def _vsce_extension_impl(ctx):
    out_file = ctx.outputs.out
    tool = ctx.executable.tool
    
    # Runfiles
    # We need to make sure the tool's runfiles are available.
    # ctx.actions.run_shell tools arg handles this.

    # Shell script using environment variables to avoid python format issues
    script = """
set -e

# Setup staging directory
mkdir -p staging/out

# Copy source files
for src in $SRCS; do
    cp "$src" "staging/$(basename "$src")"
done

# Copy extension artifacts
for ext in $EXT_JS; do
    cp "$ext" "staging/out/"
done

# Disable vscode:prepublish
sed -i.bak 's/"vscode:prepublish"/"vscode:ignore"/g' staging/package.json
rm staging/package.json.bak

# Create dummy secretlint modules
DUMMY_CONTENT='
const creator = {
  meta: {
    id: "dummy",
    recommended: true,
    type: "scanner",
    supportedContentTypes: []
  },
  create(context) { return {}; }
};
module.exports = { creator };
'

mkdir -p staging/node_modules/@secretlint/secretlint-rule-preset-recommend
echo "$DUMMY_CONTENT" > staging/node_modules/@secretlint/secretlint-rule-preset-recommend/index.js
echo '{"main": "index.js", "name": "@secretlint/secretlint-rule-preset-recommend", "version": "1.0.0"}' > staging/node_modules/@secretlint/secretlint-rule-preset-recommend/package.json

mkdir -p staging/node_modules/@secretlint/secretlint-rule-no-dotenv
echo "$DUMMY_CONTENT" > staging/node_modules/@secretlint/secretlint-rule-no-dotenv/index.js
echo '{"main": "index.js", "name": "@secretlint/secretlint-rule-no-dotenv", "version": "1.0.0"}' > staging/node_modules/@secretlint/secretlint-rule-no-dotenv/package.json

# Create dummy formatter
mkdir -p staging/node_modules/@secretlint/secretlint-formatter-sarif
echo "module.exports = function(results){return JSON.stringify({version: '2.1.0', runs: []});}" > staging/node_modules/@secretlint/secretlint-formatter-sarif/index.js
echo '{"main": "index.js", "name": "@secretlint/secretlint-formatter-sarif", "version": "1.0.0"}' > staging/node_modules/@secretlint/secretlint-formatter-sarif/package.json

# Tool path (execroot relative)
# We need absolute path or correctly relative path when we cd into staging.
# $VSCE_TOOL is relative to execroot.
# $PWD is execroot.
TOOL_PATH="$PWD/$VSCE_TOOL"

# Setup environment
export NODE_PATH="$PWD/staging/node_modules:${NODE_PATH:-}"
export BAZEL_BINDIR=.

# Execute vsce
cd staging
"$TOOL_PATH" package --out "../$OUT_PATH" --no-dependencies --skip-license --allow-missing-repository
"""

    ctx.actions.run_shell(
        outputs = [out_file],
        inputs = ctx.files.srcs + ctx.files.extension_js + ctx.files.data,
        tools = [tool],
        command = script,
        mnemonic = "VscePackage",
        progress_message = "Packaging VSCode extension...",
        env = {
            "SRCS": " ".join([f.path for f in ctx.files.srcs]),
            "EXT_JS": " ".join([f.path for f in ctx.files.extension_js]),
            "VSCE_TOOL": tool.path,
            "OUT_PATH": out_file.path,
        },
    )

    return [DefaultInfo(files = depset([out_file]))]

vsce_extension = rule(
    implementation = _vsce_extension_impl,
    attrs = {
        "srcs": attr.label_list(allow_files = True),
        "extension_js": attr.label_list(allow_files = True),
        "data": attr.label_list(allow_files = True),
        "out": attr.output(mandatory = True),
        "tool": attr.label(
            executable = True,
            cfg = "exec",
            default = Label("//tools/vscode:vsce_tool"),
        ),
    },
)