Merge pull request #644 from gigara/ls-daily-build-fixes

Fix daily build LS job failures and add label-gated LS tests to PR checks

Author: gigara

.github/actions/ls-test/action.yml

@@ -0,0 +1,62 @@
+name: Run Ballerina LS tests
+description: Sets up JDK, Gradle, and Ballerina, restores the dependency cache, and runs the language server gradle test suite. The repository must already be checked out.
+
+inputs:
+  cache-branch:
+    description: Branch name used in the Ballerina dependency cache key
+    required: true
+  gradle-version:
+    description: Version passed to gradle as -Pversion (omitted when empty)
+    required: false
+    default: ''
+  package-user:
+    description: User for maven.pkg.github.com authentication
+    required: true
+  package-pat:
+    description: Token for maven.pkg.github.com authentication
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Set up JDK 21
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+      with:
+        distribution: 'temurin'
+        java-version: 21.0.3
+
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4
+
+    - name: Set Up Ballerina
+      uses: ballerina-platform/setup-ballerina@97fd67111e3c3ecdfafff96fc24d95ad909ab299 # v1.1.4
+      with:
+        version: 2201.13.3
+
+    - name: Cache Ballerina dependencies
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      with:
+        path: ${{ runner.os == 'Windows' && 'C:\Users\runneradmin\.ballerina\repositories\' || '/home/runner/.ballerina/repositories/' }}
+        key: ${{ runner.os }}-ballerina-${{ inputs.cache-branch }}-${{ hashFiles('**/gradle.properties') }}
+        restore-keys: |
+          ${{ runner.os }}-ballerina-${{ inputs.cache-branch }}-
+          ${{ runner.os }}-ballerina-
+
+    - name: Test with Gradle
+      shell: bash
+      working-directory: packages/ballerina-language-server
+      env:
+        packageUser: ${{ inputs.package-user }}
+        packagePAT: ${{ inputs.package-pat }}
+        GRADLE_PROJECT_VERSION: ${{ inputs.gradle-version }}
+      run: |
+        if [ "$RUNNER_OS" = "Windows" ]; then
+          GRADLE=./gradlew.bat
+        else
+          GRADLE=./gradlew
+        fi
+        if [ -n "$GRADLE_PROJECT_VERSION" ]; then
+          "$GRADLE" -Pversion="$GRADLE_PROJECT_VERSION" test
+        else
+          "$GRADLE" test
+        fi

.github/workflows/build.yml

@@ -35,6 +35,10 @@ on:
         type: boolean
         required: false
         default: false
+      runLSTests:
+        type: boolean
+        required: false
+        default: false
       lsSource:
         description: LS source — local (build from source) or download (fetch from release tag)
         type: string
@@ -326,3 +330,30 @@ jobs:
           path: |
             packages/ballerina-extension/e2e-test/data/new-project/**
           retention-days: 5
+
+  LSTest_Ballerina:
+    name: Run Ballerina LS tests (${{ matrix.os }})
+    timeout-minutes: 60
+    if: ${{ inputs.runLSTests }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Enable long paths for Git
+        if: runner.os == 'Windows'
+        shell: bash
+        run: git config --system core.longpaths true
+
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Run LS tests
+        uses: ./.github/actions/ls-test
+        with:
+          cache-branch: ${{ github.ref_name }}
+          package-user: ${{ github.actor }}
+          package-pat: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/daily-build.yml

@@ -131,9 +131,6 @@ jobs:
     concurrency:
       group: ls-ubuntu-test-${{ matrix.branch }}-${{ github.ref_name }}
       cancel-in-progress: true
-    defaults:
-      run:
-        working-directory: packages/ballerina-language-server
     strategy:
       fail-fast: false
       matrix:
@@ -145,33 +142,15 @@ jobs:
           ref: ${{ matrix.branch }}
           persist-credentials: false
 
