i.bak "s/^version: $chart_version\$/version: $chart_version_bump/" ci/helm-chart/Chart.yaml + + echo "Bumping app version from $app_version to $version..." + sed -i.bak "s/^appVersion: .\+\$/appVersion: $version/" ci/helm-chart/Chart.yaml + + echo "Bumping image version from $image_version to $version..." + sed -i.bak "s/^ tag: .\+\$/ tag: '$version'/" ci/helm-chart/values.yaml +} + +function update_changelog() { + local date + date=$(printf '%(%Y-%m-%d)T\n' -1) + local link="https://github.com/coder/code-server/releases/tag/v$version" + sed -i.bak "s|## Unreleased|## Unreleased\n\n## [$version]($link) - $date|" CHANGELOG.md +} + +function main() { + cd "$(dirname "${0}")/../.." + + source ./ci/lib.sh + + local version=${VERSION:-$(git describe --tags)} + version="${version#v}" + + declare -a steps + + steps+=( + "Update Helm chart" "update_helm" + "Update changelog" "update_changelog" + ) + + # Even if a step failed, still output the last checkmark. + run-steps "${steps[@]}" || true + + # This step is always manual. + echo "- [ ] https://github.com/coder/code-server-aur/pulls" >> .cache/checklist +} + +main "$@" diff --git a/ci/build/update-vscode.sh b/ci/build/update-vscode.sh new file mode 100755 index 000000000000..76a1ad650c48 --- /dev/null +++ b/ci/build/update-vscode.sh @@ -0,0 +1,170 @@ +#!/usr/bin/env bash + +set -Eeuo pipefail + +function unapply_patches() { + local -i exit_code=0 + quiet quilt pop -af 2>&1 || exit_code=$? + case $exit_code in + # Sucessfully unapplied. + 0) ;; + # No more patches to unapply. + 2) ;; + # Some error. + *) return $exit_code ;; + esac +} + +function apply_patches() { + local -i exit_code=0 + quiet quilt push -a 2>&1 || exit_code=$? + case $exit_code in + # Sucessfully applied. + 0) ;; + # No more patches to apply. + 2) ;; + # Some error. + *) return $exit_code ;; + esac +} + +function update_vscode() { + pushd lib/vscode + if ! git checkout 2>&1 "$target_vscode_version" ; then + echo "$target_vscode_version does not exist locally, fetching..." + git fetch --all --prune --tags + echo "Checking out $target_vscode_version again..." + git checkout "$target_vscode_version" + fi + popd +} + +function refresh_patches() { + local -i exit_code=0 + while quiet quilt push 2>&1 ; ! (( exit_code=$? )) ; do + quilt refresh 2>&1 + done + case $exit_code in + # No more patches to apply. + 2) ;; + # Some error. + *) return $exit_code ;; + esac +} + +function update_node() { + local node_version + node_version=$(cat .node-version) + local target_node_version + target_node_version=$(grep target lib/vscode/remote/.npmrc | awk -F= '{print $2}' | tr -d '"') + if [[ $node_version == "$target_node_version" ]] ; then + echo "Already set to $target_node_version" + else + echo "Updating from $node_version to $target_node_version..." + echo "$target_node_version" > .node-version + fi +} + +function get-webview-script-hash() { + local html + html=$(<"$1") + local start_tag='" + html=${html##*"$start_tag"} + html=${html%%"$end_tag"*} + echo -n "$html" | openssl sha256 -binary | openssl base64 +} + +function delete_csp() { + quilt delete csp-hashes.diff || true +} + +function update_csp() { + apply_patches + + local files=( + ./lib/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html + ./lib/vscode/src/vs/workbench/services/extensions/worker/webWorkerExtensionHostIframe.html + ) + + quilt new csp-hashes.diff + + local file + for file in "${files[@]}" ; do + quilt add "$file" + + local hash + hash=$(get-webview-script-hash "$file") + echo "Calculated hash as $hash" + # Use octothorpe as a delimiter since the hash may contain a slash. + sed -i.bak "s#'sha256-[^']\+'#'sha256-$hash'#" "$file" + # For the web worker extension host iframe, there is a matching sha in the + # web server. + if [[ $file == */webWorkerExtensionHostIframe.html ]] ; then + quilt add ./lib/vscode/src/vs/server/node/webClientServer.ts + sed -i.bak \ + "s#webWorkerExtensionHostIframeScriptSHA = 'sha256-[^']\+'#webWorkerExtensionHostIframeScriptSHA = 'sha256-$hash'#" \ + ./lib/vscode/src/vs/server/node/webClientServer.ts + fi + done + + quilt refresh +} + +function add_changelog() { + local file=CHANGELOG.md + if grep --quiet "Code $target_vscode_version" "$file" ; then + echo "Changelog for $target_vscode_version already exists" + else + # TODO: This is not exactly robust. In particular, it needs to handle if + # there is already a "changed" section. + sed -i.bak "s/## Unreleased/## Unreleased\n\nCode v$target_vscode_version\n\n### Changed\n\n- Update to Code $target_vscode_version/" "$file" + fi +} + +function main() { + cd "$(dirname "${0}")/../.." + + source ./ci/lib.sh + + declare -a steps + + # Hashes are always regenerated to avoid having to resolve conflicts.. + steps+=("Revert CSP hashes" "delete_csp") + + # If version is not set, assume we are already at the target version and the + # user is just trying to resolve conflics. + local target_vscode_version + if [[ ${VERSION-} ]] ; then + # Removing patches only needs to be done locally; in CI we start from a + # fresh clone each time. + if [[ ! ${CI-} ]] ; then + steps+=("Unapplying patches" "unapply_patches") + fi + target_vscode_version="${VERSION#v}" + steps+=( + "Update Code to $target_vscode_version" "update_vscode" + "Refresh Code patches" "refresh_patches" + ) + else + target_vscode_version="$(git -C lib/vscode describe --tags --exact-match)" + echo "Detected Code version $target_vscode_version" + fi + + steps+=( + "Update Node version" "update_node" + "Regenerate CSP hashes" "update_csp" + "Add changelog note" "add_changelog" + ) + + # Even if a step failed, still output the last checkmark. + run-steps "${steps[@]}" || true + + # This step is always manual. + echo "- [ ] Verify changelog" >> .cache/checklist +} + +main "$@" diff --git a/ci/dev/audit.sh b/ci/dev/audit.sh deleted file mode 100755 index 0142eac2a906..000000000000 --- a/ci/dev/audit.sh +++ /dev/null @@ -1,12 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -main() { - cd "$(dirname "$0")/../.." - - # Prevents integration with moderate or higher vulnerabilities - # Docs: https://github.com/IBM/audit-ci#options - yarn audit-ci --moderate -} - -main "$@" diff --git a/ci/dev/ci.sh b/ci/dev/ci.sh deleted file mode 100755 index daf4ecc69414..000000000000 --- a/ci/dev/ci.sh +++ /dev/null @@ -1,13 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -main() { - cd "$(dirname "$0")/../.." - - yarn fmt - yarn lint - yarn _audit - yarn test:unit -} - -main "$@" diff --git a/ci/dev/doctoc.sh b/ci/dev/doctoc.sh index 6a4e3a635388..39930f21e0b5 100755 --- a/ci/dev/doctoc.sh +++ b/ci/dev/doctoc.sh @@ -18,7 +18,7 @@ main() { echo "Files need generation or are formatted incorrectly:" git -c color.ui=always status | grep --color=no '\[31m' echo "Please run the following locally:" - echo " yarn doctoc" + echo " npm run doctoc" exit 1 fi } diff --git a/ci/dev/gen_icons.sh b/ci/dev/gen_icons.sh index 9d27486dcc57..39d509bc4f4b 100755 --- a/ci/dev/gen_icons.sh +++ b/ci/dev/gen_icons.sh @@ -1,44 +1,50 @@ #!/bin/sh set -eu +# Generate icons from a single favicon.svg. favicon.svg should have no fill +# colors set. main() { cd src/browser/media - # We need .ico for backwards compatibility. - # The other two are the only icon sizes required by Chrome and - # we use them for stuff like apple-touch-icon as well. - # https://web.dev/add-manifest/ + # We need .ico for backwards compatibility. The other two are the only icon + # sizes required by Chrome and we use them for stuff like apple-touch-icon as + # well. https://web.dev/add-manifest/ # # This should be enough and we can always add more if there are problems. - + # + # -quiet to avoid https://github.com/ImageMagick/ImageMagick/issues/884 # -background defaults to white but we want it transparent. + # -density somehow makes the image both sharper and smaller in file size. + # # https://imagemagick.org/script/command-line-options.php#background - convert -quiet -background transparent -resize 256x256 favicon.svg favicon.ico - # We do not generate the pwa-icon from the favicon as they are slightly different - # designs and sizes. - # See favicon.afdesign and #2401 for details on the differences. - convert -quiet -background transparent -resize 192x192 pwa-icon.png pwa-icon-192.png - convert -quiet -background transparent -resize 512x512 pwa-icon.png pwa-icon-512.png + convert -quiet -background transparent \ + -resize 256x256 -density 256x256 \ + favicon.svg favicon.ico - # We use -quiet above to avoid https://github.com/ImageMagick/ImageMagick/issues/884 + # Generate PWA icons. There should be enough padding to support masking. + convert -quiet -border 60x60 -bordercolor white -background white \ + -resize 192x192 -density 192x192 \ + favicon.svg pwa-icon-maskable-192.png + convert -quiet -border 160x160 -bordercolor white -background white \ + -resize 512x512 -density 512x512 \ + favicon.svg pwa-icon-maskable-512.png - # The following adds dark mode support for the favicon as favicon-dark-support.svg - # There is no similar capability for pwas or .ico so we can only add support to the svg. - favicon_dark_style="" - # See https://stackoverflow.com/a/22901380/4283659 - # This escapes all newlines so that sed will accept them. - favicon_dark_style="$(printf "%s\n" "$favicon_dark_style" | sed -e ':a' -e 'N' -e '$!ba' -e 's/\n/\\n/g')" - sed "$( - cat -n << EOF -s% favicon-dark-support.svg + # Generate non-maskable PWA icons. + magick pwa-icon-maskable-192.png \ + \( +clone -threshold 101% -fill white -draw "roundRectangle 0,0 %[fx:int(w)],%[fx:int(h)] 50,50" \) \ + -channel-fx "| gray=>alpha" \ + pwa-icon-192.png + magick pwa-icon-maskable-512.png \ + \( +clone -threshold 101% -fill white -draw "roundRectangle 0,0 %[fx:int(w)],%[fx:int(h)] 100,100" \) \ + -channel-fx "| gray=>alpha" \ + pwa-icon-512.png + + # The following adds dark mode support for the favicon as + # favicon-dark-support.svg There is no similar capability for pwas or .ico so + # we can only add support to the svg. + favicon_dark_style="" + cp favicon.svg favicon-dark-support.svg + sed "s% favicon-dark-support.svg } main "$@" diff --git a/ci/dev/postinstall.sh b/ci/dev/postinstall.sh index a3a2c19e753b..63aad7bcf985 100755 --- a/ci/dev/postinstall.sh +++ b/ci/dev/postinstall.sh @@ -3,14 +3,13 @@ set -euo pipefail # Install dependencies in $1. install-deps() { - local args=(install) + local args=() if [[ ${CI-} ]]; then - args+=(--frozen-lockfile) + args+=(ci) + else + args+=(install) fi - if [[ "$1" == "lib/vscode" ]]; then - args+=(--no-default-rc) - fi - # If there is no package.json then yarn will look upward and end up installing + # If there is no package.json then npm will look upward and end up installing # from the root resulting in an infinite loop (this can happen if you have not # checked out the submodule yet for example). if [[ ! -f "$1/package.json" ]]; then @@ -19,7 +18,7 @@ install-deps() { fi pushd "$1" echo "Installing dependencies for $PWD" - yarn "${args[@]}" + npm "${args[@]}" popd } diff --git a/ci/dev/preinstall.js b/ci/dev/preinstall.js new file mode 100644 index 000000000000..9c4240d89696 --- /dev/null +++ b/ci/dev/preinstall.js @@ -0,0 +1,3 @@ +if (process.env.npm_execpath.includes("yarn")) { + throw new Error("`yarn` is no longer supported; please use `npm install` instead") +} diff --git a/ci/dev/test-e2e.sh b/ci/dev/test-e2e.sh index 00724ac2b5f2..fa748823974e 100755 --- a/ci/dev/test-e2e.sh +++ b/ci/dev/test-e2e.sh @@ -2,9 +2,9 @@ set -euo pipefail help() { - echo >&2 " You can build with 'yarn watch' or you can build a release" - echo >&2 " For example: 'yarn build && yarn build:vscode && KEEP_MODULES=1 yarn release'" - echo >&2 " Then 'CODE_SERVER_TEST_ENTRY=./release yarn test:e2e'" + echo >&2 " You can build with 'npm run watch' or you can build a release" + echo >&2 " For example: 'npm run build && npm run build:vscode && KEEP_MODULES=1 npm run release'" + echo >&2 " Then 'CODE_SERVER_TEST_ENTRY=./release npm run test:e2e'" echo >&2 " You can manually run that release with 'node ./release'" } @@ -15,7 +15,7 @@ main() { pushd test/e2e/extensions/test-extension echo "Building test extension" - yarn build + npm run build popd local dir="$PWD" @@ -44,7 +44,7 @@ main() { fi cd test - yarn playwright test "$@" + ./node_modules/.bin/playwright test "$@" } main "$@" diff --git a/ci/dev/test-integration.sh b/ci/dev/test-integration.sh index 2d46bb895561..36d87de8ad6d 100755 --- a/ci/dev/test-integration.sh +++ b/ci/dev/test-integration.sh @@ -2,13 +2,13 @@ set -euo pipefail help() { - echo >&2 " You can build the standalone release with 'yarn release:standalone'" + echo >&2 " You can build the release with 'KEEP_MODULES=1 npm run release'" echo >&2 " Or you can pass in a custom path." - echo >&2 " CODE_SERVER_PATH='/var/tmp/coder/code-server/bin/code-server' yarn test:integration" + echo >&2 " CODE_SERVER_PATH='/var/tmp/coder/code-server/bin/code-server' npm run test:integration" } # Make sure a code-server release works. You can pass in the path otherwise it -# will look for release-standalone in the current directory. +# will look for $RELEASE_PATH in the current directory. # # This is to make sure we don't have Node version errors or any other # compilation-related errors. @@ -17,7 +17,7 @@ main() { source ./ci/lib.sh - local path="$RELEASE_PATH-standalone/bin/code-server" + local path="$RELEASE_PATH/bin/code-server" if [[ ! ${CODE_SERVER_PATH-} ]]; then echo "Set CODE_SERVER_PATH to test another build of code-server" else @@ -33,7 +33,7 @@ main() { exit 1 fi - CODE_SERVER_PATH="$path" CS_DISABLE_PLUGINS=true ./test/node_modules/.bin/jest "$@" --coverage=false --testRegex "./test/integration" --testPathIgnorePatterns "./test/integration/fixtures" + CODE_SERVER_PATH="$path" ./test/node_modules/.bin/jest "$@" --coverage=false --testRegex "./test/integration" --testPathIgnorePatterns "./test/integration/fixtures" } main "$@" diff --git a/ci/dev/test-native.sh b/ci/dev/test-native.sh index 9362be05393e..8e91f9a63e3b 100755 --- a/ci/dev/test-native.sh +++ b/ci/dev/test-native.sh @@ -2,13 +2,13 @@ set -euo pipefail help() { - echo >&2 " You can build the standalone release with 'yarn release:standalone'" + echo >&2 " You can build the release with 'KEEP_MODULES=1 npm run release'" echo >&2 " Or you can pass in a custom path." - echo >&2 " CODE_SERVER_PATH='/var/tmp/coder/code-server/bin/code-server' yarn test:integration" + echo >&2 " CODE_SERVER_PATH='/var/tmp/coder/code-server/bin/code-server' npm run test:integration" } # Make sure a code-server release works. You can pass in the path otherwise it -# will look for release-standalone in the current directory. +# will look for $RELEASE_PATH in the current directory. # # This is to make sure we don't have Node version errors or any other # compilation-related errors. @@ -17,7 +17,7 @@ main() { source ./ci/lib.sh - local path="$RELEASE_PATH-standalone/bin/code-server" + local path="$RELEASE_PATH/bin/code-server" if [[ ! ${CODE_SERVER_PATH-} ]]; then echo "Set CODE_SERVER_PATH to test another build of code-server" else diff --git a/ci/dev/test-unit.sh b/ci/dev/test-unit.sh index e312c073e4ef..15fd2030ea59 100755 --- a/ci/dev/test-unit.sh +++ b/ci/dev/test-unit.sh @@ -6,15 +6,10 @@ main() { source ./ci/lib.sh - echo "Building test plugin" - pushd test/unit/node/test-plugin - make -s out/index.js - popd - # We must keep jest in a sub-directory. See ../../test/package.json for more # information. We must also run it from the root otherwise coverage will not # include our source files. - CS_DISABLE_PLUGINS=true ./test/node_modules/.bin/jest "$@" --testRegex "./test/unit/.*ts" --testPathIgnorePatterns "./test/unit/node/test-plugin" + ./test/node_modules/.bin/jest "$@" --testRegex "./test/unit/.*ts" } main "$@" diff --git a/ci/dev/watch.ts b/ci/dev/watch.ts index 0583a38df62f..e48489ce69dc 100644 --- a/ci/dev/watch.ts +++ b/ci/dev/watch.ts @@ -45,9 +45,11 @@ class Watcher { private readonly compilers: DevelopmentCompilers = { codeServer: spawn("tsc", ["--watch", "--pretty", "--preserveWatchOutput"], { cwd: this.rootPath }), - vscode: spawn("yarn", ["watch"], { cwd: this.paths.vscodeDir }), - vscodeWebExtensions: spawn("yarn", ["watch-web"], { cwd: this.paths.vscodeDir }), - plugins: this.paths.pluginDir ? spawn("yarn", ["build", "--watch"], { cwd: this.paths.pluginDir }) : undefined, + vscode: spawn("npm", ["run", "watch"], { cwd: this.paths.vscodeDir }), + vscodeWebExtensions: spawn("npm", ["run", "watch-web"], { cwd: this.paths.vscodeDir }), + plugins: this.paths.pluginDir + ? spawn("npm", ["run", "build", "--watch"], { cwd: this.paths.pluginDir }) + : undefined, } public async initialize(): Promise { diff --git a/ci/helm-chart/Chart.yaml b/ci/helm-chart/Chart.yaml index 3f4687efa222..001cb40e5014 100644 --- a/ci/helm-chart/Chart.yaml +++ b/ci/helm-chart/Chart.yaml @@ -15,9 +15,9 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 3.20.0 +version: 3.58.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. -appVersion: 4.89.1 +appVersion: 4.144.0 diff --git a/ci/helm-chart/templates/deployment.yaml b/ci/helm-chart/templates/deployment.yaml index e1925ee47922..18bece028fc6 100644 --- a/ci/helm-chart/templates/deployment.yaml +++ b/ci/helm-chart/templates/deployment.yaml @@ -3,23 +3,23 @@ kind: Deployment metadata: name: {{ include "code-server.fullname" . }} labels: - app.kubernetes.io/name: {{ include "code-server.name" . }} - helm.sh/chart: {{ include "code-server.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} + {{- include "code-server.labels" . | nindent 4 }} + {{- if .Values.annotations }} + annotations: {{- toYaml .Values.annotations | nindent 4 }} + {{- end }} spec: - replicas: 1 + {{- if ne .Values.replicaCount nil }} + replicas: {{ .Values.replicaCount }} + {{- end }} strategy: type: Recreate selector: matchLabels: - app.kubernetes.io/name: {{ include "code-server.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} + {{- include "code-server.selectorLabels" . | nindent 6 }} template: metadata: labels: - app.kubernetes.io/name: {{ include "code-server.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} + {{- include "code-server.selectorLabels" . | nindent 8 }} {{- if .Values.podAnnotations }} annotations: {{- toYaml .Values.podAnnotations | nindent 8 }} {{- end }} @@ -35,8 +35,9 @@ spec: securityContext: fsGroup: {{ .Values.securityContext.fsGroup }} {{- end }} - {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + {{- if or (and .Values.volumePermissions.enabled .Values.persistence.enabled) .Values.extraInitContainers }} initContainers: + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} - name: init-chmod-data image: busybox:latest imagePullPolicy: IfNotPresent @@ -50,6 +51,7 @@ spec: volumeMounts: - name: data mountPath: /home/coder + {{- end }} {{- if .Values.extraInitContainers }} {{ tpl .Values.extraInitContainers . | indent 6}} {{- end }} @@ -123,14 +125,18 @@ spec: containerPort: {{ .port }} protocol: {{ .protocol }} {{- end }} + {{- if ne .Values.livenessProbe.enabled false }} livenessProbe: httpGet: - path: / + path: /healthz port: http + {{- end }} + {{- if ne .Values.readinessProbe.enabled false }} readinessProbe: httpGet: - path: / + path: /healthz port: http + {{- end }} resources: {{- toYaml .Values.resources | nindent 12 }} {{- with .Values.nodeSelector }} diff --git a/ci/helm-chart/templates/pvc.yaml b/ci/helm-chart/templates/pvc.yaml index 2f1c87405886..206b834e930d 100644 --- a/ci/helm-chart/templates/pvc.yaml +++ b/ci/helm-chart/templates/pvc.yaml @@ -9,10 +9,7 @@ metadata: {{ toYaml . | indent 4 }} {{- end }} labels: - app.kubernetes.io/name: {{ include "code-server.name" . }} - helm.sh/chart: {{ include "code-server.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} + {{- include "code-server.labels" . | nindent 4 }} spec: accessModes: - {{ .Values.persistence.accessMode | quote }} diff --git a/ci/helm-chart/templates/secrets.yaml b/ci/helm-chart/templates/secrets.yaml index ae59be450743..93e75800dffd 100644 --- a/ci/helm-chart/templates/secrets.yaml +++ b/ci/helm-chart/templates/secrets.yaml @@ -6,10 +6,7 @@ metadata: annotations: "helm.sh/hook": "pre-install" labels: - app.kubernetes.io/name: {{ include "code-server.name" . }} - helm.sh/chart: {{ include "code-server.