Reconstruct batch 124/124: 2026-10-21 → 2026-10-23 (sessions, agenthost, chat, ci)

.github/actions/test-chat-lib/action.yml

@@ -8,18 +8,32 @@ runs:
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version-file: extensions/copilot/.nvmrc
-        cache: npm
-        cache-dependency-path: |
-          extensions/copilot/package-lock.json
-          extensions/copilot/chat-lib/package-lock.json
 
+    # Reuse a node_modules cache that .github/workflows/pr-node-modules.yml keeps warm on `main`:
+    # the Copilot cache on Linux and Windows, and the full cache (which includes extensions/copilot)
+    # on macOS. Never save: PR-scoped caches are not shared with other PRs and only evict the
+    # shared ones.
+    - name: Restore node_modules cache
+      id: cache-node-modules
+      uses: ./.github/actions/restore-node-modules
+      with:
+        key-prefix: ${{ runner.os == 'macOS' && 'node_modules-macos' || runner.os == 'Windows' && 'copilot-node_modules-windows' || 'copilot-node_modules-linux' }}
+        key-args: ${{ runner.os == 'macOS' && 'darwin $(node -p process.arch) $(node -p process.arch)' || '$(node -p process.platform) $(node -p process.arch)' }}
+
+    - name: Install Copilot dependencies
+      if: steps.cache-node-modules.outputs.cache-hit != 'true'
+      shell: bash
+      working-directory: extensions/copilot
+      run: npm ci
+
+    # Remove the node_modules of every ancestor folder (some are restored from the cache) so that
+    # chat-lib only resolves its own dependencies.
     - name: Extract chat-lib
       shell: bash
       working-directory: extensions/copilot
       run: |
-        npm ci
         npm run extract-chat-lib
-        rm -rf node_modules
+        rm -rf node_modules ../node_modules ../../node_modules
 
     - name: Install chat-lib dependencies
       shell: bash

.github/workflows/copilot-setup-steps.yml

@@ -17,7 +17,7 @@ on:
 jobs:
   # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
   copilot-setup-steps:
-    runs-on: vscode-large-runners
+    runs-on: vscode-large-runners-ubuntu-8-core
 
     # Set the permissions to the lowest permissions possible needed for your steps.
     # Copilot will be given its own token for its operations.

.github/workflows/css-order-scan.yml

@@ -17,7 +17,10 @@ concurrency:
 jobs:
   scan:
     name: Scan CSS cascade-order dependencies
-    runs-on: ubuntu-latest
+    runs-on: vscode-large-runners-ubuntu-8-core
+    # The scan stops localizing after its own time budget (below) and still
+    # writes a report; this is the hard stop if anything hangs.
+    timeout-minutes: 180
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -92,6 +95,7 @@ jobs:
         run: |
           node test/componentFixtures/cssOrderScan.mts \
             --fixture-id-regex ".*" \
+            --time-budget-minutes 150 \
             --image-base-url "https://hediet-screenshots.azurewebsites.net/images"
 
       - name: Generate random commit SHA
@@ -235,8 +239,13 @@ jobs:
         if: always()
         run: |
           REPORT="test/componentFixtures/.build/css-order-report/report.md"
-          if [ -f "$REPORT" ]; then
+          # Job summaries are limited to 1 MiB; the full report is in the css-order-report artifact.
+          MAX_BYTES=1000000
+          if [ ! -f "$REPORT" ]; then
+            echo "No report was produced." >> "$GITHUB_STEP_SUMMARY"
+          elif [ "$(wc -c < "$REPORT")" -le "$MAX_BYTES" ]; then
             cat "$REPORT" >> "$GITHUB_STEP_SUMMARY"
           else
-            echo "No report was produced." >> "$GITHUB_STEP_SUMMARY"
+            head -c "$MAX_BYTES" "$REPORT" | sed '$d' >> "$GITHUB_STEP_SUMMARY"
+            printf '\n\n> Report truncated to fit the job summary. Download the `css-order-report` artifact for the full report.\n' >> "$GITHUB_STEP_SUMMARY"
           fi

build/azure-pipelines/alpine/product-build-alpine-node-modules.yml

@@ -44,6 +44,7 @@ jobs:
           path: .build/node_modules_cache
           cacheHitVar: NODE_MODULES_RESTORED
         displayName: Restore node_modules cache
+        retryCountOnTaskFailure: 2
 
