chore: tooling updates

[GabrielCousin]

Summary

A batch of developer tooling and CI modernisation tasks, grouped into 9 thematic commits:

1. chore: clean up docs and add issue templates — Lowercase .MD → .md doc extensions; remove stale duplicate bug-report template; add feature-request issue template.
2. chore: update pre-commit, pin Node 22, and switch to npm — Update ggshield pre-commit pin to v1.49.0; pin Node 22 via .mise.toml; declare engines.node >= 20; switch from Yarn to npm with .npmrc.
3. chore: add Dependabot config with monthly schedule and cooldown — Add monthly Dependabot schedule with grouping/cooldown.
4. chore: migrate CI to jdx/mise-action@v2 and npm — Migrate to mise-action@v2; drop global vsce install in favour of npx; fix test matrix for all platforms.
5. chore(test): migrate to @vscode/test-cli, sinon, and mocha v11 — Replace legacy runTest.ts/suite/index.ts with @vscode/test-cli (.vscode-test.mjs); replace simple-mock with sinon; upgrade Mocha to v11; add childProcess abstraction for stubbing.
6. chore: migrate ESLint to v9 flat config and enforce strict types — Migrate from .eslintrc.json to ESLint v9 flat config (eslint.config.mjs) + typescript-eslint v8; enforce no-explicit-any; replace remaining any types with proper types across src/.
7. fix: use correct 'supported' key for untrustedWorkspaces capability — Fix typo in package.json capabilities declaration.
8. chore: restructure tsconfig with explicit src/test projects — Split tsconfig into explicit src/ and test/ project references.
9. chore: add esbuild bundler and consolidate output to dist/ — Bundle extension with esbuild; consolidate output to dist/; update .vscodeignore accordingly.

Test plan

• npm install succeeds from a clean checkout
• npm run lint passes with no errors
• npm run compile succeeds
• CI workflow passes (build + test jobs green on Linux, macOS, Windows)
• Extension tests pass via @vscode/test-cli runner

⚠️ Should be synced with #140

[GabrielCousin]

Code review

Found 2 issues:

1. pretest overwrites the esbuild bundle before tests run. pretest runs npm run compile (esbuild → bundled dist/extension.js) and then tsc -p tsconfig.test.json, which has outDir: "dist" and include: ["src/**/*.ts"], so it re-emits an unbundled dist/extension.js on top of the bundle. Tests therefore run against the unbundled tree rather than the artifact that ships, masking bundle-only regressions (externals, tree-shaking, module resolution). Suggest narrowing tsconfig.test.json include to src/test/**/*.ts or emitting to a separate outDir.

gitguardian-vscode/package.json

Lines 175 to 178 in 6e2b983

	"check": "tsc --noEmit -p ./tsconfig.src.json && tsc --noEmit -p ./tsconfig.test.json",
	"lint": "eslint src",
	"pretest": "npm run check && npm run compile && tsc -p tsconfig.test.json",
	"test": "vscode-test"

gitguardian-vscode/tsconfig.test.json

Lines 1 to 9 in 6e2b983

	{
	"extends": "./tsconfig.src.json",
	"compilerOptions": {
	"types": ["node", "mocha"],
	"outDir": "dist"
	},
	"include": ["src/**/*.ts"],
	"exclude": []
	}

2. ESLint is skipped in CI but never run elsewhere. The pre-commit job sets SKIP: ggshield,eslint # already done by other jobs. ggshield is indeed covered by the scanning job, but no other job runs npm run lint — neither build-and-test nor pretest invoke ESLint. The comment is misleading for eslint, and lint errors will only be caught by the local pre-commit hook (which contributors may not have installed). Either run npm run lint in build-and-test or remove eslint from the SKIP list.

gitguardian-vscode/.github/workflows/ci.yaml

Lines 19 to 25 in 6e2b983

	- name: Run pre-commit
	run: pipx run pre-commit run --all-files --show-diff-on-failure
	env:
	SKIP: ggshield,eslint # already done by other jobs
	build-and-test:

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}