-      - name: Set up JDK 21
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
-        with:
-          distribution: 'temurin'
-          java-version: 21.0.3
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4
-
-      - name: Set Up Ballerina
-        uses: ballerina-platform/setup-ballerina@97fd67111e3c3ecdfafff96fc24d95ad909ab299 # v1.1.4
+      # Resolved from the matrix.branch checkout — the action file must
+      # also exist on release branches in the matrix.
+      - name: Run LS tests
+        uses: ./.github/actions/ls-test
         with:
-          version: 2201.13.3
-
-      - name: Cache Ballerina dependencies
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
-        with:
-          path: /home/runner/.ballerina/repositories/
-          key: ${{ runner.os }}-ballerina-${{ matrix.branch }}-${{ hashFiles('**/gradle.properties') }}
-          restore-keys: |
-            ${{ runner.os }}-ballerina-${{ matrix.branch }}-
-
-      - name: Test with Gradle
-        env:
-          packageUser: ${{ github.actor }}
-          packagePAT: ${{ secrets.GITHUB_TOKEN }}
-        run: ./gradlew -Pversion=${{ matrix.version }} test
+          cache-branch: ${{ matrix.branch }}
+          gradle-version: ${{ matrix.version }}
+          package-user: ${{ github.actor }}
+          package-pat: ${{ secrets.GITHUB_TOKEN }}
 
   ls-windows-build:
     name: LS Windows build (${{ matrix.branch }})
@@ -191,6 +170,8 @@ jobs:
     steps:
       - name: Enable long paths for Git
         shell: bash
+        # Override the job default working-directory — it does not exist before checkout.
+        working-directory: ${{ github.workspace }}
         run: git config --system core.longpaths true
 
       - name: Checkout repository

.github/workflows/pull-request.yml

@@ -50,3 +50,4 @@ jobs:
     with:
       runOnAWS: ${{ contains(github.event.pull_request.labels.*.name, 'Runner/AWS') }}
       runBalE2ETests: ${{ contains(github.event.pull_request.labels.*.name, 'Checks/Run Ballerina UI Tests') || github.base_ref == 'stable/ballerina' }}
+      runLSTests: ${{ contains(github.event.pull_request.labels.*.name, 'Checks/Run LS Tests') }}

common/config/rush/pnpm-config.json

@@ -94,18 +94,27 @@
       // Security overrides — keep in sync with trivy findings. Bump to the
       // first fix version listed for each CVE. If a bump breaks workspace
       // consumers, narrow the selector (e.g. "pkg@<x.y.z": "x.y.z").
+      "@babel/core@>=7 <8": "7.29.6",
       "@tootallnate/once": "3.0.1",
       "braces": "3.0.3",
-      "dompurify": "3.4.0",
+      "dompurify": "3.4.9",
+      "form-data@>=2 <3": "2.5.6",
+      "form-data@>=4 <5": "4.0.6",
       "handlebars": "4.7.9",
       "http-proxy": "1.18.1",
-      "js-yaml@4": "4.1.1",
+      "joi@>=17 <18": "17.13.4",
+      // js-yaml v3 has no in-line fix for CVE-2026-53550; the GHSA only fixes
+      // in v4.2.0. Force all consumers to v4 — revert with narrower selector
+      // if a workspace package needs the v3 sync API.
+      "js-yaml": "4.2.0",
+      "launch-editor": "2.14.1",
+      "markdown-it@>=14 <15": "14.2.0",
       "micromatch": "4.0.8",
       "prismjs": "1.30.0",
-      "protobufjs": "7.5.8",
+      "protobufjs@>=7 <8": "7.6.3",
       "qs@6": "6.15.2",
       "serialize-javascript": "7.0.5",
-      "tmp": "0.2.6",
+      "tmp": "0.2.7",
       // uuid 8.x has no in-line fix; bump to 11.1.1 (fix line for v11). Revert
       // if this breaks consumers that strictly need uuid v8 API.
       "uuid@8": "11.1.1",