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} + {{- include "code-server.labels" . | nindent 4 }} type: Opaque data: {{- if .Values.password }} diff --git a/ci/helm-chart/templates/service.yaml b/ci/helm-chart/templates/service.yaml index d5a3c5e8ab38..27c4cc49e299 100644 --- a/ci/helm-chart/templates/service.yaml +++ b/ci/helm-chart/templates/service.yaml @@ -3,12 +3,14 @@ kind: Service metadata: name: {{ include "code-server.fullname" . }} labels: - app.kubernetes.io/name: {{ include "code-server.name" . }} - helm.sh/chart: {{ include "code-server.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} + {{- include "code-server.labels" . | nindent 4 }} + annotations: + {{- with .Values.service.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: type: {{ .Values.service.type }} + loadBalancerClass: {{ .Values.service.loadBalancerClass }} ports: - port: {{ .Values.service.port }} targetPort: http diff --git a/ci/helm-chart/templates/serviceaccount.yaml b/ci/helm-chart/templates/serviceaccount.yaml index df9e1e37562b..2fa308fec172 100644 --- a/ci/helm-chart/templates/serviceaccount.yaml +++ b/ci/helm-chart/templates/serviceaccount.yaml @@ -3,9 +3,6 @@ apiVersion: v1 kind: ServiceAccount metadata: labels: - app.kubernetes.io/name: {{ include "code-server.name" . }} - helm.sh/chart: {{ include "code-server.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} + {{- include "code-server.labels" . | nindent 4 }} name: {{ template "code-server.serviceAccountName" . }} {{- end -}} diff --git a/ci/helm-chart/templates/tests/test-connection.yaml b/ci/helm-chart/templates/tests/test-connection.yaml index 2e67f56ec64c..dd81f8904e06 100644 --- a/ci/helm-chart/templates/tests/test-connection.yaml +++ b/ci/helm-chart/templates/tests/test-connection.yaml @@ -3,16 +3,13 @@ kind: Pod metadata: name: "{{ include "code-server.fullname" . }}-test-connection" labels: - app.kubernetes.io/name: {{ include "code-server.name" . }} - helm.sh/chart: {{ include "code-server.chart" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/managed-by: {{ .Release.Service }} + {{- include "code-server.labels" . | nindent 4 }} annotations: - "helm.sh/hook": test-success + "helm.sh/hook": test spec: containers: - name: wget image: busybox command: ['wget'] - args: ['{{ include "code-server.fullname" . }}:{{ .Values.service.port }}'] + args: ['{{ include "code-server.fullname" . }}:{{ .Values.service.port }}/healthz'] restartPolicy: Never diff --git a/ci/helm-chart/values.yaml b/ci/helm-chart/values.yaml index b4e6816258a4..005a687d51fc 100644 --- a/ci/helm-chart/values.yaml +++ b/ci/helm-chart/values.yaml @@ -6,7 +6,7 @@ replicaCount: 1 image: repository: codercom/code-server - tag: '4.89.1' + tag: '4.144.0' pullPolicy: Always # Specifies one or more secrets to be used when pulling images from a @@ -19,6 +19,9 @@ nameOverride: "" fullnameOverride: "" hostnameOverride: "" +# The existing secret to use for code-server authentication in the frontend. the password is stored in the secret under the key `password` +# existingSecret: "" + serviceAccount: # Specifies whether a service account should be created create: true @@ -28,6 +31,13 @@ serviceAccount: # If not set and create is true, a name is generated using the fullname template name: "" +# Specifies annotations for deployment +annotations: {} + +# code-server.labels -- The Deployment labels. See: +# https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ +labels: {} + podAnnotations: {} podSecurityContext: {} @@ -38,6 +48,8 @@ priorityClassName: "" service: type: ClusterIP port: 8080 + loadBalancerClass: null + annotations: {} ingress: enabled: false @@ -72,8 +84,9 @@ extraArgs: [] extraVars: [] # - name: DISABLE_TELEMETRY # value: "true" +# if dind is desired: # - name: DOCKER_HOST -# value: "tcp://localhost:2375" +# value: "tcp://localhost:2376" ## ## Init containers parameters: @@ -104,6 +117,12 @@ resources: {} # cpu: 100m # memory: 1000Mi +livenessProbe: + enabled: true + +readinessProbe: + enabled: true + nodeSelector: {} tolerations: [] @@ -136,25 +155,39 @@ lifecycle: # - -c # - curl -s -L SOME_SCRIPT | bash + # for dind, the following may be helpful + # postStart: + # exec: + # command: + # - /bin/sh + # - -c + # - | + # sudo apt-get update \ + # && sudo apt-get install -y docker.io + ## Enable an Specify container in extraContainers. ## This is meant to allow adding code-server dependencies, like docker-dind. extraContainers: | # If docker-dind is used, DOCKER_HOST env is mandatory to set in "extraVars" -#- name: docker-dind -# image: docker:19.03-dind -# imagePullPolicy: IfNotPresent -# resources: -# requests: -# cpu: 250m -# memory: 256M -# securityContext: -# privileged: true -# procMount: Default -# env: -# - name: DOCKER_TLS_CERTDIR -# value: "" -# - name: DOCKER_DRIVER -# value: "overlay2" +# - name: docker-dind +# image: docker:28.3.2-dind +# imagePullPolicy: IfNotPresent +# resources: +# requests: +# cpu: 1 +# ephemeral-storage: "50Gi" +# memory: 10Gi +# securityContext: +# privileged: true +# procMount: Default +# env: +# - name: DOCKER_TLS_CERTDIR +# value: "" # disable TLS setup +# command: +# - dockerd +# - --host=unix:///var/run/docker.sock +# - --host=tcp://0.0.0.0:2376 + extraInitContainers: | # - name: customization diff --git a/ci/lib.sh b/ci/lib.sh index 2b5023fd1c6b..bd9c5c9c0c53 100755 --- a/ci/lib.sh +++ b/ci/lib.sh @@ -44,11 +44,84 @@ rsync() { command rsync -a --del "$@" } -ARCH="$(arch)" -export ARCH -OS=$(os) -export OS +if [[ ! ${ARCH-} ]]; then + ARCH=$(arch) + export ARCH +fi + +# Windows predefines OS as Windows_NT for every process, so on a windows shell +# the check below would always find a value and never call os(). That is not a +# name this build knows, so it does not count as one the caller chose. +if [[ ! ${OS-} || ${OS-} == "Windows_NT" ]]; then + OS=$(os) + export OS +fi # RELEASE_PATH is the destination directory for the release from the root. # Defaults to release -RELEASE_PATH="${RELEASE_PATH-release}" +if [[ ! ${RELEASE_PATH-} ]]; then + RELEASE_PATH="release" + export RELEASE_PATH +fi + +nodeOS() { + osname=$OS + case $osname in + macos) osname=darwin ;; + windows) osname=win32 ;; + esac + echo "$osname" +} + +nodeArch() { + cpu=$ARCH + case $cpu in + amd64) cpu=x64 ;; + esac + echo "$cpu" +} + +run-steps() { + local -i failed=0 + mkdir -p .cache + rm -f .cache/checklist + while (( $# )) ; do + local name=$1 ; shift + local fn=$1 ; shift + echo "$name..." + # Only run if an earlier step has not failed. + # For all failed steps, write out an empty checkbox. + if [[ $failed == 0 ]] ; then + if $fn | indent ; then + echo "- [X] $name" >> .cache/checklist + else + ((failed++)) + echo "- [ ] $name" >> .cache/checklist + echo "Failed" | indent + fi + else + echo "- [ ] $name" >> .cache/checklist + echo "Skipped" | indent + fi + done + if [[ $failed != 0 ]] ; then + return 1 + fi +} + +quiet() { + "$@" >/dev/null +} + +indent() { + local count=2 + local space + space=$(printf "%${count}s") + sed "s/^/$space| /g" +} + +# See gulpfile.reh.ts for available targets. +if [[ ! ${VSCODE_TARGET-} ]]; then + VSCODE_TARGET="$(nodeOS)-$(nodeArch)" + export VSCODE_TARGET +fi diff --git a/ci/release-image/Dockerfile b/ci/release-image/Dockerfile index afdd1b851601..4c91e291e0e8 100644 --- a/ci/release-image/Dockerfile +++ b/ci/release-image/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:experimental -ARG BASE=debian:12 +ARG BASE=debian:13 FROM scratch AS packages COPY release-packages/code-server*.deb /tmp/ @@ -31,7 +31,10 @@ RUN sed -i "s/# en_US.UTF-8/en_US.UTF-8/" /etc/locale.gen \ && locale-gen ENV LANG=en_US.UTF-8 -RUN adduser --gecos '' --disabled-password coder \ +RUN if grep -q 1000 /etc/passwd; then \ + userdel -r "$(id -un 1000)"; \ + fi \ + && adduser --gecos '' --disabled-password coder \ && echo "coder ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/nopasswd RUN ARCH="$(dpkg --print-architecture)" \ diff --git a/ci/release-image/docker-bake.hcl b/ci/release-image/docker-bake.hcl index 182f12791ec1..ecb0c313daed 100644 --- a/ci/release-image/docker-bake.hcl +++ b/ci/release-image/docker-bake.hcl @@ -16,9 +16,11 @@ variable "GITHUB_REGISTRY" { group "default" { targets = [ + "code-server-debian-13", "code-server-debian-12", "code-server-ubuntu-focal", "code-server-ubuntu-noble", + "code-server-ubuntu-resolute", "code-server-fedora-39", "code-server-opensuse-tumbleweed", ] @@ -48,20 +50,30 @@ function "gen_tags_for_docker_and_ghcr" { ) } -target "code-server-debian-12" { +target "code-server-debian-13" { dockerfile = "ci/release-image/Dockerfile" tags = concat( gen_tags_for_docker_and_ghcr(""), gen_tags_for_docker_and_ghcr("debian"), + gen_tags_for_docker_and_ghcr("trixie"), + ) + platforms = ["linux/amd64", "linux/arm64"] +} + +target "code-server-debian-12" { + dockerfile = "ci/release-image/Dockerfile" + tags = concat( gen_tags_for_docker_and_ghcr("bookworm"), ) + args = { + BASE = "debian:12" + } platforms = ["linux/amd64", "linux/arm64"] } target "code-server-ubuntu-focal" { dockerfile = "ci/release-image/Dockerfile" tags = concat( - gen_tags_for_docker_and_ghcr("ubuntu"), gen_tags_for_docker_and_ghcr("focal"), ) args = { @@ -74,6 +86,7 @@ target "code-server-ubuntu-noble" { dockerfile = "ci/release-image/Dockerfile" tags = concat( gen_tags_for_docker_and_ghcr("noble"), + gen_tags_for_docker_and_ghcr("ubuntu"), ) args = { BASE = "ubuntu:noble" @@ -81,6 +94,17 @@ target "code-server-ubuntu-noble" { platforms = ["linux/amd64", "linux/arm64"] } +target "code-server-ubuntu-resolute" { + dockerfile = "ci/release-image/Dockerfile" + tags = concat( + gen_tags_for_docker_and_ghcr("resolute"), + ) + args = { + BASE = "ubuntu:resolute" + } + platforms = ["linux/amd64", "linux/arm64"] +} + target "code-server-fedora-39" { dockerfile = "ci/release-image/Dockerfile.fedora" tags = concat( diff --git a/ci/release-image/entrypoint.sh b/ci/release-image/entrypoint.sh index 460b559ba9cb..efe2f39d9bd9 100755 --- a/ci/release-image/entrypoint.sh +++ b/ci/release-image/entrypoint.sh @@ -7,7 +7,7 @@ eval "$(fixuid -q)" if [ "${DOCKER_USER-}" ]; then USER="$DOCKER_USER" - if [ "$DOCKER_USER" != "$(whoami)" ]; then + if [ -z "$(id -u "$DOCKER_USER" 2>/dev/null)" ]; then echo "$DOCKER_USER ALL=(ALL) NOPASSWD:ALL" | sudo tee -a /etc/sudoers.d/nopasswd > /dev/null # Unfortunately we cannot change $HOME as we cannot move any bind mounts # nor can we bind mount $HOME into a new home as that requires a privileged container. diff --git a/ci/steps/brew-bump.sh b/ci/steps/brew-bump.sh deleted file mode 100755 index e8af2a22e8fd..000000000000 --- a/ci/steps/brew-bump.sh +++ /dev/null @@ -1,37 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -main() { - # Only sourcing this so we get access to $VERSION - source ./ci/lib.sh - source ./ci/steps/steps-lib.sh - - echo "Checking environment variables" - - # We need VERSION to bump the brew formula - if ! is_env_var_set "VERSION"; then - echo "VERSION is not set" - exit 1 - fi - - # We need HOMEBREW_GITHUB_API_TOKEN to push up commits - if ! is_env_var_set "HOMEBREW_GITHUB_API_TOKEN"; then - echo "HOMEBREW_GITHUB_API_TOKEN is not set" - exit 1 - fi - - # Find the docs for bump-formula-pr here - # https://github.com/Homebrew/brew/blob/master/Library/Homebrew/dev-cmd/bump-formula-pr.rb#L18 - local output - if ! output=$(brew bump-formula-pr --version="${VERSION}" code-server --no-browse --no-audit --message="PR opened by @${GITHUB_ACTOR}" 2>&1); then - if [[ $output == *"Duplicate PRs should not be opened"* ]]; then - echo "$VERSION is already submitted" - exit 0 - else - echo "$output" - exit 1 - fi - fi -} - -main "$@" diff --git a/ci/steps/publish-npm.sh b/ci/steps/publish-npm.sh deleted file mode 100755 index 468dc98bae18..000000000000 --- a/ci/steps/publish-npm.sh +++ /dev/null @@ -1,153 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -main() { - cd "$(dirname "$0")/../.." - source ./ci/lib.sh - source ./ci/steps/steps-lib.sh - - ## Authentication tokens - # Needed to publish on NPM - if ! is_env_var_set "NPM_TOKEN"; then - echo "NPM_TOKEN is not set. Cannot publish to npm without credentials." - exit 1 - fi - - ## Publishing Information - # All the variables below are used to determine how we should publish - # the npm package. We also use this information for bumping the version. - # This is because npm won't publish your package unless it's a new version. - # i.e. for development, we bump the version to -- - # example: "version": "4.0.1-4769-ad7b23cfe6ffd72914e34781ef7721b129a23040" - # We use this to grab the PR_NUMBER - if ! is_env_var_set "GITHUB_REF"; then - echo "GITHUB_REF is not set. Are you running this locally? We rely on values provided by GitHub." - exit 1 - fi - - # We use this when setting NPM_VERSION - if ! is_env_var_set "GITHUB_SHA"; then - echo "GITHUB_SHA is not set. Are you running this locally? We rely on values provided by GitHub." - exit 1 - fi - - # We use this to determine the NPM_ENVIRONMENT - if ! is_env_var_set "GITHUB_EVENT_NAME"; then - echo "GITHUB_EVENT_NAME is not set. Are you running this locally? We rely on values provided by GitHub." - exit 1 - fi - - # Check that we're using at least v7 of npm CLI - if ! command -v jq &> /dev/null; then - echo "Couldn't find jq" - echo "We need this in order to modify the package.json for dev builds." - exit 1 - fi - - # This allows us to publish to npm in CI workflows - if [[ ${CI-} ]]; then - echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc - fi - - ## Environment - # This string is used to determine how we should tag the npm release. - # Environment can be one of three choices: - # "development" - this means we tag with the PR number, allowing - # a developer to install this version with `yarn add code-server@` - # "staging" - this means we tag with `beta`, allowing - # a developer to install this version with `yarn add code-server@beta` - # "production" - this means we tag with `latest` (default), allowing - # a developer to install this version with `yarn add code-server@latest` - if ! is_env_var_set "NPM_ENVIRONMENT"; then - echo "NPM_ENVIRONMENT is not set." - echo "Determining in script based on GITHUB environment variables." - - if [[ "$GITHUB_EVENT_NAME" == 'push' && "$GITHUB_REF" == 'refs/heads/main' ]]; then - NPM_ENVIRONMENT="staging" - else - NPM_ENVIRONMENT="development" - fi - - fi - - # NOTE@jsjoeio - this script assumes we have the artifact downloaded on disk - # That happens in CI as a step before we run this. - # https://github.com/actions/upload-artifact/issues/38 - tar -xzf release-npm-package/package.tar.gz - - # We use this to set the name of the package in the - # package.json - PACKAGE_NAME="code-server" - - # NOTES:@jsjoeio - # We only need to run npm version for "development" and "staging". - # This is because our release:prep script automatically bumps the version - # in the package.json and we commit it as part of the release PR. - if [[ "$NPM_ENVIRONMENT" == "production" ]]; then - NPM_VERSION="$VERSION" - # This means the npm version will be published as "stable" - # and installed when a user runs `yarn install code-server` - NPM_TAG="latest" - else - COMMIT_SHA="$GITHUB_SHA" - - if [[ "$NPM_ENVIRONMENT" == "staging" ]]; then - NPM_VERSION="$VERSION-beta-$COMMIT_SHA" - # This means the npm version will be tagged with "beta" - # and installed when a user runs `yarn install code-server@beta` - NPM_TAG="beta" - PACKAGE_NAME="@coder/code-server-pr" - fi - - if [[ "$NPM_ENVIRONMENT" == "development" ]]; then - # Source: https://github.com/actions/checkout/issues/58#issuecomment-614041550 - PR_NUMBER=$(echo "$GITHUB_REF" | awk 'BEGIN { FS = "/" } ; { print $3 }') - NPM_VERSION="$VERSION-$PR_NUMBER-$COMMIT_SHA" - PACKAGE_NAME="@coder/code-server-pr" - # This means the npm version will be tagged with "" - # and installed when a user runs `yarn install code-server@` - NPM_TAG="$PR_NUMBER" - fi - - echo "- tag: $NPM_TAG" - echo "- version: $NPM_VERSION" - echo "- package name: $PACKAGE_NAME" - echo "- npm environment: $NPM_ENVIRONMENT" - - # We modify the version in the package.json - # to be the current version + the PR number + commit SHA - # or we use current version + beta + commit SHA - # Example: "version": "4.0.1-4769-ad7b23cfe6ffd72914e34781ef7721b129a23040" - # Example: "version": "4.0.1-beta-ad7b23cfe6ffd72914e34781ef7721b129a23040" - pushd release - # NOTE@jsjoeio - # I originally tried to use `yarn version` but ran into issues and abandoned it. - npm version "$NPM_VERSION" - # NOTE@jsjoeio - # Use the development package name - # This is so we don't clutter the code-server versions on npm - # with development versions. - # jq can't edit in place so we must store in memory and echo - local contents - contents="$(jq ".name |= \"$PACKAGE_NAME\"" package.json)" - echo "${contents}" > package.json - popd - fi - - # NOTE@jsjoeio - # We need to make sure we haven't already published the version. - # If we get error, continue with script because we want to publish - # If version is valid, we check if we're publishing the same one - local hasVersion - if hasVersion=$(npm view "$PACKAGE_NAME@$NPM_VERSION" version 2> /dev/null) && [[ $hasVersion == "$NPM_VERSION" ]]; then - echo "$NPM_VERSION is already published under $PACKAGE_NAME" - return - fi - - # NOTE@jsjoeio - # Since the dev builds are scoped to @coder - # We pass --access public to ensure npm knows it's not private. - yarn publish --non-interactive release --tag "$NPM_TAG" --access public -} - -main "$@" diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md index fcd75569790e..d857b20c3850 100644 --- a/docs/CONTRIBUTING.md +++ b/docs/CONTRIBUTING.md @@ -5,13 +5,10 @@ - [Requirements](#requirements) - [Linux-specific requirements](#linux-specific-requirements) -- [Creating pull requests](#creating-pull-requests) - - [Commits and commit history](#commits-and-commit-history) - [Development workflow](#development-workflow) - [Version updates to Code](#version-updates-to-code) - [Patching Code](#patching-code) - [Build](#build) - - [Creating a Standalone Release](#creating-a-standalone-release) - [Troubleshooting](#troubleshooting) - [I see "Forbidden access" when I load code-server in the browser](#i-see-forbidden-access-when-i-load-code-server-in-the-browser) - ["Can only have one anonymous define call per script"](#can-only-have-one-anonymous-define-call-per-script) @@ -28,19 +25,16 @@ -- [Detailed CI and build process docs](../ci) - ## Requirements The prerequisites for contributing to code-server are almost the same as those -for [VS -Code](https://github.com/Microsoft/vscode/wiki/How-to-Contribute#prerequisites). +for [VS Code](https://github.com/Microsoft/vscode/wiki/How-to-Contribute#prerequisites). Here is what is needed: -- `node` v18.x +- `node` v24.x - `git` v2.x or greater - [`git-lfs`](https://git-lfs.github.com) -- [`yarn`](https://classic.yarnpkg.com/en/) +- [`npm`](https://www.npmjs.com/) - Used to install JS packages and run scripts - [`nfpm`](https://nfpm.goreleaser.com/) - Used to build `.deb` and `.rpm` packages @@ -60,38 +54,23 @@ Here is what is needed: ### Linux-specific requirements -If you're developing code-server on Linux, make sure you have installed or install the following dependencies: +If you're developing code-server on Linux, make sure you have installed or +install the following dependencies: ```shell sudo apt-get install build-essential g++ libx11-dev libxkbfile-dev libsecret-1-dev libkrb5-dev python-is-python3 ``` -These are required by Code. See [their Wiki](https://github.com/microsoft/vscode/wiki/How-to-Contribute#prerequisites) for more information. - -## Creating pull requests - -Please create a [GitHub Issue](https://github.com/coder/code-server/issues) that -includes context for issues that you see. You can skip this if the proposed fix -is minor. - -In your pull requests (PR), link to the issue that the PR solves. - -Please ensure that the base of your PR is the **main** branch. - -### Commits and commit history - -We prefer a clean commit history. This means you should squash all fixups and -fixup-type commits before asking for a review (e.g., clean up, squash, then