chore: compile once for all runs

.github/workflows/actions/setup-node-environment/action.yaml

@@ -30,22 +30,35 @@ runs:
         node-version: ${{ steps.get-vscode-node-version.outputs.vscode-node-version }}
         cache: pnpm
 
+    - name: Cache dependencies
+      id: cache-node-modules
+      uses: actions/cache@v4
+      with:
+        path: |
+          node_modules
+        key: ${{ runner.os }}-deps-${{ steps.get-vscode-node-version.outputs.vscode-node-version }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+        restore-keys: |
+          ${{ runner.os }}-deps-${{ steps.get-vscode-node-version.outputs.vscode-node-version }}-
+
     - name: Install Deps Ubuntu
       if: ${{ runner.os == 'Linux' }}
       run: sudo apt-get update -y && sudo apt-get -y install libkrb5-dev libsecret-1-dev net-tools libstdc++6 gnome-keyring
       shell: bash
 
     - name: Setup Python
+      if: steps.cache-node-modules.outputs.cache-hit != 'true'
       uses: actions/setup-python@v5
       with:
         python-version: '3.11'
 
     - name: Run node-gyp bug workaround script
+      if: steps.cache-node-modules.outputs.cache-hit != 'true'
       run: |
         curl -sSfLO https://raw.githubusercontent.com/mongodb-js/compass/42e6142ae08be6fec944b80ff6289e6bcd11badf/.evergreen/node-gyp-bug-workaround.sh && bash node-gyp-bug-workaround.sh
       shell: bash
 
     - name: Install Dependencies
+      if: steps.cache-node-modules.outputs.cache-hit != 'true'
       shell: bash
       run: |
         pnpm install --frozen-lockfile

.github/workflows/draft-release.yaml

@@ -199,9 +199,44 @@ jobs:
         run: pnpm run test-install
         shell: bash
 
+  test-snyk:
+    name: Snyk Test
+    needs: build-and-check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node environment
+        uses: ./.github/workflows/actions/setup-node-environment
+
+      - name: Run Snyk Test
+        shell: bash
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          pnpm run snyk-test
+
+      - name: Upload Snyk Report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: Snyk Report - ${{ github.run_id }}
+          path: |
+            .sbom/snyk-test-result.html
+            .sbom/snyk-test-result.json
+
+      - name: Generate Vulnerability Report (Fail on >= High)
+        shell: bash
+        run: |
+          pnpm run generate-vulnerability-report > /dev/null
+
   create-draft-release:
     name: Create Draft Release
-    needs: [prepare-version, test, test-install]
+    needs: [prepare-version, test, test-install, test-snyk]
 
     runs-on: ubuntu-latest
 
@@ -244,26 +279,6 @@ jobs:
             *.vsix
             *.vsix.sig
 
-      - name: Run Snyk Test
-        shell: bash
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        run: |
-          pnpm run snyk-test
-
-      - name: Upload Snyk Report
-        uses: actions/upload-artifact@v4
-        with:
-          name: Snyk Report - ${{ github.run_id }}
-          path: |
-            .sbom/snyk-test-result.html
-            .sbom/snyk-test-result.json
-
-      - name: Generate Vulnerability Report (Fail on >= High)
-        shell: bash
-        run: |
-          pnpm run generate-vulnerability-report > /dev/null
-
       - name: Create Draft Release
         env:
           RELEASE_TAG: ${{ needs.prepare-version.outputs.release_tag }}

.github/workflows/snyk-test.yaml

@@ -0,0 +1,51 @@
+name: Snyk Test
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*.*.*"
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * *"
+
+permissions:
+  contents: read
+
+jobs:
+  test-snyk:
+    name: Run Snyk
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || (github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository)
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node environment
+        uses: ./.github/workflows/actions/setup-node-environment
+
+      - name: Run Snyk Test
+        shell: bash
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        run: |
+          pnpm run snyk-test
+
+      - name: Upload Snyk Report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: Snyk Report - ${{ github.run_id }}
+          path: |
+            .sbom/snyk-test-result.html
+            .sbom/snyk-test-result.json
+
+      - name: Generate Vulnerability Report (Fail on >= High)
+        continue-on-error: ${{ github.event_name == 'pull_request' }}
+        shell: bash
+        run: |
+          pnpm run generate-vulnerability-report > /dev/null

.github/workflows/test-and-build-from-fork.yaml

@@ -26,6 +26,39 @@ jobs:
         run: pnpm run check
         shell: bash
 
+      - name: Compile
+        run: pnpm run compile
+        shell: bash
+
+      - name: Upload compiled output
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-output
+          path: |
+            ./dist
+            ./out
+          retention-days: 1
+
+  build-vsix:
+    name: Build Extension
+    needs: build-and-check
+    if: github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node environment
+        uses: ./.github/workflows/actions/setup-node-environment
+
+      - name: Download compiled output
+        uses: actions/download-artifact@v4
+        with:
+          name: build-output
+
       - name: Build .vsix
         env:
           NODE_OPTIONS: "--require ./scripts/no-npm-list-fail.js --max_old_space_size=4096"
@@ -34,7 +67,11 @@ jobs:
           pnpm exec vsce package --githubBranch main
         shell: bash
 
