Skip to content

feat(release): add OIDC trusted-publishing support to vscode-publish-release-vsix.yml - W-24756661 #203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
madhur310 wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

feat(release): add OIDC trusted-publishing support to vscode-publish-release-vsix.yml - W-24756661 #203

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
50a5cb6
feat(release): add OIDC trusted-publishing support to vscode-publish-…
madhur310 Nov 2, 2026
fce190f
feat(release): add vsix-name-pattern/exclude-web-vsix to vscode-publi…
madhur310 Nov 3, 2026
7eb9b4b
fix(release): drop the oidc toggle, straight-swap vscode-publish-rele…
madhur310 Nov 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 27 additions & 9 deletions .github/workflows/vscode-publish-release-vsix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,17 +12,28 @@ on:
required: false
default: false
type: boolean
secrets:
VSCE_PERSONAL_ACCESS_TOKEN:
description: VS Code Marketplace publishing token
required: true
vsix-name-pattern:
description: Glob of downloaded VSIX file names to publish
required: false
default: '*.vsix'
type: string
exclude-web-vsix:
description: Exclude *-web-* VSIXs from publishing
required: false
default: 'false'
type: string

permissions:
contents: read

jobs:
publish:
runs-on: ubuntu-latest
permissions:
contents: read
# vsce exchanges this job's OIDC ID token for a short-lived Marketplace publishing token
# (--oidc below) -- without this, there is no token to exchange.
id-token: write
steps:
- name: Download release VSIXs
id: release
Expand All @@ -34,7 +45,8 @@ jobs:
env:
DRY_RUN: ${{ inputs.dry-run }}
PRE_RELEASE: ${{ steps.release.outputs.pre-release }}
VSCE_PERSONAL_ACCESS_TOKEN: ${{ secrets.VSCE_PERSONAL_ACCESS_TOKEN }}
VSIX_PATTERN: ${{ inputs.vsix-name-pattern }}
EXCLUDE_WEB: ${{ inputs.exclude-web-vsix }}
run: |
# Marketplace gallery requests can sit until typed-rest-client's 180s
# socket timeout. vsce has no timeout flag; retry per VSIX.
Expand All @@ -55,18 +67,24 @@ jobs:
}

while IFS= read -r -d '' vsix; do
args=(--packagePath "$vsix" --skip-duplicate)
args=(--packagePath "$vsix" --oidc --skip-duplicate)
if [ "$PRE_RELEASE" = true ]; then
args+=(--pre-release)
fi

if [ "$DRY_RUN" = true ]; then
echo "Would publish $vsix to the VS Code Marketplace: @vscode/vsce publish ${args[*]}"
echo "Would publish $vsix to the VS Code Marketplace with --skip-duplicate: @vscode/vsce publish ${args[*]}"
continue
fi

if ! VSCE_PAT="$VSCE_PERSONAL_ACCESS_TOKEN" publish_with_retry npx @vscode/vsce publish "${args[@]}"; then
if ! publish_with_retry npx @vscode/vsce publish "${args[@]}"; then
echo "::error::Failed to publish $vsix after 3 attempts"
exit 1
fi
done < <(find extensions -type f -name '*.vsix' -print0)
done < <(
if [ "$EXCLUDE_WEB" = "true" ]; then
find extensions -type f -name "$VSIX_PATTERN" ! -iname '*-web-*' -print0
else
find extensions -type f -name "$VSIX_PATTERN" -print0
fi
)