chore: 0.3.2 릴리스 안정성 강화

.github/workflows/pr-ci.yml

@@ -72,3 +72,22 @@ jobs:
 
       - name: Run test suite
         run: npm run test
+
+  package:
+    name: package
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Verify extension package
+        run: npm run package:check

.github/workflows/publish-extension.yml

@@ -20,12 +20,12 @@ jobs:
       DSLFORGE_TELEMETRY_PROXY_ENDPOINT: ${{ vars.DSLFORGE_TELEMETRY_PROXY_ENDPOINT }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm
@@ -61,10 +61,20 @@ jobs:
       - name: Run test suite
         run: npm run test
 
+      - name: Verify extension package contents
+        run: npm exec -- vsce ls
+
       - name: Package extension
-        run: npm exec --yes @vscode/vsce -- package
+        run: npm exec -- vsce package --out "dslforge-${GITHUB_REF_NAME#v}.vsix"
+
+      - name: Upload extension package
+        uses: actions/upload-artifact@v7
+        with:
+          name: dslforge-${{ github.ref_name }}
+          path: dslforge-*.vsix
+          if-no-files-found: error
 
       - name: Publish extension
         env:
           VSCE_PAT: ${{ secrets.VSCE_PAT }}
-        run: npm exec --yes @vscode/vsce -- publish --packagePath "dslforge-${GITHUB_REF_NAME#v}.vsix" -p "$VSCE_PAT"
+        run: npm exec -- vsce publish --packagePath "dslforge-${GITHUB_REF_NAME#v}.vsix" -p "$VSCE_PAT"

.gitignore

@@ -14,3 +14,4 @@ AGENTS.md
 *.vsix
 .vscode-test/
 .tmp-vsix-*/
+.tmp/

.vscodeignore

@@ -1,15 +1,23 @@
 .agents/**
+.github/**
 .git/**
 .gitignore
+.husky/**
 .idea/**
+.prettierignore
+.tmp/**
 .tmp-vsix-ext/**
 .tmp-vsix-user/**
 .vscode/**
 docs/**
 node_modules/**
+api/**
+scripts/**
 src/**
+test/**
 test-fixtures/**
-tsconfig.json
+tsconfig*.json
 dist/test/**
 **/*.map
 *.vsix
+vercel.json

CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 ## Unreleased
 
+## 0.3.2 - 2026-10-01
+
+- Hardened the tag-based release workflow with GitHub Actions v7, a pinned `@vscode/vsce` toolchain, package-content verification, and archived VSIX artifacts.
+- Added CI packaging checks so pull requests verify the same extension payload used by releases.
+- Added telemetry policy and proxy regression coverage for opt-out behavior, endpoint selection, sensitive-field filtering, payload validation, sink failures, and rate limiting.
+- Fixed client telemetry filtering so allowlisted aggregate fields such as output kind, context file counts, and apply target counts are preserved without allowing workspace content or paths.
+- Made generated telemetry endpoint configuration deterministic and compatible with the repository's formatting rules.
 - Updated the development toolchain to TypeScript 7 and Node.js 24 for CI.
 - Aligned Node.js and VS Code type definitions with the VS Code 1.120 minimum supported version.
 - Updated GitHub Actions workflows to the latest major versions and refreshed Langium and Xtext project-detection fixtures.

README.md

@@ -45,7 +45,7 @@ Until then, you can evaluate it locally:
 
 1. run `npm install`
 2. run `npm exec -- vsce package`
-3. install the generated `dslforge-0.3.1.vsix` in VS Code
+3. install the generated `dslforge-0.3.2.vsix` in VS Code
 
 ## One-Minute Flow
 

api/telemetry.ts

@@ -2,7 +2,7 @@ import { PostHog } from 'posthog-node';
 
 type Primitive = string | number | boolean;
 
-interface TelemetryRequestBody {
+export interface TelemetryRequestBody {
   event?: unknown;
   distinctId?: unknown;
   properties?: unknown;
@@ -155,7 +155,7 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 
-function parseBody(body: unknown): TelemetryRequestBody | undefined {
+export function parseBody(body: unknown): TelemetryRequestBody | undefined {
   if (typeof body === 'string') {
     if (body.length > MAX_BODY_CHARACTERS) {
       return undefined;
@@ -186,7 +186,7 @@ function sanitizeString(value: string): string | undefined {
   return trimmed ? trimmed.slice(0, MAX_STRING_LENGTH) : undefined;
 }
 
-function sanitizeProperties(value: unknown): Record<string, Primitive> | undefined {
+export function sanitizeProperties(value: unknown): Record<string, Primitive> | undefined {
   if (!isPlainObject(value)) {
     return undefined;
   }
@@ -227,7 +227,7 @@ function sanitizeProperties(value: unknown): Record<string, Primitive> | undefin
   return entries.length > 0 ? Object.fromEntries(entries) : undefined;
 }
 
-function validatePayload(body: TelemetryRequestBody):
+export function validatePayload(body: TelemetryRequestBody):
   | {
       event: string;
       distinctId: string;

docs/development-todo.md

@@ -1,13 +1,20 @@
 # Development TODO
 
-Last updated: 2026-06-16
+Last updated: 2026-10-01
 
 ## Active Backlog
 
 - [ ] Run manual VS Code smoke for the Xtext validation fixtures and the reviewed AI preview/apply path.
 - [ ] Run one successful AI smoke in a model-enabled VS Code environment for `Explain Current Grammar`, `Create DSL Scaffold`, and `Generate Sample DSL`.
 - [ ] Decide whether bootstrap scaffold mode should add Xtext-specific framework hints or remain limited to Langium, ANTLR4, and unspecified hints, then align README/spec/tests.
 