force -push). If you need help with this, feel free to leave a comment in your PR, and -we'll guide you. +These are required by Code. See [their Wiki](https://github.com/microsoft/vscode/wiki/How-to-Contribute#prerequisites) +for more information. ## Development workflow 1. `git clone https://github.com/coder/code-server.git` - Clone `code-server` 2. `git submodule update --init` - Clone `vscode` submodule 3. `quilt push -a` - Apply patches to the `vscode` submodule. -4. `yarn` - Install dependencies -5. `yarn watch` - Launch code-server localhost:8080. code-server will be live +4. `npm install` - Install dependencies +5. `npm run watch` - Launch code-server localhost:8080. code-server will be live reloaded when changes are made; the browser needs to be refreshed manually. When pulling down changes that include modifications to the patches you will @@ -99,109 +78,114 @@ need to apply them with `quilt`. If you pull down changes that update the `vscode` submodule you will need to run `git submodule update --init` and re-apply the patches. +When you make a change that affects people deploying the marketplace please +update the changelog as part of your PR. + +Note that building code-server takes a very, very long time, and loading it in +the browser in development mode also takes a very, very long time. + +Display language (Spanish, etc) support only works in a full build; it will not +work in development mode. + +Generally we prefer that PRs be squashed into `main` but you can rebase or merge +if it is important to keep the individual commits (make sure to clean up the +commits first if you are doing this). + ### Version updates to Code -1. Update the `lib/vscode` submodule to the desired upstream version branch. - 1. `cd lib/vscode && git checkout release/1.66 && cd ../..` - 2. `git add lib && git commit -m "chore: update Code"` -2. Apply the patches (`quilt push -a`) or restore your stashed changes. At this - stage you may need to resolve conflicts. For example use `quilt push -f`, - manually apply the rejected portions, then `quilt refresh`. -3. From the code-server **project root**, run `yarn install`. -4. Test code-server locally to make sure everything works. -5. Check the Node.js version that's used by Electron (which is shipped with VS - Code. If necessary, update your version of Node.js to match. -6. Commit the updated submodule and patches to `code-server`. -7. Open a PR. - -Tip: if you're certain all patches are applied correctly and you simply need to -refresh, you can use this trick: +PRs will be automatically created with updates to VS Code. If a patch cannot be +automatically resolved, it will be necessary to clone the branch, resolve the +conflicts manually, and finish the update. To do this: -```shell -while quilt push; do quilt refresh; done -``` +1. Apply as many patches as possible `quilt push -a`. +2. Once you hit a conflict, force apply with `quilt push -f`, manually add back + the rejected code, then run `quilt refresh`. +3. Once all patches have been resolved, run `./ci/build/update.sh` to finish the + update process. +4. Commit all changes, push them up to the branch, and update the checklist in + the PR description. -[Source](https://raphaelhertzog.com/2012/08/08/how-to-use-quilt-to-manage-patches-in-debian-packages/) +Once the PR is ready, manually verify that the unreleased changelog section +contains all the changes going into this version before merging. ### Patching Code -0. You can go through the patch stack with `quilt push` and `quilt pop`. -1. Create a new patch (`quilt new {name}.diff`) or use an existing patch. -1. Add the file(s) you are patching (`quilt add [-P patch] {file}`). A file +1. You can go through the patch stack with `quilt push` and `quilt pop`. +2. Create a new patch (`quilt new {name}.diff`) or use an existing patch. +3. Add the file(s) you are patching (`quilt add [-P patch] {file}`). A file **must** be added before you make changes to it. -1. Make your changes. Patches do not need to be independent of each other but +4. Make your changes. Patches do not need to be independent of each other but each patch must result in a working code-server without any broken in-between states otherwise they are difficult to test and modify. -1. Add your changes to the patch (`quilt refresh`) -1. Add a comment in the patch about the reason for the patch and how to +5. Add your changes to the patch (`quilt refresh`) +6. Add a comment in the patch about the reason for the patch and how to reproduce the behavior it fixes or adds. Every patch should have an e2e test as well. ### Build -You can build as follows: +You can build a full production release as follows: ```shell -yarn build -yarn build:vscode -yarn release +git submodule update --init +quilt push -a +npm install +npm run build +VERSION=0.0.0 npm run build:vscode +KEEP_MODULES=1 npm run release ``` -_NOTE: this does not keep `node_modules`. If you want them to be kept, use `KEEP_MODULES=1 yarn release` (if you're testing in Coder, you'll want to do this)_ +You can omit `KEEP_MODULES` if you intend to use this in a platform-agnostic way +(like for publishing to NPM), but since the VS Code build process does +post-processing deletion of the modules, it is recommended to keep the modules +when possible, since if you install them later you will have more than is +required. `KEEP_MODULES` will also bundle Node and the code-server entry script. Run your build: +```shell +./release/bin/code-server +``` + +Or if you omitted `KEEP_MODULES`: + ```shell cd release -npm install --omit=dev # Skip if you used KEEP_MODULES=1 -# Runs the built JavaScript with Node. +npm install --omit=dev node . ``` -Build the release packages (make sure that you run `yarn release` first): +Then, to package the release: ```shell -yarn release:standalone -yarn test:integration -yarn package +npm run package ``` > On Linux, the currently running distro will become the minimum supported -> version. In our GitHub Actions CI, we use CentOS 7 for maximum compatibility. +> version. In our GitHub Actions CI, we use CentOS 8 for maximum compatibility. > If you need your builds to support older distros, run the build commands > inside a Docker container with all the build requirements installed. -#### Creating a Standalone Release - -Part of the build process involves creating standalone releases. At the time of -writing, we do this for the following platforms/architectures: - -- Linux amd64 (.tar.gz, .deb, and .rpm) -- Linux arm64 (.tar.gz, .deb, and .rpm) -- Linux arm7l (.tar.gz) -- Linux armhf.deb -- Linux armhf.rpm -- macOS amd64 (Intel-based) - -Currently, these are compiled in CI using the `yarn release-standalone` command -in the `release.yaml` workflow. We then upload them to the draft release and -distribute via GitHub Releases. - ### Troubleshooting #### I see "Forbidden access" when I load code-server in the browser -This means your patches didn't apply correctly. We have a patch to remove the auth from vanilla Code because we use our own. +This means your patches didn't apply correctly. We have a patch to remove the +auth from vanilla Code because we use our own. -Try popping off the patches with `quilt pop -a` and reapplying with `quilt push -a`. +Try popping off the patches with `quilt pop -a` and reapplying with `quilt push +-a`. #### "Can only have one anonymous define call per script" -Code might be trying to use a dev or prod HTML in the wrong context. You can try re-running code-server and setting `VSCODE_DEV=1`. +Code might be trying to use a dev or prod HTML in the wrong context. You can try +re-running code-server and setting `VSCODE_DEV=1`. ### Help -If you get stuck or need help, you can always start a new GitHub Discussion [here](https://github.com/coder/code-server/discussions). One of the maintainers will respond and help you out. +If you get stuck or need help, you can always start a new GitHub Discussion +[here](https://github.com/coder/code-server/discussions). One of the maintainers +will respond and help you out. ## Test @@ -219,7 +203,9 @@ Our unit tests are written in TypeScript and run using These live under [test/unit](../test/unit). -We use unit tests for functions and things that can be tested in isolation. The file structure is modeled closely after `/src` so it's easy for people to know where test files should live. +We use unit tests for functions and things that can be tested in isolation. The +file structure is modeled closely after `/src` so it's easy for people to know +where test files should live. ### Script tests @@ -227,12 +213,14 @@ Our script tests are written in bash and run using [bats](https://github.com/bat These tests live under `test/scripts`. -We use these to test anything related to our scripts (most of which live under `ci`). +We use these to test anything related to our scripts (most of which live under +`ci`). ### Integration tests -These are a work in progress. We build code-server and run tests with `yarn test:integration`, which ensures that code-server builds work on their respective -platforms. +These are a work in progress. We build code-server and run tests with `npm run +test:integration`, which ensures that code-server builds work on their +respective platforms. Our integration tests look at components that rely on one another. For example, testing the CLI requires us to build and package code-server. @@ -253,15 +241,10 @@ Take a look at `codeServer.test.ts` to see how you would use it (see We also have a model where you can create helpers to use within tests. See [models/CodeServer.ts](../test/e2e/models/CodeServer.ts) for an example. -Generally speaking, e2e means testing code-server while running in the browser -and interacting with it in a way that's similar to how a user would interact -with it. When running these tests with `yarn test:e2e`, you must have -code-server running locally. In CI, this is taken care of for you. - ## Structure -The `code-server` script serves as an HTTP API for login and starting a remote -Code process. +code-server essentially serves as an HTTP API for logging in and starting