Phase 3.2: migrate the results tab to azure-devops-extension-sdk#21
Merged
Merged
Conversation
Ports the build-results tab off the deprecated vss-web-extension-sdk (VSS.SDK.js
+ AMD module loader) to the supported azure-devops-extension-sdk v4 +
azure-devops-extension-api v5. TypeScript, plain DOM, self-contained bundle. No
React (not needed). The /mini viewer and behaviour are preserved.
- info.ts / dialog.ts (was info.js / dialog.js): SDK.init/ready; build context
via BuildPageDataService.getBuildPageData(); attachment listing via
BuildRestClient.getAttachments + download from the attachment _links.self.href
with SDK.getAccessToken(); TestingBot API via ServiceEndpointRestClient
.executeServiceEndpointRequest; embed dialog via
IHostPageLayoutService.openCustomDialog (config passed as { url }, read by the
dialog through SDK.getConfiguration()).
- Drop jQuery for plain document.createElement, and Buffer for btoa; the 180-line
inline MD5 is replaced by the blueimp-md5 package. Keeps the Phase 3 pagination
(stable page size, count=0 guard) and error-state fixes.
- HTML now loads the webpack bundle directly (<script src="scripts/info.js">);
VSS.SDK.js and the AMD loader are gone.
- webpack bundles the SDK/API/md5 in (no AMD externals, no buffer polyfill);
@babel/preset-typescript compiles the tab. babel only strips types, so
`npm run typecheck` (tb-build-info/tsconfig.json) type-checks it; wired into
`npm run package` and the CI build workflow.
- Manifest: embed-dialog uri drops ?url={{url}} (config now via the dialog API);
the lib/ (VSS.SDK.js) entry is removed from files.
- eslint: tab files are now .ts (browser globals, typescript-eslint).
Verified statically: npm run typecheck (tab) clean, npm run lint clean,
npm test 8 passing, npm run package builds a vsix whose tab bundle is
self-contained (66KB, no AMD/define, no VSS.SDK.js).
RUNTIME VALIDATION REQUIRED (cannot be exercised outside a live Azure DevOps org):
attachment download via _links.self.href + access token; getBuildPageData()
replacing the old onBuildChanged (one-shot read on load); openCustomDialog
rendering embedDialog.html and passing { url }. Smoke-test the tab in a real org
before release.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tb-build-info/scripts/info.ts`:
- Around line 7-12: Update the build attachment contract represented by
BuildInformation to remove TB_KEY and TB_SECRET, retaining only non-secret build
metadata such as TB_BUILD_NAME and CONNECTED_SERVICE_NAME. Adjust the attachment
generation and consumers so browser-readable TestingBotBuildResult data no
longer carries credentials, and move Basic authentication and /mini signing to
the server-side flow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 9a4c9fdb-0e16-49aa-bf7b-d2e1f9d845bd
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (14)
.github/workflows/build.ymlCLAUDE.mdMODERNIZATION.mdeslint.config.mjspackage.jsontb-build-info/embedDialog.htmltb-build-info/infoTab.htmltb-build-info/scripts/dialog.jstb-build-info/scripts/dialog.tstb-build-info/scripts/info.jstb-build-info/scripts/info.tstb-build-info/tsconfig.jsonvss-extension.jsonwebpack.config.js
💤 Files with no reviewable changes (2)
- tb-build-info/scripts/dialog.js
- tb-build-info/scripts/info.js
Comment on lines
+7
to
+12
| interface BuildInformation { | ||
| TB_KEY: string; | ||
| TB_SECRET: string; | ||
| TB_BUILD_NAME: string; | ||
| CONNECTED_SERVICE_NAME: string; | ||
| } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ast-grep outline tb-main --items all --type function
rg -n -C 4 'addattachment|TestingBotBuildResult|TB_(KEY|SECRET)|CONNECTED_SERVICE_NAME' \
tb-main tb-build-infoRepository: testingbot/vso-testingbot-plugin
Length of output: 7944
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,140p' tb-build-info/scripts/info.ts
printf '\n---\n'
sed -n '140,230p' tb-main/index.tsRepository: testingbot/vso-testingbot-plugin
Length of output: 6607
Remove TB_KEY and TB_SECRET from the TestingBotBuildResult attachment contract.
The build tab consumes this browser-readable payload and uses those values for Basic auth and /mini signing; keep only non-secret build metadata in the attachment and move signing server-side.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tb-build-info/scripts/info.ts` around lines 7 - 12, Update the build
attachment contract represented by BuildInformation to remove TB_KEY and
TB_SECRET, retaining only non-secret build metadata such as TB_BUILD_NAME and
CONNECTED_SERVICE_NAME. Adjust the attachment generation and consumers so
browser-readable TestingBotBuildResult data no longer carries credentials, and
move Basic authentication and /mini signing to the server-side flow.
Source: Learnings
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The one large item deferred from Phase 3: port the build-results tab off the deprecated
vss-web-extension-sdk(VSS.SDK.js+ AMD loader) to the supportedazure-devops-extension-sdkv4 +azure-devops-extension-apiv5. TypeScript, plain DOM, self-contained bundle. No React (you picked the minimal swap). The/miniviewer and behaviour are preserved.What changed
info.ts/dialog.ts(were.js):SDK.init/ready; build context viaBuildPageDataService.getBuildPageData(); attachments viaBuildRestClient.getAttachments+ download from_links.self.hrefwithSDK.getAccessToken(); TestingBot API viaServiceEndpointRestClient.executeServiceEndpointRequest; embed dialog viaIHostPageLayoutService.openCustomDialog(URL passed as{ url }, read by the dialog throughSDK.getConfiguration()).document.createElement, andBufferforbtoa; the 180-line inline MD5 is now theblueimp-md5package. Kept the Phase 3 pagination + error-state fixes.<script src="scripts/info.js">);VSS.SDK.jsand the AMD loader are gone.@babel/preset-typescriptcompiles the tab. Since babel only strips types,npm run typechecktype-checks the tab and is wired intonpm run package+ the CI build workflow.embed-dialoguri drops?url={{url}}; thelib/(VSS.SDK.js)filesentry is removed.Verified statically
npm run typecheck(tab) clean ·npm run lintclean ·npm test8 passing ·npm run packagebuilds a vsix whose tab bundle is self-contained (66 KB, nodefine(/AMD, noVSS.SDK.js).Please smoke-test the tab in a real Azure DevOps org before release. The three things that behave differently from the old SDK and need a live check:
attachment._links.self.href+SDK.getAccessToken()(the moderngetAttachmentsdoesn't return timelineId/recordId, so I fetch the self link).getBuildPageData()replaces the oldonBuildChanged— it's a one-shot read on tab load (fine for opening a build; it won't re-fetch if the user navigates between builds without a reload).openCustomDialogrenderingembedDialog.htmland receiving{ url }viaSDK.getConfiguration().If any of those need adjusting after a live test, it's a contained follow-up.
Summary by CodeRabbit
New Features
Improvements
Documentation