+## Completed For 0.3.2
+
+- [x] Pin the VSIX packaging toolchain and align release GitHub Actions with PR CI.
+- [x] Add automated telemetry client policy and proxy validation coverage.
+- [x] Verify extension package contents in CI and archive the release VSIX artifact.
+- [x] Keep `preview: true` while manual AI and Marketplace feedback collection remains pending.
+
 ## Notes
 
 - Screenshot capture work is excluded by the current user instruction and is not tracked as an active task here.

docs/manual-smoke-ai.md

@@ -17,11 +17,11 @@ The goal is to verify four things:
 
 Use this workspace unless a case explicitly says otherwise:
 
-- `/Users/emfpdlzj/Desktop/DSLForge/test-fixtures/langium/import-context`
+- `test-fixtures/langium/import-context`
 
 Additional Xtext workspace for context-sensitive AI smoke:
 
-- `/Users/emfpdlzj/Desktop/DSLForge/test-fixtures/xtext/import-context`
+- `test-fixtures/xtext/import-context`
 
 Open this file before running commands:
 
@@ -43,7 +43,7 @@ Expected selected context set for AI commands:
 
 ## Launch
 
-Use the dedicated extension host configuration in [.vscode/launch.json](/Users/emfpdlzj/Desktop/DSLForge/.vscode/launch.json:1):
+Use the dedicated extension host configuration in [`.vscode/launch.json`](../.vscode/launch.json):
 
 - `Run DSLForge: import-context fixture`
 - `Run DSLForge: xtext-import-context fixture`

docs/manual-smoke-validation.md

@@ -4,12 +4,12 @@ This document fixes the validation-resolution paths used by `DSLForge: Validate
 
 ## Fixtures
 
-- configured command: `/Users/emfpdlzj/Desktop/DSLForge/test-fixtures/langium/configured-command`
-- package script: `/Users/emfpdlzj/Desktop/DSLForge/test-fixtures/langium/package-script`
-- missing command: `/Users/emfpdlzj/Desktop/DSLForge/test-fixtures/langium/missing-command`
-- import context: `/Users/emfpdlzj/Desktop/DSLForge/test-fixtures/langium/import-context`
-- xtext gradle wrapper: `/Users/emfpdlzj/Desktop/DSLForge/test-fixtures/xtext/gradle-wrapper`
-- xtext maven wrapper: `/Users/emfpdlzj/Desktop/DSLForge/test-fixtures/xtext/maven-wrapper`
+- configured command: `test-fixtures/langium/configured-command`
+- package script: `test-fixtures/langium/package-script`
+- missing command: `test-fixtures/langium/missing-command`
+- import context: `test-fixtures/langium/import-context`
+- xtext gradle wrapper: `test-fixtures/xtext/gradle-wrapper`
+- xtext maven wrapper: `test-fixtures/xtext/maven-wrapper`
 
 ## Launch
 

docs/marketplace-launch.md

@@ -39,7 +39,7 @@ The current workstream excludes screenshot capture, so screenshot items remain p
 
 Companion onboarding doc:
 
-- [docs/onboarding-quickstart.md](/private/tmp/DSLForge-xtext-validation-normalization/docs/onboarding-quickstart.md:1)
+- [onboarding quickstart](onboarding-quickstart.md)
 
 ## Supported Workspace Examples
 

docs/release-checklist.md

@@ -1,8 +1,8 @@
 # DSLForge Release Checklist
 
-Last updated: 2026-06-16
+Last updated: 2026-10-01
 
-This checklist is for the first public VS Code Marketplace release of `DSLForge`.
+This checklist tracks the `0.3.2` VS Code Marketplace patch release of `DSLForge`.
 