a +remote Code process. The CLI code is in [src/node](../src/node) and the HTTP routes are implemented in [src/node/routes](../src/node/routes). diff --git a/docs/FAQ.md b/docs/FAQ.md index f300d410eea4..c492c73b2c59 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -17,11 +17,13 @@ - [Where is VS Code configuration stored?](#where-is-vs-code-configuration-stored) - [How can I reuse my VS Code configuration?](#how-can-i-reuse-my-vs-code-configuration) - [How does code-server decide what workspace or folder to open?](#how-does-code-server-decide-what-workspace-or-folder-to-open) +- [Can I open a file at a specific line from a URL?](#can-i-open-a-file-at-a-specific-line-from-a-url) - [How do I access my Documents/Downloads/Desktop folders in code-server on macOS?](#how-do-i-access-my-documentsdownloadsdesktop-folders-in-code-server-on-macos) - [How do I direct server-side requests through a proxy?](#how-do-i-direct-server-side-requests-through-a-proxy) - [How do I debug issues with code-server?](#how-do-i-debug-issues-with-code-server) - [What is the healthz endpoint?](#what-is-the-healthz-endpoint) - [What is the heartbeat file?](#what-is-the-heartbeat-file) +- [How do I change the reconnection grace time?](#how-do-i-change-the-reconnection-grace-time) - [How do I change the password?](#how-do-i-change-the-password) - [Can I store my password hashed?](#can-i-store-my-password-hashed) - [Is multi-tenancy possible?](#is-multi-tenancy-possible) @@ -31,12 +33,15 @@ - [What's the difference between code-server and Theia?](#whats-the-difference-between-code-server-and-theia) - [What's the difference between code-server and OpenVSCode-Server?](#whats-the-difference-between-code-server-and-openvscode-server) - [What's the difference between code-server and GitHub Codespaces?](#whats-the-difference-between-code-server-and-github-codespaces) +- [What's the difference between code-server and VS Code web?](#whats-the-difference-between-code-server-and-vs-code-web) - [Does code-server have any security login validation?](#does-code-server-have-any-security-login-validation) - [Are there community projects involving code-server?](#are-there-community-projects-involving-code-server) - [How do I change the port?](#how-do-i-change-the-port) - [How do I hide the coder/coder promotion in Help: Getting Started?](#how-do-i-hide-the-codercoder-promotion-in-help-getting-started) - [How do I disable the proxy?](#how-do-i-disable-the-proxy) - [How do I disable file download?](#how-do-i-disable-file-download) +- [Why do web views not work?](#why-do-web-views-not-work) +- [Can I run code-server with systemd socket activation?](#can-i-run-code-server-with-systemd-socket-activation) @@ -227,6 +232,39 @@ code-server tries the following in this order: 3. The workspace or directory passed via the command line 4. The last opened workspace or directory +## Can I open a file at a specific line from a URL? + +Yes. In addition to `workspace` and `folder`, code-server supports VS Code's +`payload` query parameter, which can open a specific file — optionally at a +line and column — once the workbench loads. + +`payload` is a URL-encoded JSON array of `[key, value]` string pairs. The +`openFile` key takes a `vscode-remote:///` URI, where +`` is the host you use to reach code-server. Add +`["gotoLineMode","true"]` to have a trailing `:line[:column]` suffix on the +path interpreted as a cursor position: + +```text +https://code.example.com/?folder=/home/coder/project&payload=[["gotoLineMode","true"],["openFile","vscode-remote://code.example.com/home/coder/project/src/app.py:10:5"]] +``` + +(with the `payload` value URL-encoded). Notes: + +- Paths must be absolute; there is no form relative to `folder`. +- This is upstream VS Code web behavior (the same mechanism vscode.dev uses), + so it works without any code-server-specific configuration. + +For example, to generate links from a shell: + +```sh +#!/bin/sh +# usage: code-link [line[:column]] +HOST=code.example.com +payload="[[\"gotoLineMode\",\"true\"],[\"openFile\",\"vscode-remote://$HOST$1${2:+:$2}\"]]" +printf 'https://%s/?folder=%s&payload=%s\n' "$HOST" "$(dirname "$1")" \ + "$(printf '%s' "$payload" | jq -sRr @uri)" +``` + ## How do I access my Documents/Downloads/Desktop folders in code-server on macOS? Newer versions of macOS require permission through a non-UNIX mechanism for @@ -321,12 +359,18 @@ As long as there is an active browser connection, code-server touches `~/.local/share/code-server/heartbeat` once a minute. If you want to shutdown code-server if there hasn't been an active connection -after a predetermined amount of time, you can do so by checking continuously for -the last modified time on the heartbeat file. If it is older than X minutes (or -whatever amount of time you'd like), you can kill code-server. +after a predetermined amount of time, you can use the --idle-timeout-seconds flag +or set an `CODE_SERVER_IDLE_TIMEOUT_SECONDS` environment variable. + +## How do I change the reconnection grace time? -Eventually, [#1636](https://github.com/coder/code-server/issues/1636) will make -this process better. +Pass `--reconnection-grace-time ` to `code-server`, set +`CODE_SERVER_RECONNECTION_GRACE_TIME=`, or add +`reconnection-grace-time: ` to +`~/.config/code-server/config.yaml`. + +The default is `10800` (3 hours). If a client stays disconnected longer than +this, it must reload the window. ## How do I change the password? @@ -382,6 +426,9 @@ mount into `/home/coder/myproject` from inside the `code-server` container. You need to make sure the Docker daemon's `/home/coder/myproject` is the same as the one mounted inside the `code-server` container, and the mount will work. +If you want Docker enabled when deploying on Kubernetes, look at the `values.yaml` +file for the 3 fields: `extraVars`, `lifecycle.postStart`, and `extraContainers`. + ## How do I disable telemetry? Use the `--disable-telemetry` flag to disable telemetry. @@ -439,6 +486,8 @@ Specific changes include: - The ability to use your own marketplace and collect your own telemetry - Built-in proxy for accessing ports on the remote machine integrated into VS Code's ports panel +- Settings are stored on disk like desktop VS Code, instead of in browser + storage (note that state is still stored in browser storage). - Wrapper process that spawns VS Code on-demand and has a separate CLI - Notification when updates are available - [Some other things](https://github.com/coder/code-server/tree/main/patches) @@ -447,6 +496,12 @@ Some of these changes appear very unlikely to ever be adopted by Microsoft. Some may make their way upstream, further closing the gap, but at the moment it looks like there will always be some subtle differences. +## What's the difference between code-server and VS Code web? + +VS Code web (which can be ran using `code serve-web`) has the same differences +as the Codespaces section above. VS Code web can be a better choice if you need +access to the official Microsoft marketplace. + ## Does code-server have any security login validation? code-server supports setting a single password and limits logins to two per @@ -487,3 +542,60 @@ when using the option. ## How do I disable file download? You can pass the flag `--disable-file-downloads` to `code-server` + +## Why do web views not work? + +Web views rely on service workers, and service workers are only available in a +secure context, so most likely the answer is that you are using an insecure +context (for example an IP address). + +If this happens, in the browser log you will see something like: + +> Error loading webview: Error: Could not register service workers: SecurityError: Failed to register a ServiceWorker for scope with script: An SSL certificate error occurred when fetching the script.. + +To fix this, you must either: + +- Access over localhost/127.0.0.1 which is always considered secure. +- Use a domain with a real certificate (for example with Let's Encrypt). +- Use a trusted self-signed certificate with [mkcert](https://mkcert.dev) (or + create and trust a certificate manually). +- Disable security if your browser allows it. For example, in Chromium see + `chrome://flags/#unsafely-treat-insecure-origin-as-secure` + +## Can I run code-server with systemd socket activation? + +Yes. Pass the inherited socket to code-server with `--socket-fd`. systemd +passes the first listening socket as file descriptor `3`. + +Create a socket unit, `~/.config/systemd/user/code-server.socket`: + +```ini +[Socket] +ListenStream=8080 + +[Install] +WantedBy=sockets.target +``` + +And a matching service unit, `~/.config/systemd/user/code-server.service`: + +```ini +[Service] +ExecStart=/usr/bin/code-server --socket-fd 3 +``` + +Then enable and start the socket: + +```bash +systemctl --user enable --now code-server.socket +``` + +code-server will start on the first connection and listen on the socket +systemd created. `--socket-fd` takes precedence over `--socket` and +`--bind-addr`/`--port`/`--host`, and `--socket-mode` is ignored because +systemd owns the socket's permissions. + +Socket activation only changes how code-server binds; your usual +authentication still applies (it keeps prompting for the configured password +unless you set `--auth none`), so keep authentication enabled when exposing the +server. diff --git a/docs/MAINTAINING.md b/docs/MAINTAINING.md index cabe7869672c..69263576ec2c 100644 --- a/docs/MAINTAINING.md +++ b/docs/MAINTAINING.md @@ -3,24 +3,12 @@ # Maintaining -- [Team](#team) - - [Onboarding](#onboarding) - - [Offboarding](#offboarding) -- [Workflow](#workflow) - - [Milestones](#milestones) - - [Triage](#triage) -- [Versioning](#versioning) -- [Pull requests](#pull-requests) - - [Merge strategies](#merge-strategies) - - [Changelog](#changelog) -- [Releases](#releases) - - [Publishing a release](#publishing-a-release) +- [Releasing](#releasing) - [Release Candidates](#release-candidates) - [AUR](#aur) - [Docker](#docker) - - [Homebrew](#homebrew) + - [nixpkgs](#nixpkgs) - [npm](#npm) -- [Syncing with upstream