Vscode-vsce: Add github.com as badge provider

[andreujuanc]

Now with Github Actions having badges, we've got a new provider to add to the whitelist.
I'm removing my badges for now.

[joaomoreno]

Since https://github.com/microsoft/vscode-vsce/commit/84f537a4fac4b26b37a3cbd0f3644f0f517a04ec there is no more whitelist. Please update to the latest vsce.

[andreujuanc]

@joaomoreno Well, when i had GitHub badges it stated that it was an invalid badge.

I will try again next week and create another issue if it occurs again.

Cheers

[andreujuanc]

@joaomoreno
https://code.visualstudio.com/api/working-with-extensions/publishing-extension#publishing-extensions
https://code.visualstudio.com/api/references/extension-manifest#approved-badges

All these doc articles does not reflect the fact that the badges are not whitelisted anymore.

And this part of the doc , actually states the problem I have now:
Images in README.md and CHANGELOG.md may not be SVGs unless they are from trusted badge providers.

[joaomoreno]

@andreujuanc Thanks for the ping.

We've actually just had a discussion yesterday in the team that this list should be brought back: https://github.com/microsoft/vscode-vsce/issues/395

I will fix it asap and release a new VSCE version.

[joaomoreno]

@andreujuanc Can you show me an example badge from Github?

[andreujuanc]

Sorry for the delay @joaomoreno it was a busy day.
Here is the badge I was trying to use:

[![Actions Status](https://github.com/DigitalMolecules/vscode-servicebus-explorer/workflows/Build/badge.svg)](https://github.com/DigitalMolecules/vscode-servicebus-explorer/actions)

Thanks for reopening this, it'd be really cool to show the badge :)

[joaomoreno]

We can't add that source as a trusted badge provider, since this would enable anyone to simply use any badge by simply uploading it to Github.

[joaomoreno]

Hm... I see that's actually the Actions badge. We might need to improve the pattern here, since we currently filter on domain only.

So we're currently blocked by the Marketplace first and then by VSCE.

cc @viradhamMS @pkuma-msft

[JohnstonCode]

Reference to all the possible badge URLs
https://help.github.com/en/actions/automating-your-workflow-with-github-actions/configuring-a-workflow#adding-a-workflow-status-badge-to-your-repository

[felangel]

@joaomoreno had to remove my badges as well 😞@joaomoreno do you know what security concerns warrant a whitelist? I haven't seen other package/plugin discovery platforms have this requirement.

[edgardmessias]

A temporary solution:
Instead of
https://github.com/<:user>/<:repo>/workflows/<:workflow>/badge.svg
Use the:
https://img.shields.io/github/workflow/status/<:user>/<:repo>/<:workflow>.svg or
https://img.shields.io/github/workflow/status/<:user>/<:repo>/<:workflow>/<:branch>.svg

Example:
vs

Appending ?logo=github
https://img.shields.io/github/workflow/status/<:user>/<:repo>/<:workflow>.svg?logo=github or
https://img.shields.io/github/workflow/status/<:user>/<:repo>/<:workflow>/<:branch>.svg?logo=github

Appending ?label=<label>
https://img.shields.io/github/workflow/status/<:user>/<:repo>/<:workflow>.svg?label=<label> or
https://img.shields.io/github/workflow/status/<:user>/<:repo>/<:workflow>/<:branch>.svg?label=<label>
, or with logo

Source: https://github.com/badges/shields/blob/c455993a4d307823a1f551955e9300cd3bc6e2c2/services/github/github-workflow-status.service.js

[Stanzilla]

@joaomoreno what's the long term plan here?

[joaomoreno]

It's to resolve the issue. 👍 Still waiting on the upstream Marketplace implementation.

[Stanzilla]

That's not a public issue we can follow, right?

[joaomoreno]

Unfortunately right, but I can tell you it's getting done!

[joaomoreno]

This is finally in! Both the server side changes and VSCE changes were deployed. Starting with [email protected], you can now use github workflow badges.