       - script: |
           set -e

build/azure-pipelines/alpine/product-build-alpine.yml

@@ -88,6 +88,7 @@ jobs:
           path: .build/node_modules_cache
           cacheHitVar: NODE_MODULES_RESTORED
         displayName: Restore node_modules cache
+        retryCountOnTaskFailure: 2
 
       - script: tar -xzf .build/node_modules_cache/cache.tgz
         condition: and(succeeded(), eq(variables.NODE_MODULES_RESTORED, 'true'))

build/azure-pipelines/cli/cli-compile.yml

@@ -25,6 +25,7 @@ steps:
     inputs:
       key: 'sccache | "$(Agent.OS)" | "${{ parameters.VSCODE_CLI_TARGET }}" | "${{ parameters.VSCODE_CHECK_ONLY }}" | $(Build.SourcesDirectory)/cli/Cargo.toml | $(Build.SourcesDirectory)/build/.cachesalt'
       path: $(Pipeline.Workspace)/sccache
+    retryCountOnTaskFailure: 2
 
   - ${{ if contains(parameters.VSCODE_CLI_TARGET, '-windows-') }}:
     - pwsh: |

build/azure-pipelines/common/agent-sdk-produce.yml

@@ -6,6 +6,12 @@ parameters:
       - linux
       - alpine
       - win32
+  # Whether to include the steps and jobs that need a privileged service
+  # connection (signing, CDN uploads, Copilot test setup). Only
+  # sdk-validation-build.yml sets this to false.
+  - name: VSCODE_PRIVILEGED_CONNECTIONS
+    type: boolean
+    default: true
 
 # Builds the agent SDK tarballs for ONE VS Code build, and (on real
 # publish runs) uploads them to the CDN, emits
@@ -63,18 +69,21 @@ steps:
     condition: and(succeeded(), ne(variables['NPM_REGISTRY'], 'none'))
     displayName: "Agent SDK: authenticate npm"
 
-  - task: AzureCLI@2
-    displayName: "Agent SDK: fetch CDN credentials"
-    condition: and(succeeded(), eq(lower(variables['VSCODE_PUBLISH']), 'true'))
-    inputs:
-      azureSubscription: vscode
-      scriptType: pscore
-      scriptLocation: inlineScript
-      addSpnToEnvironment: true
-      inlineScript: |
-        Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
-        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
-        Write-Host "##vso[task.setvariable variable=AZURE_ID_TOKEN;issecret=true]$env:idToken"
+  # The SDK validation pipeline (sdk-validation-build.yml) never publishes
+  # and must not reference the vscode connection.
+  - ${{ if eq(parameters.VSCODE_PRIVILEGED_CONNECTIONS, true) }}:
+    - task: AzureCLI@2
+      displayName: "Agent SDK: fetch CDN credentials"
+      condition: and(succeeded(), eq(lower(variables['VSCODE_PUBLISH']), 'true'))
+      inputs:
+        azureSubscription: vscode
+        scriptType: pscore
+        scriptLocation: inlineScript
+        addSpnToEnvironment: true
+        inlineScript: |
+          Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
+          Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
+          Write-Host "##vso[task.setvariable variable=AZURE_ID_TOKEN;issecret=true]$env:idToken"
 
