Merge "ballerina-integrator-1.3.0" into "release-ballerina"

.github/CODEOWNERS

@@ -1,6 +1,7 @@
 *.tsx @hevayo @gigara @tharindulak
 *.css @hevayo @gigara @tharindulak
 *.scss @hevayo @gigara @tharindulak
+.trivyignore @hevayo @gigara
 /workspaces/common-libs/ @hevayo @gigara @tharindulak
 /workspaces/mi/ @hevayo @gigara @kaumini
 /workspaces/ballerina/ballerina-core/src/interfaces/extended-lang-client.ts @hevayo @axewilledge @kanushka

.github/actions/build/action.yml

@@ -6,6 +6,9 @@ inputs:
   enableCache:
     default: true
     type: boolean
+  enableLSCache:
+    default: true
+    type: boolean
   ballerina:
     description: Update Ballerina extension version
     type: boolean
@@ -139,7 +142,7 @@ runs:
 
     - name: Restore MI LS from cache
       id: mi-ls-cache
-      if: ${{ inputs.isPreRelease == 'true' }}
+      if: ${{ inputs.enableLSCache == 'true' }}
       uses: actions/cache@v4
       with:
         path: workspaces/mi/mi-extension/ls
@@ -148,7 +151,7 @@ runs:
 
     - name: Restore Ballerina LS from cache
       id: ballerina-ls-cache
-      if: ${{ inputs.isPreRelease == 'true' }}
+      if: ${{ inputs.enableLSCache == 'true' }}
       uses: actions/cache@v4
       with:
         path: workspaces/ballerina/ballerina-extension/ls

.github/actions/pr/action.yml

@@ -3,6 +3,9 @@ inputs:
   version:
     description: 'Publish version'
     required: true 
+  isPreRelease:
+    default: true
+    type: boolean    
   chatAPI:
     description: 'Google chat API'
     required: true
@@ -97,11 +100,32 @@ runs:
         shell: bash
         id: commit
         run: |
+          mv .git/config .git/config-old 
+          git remote add origin https://${{ inputs.bot_token }}@github.com/${{ github.repository }}.git
           git diff --staged --quiet || git commit -m "Update version to ${{ inputs.version }}"
-          git checkout -b "${{ inputs.version }}"
-          git remote set-url origin https://${{ inputs.bot_username }}:$GITHUB_TOKEN@github.com/$GITHUB_REPOSITORY.git
+        env:
+          GH_TOKEN: ${{ inputs.bot_token }}
+
+      - name: Create tag
+        shell: bash
+        id: create_tag
+        run: |
           git tag ${{ inputs.version }}
-          git push origin "refs/heads/${{ inputs.version }}" "refs/tags/${{ inputs.version }}"
+          git push origin "refs/tags/${{ inputs.version }}"
+
+      - name: Create release branch
+        shell: bash
+        if: ${{ inputs.isPreRelease == 'false' }}
+        id: create_branch
+        run: |
+          git checkout -b "${{ inputs.version }}"
+          git push origin "refs/heads/${{ inputs.version }}"
+
+      - name: Create Pull Request
+        shell: bash
+        if: ${{ inputs.isPreRelease == 'false' }}
+        id: pr
+        run: |
           baseBranch=""
           if [ "${{ inputs.ballerina }}" == 'true' ]; then
             baseBranch="release-ballerina"
@@ -119,9 +143,10 @@ runs:
           pr=$(gh pr create -B "$baseBranch" -H "${{ inputs.version }}" --title "Merge \"${{ inputs.version }}\" into \"$baseBranch\"" --body '$subject')
           echo "prURL=$pr" >> $GITHUB_OUTPUT
         env:
-          GITHUB_TOKEN: ${{ inputs.bot_token }}
+          GH_TOKEN: ${{ inputs.bot_token }}
 
       - name: "PR Notification"
+        if: ${{ inputs.isPreRelease == 'false' }}
         shell: bash
         run: |
           body=$(cat << EOF

