Skip to content

ci: switch extension publishing to Trusted Publishing (OIDC) - #1930

Merged
randy3k merged 2 commits into
mainfrom
ci/trusted-publishing
Nov 10, 2026
Merged

randy3k merged 2 commits into
mainfrom
ci/trusted-publishing

Conversation

@randy3k

@randy3k randy3k commented Nov 10, 2026

Copy link
Copy Markdown
Member

Closes #1772

Summary

  • Consolidate daily Marketplace/Open VSX pre-release publishing from .github/workflows/marketplace-pre-release.yml into .github/workflows/release.yml so Open VSX Trusted Publishing (which allows a single workflow registration per extension) covers both stable (v* tags) and daily pre-release (schedule / workflow_dispatch) builds.
  • Switch Visual Studio Marketplace publishing to vsce publish --oidc under the vs-marketplace GitHub environment (id-token: write), removing VSCE_PAT / VSCE_TOKEN.
  • Switch Open VSX publishing to ovsx publish --trusted-publishing under the open-vsx GitHub environment (id-token: write), removing OVSX_PAT / OPEN_VSX_TOKEN.
  • Update .github/scripts/marketplace-pre-release-history.js (and tests) to inspect release.yml while preserving history lookups against the retired marketplace-pre-release.yml workflow ID (376461048).

@randy3k
randy3k requested a review from eitsupi November 10, 2026 03:34

@eitsupi eitsupi left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ChatGPT review

[Blocking] Fix the concurrency group collision with the reusable workflow.

The new release.yml concurrency group resolves to release-refs/tags/vX.Y.Z for stable releases.

However, the reusable main.yml workflow uses:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Since github.workflow in a reusable workflow refers to the caller's workflow name, both workflows end up using the same concurrency group. This can cause the reusable workflow to cancel the calling release workflow.

Please use a distinct concurrency group name in release.yml, for example:

concurrency:
  group: ${{ github.event_name == 'push' && format('stable-publishing-{0}', github.ref) || 'marketplace-pre-release' }}
  cancel-in-progress: false

This avoids the collision without changing the existing concurrency behavior in main.yml.

@randy3k
randy3k requested a review from eitsupi November 10, 2026 03:51

@eitsupi eitsupi left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!
I canceled today's pre-release workflow before it ran, so I'd like to manually trigger the new workflow after merging this PR to verify that everything works correctly.

@randy3k

randy3k commented Nov 10, 2026 •

Copy link
Copy Markdown
Member Author

Will be around for the coming couple of hours, let me know if it doesn't work.

@randy3k
randy3k merged commit 7b5720c into main Nov 10, 2026
7 of 8 checks passed
@randy3k
randy3k deleted the ci/trusted-publishing branch November 10, 2026 04:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Trusted publishing for Visual Studio Marketplace and Open VSX

2 participants