   - ${{ if eq(parameters.vscodePlatform, 'win32') }}:
     - powershell: |

build/azure-pipelines/common/dictation-runtime-produce.yml

@@ -5,6 +5,12 @@ parameters:
       - darwin
       - linux
       - win32
+  # Whether to include the steps and jobs that need a privileged service
+  # connection (signing, CDN uploads, Copilot test setup). Only
+  # sdk-validation-build.yml sets this to false.
+  - name: VSCODE_PRIVILEGED_CONNECTIONS
+    type: boolean
+    default: true
 
 # Produces the dictation-runtime for ONE VS Code build:
 #   - STAMP: writes the (target-agnostic) product.dictationRuntime results file
@@ -33,18 +39,21 @@ steps:
     displayName: "Dictation runtime: authenticate NuGet"
     condition: and(succeeded(), eq(lower(variables['VSCODE_PUBLISH']), 'true'))
 
-  - task: AzureCLI@2
-    displayName: "Dictation runtime: fetch CDN credentials"
-    condition: and(succeeded(), eq(lower(variables['VSCODE_PUBLISH']), 'true'))
-    inputs:
-      azureSubscription: vscode
-      scriptType: pscore
-      scriptLocation: inlineScript
-      addSpnToEnvironment: true
-      inlineScript: |
-        Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
-        Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
-        Write-Host "##vso[task.setvariable variable=AZURE_ID_TOKEN;issecret=true]$env:idToken"
+  # The SDK validation pipeline (sdk-validation-build.yml) never publishes
+  # and must not reference the vscode connection.
+  - ${{ if eq(parameters.VSCODE_PRIVILEGED_CONNECTIONS, true) }}:
+    - task: AzureCLI@2
+      displayName: "Dictation runtime: fetch CDN credentials"
+      condition: and(succeeded(), eq(lower(variables['VSCODE_PUBLISH']), 'true'))
+      inputs:
+        azureSubscription: vscode
+        scriptType: pscore
+        scriptLocation: inlineScript
+        addSpnToEnvironment: true
+        inlineScript: |
+          Write-Host "##vso[task.setvariable variable=AZURE_TENANT_ID]$env:tenantId"
+          Write-Host "##vso[task.setvariable variable=AZURE_CLIENT_ID]$env:servicePrincipalId"
+          Write-Host "##vso[task.setvariable variable=AZURE_ID_TOKEN;issecret=true]$env:idToken"
 
   - ${{ if eq(parameters.vscodePlatform, 'win32') }}:
     - powershell: |

build/azure-pipelines/common/install-builtin-extensions.yml

@@ -19,6 +19,7 @@ steps:
       path: .build/builtInExtensions
       cacheHitVar: BUILTIN_EXTENSIONS_RESTORED
     displayName: Restore built-in extensions cache
+    retryCountOnTaskFailure: 2
 
   - script: node build/lib/builtInExtensions.ts
     env:

build/azure-pipelines/common/sanity-tests.yml

@@ -173,6 +173,7 @@ jobs:
           path: $(TEST_DIR)/node_modules
           cacheHitVar: SANITY_NODE_MODULES_RESTORED
         displayName: Restore node_modules cache
+        retryCountOnTaskFailure: 2
 
       - script: npm config set registry "$(NPM_REGISTRY)" --location=project
         workingDirectory: $(TEST_DIR)

build/azure-pipelines/copilot/setup-steps.yml

@@ -31,6 +31,7 @@ steps:
       path: .build/node_modules_cache
       cacheHitVar: BUILD_CACHE_RESTORED
     displayName: Restore node_modules cache
+    retryCountOnTaskFailure: 2
 