.github/workflows/build.yml

@@ -3,6 +3,12 @@ name: Build and run Tests
 on: 
   workflow_call:
     inputs: 
+      runOnAWS:
+        default: false
+        type: boolean
+      awsRunnerId:
+        default: 'codebuild-wso2_vscode-extensions-${{ github.run_id }}-${{ github.run_attempt }}'
+        type: string  
       isPreRelease:
         default: true
         type: boolean  
@@ -64,7 +70,7 @@ jobs:
   Build_Stage:
     name: Build repo
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runOnAWS && inputs.awsRunnerId || 'ubuntu-latest' }}
     outputs:
       runBalExtTests: ${{ steps.testMatrix.outputs.runBalExtTests }}
       runChoreoExtTests: ${{ steps.testMatrix.outputs.runChoreoExtTests }}
@@ -148,6 +154,7 @@ jobs:
         with:
           isPreRelease: ${{ inputs.isPreRelease }}
           enableCache: ${{ inputs.enableCache }}
+          enableLSCache: ${{ !inputs.isReleaseBuild }}
           ballerina: ${{ inputs.ballerina }}
           choreo: ${{ inputs.choreo }}
           wso2-platform: ${{ inputs.wso2-platform }}
@@ -168,12 +175,11 @@ jobs:
           PLATFORM_DEV_DEVANT_ASGARDEO_CLIENT_ID: ${{ secrets.PLATFORM_DEV_DEVANT_ASGARDEO_CLIENT_ID }}
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@0.33.1
         with:
           scan-type: 'fs'
           scan-ref: '.'
           format: 'table'
-          ignore-unfixed: true
           exit-code: '1'
           timeout: '10m'
           skip-dirs: 'common/temp'
@@ -184,7 +190,7 @@ jobs:
     if: false
     # if: ${{ inputs.runTests || !inputs.isPreRelease || needs.Build_Stage.outputs.runBalExtTests == 'true' || github.base_ref == 'release-ballerina' }}
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runOnAWS && inputs.awsRunnerId || 'ubuntu-latest' }}
     steps:
       - name: Restore build
         uses: actions/download-artifact@v4
@@ -230,7 +236,7 @@ jobs:
     if: false
     # if: ${{ inputs.runE2ETests || github.base_ref == 'release-ballerina' }}
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runOnAWS && inputs.awsRunnerId || 'ubuntu-latest' }}
     steps:
       - name: Restore build
         uses: actions/download-artifact@v4
@@ -301,7 +307,7 @@ jobs:
     # if: ${{ !inputs.skipUiTests || github.base_ref == 'release-choreo' }}
     needs: Build_Stage
     timeout-minutes: 120
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runOnAWS && inputs.awsRunnerId || 'ubuntu-latest' }}
     steps:
       - name: Restore build
         uses: actions/download-artifact@v4
@@ -378,7 +384,7 @@ jobs:
     needs: Build_Stage
     if: ${{ inputs.runTests || !inputs.isPreRelease || needs.Build_Stage.outputs.runMIExtTests == 'true' || github.base_ref == 'release-mi' }}
     timeout-minutes: 30
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runOnAWS && inputs.awsRunnerId || 'ubuntu-latest' }}
     steps:
       - name: Restore build
         uses: actions/download-artifact@v4
@@ -408,7 +414,7 @@ jobs:
     needs: Build_Stage
     if: ${{ inputs.runE2ETests || github.base_ref == 'release-mi' }}
     timeout-minutes: 60
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runOnAWS && inputs.awsRunnerId || 'ubuntu-latest' }}
     strategy:
       fail-fast: false
       matrix:

.github/workflows/publish-vsix.yml

@@ -40,7 +40,7 @@ on:
 jobs:
   publish:
     name: Publish vsix to marketplaces
-    runs-on: ubuntu-latest
+    runs-on: codebuild-wso2_vscode-extensions-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - name: Download artifact
         id: download-artifact
@@ -106,16 +106,47 @@ jobs:
         run: ovsx publish -p ${{ secrets.OPENVSX_TOKEN }} --packagePath ${{ steps.vsix.outputs.vsixName }} ${{ steps.vsix.outputs.releaseMode }}
 
