build: reduce official build latency

[Dmitriy Vasyura (dmitrivMS)]

Summary

Improves official build latency based on analysis of build 20260912.1, which completed in 1h 46m 41s.

• pipeline macOS signing and notarization per artifact instead of waiting for every signing operation
• cache the API Scan dependency installation with a key that includes its scan-specific GYP configuration
• retry sanity-test extension installation as soon as the target extension becomes actionable again

Measurements

• macOS universal signing and notarization took 44.7 minutes; per-artifact chaining removes the global signing barrier
• API Scan spent 13.4 minutes in a fresh dependency install
• macOS arm64 sanity tests lost 5 minutes waiting for an extension install timeout before a retry succeeded in approximately 2.4 seconds

Validation

• npm run eslint
• cd build && npm run typecheck
• cd test/sanity && npm run compile
• parsed build/azure-pipelines/win32/sdl-scan-win32.yml with js-yaml
• git diff --check

No Azure DevOps pipelines were started as part of this investigation.

[Copilot]

Copilot review overview

🟡 Changes recommended

The cache key can cross registries, and the scoped installation-success locator cannot find its target.

Get a fresh assessment by requesting another Copilot review.

Review tier: Balanced
Findings: 2

Open findings (2)

• Include the selected registry in the cache key · New
• Do not look for Uninstall inside the list item · New

What changed in this PR

Reduces official build latency through parallelized macOS signing, cached API Scan dependencies, and faster sanity-test retries.

Changes:

• Chains notarization per macOS artifact.
• Adds API Scan node_modules caching.
• Retries extension installation when it becomes actionable.

File	Description
test/​sanity/​src/​uiTest.ts	Improves extension-install retry detection.
build/​azure-pipelines/​win32/​sdl-scan-win32.yml	Adds API Scan dependency caching.
build/​azure-pipelines/​darwin/​codesign.ts	Parallelizes per-artifact signing and notarization.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Dmitriy Vasyura (dmitrivMS)]

Investigated official Insider build 20260912.7 (d57d9bf81e4). The failure is not caused by this PR's build-performance changes:

• Windows x64 failed Agent Host Provider Integration — Codex Customizations: the trusted workspace SessionStart hook timed out waiting for its marker file.
• macOS arm64 failed Agent Host Provider Integration — Copilot Customizations: the instruction-file watcher timed out waiting for added.instructions.md to appear.
• Publish first hit the existing shared temporary cert.pem race while publishing vscode_cli_linux_x64_cli; the task retry published that artifact successfully, then correctly failed because the Windows and macOS stages had failed.
• The changed API Scan cache steps all succeeded (cache miss, install, verification/symbol collection, archive creation).
• The changed Codesign & Notarize task succeeded. No ESRP overlap/throttling failure occurred.
• Sanity tests did not run because Publish failed, so this run provides no signal for the extension-install retry change.

The run used the initial PR commit; the current head also contains the two review-fix commits. I did not queue or rerun any Azure pipeline.

[Dmitriy Vasyura (dmitrivMS)]

Closing in favor of three focused replacement PRs: macOS signing, API Scan caching, and the sanity-test retry change. The sanity-test PR will be created only after local Windows validation against an archive ZIP.