   - script: tar -xzf .build/node_modules_cache/cache.tgz
     condition: and(succeeded(), eq(variables.BUILD_CACHE_RESTORED, 'true'))

build/azure-pipelines/darwin/product-build-darwin-ci.yml

@@ -7,6 +7,12 @@ parameters:
     type: string
   - name: VSCODE_TEST_IDS
     type: object
+  # Whether to include the steps and jobs that need a privileged service
+  # connection (signing, CDN uploads, Copilot test setup). Only
+  # sdk-validation-build.yml sets this to false.
+  - name: VSCODE_PRIVILEGED_CONNECTIONS
+    type: boolean
+    default: true
 
 jobs:
   - job: macOS${{ parameters.VSCODE_JOB_NAME }}
@@ -44,3 +50,4 @@ jobs:
           VSCODE_ARCH: arm64
           VSCODE_CIBUILD: ${{ parameters.VSCODE_CIBUILD }}
           VSCODE_TEST_IDS: ${{ parameters.VSCODE_TEST_IDS }}
+          VSCODE_PRIVILEGED_CONNECTIONS: ${{ parameters.VSCODE_PRIVILEGED_CONNECTIONS }}

build/azure-pipelines/darwin/product-build-darwin-cli.yml

@@ -6,6 +6,12 @@ parameters:
     default: false
   - name: VSCODE_QUALITY
     type: string
+  # Whether to include the steps and jobs that need a privileged service
+  # connection (signing, CDN uploads, Copilot test setup). Only
+  # sdk-validation-build.yml sets this to false.
+  - name: VSCODE_PRIVILEGED_CONNECTIONS
+    type: boolean
+    default: true
 
 jobs:
 - job: macOS_${{ parameters.VSCODE_ARCH }}_CLI
@@ -22,7 +28,7 @@ jobs:
     VSCODE_ARCH: ${{ parameters.VSCODE_ARCH }}
   templateContext:
     outputs:
-      - ${{ if not(parameters.VSCODE_CHECK_ONLY) }}:
+      - ${{ if and(not(parameters.VSCODE_CHECK_ONLY), eq(parameters.VSCODE_PRIVILEGED_CONNECTIONS, true)) }}:
         - output: pipelineArtifact
           targetPath: $(Build.ArtifactStagingDirectory)/out/vscode_cli_darwin_$(VSCODE_ARCH)_cli/vscode_cli_darwin_$(VSCODE_ARCH)_cli.zip
           artifactName: vscode_cli_darwin_$(VSCODE_ARCH)_cli
@@ -117,49 +123,52 @@ jobs:
           displayName: Publish unsigned Copilot shim
           sbomEnabled: false
 
