Update codeserver

.github/workflows/build-notebooks-TEMPLATE.yaml

@@ -117,9 +117,10 @@ jobs:
       - name: Unlock encrypted secrets with git-crypt
         if: ${{ inputs.subscription }}
         run: |
-          echo "${GIT_CRYPT_KEY}" | base64 --decode > ./git-crypt-key
-          git-crypt unlock ./git-crypt-key
-          rm ./git-crypt-key
+          key_file="$(mktemp)"
+          echo "${GIT_CRYPT_KEY}" | base64 --decode > "${key_file}"
+          trap 'rm -f "${key_file}"' EXIT
+          git-crypt unlock "${key_file}"
         env:
           GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}
 

.github/workflows/params-env.yaml

@@ -49,9 +49,10 @@ jobs:
       - name: Unlock encrypted secrets with git-crypt
         if: matrix.variant == 'rhoai'
         run: |
-          echo "${GIT_CRYPT_KEY}" | base64 --decode > ./git-crypt-key
-          git-crypt unlock ./git-crypt-key
-          rm ./git-crypt-key
+          key_file="$(mktemp)"
+          echo "${GIT_CRYPT_KEY}" | base64 --decode > "${key_file}"
+          trap 'rm -f "${key_file}"' EXIT
+          git-crypt unlock "${key_file}"
         env:
           GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}
 

.github/workflows/renovate-self-hosted.yaml

@@ -86,9 +86,10 @@ jobs:
 
       - name: Unlock encrypted secrets with git-crypt
         run: |
-          echo "${GIT_CRYPT_KEY}" | base64 --decode > ./git-crypt-key
-          trap 'rm -f ./git-crypt-key' EXIT
-          git-crypt unlock ./git-crypt-key
+          key_file="$(mktemp)"
+          echo "${GIT_CRYPT_KEY}" | base64 --decode > "${key_file}"
+          trap 'rm -f "${key_file}"' EXIT
+          git-crypt unlock "${key_file}"
         env:
           GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}
 

.github/workflows/rpms-lock-renewal.yaml

@@ -55,6 +55,10 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        env:
+          # Avoid smudging LFS files during checkout; mis-tracked *.vsix blobs
+          # otherwise leave the tree dirty and block git-crypt unlock.
+          GIT_LFS_SKIP_SMUDGE: 1
         with:
           ref: ${{ env.BRANCH }}
           persist-credentials: false
@@ -76,12 +80,26 @@ jobs:
         with:
           packages: git-crypt
 
+      - name: Normalize git tree before git-crypt unlock
+        if: env.VARIANT == 'rhds'
+        run: |
+          # git-crypt unlock requires `git status -uno` to be empty. Ubuntu runners
+          # ship Git LFS; *.vsix files committed without LFS pointers show as modified.
+          git lfs install --local --skip-smudge
+          git checkout -f HEAD
+          if [[ -n "$(git status -uno --porcelain)" ]]; then
+            echo "Working tree still dirty before git-crypt unlock:" >&2
+            git status -uno --porcelain >&2
+            exit 1
+          fi
+
       - name: Unlock encrypted secrets with git-crypt
         if: env.VARIANT == 'rhds'
         run: |
-          echo "${GIT_CRYPT_KEY}" | base64 --decode > ./git-crypt-key
-          trap 'rm -f ./git-crypt-key' EXIT
-          git-crypt unlock ./git-crypt-key
+          key_file="$(mktemp)"
+          echo "${GIT_CRYPT_KEY}" | base64 --decode > "${key_file}"
+          trap 'rm -f "${key_file}"' EXIT
+          git-crypt unlock "${key_file}"
         env:
           GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}
 

.github/workflows/software-versions.yaml

@@ -43,9 +43,10 @@ jobs:
 
       - name: Unlock encrypted secrets with git-crypt
         run: |
-          echo "${GIT_CRYPT_KEY}" | base64 --decode > ./git-crypt-key
-          trap 'rm -f ./git-crypt-key' EXIT
-          git-crypt unlock ./git-crypt-key
+          key_file="$(mktemp)"
+          echo "${GIT_CRYPT_KEY}" | base64 --decode > "${key_file}"
+          trap 'rm -f "${key_file}"' EXIT
+          git-crypt unlock "${key_file}"
         env:
           GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}
 

