review-followups-4: @vscode/test-electron integration tests (R17)

[dmartinochoa]

Summary

Fourth batch from the post-v0.1.1 review. Stacked on #13. Lands R17 — `@vscode/test-electron` integration tests.

Scope is deliberately bounded to client-side activation contracts so CI doesn't need Python + pipeline-check[lsp] installed. Future PRs can add an LSP stub to verify end-to-end diagnostic publishing if it earns its keep.

What changed

New test surface

• .vscode-test.mjs — workspace-folder pinned to `test-fixtures/sample-workflow` so `workspaceContains:` events fire.
• tsconfig.integration.json — compiles `src/test/integration/` to `out-test/` with mocha globals enabled.
• src/test/integration/activation.test.ts — 5 tests covering activation, every command's registration, the Findings view registration, the configuration-schema completeness, and the workspace-trust capability declarations.

Wiring

• `npm run test:integration` compiles + runs the suite via `vscode-test`. `xvfb-run -a npm run test:integration` in CI on Linux only.
• `tsconfig.json` and `vitest.config.ts` exclude `src/test/integration/` so the main build / unit suite don't pick up the mocha-style files.
• `.vscodeignore` excludes `out-test/` and the new tsconfig/test-cli config files so the `.vsix` stays clean.

DevDeps

• `@vscode/test-cli`, `@vscode/test-electron`, `mocha@^11`, `@types/mocha`.
• Mocha pinned to `^11` deliberately — npm chose `mocha@12-beta` by default and the beta has unfixed advisories in `diff` and `serialize-javascript`. CI's prod-only `npm audit` still returns 0; the dev-only advisories don't reach users.

What this catches that unit tests can't

The 5 integration tests verify:

1. Activation actually fires. `vi.mock("vscode")` can't tell us whether the extension wakes up in a real editor.
2. Every declared command registers. Catches the class of bug where a contributions entry exists but the `registerCommand` call is missing (or vice versa).
3. The Findings view registers under the activity-bar container. The auto-generated `pipelineCheck.findings.focus` command is a proxy for view-registration without using private API.
4. The configuration schema deserialises — every setting we document is queryable via `config.inspect()`.
5. Workspace-trust capability is correct — `untrustedWorkspaces.supported === "limited"` and `virtualWorkspaces === false`.

Test plan

• `npm run lint` clean
• `npm run compile` clean
• `npm test` — 90 unit tests pass (unchanged)
• `npm run test:integration:compile` — emits to `out-test/` cleanly
• `npm run smoke` clean
• `vsce ls` confirms `out-test/` + config files don't ship
• CI run on this PR exercises `xvfb-run -a npm run test:integration` on Linux (Windows/macOS skip).
• First failing-activation PR after this lands will fail-fast in CI instead of in the marketplace.

Notes

• The pattern `assert(value)` (default import) instead of `assert.ok(value)` (namespace import) is the cleanest way to get TypeScript's assertion-function narrowing inside the test file.
• The CI step uses `xvfb-run -a` (auto-server-number) so concurrent matrix shards don't collide on a fixed display number. The Windows/macOS shards don't need it — VS Code's GUI mode works headless there.
• Open Open VSX's tests run on push only, not pre-merge, so we don't need an Open-VSX-specific integration story.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cd1e345d-b0e0-4e74-9476-fe424a3b1f55

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch review-followups-batch-4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[dmartinochoa]

Rolled into #16 (v0.2.0 mega-PR). Every commit from this branch is in #16's history; closing to consolidate the merge.