Code](#syncing-with-upstream-code) - [Testing](#testing) - [Documentation](#documentation) - [Troubleshooting](#troubleshooting) @@ -28,131 +16,28 @@ -This document is meant to serve current and future maintainers of code-server, -as well as share our workflow for maintaining the project. - -## Team - -Current maintainers: - -- @code-asher -- @jsjoeio - -Occasionally, other Coder employees may step in time to time to assist with code-server. - -### Onboarding - -To onboard a new maintainer to the project, please make sure to do the following: - -- [ ] Add to [coder/code-server](https://github.com/orgs/coder/teams/code-server) -- [ ] Add as Admin under [Repository Settings > Access](https://github.com/coder/code-server/settings/access) -- [ ] Add to [npm Coder org](https://www.npmjs.com/org/coder) -- [ ] Add as [AUR maintainer](https://aur.archlinux.org/packages/code-server/) (talk to Colin) -- [ ] Introduce to community via Discussion (see [example](https://github.com/coder/code-server/discussions/3955)) - -### Offboarding - -Very similar to Onboarding but Remove maintainer from all teams and revoke access. Please also do the following: - -- [ ] Write farewell post via Discussion (see [example](https://github.com/coder/code-server/discussions/3933)) - -## Workflow - -The workflow used by code-server maintainers aims to be easy to understood by -the community and easy enough for new maintainers to jump in and start -contributing on day one. - -### Milestones - -We operate mainly using -[milestones](https://github.com/coder/code-server/milestones). This was heavily -inspired by our friends over at [vscode](https://github.com/microsoft/vscode). - -Here are the milestones we use and how we use them: - -- "Backlog" -> Work not yet planned for a specific release. -- "On Deck" -> Work under consideration for upcoming milestones. -- "Backlog Candidates" -> Work that is not yet accepted for the backlog. We wait - for the community to weigh in. -- "" -> Work to be done for said month. - -With this flow, any un-assigned issues are essentially in triage state. Once -triaged, issues are either "Backlog" or "Backlog Candidates". They will -eventually move to "On Deck" (or be closed). Lastly, they will end up on a -version milestone where they will be worked on. - -### Triage - -We use the following process for triaging GitHub issues: - -1. Create an issue -1. Add appropriate labels to the issue (including "needs-investigation" if we - should look into it further) -1. Add the issue to a milestone - 1. If it should be fixed soon, add to version milestone or "On Deck" - 2. If not urgent, add to "Backlog" - 3. Otherwise, add to "Backlog Candidate" for future consideration - -## Versioning - -`` - -The code-server project follows traditional [semantic -versioning](https://semver.org/), with the objective of minimizing major changes -that break backward compatibility. We increment the patch level for all -releases, except when the upstream Visual Studio Code project increments its -minor version or we change the plugin API in a backward-compatible manner. In -those cases, we increment the minor version rather than the patch level. - -## Pull requests - -Ideally, every PR should fix an issue. If it doesn't, make sure it's associated -with a version milestone. - -If a PR does fix an issue, don't add it to the version milestone. Otherwise, the -version milestone will have duplicate information: the issue and the PR fixing -the issue. - -### Merge strategies - -For most things, we recommend the **squash and merge** strategy. There -may be times where **creating a merge commit** makes sense as well. Use your -best judgment. If you're unsure, you can always discuss in the PR with the team. - -### Changelog - -To save time when creating a new release for code-server, we keep a running -changelog at `CHANGELOG.md`. - -If either the author or reviewer of a PR believes the change should be mentioned -in the changelog, then it should be added. - -If there is not a **Next Version** when you modify `CHANGELOG.md`, please add it -using the template you see near the top of the changelog. - -When writing your changelog item, ask yourself: - -1. How do these changes affect code-server users? -2. What actions do they need to take (if any)? - -If you need inspiration, we suggest looking at the [Emacs -changelog](https://github.com/emacs-mirror/emacs/blob/master/etc/NEWS). - -## Releases - -### Publishing a release - -1. Go to GitHub Actions > Draft release > Run workflow on the commit you want to - release. Make sure CI has finished the build workflow on that commit or this - will fail. -2. CI will automatically grab the build artifact on that commit, inject the - version into the `package.json`, put together platform-specific packages, and - upload those packages to a draft release. -3. Summarize the major changes in the `CHANGELOG.md`. -4. Copy the relevant changelog section to the release then publish it. -5. CI will automatically publish the NPM package, Docker image, and update - Homebrew using the published release assets. -6. Bump the chart version in `Chart.yaml` and merge in the changelog updates. +We keep code-server up to date with VS Code releases (there are usually two or +three a month) but we are not generally actively developing code-server aside +from fixing regressions. + +Most of the work is keeping on top of issues and discussions. + +## Releasing + +1. Check that the changelog lists all the important changes. +2. Make sure the changelog entry lists the current version of VS Code. +3. Go to GitHub Actions > Draft release > Run workflow on the commit you want to + release. For the version we match VS Code's minor and patch version. The + patch number may become temporarily out of sync if we need to put out a + patch, but if we make our own minor change then we will not release it until + the next minor VS Code release. +4. CI will build an NPM package and platform-specific packages, and upload those + to a draft release. +5. Update the resulting draft release with the changelog contents. +6. Publish the draft release after validating it. +7. Update the changelog with the release date and bump the Helm chart version + once the Docker images have published. +8. Merge the PR submitted to coder/code-server-aur repo. #### Release Candidates @@ -167,56 +52,59 @@ full-blown release. To do this follow the same steps as above but: #### AUR -We publish to AUR as a package [here](https://aur.archlinux.org/packages/code-server/). This process is manual and can be done by following the steps in [this repo](https://github.com/coder/code-server-aur). +We publish to AUR as a package +[here](https://aur.archlinux.org/packages/code-server/). This process is manual +and can be done by following the steps in [this +repo](https://github.com/coder/code-server-aur). #### Docker -We publish code-server as a Docker image [here](https://hub.docker.com/r/codercom/code-server), tagging it both with the version and latest. +We publish code-server as a Docker image +[here](https://hub.docker.com/r/codercom/code-server), tagging it both with the +version and latest. This is currently automated with the release process. -#### Homebrew +#### nixpkgs -We publish code-server on Homebrew [here](https://github.com/Homebrew/homebrew-core/blob/master/Formula/code-server.rb). - -This is currently automated with the release process (but may fail occasionally). If it does, run this locally: - -```shell -# Replace VERSION with version -brew bump-formula-pr --version="${VERSION}" code-server --no-browse --no-audit -``` +We publish code-server in nixpkgs but it must be updated manually. #### npm -We publish code-server as a npm package [here](https://www.npmjs.com/package/code-server/v/latest). +We publish code-server as a npm package +[here](https://www.npmjs.com/package/code-server/v/latest). This is currently automated with the release process. -## Syncing with upstream Code - -Refer to the [contributing docs](https://coder.com/docs/code-server/latest/CONTRIBUTING#version-updates-to-code) for information on how to update Code within code-server. - ## Testing -Our testing structure is laid out under our [Contributing docs](https://coder.com/docs/code-server/latest/CONTRIBUTING#test). - -We hope to eventually hit 100% test coverage with our unit tests, and maybe one day our scripts (coverage not tracked currently). +Our testing structure is laid out under our [Contributing +docs](https://coder.com/docs/code-server/latest/CONTRIBUTING#test). If you're ever looking to add more tests, here are a few ways to get started: -- run `yarn test:unit` and look at the coverage chart. You'll see all the uncovered lines. This is a good place to start. -- look at `test/scripts` to see which scripts are tested. We can always use more tests there. +- run `npm run test:unit` and look at the coverage chart. You'll see all the + uncovered lines. This is a good place to start. +- look at `test/scripts` to see which scripts are tested. We can always use more + tests there. - look at `test/e2e`. We can always use more end-to-end tests. -Otherwise, talk to a current maintainer and ask which part of the codebase is lacking most when it comes to tests. +Otherwise, talk to a current maintainer and ask which part of the codebase is +lacking most when it comes to tests. ## Documentation ### Troubleshooting -Our docs are hosted on [Vercel](https://vercel.com/). Vercel only shows logs in realtime, which means you need to have the logs open in one tab and reproduce your error in another tab. Since our logs are private to Coder the organization, you can only follow these steps if you're a Coder employee. Ask a maintainer for help if you need it. +Our docs are hosted on [Vercel](https://vercel.com/). Vercel only shows logs in +realtime, which means you need to have the logs open in one tab and reproduce +your error in another tab. Since our logs are private to Coder the organization, +you can only follow these steps if you're a Coder employee. Ask a maintainer for +help if you need it. -Taking a real scenario, let's say you wanted to troubleshoot [this docs change](https://github.com/coder/code-server/pull/4042). Here is how you would do it: +Taking a real scenario, let's say you wanted to troubleshoot [this docs +change](https://github.com/coder/code-server/pull/4042). Here is how you would +do it: 1. Go to https://vercel.com/codercom/codercom 2. Click "View Function Logs" diff --git a/docs/README.md b/docs/README.md index b56f267e4d3c..470095071afd 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,6 +1,6 @@ # code-server -[!