.tekton/odh-workbench-codeserver-datascience-cpu-py312-ubi9-ci-push.yaml

@@ -111,7 +111,7 @@ spec:
       type: npm
     - path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/merge-conflict
       type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/mermaid-chat-features
+    - path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/mermaid-markdown-features
       type: npm
     - path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/notebook-renderers
       type: npm
@@ -154,20 +154,12 @@ spec:
     - path: codeserver/ubi9-python-3.12/prefetch-input/code-server
       type: npm
     # patches/ overlay (codeserver/ubi9-python-3.12/prefetch-input/patches/) — Cachi2 prefetches registry-only lockfiles; keep in sync with patches that have package.json
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode
+    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.127.0/lib/vscode
       type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/remote
-      type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/extensions
-      type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/extensions/emmet
-      type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/test
-      type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/extensions/microsoft-authentication
+    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.127.0/lib/vscode/extensions/emmet
       type: npm
     # Registry-only npm deps (ProdSec); @parcel/watcher, @emmetio/css-parser, @playwright/browser-chromium in custom-packages/package.json
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/custom-packages
+    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.127.0/custom-packages
       type: npm
 
   taskRunSpecs:

.tekton/odh-workbench-codeserver-datascience-cpu-py312-ubi9-pull-request.yaml

@@ -121,7 +121,7 @@ spec:
       type: npm
     - path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/merge-conflict
       type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/mermaid-chat-features
+    - path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/mermaid-markdown-features
       type: npm
     - path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/notebook-renderers
       type: npm
@@ -164,20 +164,12 @@ spec:
     - path: codeserver/ubi9-python-3.12/prefetch-input/code-server
       type: npm
     # patches/ overlay (overwrites code-server at build); use these so Cachi2 prefetches registry-only lockfiles
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode
+    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.127.0/lib/vscode
       type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/remote
-      type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/extensions
-      type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/extensions/emmet
-      type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/test
-      type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/extensions/microsoft-authentication
+    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.127.0/lib/vscode/extensions/emmet
       type: npm
     # Registry-only npm deps (ProdSec); @parcel/watcher, @emmetio/css-parser, @playwright/browser-chromium in custom-packages/package.json
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/custom-packages
+    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.127.0/custom-packages
       type: npm
   taskRunSpecs:
   - pipelineTaskName: prefetch-dependencies

.tekton/odh-workbench-codeserver-datascience-cpu-py312-ubi9-push.yaml

@@ -116,7 +116,7 @@ spec:
       type: npm
     - path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/merge-conflict
       type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/mermaid-chat-features
+    - path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/mermaid-markdown-features
       type: npm
     - path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/notebook-renderers
       type: npm
@@ -159,20 +159,12 @@ spec:
     - path: codeserver/ubi9-python-3.12/prefetch-input/code-server
       type: npm
     # patches/ overlay (codeserver/ubi9-python-3.12/prefetch-input/patches/) — Cachi2 prefetches registry-only lockfiles; keep in sync with patches that have package.json
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode
+    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.127.0/lib/vscode
       type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/remote
-      type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/extensions
-      type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/extensions/emmet
-      type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/test
-      type: npm
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/extensions/microsoft-authentication
+    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.127.0/lib/vscode/extensions/emmet
       type: npm
     # Registry-only npm deps (ProdSec); @parcel/watcher, @emmetio/css-parser, @playwright/browser-chromium in custom-packages/package.json
-    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/custom-packages
+    - path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.127.0/custom-packages
       type: npm
 
   taskRunSpecs:

codeserver/Extensions.md

@@ -44,8 +44,16 @@ When adding or updating extensions, place the downloaded `.vsix` artifacts under
 
 For `codeserver/ubi9-python-3.12`, the image expects these `.vsix` files in `utils/`:
 