 ## Release Goal
 
@@ -33,13 +33,16 @@ Completed in this audit:
 - `docs/onboarding-quickstart.md` now provides a short onboarding path for supported workspaces
 - current branch packaging still succeeds after the reviewed AI preview apply flow changes
 - reviewed AI preview apply logic now has dedicated fixture coverage for file-target parsing, bundle selection, and conflict detection
+- telemetry client policy and proxy validation now have automated regression coverage
+- pull requests now verify the extension package payload with pinned `@vscode/vsce`
+- tagged releases now archive the generated VSIX before publishing
+- `preview: true` remains intentional for `0.3.2`
+- `dslforge-0.3.2.vsix` installs successfully in an isolated VS Code profile
+- the `VSCE_PAT` secret and `DSLFORGE_TELEMETRY_PROXY_ENDPOINT` repository variable are configured
 
 ## Remaining Release-Critical Work
 
 - complete manual VS Code smoke for the Xtext fixtures and AI preview/apply path
-- run one final local VSIX install smoke on the exact package to publish
-- decide whether to keep `preview: true` for the first public release
-- fix `origin` remote to the intended public repository
 - confirm publisher access and Marketplace login path
 - review the exact release commit state before `vsce publish`
 - publish intentionally with the confirmed publisher account
@@ -48,13 +51,13 @@ Completed in this audit:
 
 - Marketplace screenshots are deferred by current user instruction and are not treated as an active release blocker unless release policy changes.
 - Extra README copy polish is optional as long as the current opening section stays accurate and concrete.
-- Additional launch collateral beyond the existing [docs/marketplace-launch.md](/private/tmp/DSLForge-xtext-validation-normalization/docs/marketplace-launch.md:1) pack is optional.
+- Additional launch collateral beyond the existing [Marketplace launch pack](marketplace-launch.md) is optional.
 
 ## Post-Publish Follow-Up
 
 - announce the release through the intended promotion channels
 - re-enable and capture Marketplace screenshots later if the release process requires them
-- collect first-user feedback and fold any follow-up items back into [docs/development-todo.md](/private/tmp/DSLForge-xtext-validation-normalization/docs/development-todo.md:1)
+- collect first-user feedback and fold any follow-up items back into the [development backlog](development-todo.md)
 
 ## Blocking Checks
 
@@ -78,8 +81,8 @@ These items must be true before `vsce publish`:
 
 - Confirm extension title and short description are final
 - Confirm `keywords` match real discovery terms
-- Review [docs/marketplace-launch.md](/private/tmp/DSLForge-xtext-validation-normalization/docs/marketplace-launch.md:1) and finalize one short description candidate plus the opening paragraph
-- Review [docs/onboarding-quickstart.md](/private/tmp/DSLForge-xtext-validation-normalization/docs/onboarding-quickstart.md:1) and keep it aligned with the README quick-start flow
+- Review the [Marketplace launch pack](marketplace-launch.md) and finalize one short description candidate plus the opening paragraph
+- Review the [onboarding quickstart](onboarding-quickstart.md) and keep it aligned with the README quick-start flow
 - Keep README opening section short and concrete:
   - what DSLForge is
   - currently documented adapter scope
@@ -92,8 +95,7 @@ These items must be true before `vsce publish`:
 - Run `npm run build`
 - Run `npm run typecheck`
 - Run `npm run test`
-- Run `npm exec -- vsce ls`
-- Run `npm exec -- vsce package`
+- Run `npm run package:check`
 - Install the generated `.vsix` into a clean VS Code profile or Extension Development Host
 - Verify validation command paths:
   - configured command fixture
@@ -124,13 +126,32 @@ These items must be true before `vsce publish`:
 
 - Confirm Marketplace publisher exists for `emfpdlzj`
 - Confirm you can authenticate with the publisher account
-- Confirm `vsce` is available in the intended publishing environment
+- Confirm the pinned `@vscode/vsce` version installs through `npm ci`
 - Confirm the `VSCE_PAT` GitHub Actions secret exists before pushing a release tag
 - Prefer an Entra ID-based publishing path for longer-term automation planning
 - If doing a one-off manual publish, confirm the current official authentication path you will use before release day
 
 ## Execution Log
 
+Audit run on 2026-10-01 for `0.3.2`:
+
+- `npm run ci:check`
+  - passed
+- `npm test`
+  - passed, including telemetry client and proxy fixtures
+- `npm audit`
+  - passed with no known vulnerabilities
+- `npm run package:check`
+  - passed
+  - package payload excludes source, test, proxy, and build-only files
+  - output package: `dslforge-0.3.2.vsix`
+- isolated VS Code profile install
+  - passed
+  - installed extension: `emfpdlzj.dslforge@0.3.2`
+- GitHub release configuration
+  - `VSCE_PAT` secret exists
+  - `DSLFORGE_TELEMETRY_PROXY_ENDPOINT` variable exists
+
 Audit run on 2026-06-15:
 
 - `npm run typecheck`
@@ -170,10 +191,10 @@ Earlier audit notes on 2026-06-14:
 ## Recommended Release Order
 
 1. Finish the remaining manual VS Code smoke for Xtext and AI preview/apply.
-2. Fix repository remote alignment and confirm Marketplace publisher access.
+2. Confirm Marketplace publisher access.
 3. Re-run technical verification on the exact release candidate.
 4. Review `git status` and staged diff for the intended release commit.
-5. Package with `npm exec -- vsce package`.
+5. Package with `npm run package:check`.
 6. Install the generated VSIX once more.
 7. Publish intentionally with the confirmed publisher account.
 8. Run promotion as a post-publish activity.