fix: support package manager retries in VS Code promotion - W-23832274

[peternhale]

Summary

• add package-manager inputs to VS Code manual and stable promotion workflows
• use retry-backed, package-manager-agnostic dependency and lockfile installation for npm, pnpm, and Yarn
• retain fixed stable-promotion quality checks and remove unneeded publish-job dependency installs

GUS

W-23832274: 4 Publish web VSIX to CBWeb internal marketplace

Validation

• Parsed modified action and workflow YAML with Ruby YAML.load_file
• Ran git diff --check

This enables package-manager-agnostic VS Code promotion workflows while preserving retry behavior for network-dependent installs.

[iowillhoit]

This PR doesn't make any changes to the actions/retry action, why is the @your-branch needed?

[peternhale]

Good catch. The retry action is unchanged, so it should remain pinned to @main. I reverted the unnecessary branch references while retaining branch references only for actions changed by this PR.

[WillieRuemmele]

Critical: Silent pass when required-checks input is malformed

In both check-ci-status actions, the migration from comma-separated to JSON array (jq -r '.[]' <<< "$REQUIRED_CHECKS") has a silent-failure mode: if a caller still passes the old comma-separated format (or any non-JSON string), jq emits a parse error to stderr, the while loop runs zero iterations, FAILED stays 0, and the quality gate reports PASS with zero checks validated.

Repro:

$ bash -c 'REQUIRED_CHECKS="CI Complete, Package"; FAILED=0; while IFS= read -r CHECK; do FAILED=1; done < <(jq -r ".[]" <<< "$REQUIRED_CHECKS"); echo FAILED=$FAILED'
jq: parse error ...
FAILED=0

This is the promotion gate — a silent no-op on bad input is scary. Suggestion: add a jq -e 'type == "array"' <<< "$REQUIRED_CHECKS" || { echo "ERROR: required-checks must be a JSON array"; exit 1; } guard before the loop, or validate the input in the calling workflow's validate-inputs step.

---

Convention: ${{ inputs.slot }} used directly in a run: block

In vscode-manual-publish.yml validate-inputs step, there's:

if [ "$PUBLISH_WEB_VSIX" = "true" ] && [ "${{ inputs.slot }}" != "pre-release" ]; then

Per the repo convention (.cursor/rules/yaml-checklist.mdc), inputs in shell scripts should go through env vars. SLOT is already set as an env var in the resolve step — just needs to be added to the validate-inputs env block too.

---

Nit: Branch-pinned action refs

I see the @ph/W-23832274-pnpm-stable-promotion refs — assuming those get flipped to @main at merge time, just calling it out so it doesn't get missed.

---

Optional: Two check-ci-status actions drifting

.github/actions/check-ci-status/ and .github/actions/vscode/check-ci-status/ are ~90% the same bash now. The top-level one has better logic (checks status != completed before conclusion, handles absent checks explicitly). If you're consolidating VS Code actions into this repo anyway, might be worth pointing everything at the top-level one and deleting the vscode-scoped copy — one less thing to keep in sync.

---

Optional: commit-stable-version duplication

The commit-stable-version job in vscode-manual-publish.yml and vscode-promote-stable.yml are ~100 lines of near-identical bash (already slightly drifting — one uses a hand-rolled node -e semver check, the other uses npx semver). Not blocking, but could be a future composite action to avoid divergence.

---

Everything else looks solid — the updateNodeLockfile action is a nice extraction, the CBWeb publish job is well-guarded, and the tag-published/commit-stable-version condition changes are correct given the new job dependencies. 👍

[WillieRuemmele]

Critical issues addressed — jq validation guard and env var convention fix both look good. Branch refs to flip at merge time. Ship it.