.github/dependabot.yaml

@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      time: "06:00"
+      timezone: "America/Chicago"
+    labels: []
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      time: "06:00"
+      timezone: "America/Chicago"
+    labels: []
+    open-pull-requests-limit: 15
+    groups:
+      x:
+        patterns:
+          - "golang.org/x/*"

.github/workflows/build.yaml

@@ -13,10 +13,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version: "~1.19"
+          go-version: "~1.22"
 
       - name: Get Go cache paths
         id: go-cache-paths
@@ -25,20 +25,20 @@ jobs:
           echo "::set-output name=go-mod::$(go env GOMODCACHE)"
 
       - name: Go build cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ${{ steps.go-cache-paths.outputs.go-build }}
           key: ${{ runner.os }}-release-go-build-${{ hashFiles('**/go.sum') }}
 
       - name: Go mod cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ${{ steps.go-cache-paths.outputs.go-mod }}
           key: ${{ runner.os }}-release-go-mod-${{ hashFiles('**/go.sum') }}
 
       - run: make build
 
-      - uses: softprops/action-gh-release@v1
+      - uses: softprops/action-gh-release@v2
         with:
           draft: true
           files: ./bin/*

.github/workflows/cla.yaml

@@ -11,7 +11,7 @@ jobs:
     steps:
       - name: "CLA Assistant"
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
-        uses: contributor-assistant/github-action@v2.2.1
+        uses: contributor-assistant/github-action@v2.6.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # the below token should have repo scope and must be manually added by you in the repository's secret

.github/workflows/helm.yaml

@@ -24,8 +24,8 @@ jobs:
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: azure/setup-helm@v3.5
+      - uses: actions/checkout@v4
+      - uses: azure/setup-helm@v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
       - run: helm lint --strict ./helm

.github/workflows/lint.yaml

@@ -26,11 +26,11 @@ jobs:
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version: "~1.19"
+          go-version: 1.24.2
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3.2.0
+        uses: golangci/golangci-lint-action@v7.0.0
         with:
-          version: v1.48.0
+          version: v2.1.2

.github/workflows/publish.yaml

@@ -18,22 +18,22 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: robinraju/release-downloader@v1.5
+      - uses: actions/checkout@v4
+      - uses: robinraju/release-downloader@v1.12
         with:
           repository: "coder/code-marketplace"
           tag: ${{ github.event.inputs.version || github.ref_name }}
           fileName: "code-marketplace-linux-*"
           out-file-path: "bin"
 
-      - uses: docker/login-action@v2
+      - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: docker/setup-qemu-action@v2
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
       - run: docker buildx bake -f ./docker-bake.hcl --push
         env:
           VERSION: ${{ github.event.inputs.version || github.ref_name }}

.github/workflows/test.yaml

@@ -32,10 +32,10 @@ jobs:
           - macos-latest
           - windows-2022
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version: "~1.19"
+          go-version: "~1.22"
 
       - name: Echo Go Cache Paths
         id: go-cache-paths
@@ -44,23 +44,19 @@ jobs:
           echo "::set-output name=go-mod::$(go env GOMODCACHE)"
 
       - name: Go Build Cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ${{ steps.go-cache-paths.outputs.go-build }}
           key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.**', '**.go') }}
 
       - name: Go Mod Cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ${{ steps.go-cache-paths.outputs.go-mod }}
           key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}
 
       - name: Install gotestsum
-        uses: jaxxstorm/action-install-gh-release@v1.7.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          repo: gotestyourself/gotestsum
-          tag: v1.7.0
+        shell: bash
+        run: go install gotest.tools/gotestsum@latest
 