["GitHub Discussions"](https://img.shields.io/badge/%20GitHub-%20Discussions-gray.svg?longCache=true&logo=github&colorB=purple)](https://github.com/coder/code-server/discussions) [!["Join us on Slack"](https://img.shields.io/badge/join-us%20on%20slack-gray.svg?longCache=true&logo=slack&colorB=brightgreen)](https://coder.com/community) [![Twitter Follow](https://img.shields.io/twitter/follow/CoderHQ?label=%40CoderHQ&style=social)](https://twitter.com/coderhq) [![codecov](https://codecov.io/gh/coder/code-server/branch/main/graph/badge.svg?token=5iM9farjnC)](https://codecov.io/gh/coder/code-server) [![See latest](https://img.shields.io/static/v1?label=Docs&message=see%20latest&color=blue)](https://coder.com/docs/code-server/latest) +[!["GitHub Discussions"](https://img.shields.io/badge/%20GitHub-%20Discussions-gray.svg?longCache=true&logo=github&colorB=purple)](https://github.com/coder/code-server/discussions) [!["Join us on Slack"](https://img.shields.io/badge/join-us%20on%20slack-gray.svg?longCache=true&logo=slack&colorB=brightgreen)](https://coder.com/community) [![Twitter Follow](https://img.shields.io/twitter/follow/CoderHQ?label=%40CoderHQ&style=social)](https://twitter.com/coderhq) [![Discord](https://img.shields.io/discord/747933592273027093)](https://discord.com/invite/coder) [![codecov](https://codecov.io/gh/coder/code-server/branch/main/graph/badge.svg?token=5iM9farjnC)](https://codecov.io/gh/coder/code-server) [![See latest](https://img.shields.io/static/v1?label=Docs&message=see%20latest&color=blue)](https://coder.com/docs/code-server/latest) Run [VS Code](https://github.com/Microsoft/vscode) on any machine anywhere and access it in the browser. @@ -24,7 +24,7 @@ on how to set up a Google VM on which you can install code-server. ## Getting started -There are four ways to get started: +There are five ways to get started: 1. Using the [install script](https://github.com/coder/code-server/blob/main/install.sh), which @@ -35,6 +35,9 @@ There are four ways to get started: 3. Deploy code-server to your team with [coder/coder](https://cdr.co/coder-github) 4. Using our one-click buttons and guides to [deploy code-server to a cloud provider](https://github.com/coder/deploy-code-server) ⚡ +5. Using the [code-server feature for + devcontainers](https://github.com/coder/devcontainer-features/blob/main/src/code-server/README.md), + if you already use devcontainers in your project. If you use the install script, you can preview what occurs during the install process: diff --git a/docs/SECURITY.md b/docs/SECURITY.md index 0b4062ef0749..9ff33e365c4b 100644 --- a/docs/SECURITY.md +++ b/docs/SECURITY.md @@ -17,10 +17,8 @@ We use the following tools to help us stay on top of vulnerability mitigation. - Comprehensive vulnerability scanner that runs on PRs into the default branch and scans both our container image and repository code (see `trivy-scan-repo` and `trivy-scan-image` jobs in `build.yaml`) -- [`audit-ci`](https://github.com/IBM/audit-ci) - - Audits npm and Yarn dependencies in CI (see `Audit for vulnerabilities` step - in `build.yaml`) on PRs into the default branch and fails CI if moderate or - higher vulnerabilities (see the `audit.sh` script) are present. +- `npm audit` + - Audits NPM dependencies. ## Supported Versions diff --git a/docs/android.md b/docs/android.md index 8107be873da8..4541bc7b5fee 100644 --- a/docs/android.md +++ b/docs/android.md @@ -11,11 +11,11 @@ curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash ``` 6. Exit the terminal using `exit` and then reopen the terminal -7. Install and use Node.js 18: +7. Install and use Node.js 24: ```shell -nvm install 18 -nvm use 18 +nvm install 24 +nvm use 24 ``` 8. Install code-server globally on device with: `npm install --global code-server` diff --git a/docs/coder.md b/docs/coder.md index f62a3c2edcd8..eff3423b5b7a 100644 --- a/docs/coder.md +++ b/docs/coder.md @@ -33,7 +33,7 @@ resource "coder_app" "code-server" { } ``` -Or use our official [`code-server`](https://registry.coder.com/modules/code-server) module from the Coder [module registry](htpps://registry.coder.com/modules): +Or use our official [`code-server`](https://registry.coder.com/modules/code-server) module from the Coder [module registry](https://registry.coder.com/modules): ```terraform module "code-server" { diff --git a/docs/guide.md b/docs/guide.md index 5bf2fc9dac68..c661caae60ea 100644 --- a/docs/guide.md +++ b/docs/guide.md @@ -9,6 +9,7 @@ - [Using Let's Encrypt with NGINX](#using-lets-encrypt-with-nginx) - [Using a self-signed certificate](#using-a-self-signed-certificate) - [TLS 1.3 and Safari](#tls-13-and-safari) + - [Cloudflare Rocket Loader](#cloudflare-rocket-loader) - [External authentication](#external-authentication) - [HTTPS and self-signed certificates](#https-and-self-signed-certificates) - [Accessing web services](#accessing-web-services) @@ -20,9 +21,11 @@ - [Proxying to a Vue app](#proxying-to-a-vue-app) - [Proxying to an Angular app](#proxying-to-an-angular-app) - [Proxying to a Svelte app](#proxying-to-a-svelte-app) -- [SSH into code-server on VS Code](#ssh-into-code-server-on-vs-code) - - [Option 1: cloudflared tunnel](#option-1-cloudflared-tunnel) - - [Option 2: ngrok tunnel](#option-2-ngrok-tunnel) + - [Prefixing `/absproxy/` with a path](#prefixing-absproxyport-with-a-path) + - [Preflight requests](#preflight-requests) +- [Internationalization and customization](#internationalization-and-customization) + - [Available keys and placeholders](#available-keys-and-placeholders) + - [Legacy flag](#legacy-flag) @@ -121,22 +124,22 @@ access code-server on an iPad or do not want to use SSH port forwarding. 1. This option requires that the remote machine be exposed to the internet. Make sure that your instance allows HTTP/HTTPS traffic. -1. You'll need a domain name (if you don't have one, you can purchase one from +2. You'll need a domain name (if you don't have one, you can purchase one from [Google Domains](https://domains.google.com) or the domain service of your - choice)). Once you have a domain name, add an A record to your domain that contains your + choice). Once you have a domain name, add an A record to your domain that contains your instance's IP address. -1. Install [Caddy](https://caddyserver.com/docs/download#debian-ubuntu-raspbian): +3. Install [Caddy](https://caddyserver.com/docs/download#debian-ubuntu-raspbian): -```console -sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https -curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg -curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list -sudo apt update -sudo apt install caddy -``` + ```console + sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https + curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg + curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list + sudo apt update + sudo apt install caddy + ``` -1. Replace `/etc/caddy/Caddyfile` using `sudo` so that the file looks like this: +4. Replace `/etc/caddy/Caddyfile` using `sudo` so that the file looks like this: ```text mydomain.com { @@ -155,7 +158,7 @@ sudo apt install caddy Remember to replace `mydomain.com` with your domain name! -1. Reload Caddy: +5. Reload Caddy: ```console sudo systemctl reload caddy @@ -166,21 +169,22 @@ At this point, you should be able to access code-server via ### Using Let's Encrypt with NGINX -1. This option requires that the remote machine be exposed to the internet. Make sure that your instance allows HTTP/HTTPS traffic. +1. This option requires that the remote machine be exposed to the internet. Make + sure that your instance allows HTTP/HTTPS traffic. -1. You'll need a domain name (if you don't have one, you can purchase one from +2. You'll need a domain name (if you don't have one, you can purchase one from [Google Domains](https://domains.google.com) or the domain service of your - choice)). Once you have a domain name, add an A record to your domain that contains your + choice). Once you have a domain name, add an A record to your domain that contains your instance's IP address. -1. Install NGINX: +3. Install NGINX: ```bash sudo apt update sudo apt install -y nginx certbot python3-certbot-nginx ``` -1. Update `/etc/nginx/sites-available/code-server` using sudo with the following +4. Update `/etc/nginx/sites-available/code-server` using sudo with the following configuration: ```text @@ -201,13 +205,11 @@ At this point, you should be able to access code-server via Be sure to replace `mydomain.com` with your domain name! -1. Enable the config: - +5. Enable the config: ```console sudo ln -s ../sites-available/code-server /etc/nginx/sites-enabled/code-server sudo certbot --non-interactive --redirect --agree-tos --nginx -d mydomain.com -m me@example.com ``` - Be sure to replace `me@example.com` with your actual email. At this point, you should be able to access code-server via @@ -268,14 +270,34 @@ than TLS 1.3 you will need to add support for TLS 1.2 since Safari does not support TLS 1.3 for web sockets at the time of writing. If this is the case you should see OSSStatus: 9836 in the browser console. +### Cloudflare Rocket Loader + +If you serve code-server through Cloudflare, disable Rocket Loader for that +hostname. Rocket Loader rewrites inline ` - - + - - + ", } - const req = createRequest() + const req = await createRequest() const res = { status: jest.fn().mockReturnValue(this), send: jest.fn().mockReturnValue(this), @@ -20,9 +21,41 @@ describe("error page is rendered for text/html requests", () => { expect(res.status).toHaveBeenCalledWith(404) expect(res.send).toHaveBeenCalledWith(expect.not.stringContaining("