build: vendor the Coder API client with a sync script

The extension imports five files from coder/coder, but the git dependency
downloads the whole 125 MB repository on every cold install. Add
`pnpm sync:coder` to download the files into `vendor/coder` at a pinned
release commit, and link the `coder` dependency to that folder so imports
stay `coder/site/src/...`.

The Lint job runs the sync and fails on any diff, so hand edits or a
bumped commit without a resync can't merge. With no git dependencies
left, drop the HTTPS rewrite from CI setup.

Author: EhabY

.gitattributes

@@ -1,3 +1,4 @@
 * text=auto eol=lf
 pnpm-lock.yaml linguist-generated=true
 flake.lock linguist-generated=true
+vendor/coder/site/** linguist-generated=true

.github/actions/setup/action.yml

@@ -4,11 +4,6 @@ description: Install pnpm, Node.js, and project dependencies.
 runs:
   using: composite
   steps:
-    - name: Use HTTPS for GitHub git clones
-      shell: bash
-      # Needed for git-based deps (e.g. github:coder/coder) so pnpm can clone without SSH.
-      run: git config --global url."https://github.com/".insteadOf "git@github.com:"
-
     - uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
       with:
         runtime: node@22

.github/workflows/ci.yaml

@@ -28,6 +28,9 @@ jobs:
 
       - run: pnpm format:check
 
+      - name: Check vendored Coder client
+        run: pnpm sync:coder && git diff --exit-code vendor/coder
+
       - run: pnpm lint
 
       - run: pnpm build

.oxfmtrc.jsonc

@@ -7,9 +7,10 @@
 	"ignorePatterns": [
 		"flake.lock",
 		"pnpm-lock.yaml",
-		// Golden snapshots and generated VS Code theme dumps are written verbatim.
+		// Golden snapshots, VS Code theme dumps, and the vendored Coder client are written verbatim.
 		"**/__golden__/",
-		".storybook/themes/generated/"
+		".storybook/themes/generated/",
+		"vendor/coder/site/"
 	],
 	"overrides": [
 		{

.oxlintrc.jsonc

@@ -17,7 +17,8 @@
 		"**/vite.config*.ts",
 		".vscode-test/**",
 		"test/fixtures/scripts/**",
-		"storybook-static/**"
+		"storybook-static/**",
+		"vendor/coder/site/**"
 	],
 	"overrides": [
 		{

docs/TOOLING.md

@@ -74,11 +74,9 @@ Some dependencies are not directly used in the source but are required anyway.
   builds are off, so Windows on ARM64 uses their JavaScript fallback.
 - `ua-parser-js` and `dayjs` are used by the Coder API client.
 
-The coder client is vendored from coder/coder. Pin it to a release tag in
-`pnpm-workspace.yaml` (e.g. `coder: github:coder/coder#v2.33.1`), not `#main`.
-A tag gives reproducible builds and is not re-fetched on every `pnpm install`,
-unlike `#main` which can drift between installs. To update, bump the tag and
-run `pnpm install` (or `pnpm update coder`).
+The Coder API client is vendored from coder/coder into `vendor/coder/site`. To
+update it, set `CODER_COMMIT` in `vendor/coder/sync.mjs` to a release commit
+and run `pnpm sync:coder`.
 
 After running `pnpm update`, always run `pnpm dedupe` to consolidate duplicate
 package versions across the workspace. Without this, workspace packages can

eslint.config.mjs

@@ -25,6 +25,7 @@ export default defineConfig(
 		".vscode-test/**",
 		"test/fixtures/scripts/**",
 		"storybook-static/**",
+		"vendor/coder/site/**",
 	]),
 
 	// Parse TypeScript without the type-aware programs; Oxlint owns typed rules.
@@ -42,6 +43,7 @@ export default defineConfig(
 				createTypeScriptImportResolver({ project: "./tsconfig.json" }),
 			],
 			"import-x/internal-regex": "^@/",
+			"import-x/external-module-folders": ["node_modules", "vendor"],
 		},
 		rules: {
 			"import-x/order": [

package.json

@@ -41,6 +41,7 @@
 		"storybook": "storybook dev -p 6006 --config-dir .storybook",
 		"storybook:build": "storybook build --config-dir .storybook",
 		"storybook:ci": "storybook build --test --config-dir .storybook",
+		"sync:coder": "node vendor/coder/sync.mjs",
 		"sync:vscode-themes": "node .storybook/themes/sync.mjs",
 		"test": "cross-env CI=true ELECTRON_RUN_AS_NODE=1 electron node_modules/vitest/vitest.mjs",
 		"test:extension": "cross-env ELECTRON_RUN_AS_NODE=1 electron node_modules/vitest/vitest.mjs --project extension",
@@ -853,7 +854,7 @@
 		"@vscode/vsce": "^4.0.0",
 		"babel-plugin-react-compiler": "catalog:",
 		"bufferutil": "^4.1.0",
-		"coder": "catalog:",
+		"coder": "link:vendor/coder",
 		"concurrently": "^10.0.5",
 		"cross-env": "^10.1.0",
 		"dayjs": "^1.11.23",

pnpm-lock.yaml

@@ -16,7 +16,6 @@ catalog:
   "@vscode-elements/react-elements": ^2.4.0
   "@vscode/codicons": 0.0.46-24
   babel-plugin-react-compiler: ^1.0.0
-  coder: github:coder/coder#22f4284f8fa67bc3af6fc38e0079616d39128566 # v2.37.1
   date-fns: ^4.4.0
   react: ^19.3.0
   react-dom: ^19.3.0