feat(vscode): switch vsix build to bazel aspects

v0.1.57
CMK-33447

Replace the vsix genrule with proper aspect_rules_js rules:
- js_binary + js_run_binary wrapping esbuild.js for the bundle
- copy_to_directory to stage only VSIX-bound files (keeps sandbox
  artifacts out of the package)
- vsce_bin.vsce from the pnpm workspace to produce the VSIX
- --allow-package-all-secrets / --allow-package-env-file to skip
  secretlint (rules aren't findable through the pnpm layout)

esbuild's native ELF bin can't be invoked through aspect_rules_js's
bin macro, so we keep esbuild.js as a tiny JS driver.

Change-Id: Ia7d9dcf8075ccf3727164a8bd8316c85edd8d559

Author: otAAAh

.ide/vscode/BUILD

@@ -1,6 +1,8 @@
-load("@aspect_rules_js//js:defs.bzl", "js_library")
+load("@aspect_bazel_lib//lib:copy_to_directory.bzl", "copy_to_directory")
+load("@aspect_rules_js//js:defs.bzl", "js_binary", "js_library", "js_run_binary")
 load("@npm//:defs.bzl", "npm_link_all_packages")
 load("@npm//:vitest/package_json.bzl", vitest_bin = "bin")
+load("@npm//.ide/vscode:@vscode/vsce/package_json.bzl", vsce_bin = "bin")
 load("@rules_python//python:defs.bzl", "py_binary")
 
 npm_link_all_packages(name = "node_modules")
@@ -47,46 +49,56 @@ py_binary(
     srcs = ["scripts/generate_changelog.py"],
 )
 
-genrule(
-    name = "vsix",
-    srcs = glob(
+js_binary(
+    name = "esbuild_bundler",
+    data = [":node_modules/esbuild"],
+    entry_point = "esbuild.js",
+)
+
+js_run_binary(
+    name = "bundle",
+    srcs = [":src_ts"],
+    chdir = package_name(),
+    out_dirs = ["out"],
+    tool = ":esbuild_bundler",
+)
+
+copy_to_directory(
+    name = "vsix_staging",
+    srcs = [
+        ".vscodeignore",
+        "CLAUDE.md",
+        "README.md",
+        "icon.png",
+        "icon.svg",
+        "package.json",
+        ":bundle",
+    ] + glob(
         [
-            "src/**",
             "config/**",
-            "icons/**",
             "docs/**",
+            "icons/**",
             "scripts/**",
             "changelog/**",
         ],
         allow_empty = True,
-        exclude = [
-            "node_modules/**",
-            "out/**",
-            "*.vsix",
-        ],
-    ) + [
-        "package.json",
-        "tsconfig.json",
-        "esbuild.js",
-        ".vscodeignore",
-        "CLAUDE.md",
-        "README.md",
-        "icon.png",
-        "icon.svg",
-    ],
+    ),
+    root_paths = [package_name()],
+)
+
+vsce_bin.vsce(
+    name = "vsix",
+    srcs = [":vsix_staging"],
     outs = ["cmk-vscode.vsix"],
-    cmd = """
-        ROOT=$$PWD
-        EXT_DIR=$$(dirname $(location package.json))
-        cd "$$EXT_DIR"
-        node esbuild.js
-        npx @vscode/vsce package --no-dependencies -o cmk-vscode.vsix 2>&1
-        mkdir -p $$(dirname "$$ROOT/$@")
-        cp cmk-vscode.vsix "$$ROOT/$@"
-    """,
-    local = True,
-    tags = [
-        "manual",
-        "no-remote",
+    args = [
+        "package",
+        "--no-dependencies",
+        # Skip secretlint scan — it can't resolve its rules from the pnpm
+        # node_modules layout. The extension source is public anyway.
+        "--allow-package-all-secrets",
+        "--allow-package-env-file",
+        "-o",
+        "../cmk-vscode.vsix",
     ],
+    chdir = package_name() + "/vsix_staging",
 )

.ide/vscode/CLAUDE.md

@@ -49,7 +49,7 @@ Always run both steps together. Never skip the install step.
 
 - **TypeScript** (`tsconfig.json`): Target ES2022, strict mode, CommonJS output to `out/`
 - **esbuild** (`esbuild.js`): Bundles `src/extension.ts` → `out/extension.js`, CSS imported as text via `loader: { '.css': 'text' }`, `vscode` marked external
-- **Bazel** (`BUILD`): genrule runs `npm ci` → `node esbuild.js` → `npx @vscode/vsce package`
+- **Bazel** (`BUILD`): `js_run_binary` runs `esbuild.js` (bundles to `out/extension.js`), then `vsce_bin.vsce` packages a staged copy into `cmk-vscode.vsix`. Deps come from the root pnpm workspace; no `npm ci` at build time.
 - **CSS type declarations**: `src/css.d.ts` allows `import css from './style.css'` as string
 
 ### Entry Point (`src/extension.ts`)