-      - script: |
-          set -e
-          mkdir -p $(Build.ArtifactStagingDirectory)/pkg/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli
-          cp $(Build.ArtifactStagingDirectory)/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli.zip $(Build.ArtifactStagingDirectory)/pkg/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli.zip
-        displayName: Prepare CLI for signing
-
-      - task: ExtractFiles@1
-        displayName: Extract unsigned CLI (for SBOM)
-        inputs:
-          archiveFilePatterns: $(Build.ArtifactStagingDirectory)/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli.zip
-          destinationFolder: $(Build.ArtifactStagingDirectory)/sign/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli
-
-      - task: UseDotNet@2
-        inputs:
-          version: 6.x
-
-      - task: EsrpCodeSigning@6
-        inputs:
-          UseMSIAuthentication: true
-          ConnectedServiceName: vscode-esrp
-          AppRegistrationClientId: $(ESRP_CLIENT_ID)
-          AppRegistrationTenantId: $(ESRP_TENANT_ID)
-          AuthAKVName: vscode-esrp
-          AuthSignCertName: esrp-sign
-          FolderPath: .
-          Pattern: noop
-        displayName: 'Install ESRP Tooling'
-
-      - script: node build/azure-pipelines/common/sign.ts $(Agent.RootDirectory)/_tasks/EsrpCodeSigning_*/*/net6.0/esrpcli.dll sign-darwin $(Build.ArtifactStagingDirectory)/pkg/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli "*.zip"
-        env:
-          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
-        displayName: ✍️ Codesign
-
-      - script: node build/azure-pipelines/common/sign.ts $(Agent.RootDirectory)/_tasks/EsrpCodeSigning_*/*/net6.0/esrpcli.dll notarize-darwin $(Build.ArtifactStagingDirectory)/pkg/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli "*.zip"
-        env:
-          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
-        displayName: ✍️ Notarize
-
-      - script: |
-          set -e
-          mkdir -p $(Build.ArtifactStagingDirectory)/out/vscode_cli_darwin_$(VSCODE_ARCH)_cli
-          mv $(Build.ArtifactStagingDirectory)/pkg/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli.zip $(Build.ArtifactStagingDirectory)/out/vscode_cli_darwin_$(VSCODE_ARCH)_cli/vscode_cli_darwin_$(VSCODE_ARCH)_cli.zip
-        displayName: Rename signed artifact
+      # Signing needs the ESRP connection. The SDK validation pipeline
+      # (sdk-validation-build.yml) only uses the unsigned CLI.
+      - ${{ if eq(parameters.VSCODE_PRIVILEGED_CONNECTIONS, true) }}:
+        - script: |
+            set -e
+            mkdir -p $(Build.ArtifactStagingDirectory)/pkg/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli
+            cp $(Build.ArtifactStagingDirectory)/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli.zip $(Build.ArtifactStagingDirectory)/pkg/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli.zip
+          displayName: Prepare CLI for signing
+
+        - task: ExtractFiles@1
+          displayName: Extract unsigned CLI (for SBOM)
+          inputs:
+            archiveFilePatterns: $(Build.ArtifactStagingDirectory)/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli.zip
+            destinationFolder: $(Build.ArtifactStagingDirectory)/sign/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli
+
+        - task: UseDotNet@2
+          inputs:
+            version: 6.x
+
+        - task: EsrpCodeSigning@6
+          inputs:
+            UseMSIAuthentication: true
+            ConnectedServiceName: vscode-esrp
+            AppRegistrationClientId: $(ESRP_CLIENT_ID)
+            AppRegistrationTenantId: $(ESRP_TENANT_ID)
+            AuthAKVName: vscode-esrp
+            AuthSignCertName: esrp-sign
+            FolderPath: .
+            Pattern: noop
+          displayName: 'Install ESRP Tooling'
+
+        - script: node build/azure-pipelines/common/sign.ts $(Agent.RootDirectory)/_tasks/EsrpCodeSigning_*/*/net6.0/esrpcli.dll sign-darwin $(Build.ArtifactStagingDirectory)/pkg/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli "*.zip"
+          env:
+            SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+          displayName: ✍️ Codesign
+
+        - script: node build/azure-pipelines/common/sign.ts $(Agent.RootDirectory)/_tasks/EsrpCodeSigning_*/*/net6.0/esrpcli.dll notarize-darwin $(Build.ArtifactStagingDirectory)/pkg/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli "*.zip"
+          env:
+            SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+          displayName: ✍️ Notarize
+
+        - script: |
+            set -e
+            mkdir -p $(Build.ArtifactStagingDirectory)/out/vscode_cli_darwin_$(VSCODE_ARCH)_cli
+            mv $(Build.ArtifactStagingDirectory)/pkg/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli/unsigned_vscode_cli_darwin_$(VSCODE_ARCH)_cli.zip $(Build.ArtifactStagingDirectory)/out/vscode_cli_darwin_$(VSCODE_ARCH)_cli/vscode_cli_darwin_$(VSCODE_ARCH)_cli.zip
+          displayName: Rename signed artifact
 
     - ${{ if eq(parameters.VSCODE_ARCH, 'x64') }}:
       - template: ../copilot-shim/copilot-shim-quality.yml@self

build/azure-pipelines/darwin/product-build-darwin-node-modules.yml

@@ -52,6 +52,7 @@ jobs:
           path: .build/node_modules_cache
           cacheHitVar: NODE_MODULES_RESTORED
         displayName: Restore node_modules cache
+        retryCountOnTaskFailure: 2
 
       - script: |
           set -e