-      - name: Upload .vsix for tests
+      - name: Check .vsix filesize
+        run: pnpm run check-vsix-size
+        shell: bash
+
+      - name: Upload .vsix
         uses: actions/upload-artifact@v4
         with:
           name: vsix
@@ -61,16 +98,21 @@ jobs:
       - name: Setup Node environment
         uses: ./.github/workflows/actions/setup-node-environment
 
+      - name: Download compiled output
+        uses: actions/download-artifact@v4
+        with:
+          name: build-output
+
       - name: Run Tests
         env:
           NODE_OPTIONS: "--max_old_space_size=4096"
           SEGMENT_KEY: ${{ secrets.SEGMENT_KEY_DEV }}
           MDB_IS_TEST: "true"
-        run: pnpm run test
+        run: pnpm run test-ci
 
   test-install:
     name: Run Install Test
-    needs: build-and-check
+    needs: build-vsix
     if: github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.head.repo.full_name != github.repository
 
     strategy:

.github/workflows/test-and-build.yaml

@@ -48,6 +48,45 @@ jobs:
         run: pnpm run check
         shell: bash
 
+      - name: Compile
+        run: pnpm run compile
+        shell: bash
+
+      - name: Upload compiled output
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-output
+          path: |
+            ./dist
+            ./out
+          retention-days: 1
+
+  build-vsix:
+    name: Build Extension
+    needs: build-and-check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node environment
+        uses: ./.github/workflows/actions/setup-node-environment
+
+      - name: Download compiled output
+        uses: actions/download-artifact@v4
+        with:
+          name: build-output
+
+      - name: Set SEGMENT_KEY
+        env:
+          SEGMENT_KEY: ${{ secrets.SEGMENT_KEY_PROD }}
+        run: |
+          echo "SEGMENT_KEY=${SEGMENT_KEY}" >> $GITHUB_ENV
+        shell: bash
+
       - name: Build .vsix
         env:
           NODE_OPTIONS: "--require ./scripts/no-npm-list-fail.js --max_old_space_size=4096"
@@ -59,7 +98,7 @@ jobs:
         run: pnpm run check-vsix-size
         shell: bash
 
-      - name: Upload .vsix for tests
+      - name: Upload .vsix
         uses: actions/upload-artifact@v4
         with:
           name: vsix
@@ -85,17 +124,22 @@ jobs:
       - name: Setup Node environment
         uses: ./.github/workflows/actions/setup-node-environment
 
+      - name: Download compiled output
+        uses: actions/download-artifact@v4
+        with:
+          name: build-output
+
       - name: Run Tests
         env:
           NODE_OPTIONS: "--max_old_space_size=4096"
           MDB_IS_TEST: "true"
         run: |
-          pnpm run test
+          pnpm run test-ci
         shell: bash
 
   test-install:
     name: Run Install Test
-    needs: build-and-check
+    needs: build-vsix
 
     strategy:
       matrix:
@@ -123,39 +167,3 @@ jobs:
           RUNNER_OS: ${{ runner.os }}
         run: pnpm run test-install
         shell: bash
-
-  finalize:
-    name: Sign and Upload
-    needs: [test, test-install]
-
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node environment
-        uses: ./.github/workflows/actions/setup-node-environment
-
-      - name: Run Snyk Test
-        shell: bash
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        run: |
-          pnpm run snyk-test
-
-      - name: Upload Snyk Report
-        uses: actions/upload-artifact@v4
-        with:
-          name: Snyk Report - ${{ github.run_id }}
-          path: |
-            .sbom/snyk-test-result.html
-            .sbom/snyk-test-result.json
-
-      - name: Generate Vulnerability Report (Fail on >= High)
-        continue-on-error: ${{ github.event_name == 'pull_request' }}
-        shell: bash
-        run: |
-          pnpm run generate-vulnerability-report > /dev/null

package.json

@@ -53,6 +53,7 @@
     "watch:extension-bundles": "webpack --mode development --watch",
     "pretest": "pnpm run compile",
     "test": "pnpm run test-webview && pnpm run test-extension",
+    "test-ci": "pnpm run test-webview && pnpm run test-extension",
     "test-extension": "cross-env MDB_IS_TEST=true NODE_OPTIONS=--no-force-async-hooks-checks xvfb-maybe node ./out/test/runTest.js",
     "test-webview": "mocha -r ts-node/register --exit --grep=\"${MOCHA_GREP}\" --file ./src/test/setup-webview.ts src/test/suite/views/**/*.test.tsx",
     "test-install": "bash ./scripts/test-vsix-install.sh",
@@ -66,7 +67,7 @@
     "check-vsix-size": "node ./scripts/check-vsix-size.ts",
     "release-draft": "node ./scripts/release-draft.js",
     "reformat": "eslint . --fix && prettier --write .",
-    "snyk-test": "node scripts/snyk-test.js",
+    "snyk-test": "node scripts/snyk-test.ts",
     "generate-icon-font": "node ./scripts/generate-icon-font.ts",
     "generate-vulnerability-report": "mongodb-sbom-tools generate-vulnerability-report --snyk-reports=.sbom/snyk-test-result.json --dependencies=.sbom/dependencies.json --fail-on=high",
     "create-vulnerability-tickets": "mongodb-sbom-tools generate-vulnerability-report --snyk-reports=.sbom/snyk-test-result.json --dependencies=.sbom/dependencies.json --create-jira-issues",