decolint on GitHub

pin-extension-version

disallow a “customizations.vscode.extensions” entry without an explicit pinned version

Category
reproducibility
Applies to
devcontainer
Platforms
vscode, codespaces

Why

An extension ID on its own installs whatever the marketplace publishes at the moment the container is created, so two developers on the same devcontainer.json can end up with different formatters, linters, or language server versions — and an extension update can change the environment without any commit. Appending a version (publisher.name@1.2.3) makes the editor tooling as pinned as the rest of the image.

Bad

{
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
  "customizations": {
    "vscode": {
      "extensions": ["golang.go"]
    }
  }
}

Good

{
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
  "customizations": {
    "vscode": {
      "extensions": ["golang.go@0.50.0"]
    }
  }
}

References