[martinsafsten-codescene]

Summary

The extension build now pins the CWF (cs-webview) release instead of downloading whatever releases/latest happens to be. The pin lives in a committed cwf.version file at the repo root (currently 2.5.8), so a CWF bump is a one-line, reviewable commit and builds are reproducible.

Changes:

• cwf.version: new file holding the pinned version (2.5.8).
• .github/cwf.ps1 (without -Local):
  • Resolves the version from the CWF_VERSION environment variable if set, otherwise from cwf.version. Accepts MAJOR.MINOR.PATCH with an optional v prefix and rejects anything else.
  • Looks up releases/tags/v<version> and downloads the exact asset cs-webview-v<version>.zip, rather than the first asset of releases/latest.
  • Writes cs-cwf/.cwf-version after a successful extract and skips the download when that stamp matches the requested version and cs-cwf/index.js exists.
  • Fails with messages that name the missing piece (no cwf.version/CWF_VERSION, invalid version, missing token, release tag not found, asset not found, HTTP 401/403 hint about the token, extraction produced no index.js).
  • Restructured into small functions with a single Main call. The -Local path (make updatecwf) behaves as before and stamps cs-cwf/.cwf-version with local.
• Makefile: the cs-cwf.zip target now depends on cwf.version, so changing the pin re-triggers the download.
• github-release.yml, code-coverage.yml: the -Token argument is removed. The script already reads CODESCENE_IDE_DOCS_AND_WEBVIEW_TOKEN from the environment, which both workflows set, so the argument was unused.
• SETUP.md: documents the pin and two limitations: CWF_VERSION only takes effect when cwf.ps1 is run directly (Make does not see environment overrides), and returning to the pinned release after make updatecwf needs cwf.ps1 run directly or cs-cwf.zip deleted.

Reasoning for reviewers

• Using the version stamp plus an index.js existence check keeps repeat builds fast while still re-downloading if the extracted folder is incomplete or a different version.
• The stamp is removed before extraction and written only after index.js is verified, so an interrupted run never leaves a stamp that claims a good install.
• -Token was dead: the script never consumed the parameter and read the env var instead, so removing it avoids implying that it is honoured.

Test coverage

There is no automated test harness for cwf.ps1 in this repo. The change was QA-checked manually against the behaviours listed above. The CI workflows touched here exercise the real download path with the repo secret.

Sibling PRs with the same change in codescene-vscode and codescene-jetbrains are independent.

[coderabbitai]

Caution

Review failed

The pull request is closed.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codescene-access]

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: Clean Code Collective
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[codescene-access]

Code Coverage Gates Passed
New & Changed Code Coverage: 100% (required = 95%)

Review details by gate

• New & Changed Code Coverage
  • Pass/Fail Reason:
    No executable lines of code changed. (The change touched 0 files).