fix(ci): resolve the lockfile from npmjs and update simple-git to 4.0.2
Why
The ubuntu-latest CI job fails on main. The failing step is "Audit production dependencies" (npm audit --omit=dev --audit-level=high). It reports two critical findings: simple-git 3.36.0 and its dependency @simple-git/argv-parser (advisory GHSA-v5rq-49vh-5v5c). A change can merge only when every check passes, so this fixes the cause.
The lockfile also had 16 resolved entries (8 packages, each listed twice) on a third-party mirror, registry.npmmirror.com. That host returns 403 in some environments, which breaks npm ci.
Scope
| File | Change |
|---|---|
package.json | simple-git goes from ^3.22.0 to ^4.0.2. New script check:lockfile. |
package-lock.json | Regenerated with npm install --package-lock-only --registry=https://registry.npmjs.org/. Every resolved URL now points at registry.npmjs.org. simple-git 3.36.0 to 4.0.2, @simple-git/argv-parser 1.1.1 to 2.0.1, @simple-git/args-pathspec 1.0.3 to 1.0.4. |
src/services/gitService.ts | simple-git 4 has no default export, so the import is now import { simpleGit, SimpleGit } from 'simple-git'. No other code changed. |
scripts/check-lockfile-registry.js | New. Fails if any lockfile entry resolves outside https://registry.npmjs.org/. |
.github/workflows/ci.yml | New step "Check lockfile registry" before npm ci. Actions stay pinned by SHA. |
Kept on purpose
- All other dependency versions. For the 396 entries whose version did not change, the
integrityvalue is identical to the old lockfile. - The remaining
npm auditfindings (8, inundicithrough the dev-only packaging tool). They are not production dependencies and the CI step does not check them.
Verification
| Check | How it ran | Result |
|---|---|---|
| Lockfile integrity | Compared old and new lockfile by package path | 396 same-version entries, 0 integrity changes, 3 version changes (listed above), 0 added, 0 removed |
| Registry check | npm run check:lockfile | Pass, 399 entries. On the old lockfile it fails and lists the 8 packages. |
| Install | npm ci (Node 22, npm 10) from a clean tree | Pass, 390 packages, 9 s |
| Audit | npm audit --omit=dev --audit-level=high | Exit 0, 0 vulnerabilities |
| Lint | npm run lint | Pass |
| Compile | npm run compile | Pass. It failed before the import change, with TS2349 at the two simpleGit(...) calls. |
| Smoke | npm run smoke (5 scripts) | All five pass |
| Package | npx @vscode/vsce package (output outside the repo) | Exit 0, 57 files, 929.34 KB |
| Runtime | require('simple-git') from the installed tree, simpleGit(dir).raw([...]) | Returns the expected output |
The ubuntu-latest job failed only at the audit step; the install, lint, compile, smoke steps and the other two operating systems passed.
After merge
Nothing for a registry. The next Marketplace release will ship simple-git 4.0.2.
Generated by Claude Code
Summary by CodeRabbit
- Chores
- Added a validation step that checks lockfile download URLs against the npm registry before dependencies are installed.
- Updated the project’s Git integration tooling.
- Tests
- Added coverage for registry URL checks across supported lockfile formats.
These updates affect project setup and maintenance; no end-user feature or behavior changes are included.