       - run: make test

.gitignore

@@ -2,3 +2,4 @@
 bin
 coverage
 extensions
+.idea

.golangci.yaml

@@ -0,0 +1,4 @@
+version: "2"
+linters:
+  disable:
+    - errcheck

CHANGELOG.md

@@ -7,6 +7,78 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+## [2.3.1](https://github.com/coder/code-marketplace/releases/tag/v2.3.1) - 2025-03-06
+
+### Changed
+
+- Updated several dependencies with CVEs.
+
+## [2.3.0](https://github.com/coder/code-marketplace/releases/tag/v2.3.0) - 2024-12-20
+
+### Added
+
+- Add empty signatures when starting the server with --sign. This will not work
+  with VS Code on Windows and macOS as we do not have the key required, but it
+  will work for open source versions of VS Code (VSCodium, code-server) and VS
+  Code on Linux where signatures must exist but are not actually checked.
+
+### Changed
+
+- Ignore extensions without a manifest. This is not expected in normal use, but
+  could happen if, for example, a manifest temporarily failed to download, which
+  would then crash the entire process with a segfault.
+
+## [2.2.1](https://github.com/coder/code-marketplace/releases/tag/v2.2.1) - 2024-08-14
+
+### Fixed
+
+- The "attempt to download manually" URL in VS Code will now work.
+
+## [2.2.0](https://github.com/coder/code-marketplace/releases/tag/v2.2.0) - 2024-07-17
+
+### Changed
+
+- Default max page size increased from 50 to 200.
+
+### Added
+
+- New `server` sub-command flag `--max-page-size` for setting the max page size.
+
+## [2.1.0](https://github.com/coder/code-marketplace/releases/tag/v2.1.0) - 2023-12-21
+
+### Added
+
+- New `server` sub-command flag `--list-cache-duration` for setting the duration
+  of the cache used when listing and searching extensions. The default is still
+  one minute.
+- Local storage will also use a cache for listing/searching extensions
+  (previously only Artifactory storage used a cache).
+
+## [2.0.1](https://github.com/coder/code-marketplace/releases/tag/v2.0.1) - 2023-12-08
+
+### Fixed
+
+- Extensions with problematic UTF-8 characters will no longer cause a panic.
+- Preview extensions will now show up as such.
+
+## [2.0.0](https://github.com/coder/code-marketplace/releases/tag/v2.0.0) - 2023-10-11
+
+### Breaking changes
+
+- When removing extensions, the version is now delineated by `@` instead of `-`
+  (for example `remove vscodevim.vim@1.0.0`). This fixes being unable to remove
+  extensions with `-` in their names. Removal is the only backwards-incompatible
+  change; extensions are still added, stored, and queried the same way.
+
+### Added
+
+- Support for platform-specific extensions. Previously all versions would have
+  been treated as universal and overwritten each other but now versions for
+  different platforms will be stored separately and show up separately in the
+  API response. If there are platform-specific versions that have already been
+  added, they will continue to be treated as universal versions so these should
+  be removed and re-added to be properly registered as platform-specific.
+
 ## [1.2.2](https://github.com/coder/code-marketplace/releases/tag/v1.2.2) - 2023-05-30
 
 ### Changed

CONTRIBUTING.md

@@ -0,0 +1,47 @@
+# Contributing
+
+## Development
+
+```console
+mkdir extensions
+go run ./cmd/marketplace/main.go server [flags]
+```
+
+When you make a change that affects people deploying the marketplace please
+update the changelog as part of your PR.
+
+You can use `make gen` to generate a mock `extensions` directory for testing and
+`make upload` to upload them to an Artifactory repository.
+
+## Tests
+
+To run the tests:
+
+```
+make test
+```
+
+To run the Artifactory tests against a real repository instead of a mock:
+
+```
+export ARTIFACTORY_URI=myuri
+export ARTIFACTORY_REPO=myrepo
+export ARTIFACTORY_TOKEN=mytoken
+make test
+```
+
+See the readme for using the marketplace with code-server.
+
+When testing with code-server you may run into issues with content security
+policy if the marketplace runs on a different domain over HTTP; in this case you
+will need to disable content security policy in your browser or manually edit
+the policy in code-server's source.
+
+## Releasing
+
+1. Check that the changelog lists all the important changes.
+2. Update the changelog with the release date.
+3. Push a tag with the new version.
+4. Update the resulting draft release with the changelog contents.
+5. Publish the draft release.
+6. Bump the Helm chart version once the Docker images have published.