-- **ms-python.python** 2026.0.0: <https://open-vsx.org/api/ms-python/python/2026.0.0/file/ms-python.python-2026.0.0.vsix>
-- **ms-toolsai.jupyter** 2025.9.1: <https://open-vsx.org/api/ms-toolsai/jupyter/2025.9.1/file/ms-toolsai.jupyter-2025.9.1.vsix>
+**User-installed extensions (final image stage):**
+
+- **ms-python.python** 2026.0.0 (`engines.vscode`: ^1.95.0): <https://open-vsx.org/api/ms-python/python/2026.0.0/file/ms-python.python-2026.0.0.vsix>
+- **ms-toolsai.jupyter** 2025.9.1 (`engines.vscode`: ^1.105.0): <https://open-vsx.org/api/ms-toolsai/jupyter/2025.9.1/file/ms-toolsai.jupyter-2025.9.1.vsix>
+
+**Built-in VS Code extensions (hermetic build; versions must match `lib/vscode/product.json` for 1.127):**
+
+- **ms-vscode.js-debug** 1.117.0: <https://open-vsx.org/api/ms-vscode/js-debug/1.117.0/file/ms-vscode.js-debug-1.117.0.vsix> (save as `ms-vscode.js-debug.1.117.0.vsix`)
+- **ms-vscode.js-debug-companion** 1.1.3: <https://open-vsx.org/api/ms-vscode/js-debug-companion/1.1.3/file/ms-vscode.js-debug-companion-1.1.3.vsix>
+- **ms-vscode.vscode-js-profile-table** 1.0.10: <https://open-vsx.org/api/ms-vscode/vscode-js-profile-table/1.0.10/file/ms-vscode.vscode-js-profile-table-1.0.10.vsix>
 
 Download with `curl -o <filename> <url>` and place under `codeserver/ubi9-python-3.12/utils/`.
 

codeserver/ubi9-python-3.12/Dockerfile.konflux.cpu

@@ -26,7 +26,7 @@ ARG BASE_IMAGE
 #   - Node.js/npm: installed from prefetched RPMs
 #   - npm dependencies: package-lock.json resolved URLs rewritten to file:///cachi2/...
 #   - node-gyp: system headers via nodejs-devel RPM (NPM_CONFIG_NODEDIR=/usr),
-#     VS Code remote headers (22.20.0) from prefetched tarballs, ripgrep from RHOAI Python wheel (deps/pip)
+#     ripgrep from RHOAI Python wheel (deps/pip)
 #   - Build scripts patched to avoid any network fetches (patches/*.patch)
 ############################################################################################
 # e.g., registry.access.redhat.com/ubi9/python-312:latest
@@ -45,22 +45,23 @@ ENV CODESERVER_SOURCE_PREFETCH=${CODESERVER_SOURCE_CODE}/prefetch-input/code-ser
 ARG BASE_IMAGE
 ARG GHA_BUILD=false
 
-ARG NODE_VERSION=22.21.1
-ARG CODESERVER_VERSION=v4.106.3
+ARG NODE_VERSION=24.15.0
+ARG CODESERVER_VERSION=v4.127.0
 
 # [HERMETIC] Import GPG keys for prefetched RPM verification.
 # CentOS key imported only if prefetched (present in Dockerfile.cpu; may be absent in Konflux).
 RUN rpm --import /cachi2/output/deps/generic/RPM-GPG-KEY-CentOS-Official || true
 RUN rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
 
-# [HERMETIC] Enable nodejs:22 module stream so DNF can resolve nodejs-devel
+# [HERMETIC] Enable nodejs:24 module stream so DNF can resolve nodejs-devel
 # and other modular packages. The hermeto repos include module metadata
-# (modules.yaml) because rpms.in.yaml declares moduleEnable: [nodejs:22].
-RUN dnf module enable nodejs:22 -y
+# (modules.yaml) because rpms.in.yaml declares moduleEnable: [nodejs:24].
+RUN dnf module enable nodejs:24 -y
 
 # libxkbfile-devel = util-macros + libxkbfile (Previously built from source)
 RUN dnf install -y \
         nodejs nodejs-devel npm \
+        git git-lfs \
         jq patch libtool rsync gettext gcc-toolset-14 gcc-toolset-14-libatomic-devel \
         krb5-devel libX11-devel libxkbfile-devel && \
     dnf clean all
@@ -107,9 +108,20 @@ RUN cd ${CODESERVER_SOURCE_CODE} && \
 RUN . ${CODESERVER_SOURCE_CODE}/patches/codeserver-offline-env.sh && cd ${CODESERVER_SOURCE_PREFETCH} && \
     npm run build
 
