Repository navigation
ci: switch extension publishing to Trusted Publishing (OIDC) - #1930
Conversation
eitsupi
left a comment
There was a problem hiding this comment.
ChatGPT review
[Blocking] Fix the concurrency group collision with the reusable workflow.
The new release.yml concurrency group resolves to release-refs/tags/vX.Y.Z for stable releases.
However, the reusable main.yml workflow uses:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: trueSince github.workflow in a reusable workflow refers to the caller's workflow name, both workflows end up using the same concurrency group. This can cause the reusable workflow to cancel the calling release workflow.
Please use a distinct concurrency group name in release.yml, for example:
concurrency:
group: ${{ github.event_name == 'push' && format('stable-publishing-{0}', github.ref) || 'marketplace-pre-release' }}
cancel-in-progress: falseThis avoids the collision without changing the existing concurrency behavior in main.yml.
eitsupi
left a comment
There was a problem hiding this comment.
Thanks!
I canceled today's pre-release workflow before it ran, so I'd like to manually trigger the new workflow after merging this PR to verify that everything works correctly.
|
Will be around for the coming couple of hours, let me know if it doesn't work. |
Closes #1772
Summary
.github/workflows/marketplace-pre-release.ymlinto.github/workflows/release.ymlso Open VSX Trusted Publishing (which allows a single workflow registration per extension) covers both stable (v*tags) and daily pre-release (schedule/workflow_dispatch) builds.vsce publish --oidcunder thevs-marketplaceGitHub environment (id-token: write), removingVSCE_PAT/VSCE_TOKEN.ovsx publish --trusted-publishingunder theopen-vsxGitHub environment (id-token: write), removingOVSX_PAT/OPEN_VSX_TOKEN..github/scripts/marketplace-pre-release-history.js(and tests) to inspectrelease.ymlwhile preserving history lookups against the retiredmarketplace-pre-release.ymlworkflow ID (376461048).