Publish on OpenVSX

[andyw8]

Closes #646

[andyw8]

Looking into this failure:

x % yarn run package      
yarn run v1.22.22
$ vsce package --out vscode-shopify-ruby.vsix
/Users/andyw8/src/github.com/Shopify/vscode-shopify-ruby/node_modules/hosted-git-info/index.js:6
const cache = new LRU({ max: 1000 })
              ^

TypeError: LRU is not a constructor
    at Object.<anonymous> (/Users/andyw8/src/github.com/Shopify/vscode-shopify-ruby/node_modules/hosted-git-info/index.js:6:15)
    at Module._compile (node:internal/modules/cjs/loader:1504:14)
    at Module._extensions..js (node:internal/modules/cjs/loader:1588:10)
    at Module.load (node:internal/modules/cjs/loader:1282:32)
    at Module._load (node:internal/modules/cjs/loader:1098:12)
    at TracingChannel.traceSync (node:diagnostics_channel:315:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:215:24)
    at Module.require (node:internal/modules/cjs/loader:1304:12)
    at require (node:internal/modules/helpers:123:16)
    at Object.<anonymous> (/Users/andyw8/src/github.com/Shopify/vscode-shopify-ruby/node_modules/@vscode/vsce/out/package.js:48:30)

[andyw8]

^ I solved the above by removing lru-cache from resolutions then regenerating yarn.lock, but that may not be the best way.

[andyw8]

Copied from ruby-lsp.

[andyw8]

Bumped while troubleshooting. Might not have been necessary, but it now matches Ruby LSP.

[vinistock]

^ I solved the above by removing lru-cache from resolutions then regenerating yarn.lock, but that may not be the best way.

The resolutions were there to prevent installing a vulnerable version of lru-cache. Is there a way to fix this without removing it?

[andyw8]

(Confirmed with Vini that the lru-cache entry wasn't for a vulnerability, it was added here)

[andyw8]

I've added a resolution for hosted-git-info, which avoids the previous issue, and allow for a newer lru-cache. Now fails for a different reason:

% yarn package
yarn run v1.22.22
$ vsce package --out vscode-shopify-ruby.vsix
 INFO  Detected presence of yarn.lock. Using 'yarn' instead of 'npm' (to override this pass '--no-yarn' on the command line).
Executing prepublish script 'yarn run vscode:prepublish'...
$ yarn run esbuild-base --minify
$ esbuild ./src/extension.ts --bundle --outfile=out/extension.js --external:vscode --format=cjs --platform=node --minify

  out/extension.js  1.2kb

 ERROR  GitHost.fromUrl is not a function

[andyw8]

fromUrl is defined by https://github.com/npm/hosted-git-info, and imported by https://github.com/microsoft/vscode-vsce/blob/main/src/package.ts, so it's strange that it's failing.

[alexcrocha]

Since we are only using ovsx to publish our extension, would it make sense to use yarn dlx here instead of adding a dependency?

[andyw8]

I'm not familiar with that command, but ovsx is only a development dependency. What's the advantage of using dlx?

[alexcrocha]

I was checking the ovsx documentation and noticed they use npx in their examples. dlx is the Yarn equivalent of npx. It allows us to run ovsx directly without installing it as a permanent dependency.

[andyw8]

Ah, I see. I think it's better to have the explicit dependency to ensure we're running the same versions of ovsx and its dependencies in all environments. Otherwise it could be more difficult when troubleshooting.