-# [HERMETIC] Step 3: Build VS Code (the embedded editor)
+# [HERMETIC] Step 3: Build VS Code (the embedded editor).
+# Split into separate RUN steps so each gulp phase gets a fresh process tree
+# and peak RSS drops between copilot compile, core-ci, and reh-web packaging.
 RUN . ${CODESERVER_SOURCE_CODE}/patches/codeserver-offline-env.sh && cd ${CODESERVER_SOURCE_PREFETCH} && \
-    VERSION=${CODESERVER_VERSION/v/} npm run build:vscode
+    VERSION=${CODESERVER_VERSION/v/} ./ci/build/build-vscode.sh prepare
+
+RUN . ${CODESERVER_SOURCE_CODE}/patches/codeserver-offline-env.sh && cd ${CODESERVER_SOURCE_PREFETCH} && \
+    VERSION=${CODESERVER_VERSION/v/} ./ci/build/build-vscode.sh copilot
+
+RUN . ${CODESERVER_SOURCE_CODE}/patches/codeserver-offline-env.sh && cd ${CODESERVER_SOURCE_PREFETCH} && \
+    VERSION=${CODESERVER_VERSION/v/} ./ci/build/build-vscode.sh core
+
+RUN . ${CODESERVER_SOURCE_CODE}/patches/codeserver-offline-env.sh && cd ${CODESERVER_SOURCE_PREFETCH} && \
+    VERSION=${CODESERVER_VERSION/v/} ./ci/build/build-vscode.sh package
 
 # [HERMETIC] Step 4: Create release bundle.
 RUN . ${CODESERVER_SOURCE_CODE}/patches/codeserver-offline-env.sh && \
@@ -118,7 +130,7 @@ RUN . ${CODESERVER_SOURCE_CODE}/patches/codeserver-offline-env.sh && \
 
 RUN . ${CODESERVER_SOURCE_CODE}/patches/codeserver-offline-env.sh && \
     export KEEP_MODULES=1 && cd ${CODESERVER_SOURCE_PREFETCH} && \
-    npm run release:standalone
+    ./ci/build/build-standalone-release.sh
 
 # Sentinel file: downstream stages use COPY --from=rpm-base /tmp/control to wait for this stage.
 RUN echo "done" > /tmp/control
@@ -142,8 +154,8 @@ USER 0
 RUN rpm --import /cachi2/output/deps/generic/RPM-GPG-KEY-CentOS-Official || true
 RUN rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
 
-# [HERMETIC] Enable nodejs:22 module stream (see rpm-base comment).
-RUN dnf module enable nodejs:22 -y
+# [HERMETIC] Enable nodejs:24 module stream (see rpm-base comment).
+RUN dnf module enable nodejs:24 -y
 
 # [HERMETIC] Install Node.js runtime from prefetched RPMs.
 RUN dnf install -y nodejs npm && dnf clean all
@@ -179,7 +191,7 @@ ARG TARGETOS
 ARG TARGETARCH
 
 ARG CODESERVER_SOURCE_CODE=codeserver/ubi9-python-3.12
-ARG CODESERVER_VERSION=v4.106.3
+ARG CODESERVER_VERSION=v4.127.0
 ARG PYLOCK_FLAVOR
 
 ARG LABEL_REGISTRY_PREFIX
@@ -199,8 +211,8 @@ USER 0
 
 WORKDIR /opt/app-root/bin
 
-# [HERMETIC] Enable nodejs:22 module stream (see rpm-base comment).
-RUN dnf module enable nodejs:22 -y
+# [HERMETIC] Enable nodejs:24 module stream (see rpm-base comment).
+RUN dnf module enable nodejs:24 -y
 
 # [HERMETIC] Install useful OS packages from prefetched RPMs.
 # nodejs: provides libnode.so needed at runtime by code-server's bundled node binary.

codeserver/ubi9-python-3.12/README.md

@@ -292,8 +292,8 @@ Repos are injected by the **infrastructure**, not by the Dockerfile:
 
 Both environments replace the base image's default repos with hermeto-generated
 repos. These repos include module metadata (`modules.yaml`) because
-`rpms.in.yaml` declares `moduleEnable: [nodejs:22]`. The Dockerfile then runs
-`dnf module enable nodejs:22 -y` in each stage that installs nodejs packages.
+`rpms.in.yaml` declares `moduleEnable: [nodejs:24]`. The Dockerfile then runs
+`dnf module enable nodejs:24 -y` in each stage that installs nodejs packages.
 
 ---
 

codeserver/ubi9-python-3.12/prefetch-input/odh/rpms.in.yaml

@@ -30,7 +30,7 @@ arches:
   - aarch64
   - ppc64le
 
-moduleEnable: [nodejs:22]
+moduleEnable: [nodejs:24]
 
 packages:
 
@@ -66,7 +66,7 @@ packages:
   - automake
   - libtool
 
-  # Node.js (module nodejs:22)
+  # Node.js (module nodejs:24; required by code-server 4.125+)
   - nodejs-devel
   - nodejs-packaging
   - npm