Production-readiness pass: security hardening, esbuild bundle, narrowed activation #6

	name: CI

	# Gate every PR and every push to main on the same three checks the
	# publish workflow runs before shipping: lint, type-compile, and vsix
	# pack. If a contributor's PR can't be packaged, the marketplace
	# upload would have failed anyway, so failing fast here saves a
	# release-day fire-drill.

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	check:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-node@v4
	with:
	node-version: '20'
	cache: 'npm'

	- run: npm ci

	- name: Lint
	run: npm run lint

	- name: TypeScript compile
	run: npm run compile

	- name: Unit tests
	run: npm test

	- name: Bundle smoke
	# Catches the "vsix packages but won't load" failure mode — a
	# successful vsce package doesn't prove the bundle has all its
	# runtime deps. Loads dist/extension.js with a vscode stub and
	# asserts activate/deactivate are exported.
	run: npm run smoke

	- name: npm audit (prod deps, high+)
	run: npm audit --omit=dev --audit-level=high

	- name: Verify vsix packs cleanly
	# vsce is a pinned devDependency (see package.json) — Dependabot
	# bumps it via the npm config. `npm ci` has already installed it.
	run: \|
	npx vsce package --out pipeline-check.vsix
	ls -lh pipeline-check.vsix

	- uses: actions/upload-artifact@v4
	with:
	name: vsix
	path: pipeline-check.vsix
	retention-days: 14

Provide feedback