[eitsupi]

Related to #1772
Related to #1914

Motivation

During the v3.2.2 release, the Open VSX publish step failed with 503 Service Unavailable after the VS Marketplace publish had already succeeded. Both registries were steps of a single Publish job, so re-running the failed job started again with vsce publish, which then failed with REditorSupport.r v3.2.2 already exists.. The Open VSX step could never be reached again.

Changes

• release.yml
  • After verify, VS Marketplace and Open VSX are published by two independent jobs. A failure in one registry can be retried with "Re-run failed jobs" without touching the other.
  • The GitHub Release is a third independent job after verify, so the VSIX stays available as an install fallback even when a registry is down. If the release already exists (e.g. a previous attempt created it but failed to upload the asset), the VSIX is uploaded with --clobber instead.
  • vsce publish / ovsx publish use --skip-duplicate.
  • Tokens are passed via VSCE_PAT / OVSX_PAT environment variables instead of -p on the command line.
  • Workflow-level permissions are now contents: read, and GH_TOKEN is only exposed to the GitHub Release job.
• marketplace-pre-release.yml: the same split into two publish jobs, each with its own eligibility recheck.
• marketplace-pre-release-history.js: publication history is evaluated per run across the split publish jobs. The old single publish job is still recognized, so existing Actions history keeps working. Tests updated, including a run where only the failed registry job is re-run.

Notes

• The workflows keep using the existing repository-level secrets. No repository setting changes are required.
• environment: vs-marketplace / environment: open-vsx are left commented out with a TODO. They are meant for a future move to trusted publishing (OIDC, no token), which needs more than uncommenting them: a repository admin has to create the environments; VS Marketplace needs a trusted publishing policy for each publishing workflow file; and Open VSX allows only one trusted publisher per extension (announcement), so stable (release.yml) and pre-release (marketplace-pre-release.yml) Open VSX publishing would first have to be consolidated into a single workflow file (moving the publish step into a shared reusable workflow may not be enough, since the calling workflow still differs). Until then, this PR keeps using PATs.
• 3.2.2 will not be published to Open VSX; the next stable release will be published there via this workflow.

Update: draft recovery

gh release create with assets creates a draft, uploads the assets and then publishes the draft. If an attempt is interrupted before the release is published, the draft is left behind, and gh release view still finds it. When the release already exists, the job now also checks isDraft. After uploading the VSIX, it publishes a draft with gh release edit --draft=false, so a rerun cannot succeed while the release is still hidden from users.

Update: keep an existing VSIX

gh release upload --clobber deletes the existing asset before it uploads the new one, so if the upload failed on a rerun, a VSIX that was already available would be lost. When the release already exists, the job now uploads the VSIX only if the release has no completed (state == "uploaded") asset with that name. --clobber is still used in that case, so an incomplete asset is replaced. This updates the --clobber behavior described under Changes.

[renkun-ken]

The independent registry jobs and aggregation of successful publication steps across attempts look correct. I found one bug in the GitHub Release recovery path: a surviving draft can be treated as a successful release without ever being published. Please address the inline finding before merging.

Validation at e497920: node --test .github/scripts/*.test.js passed all 28 tests; the workflow YAML parsed and job dependencies resolved; the lockfile-matching vsce 3.9.2 and ovsx 1.3.0 support the publishing flags and PAT environment variables.

Hosted CI has one failing macOS Interactive integration test (restart keeps the window, drafts, transcript, bindings and kernel through multiple R processes, asserting the session-not-stopped confirmation). That test and its implementation are unchanged by this PR; I found no evidence connecting the failure to these workflow changes. The other seven checks passed.

[renkun-ken]

The prior draft-recovery finding is addressed: an existing draft is published after the VSIX is present, and upload failures stop the job before publication. The additional asset guard correctly preserves a completed matching VSIX while allowing missing or incomplete assets to be uploaded. I found no new actionable issues in the latest changes.

Validation at cb64635: all 28 workflow helper tests passed. I exercised the exact release Bash step with stubbed gh calls across 11 scenarios covering new releases, published releases and drafts with completed/missing/incomplete assets, unrelated asset names, and upload/publication/creation failures. All passed. I also verified the asset state field against actual gh release view output, checked workflow YAML/dependencies and Bash syntax, and confirmed all seven hosted CI checks passed.