       - name: Create a release in wso2/${{ steps.repo.outputs.repo }} repo
-        if: ${{ steps.repo.outputs.repo != '' }}
+        id: create_release
+        if: ${{ steps.repo.outputs.repo != '' && github.event.inputs.isPreRelease == 'false' }}
         run: |
-          id=`curl -X GET  -H "Accept: application/vnd.github.v3+json" \
+          id=`curl -X GET -H "Accept: application/vnd.github.v3+json" \
           -H "Authorization:token ${{ secrets.CHOREO_BOT_TOKEN }}" \
-          https://api.github.com/repos/wso2/${{ steps.repo.outputs.repo }}/releases/tags/v${{ steps.vsix.outputs.version }} \
+          https://api.github.com/repos/${{ steps.repo.outputs.repo }}/releases/tags/v${{ steps.vsix.outputs.version }} \
            | jq -r .id` && \
            updateResponse=`curl -X PATCH -H "Accept: application/vnd.github.v3+json" \
           -H "Authorization:token ${{ secrets.CHOREO_BOT_TOKEN }}" \
             -d '{"draft":false,"prerelease":false}' \
-            https://api.github.com/repos/wso2/${{ steps.repo.outputs.repo }}/releases/$id`         
+            https://api.github.com/repos/wso2/${{ steps.repo.outputs.repo }}/releases/$id`
+
+          # Verify the release was created/updated successfully
+          if [ $? -eq 0 ]; then
+            echo "release_created=true" >> $GITHUB_OUTPUT
+            echo "Release successfully created/updated for version v${{ steps.vsix.outputs.version }}"
+          else
+            echo "release_created=false" >> $GITHUB_OUTPUT
+            echo "Failed to create/update release for version v${{ steps.vsix.outputs.version }}"
+            exit 1
+          fi
+
+      - name: Trigger external repo workflow for ballerina release
+        if: ${{ github.event.inputs.extension == 'ballerina' && github.event.inputs.isPreRelease == 'false' && steps.create_release.outputs.release_created == 'true' }}
+        run: |
+          echo "Triggering external repository workflow for ballerina v${{ steps.vsix.outputs.version }}"
+          response=$(curl -s -w "%{http_code}" -X POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.CLOUD_EDITOR_BUILDER_REPO_TOKEN }}" \
+            https://api.github.com/repos/${{ secrets.CLOUD_EDITOR_BUILDER_REPO }}/dispatches \
+            -d '{"event_type": "extension_published", "client_payload": {"extension": "${{ github.event.inputs.extension }}", "version": "${{ steps.vsix.outputs.version }}", "release_url": "https://github.com/wso2/${{ steps.repo.outputs.repo }}/releases/tag/v${{ steps.vsix.outputs.version }}"}}')
+
+          http_code=$(echo "$response" | tail -c 4)
+
+          if [ "$http_code" -eq 204 ]; then
+            echo "Successfully triggered external repository workflow"
+          else
+            echo "Failed to trigger external repository workflow. HTTP code: $http_code"
+            echo "Response: $response"
+            exit 1
+          fi        
 
       - name: Set Chat API
         id: chat

.github/workflows/release-vsix.yml

@@ -53,6 +53,7 @@ jobs:
     uses: ./.github/workflows/build.yml
     secrets: inherit
     with:
+      runOnAWS: true
       isPreRelease: ${{ inputs.isPreRelease }}
       enableCache: false
       ballerina: ${{ inputs.ballerina }}
@@ -68,7 +69,7 @@ jobs:
     name: Release VSIX
     needs: Build
     timeout-minutes: 45
-    runs-on: ubuntu-latest
+    runs-on: codebuild-wso2_vscode-extensions-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - name: Restore build
         uses: actions/download-artifact@v4
@@ -182,6 +183,7 @@ jobs:
         uses: ./.github/actions/pr
         with:
           version: ${{ steps.vsix.outputs.version }}
+          isPreRelease: ${{ github.event.inputs.isPreRelease }}
           threadId: ${{ github.run_id }}
           bot_username: ${{ secrets.CHOREO_BOT_USERNAME }}
           bot_email: ${{ secrets.CHOREO_BOT_EMAIL }}
@@ -198,8 +200,9 @@ jobs:
   Notify:
     needs: [Release]
     if: ${{ always() && contains(needs.*.result, 'failure') && github.repository == 'wso2/vscode-extensions'}}
-    runs-on: ubuntu-latest
+    runs-on: codebuild-wso2_vscode-extensions-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
+      - uses: actions/checkout@v2
       - name: "Failure Notification"
         uses: ./.github/actions/failure-notification
         with:

.github/workflows/test-pr.yml

@@ -16,3 +16,4 @@ jobs:
     secrets: inherit  
     with:
       runE2ETests: ${{ contains(github.event.pull_request.labels.*.name, 'Checks/Run with UI Tests') }}
+      runOnAWS: ${{ contains(github.event.pull_request.labels.*.name, 'Runner/AWS') }}

.gitignore

@@ -76,4 +76,7 @@ playwright-report/
 
 extensions.json
 
-!sample-mi-project.zip
+!sample-mi-project.zip
+.claude/
+
+pnpm-lock.yaml

.trivyignore

@@ -0,0 +1,9 @@
+# Trivy ignore file for known low-risk vulnerabilities
+# Format: CVE-ID or vulnerability ID
+
+# Low severity vulnerability in jsondiffpatch package
+# Used as transitive dependency via 'ai' package
+# Risk Assessment: LOW severity, limited impact on diff operations
+# Decision: Acceptable risk - waiting for ai package to update jsondiffpatch dependency
+# Related Issue: https://github.com/wso2/product-ballerina-integrator/issues/1274
+CVE-2025-9910