feat(ci): publish VS Code extensions with the registries' own CLIs - #99
Merged
Conversation
Replaces HaaLeo/publish-vscode-extension with vsce and ovsx, run directly. The forcing issue is authentication, not the action itself. Azure DevOps retires global Personal Access Tokens on 2026-12-01, and the action declares `pat` as a required input with no Entra ID support -- so it cannot follow us onto the thing that replaces the token it depends on. vsce 3.9.2 already carries --azure-credential. Two other things fall out for free. The action still declares node20, which is what emits the "Node 20 is being deprecated" warning on every publish; a `run:` step uses the job's own Node, so there is no `using:` to be deprecated. And the action has had no commit since 2025-06, while both CLIs are first-party and shipped a release this month. The CLIs come from the extension's own devDependencies -- vsce already builds the VSIX -- so `--no-install` makes a missing one a clear failure rather than a silent unpinned fetch, and Renovate tracks their versions in the consuming repo's lockfile. Auth is unchanged for now: VSCE_PAT still, with a new azure-credential input defaulting off, so switching to Entra is one line once the Azure side exists. See #98. Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
4 tasks
jimisola
added a commit
to reqstool/reqstool-vscode
that referenced
this pull request
Aug 23, 2026
reqstool/.github#99 replaces HaaLeo/publish-vscode-extension with the registries' own CLIs, invoked as `npx --no-install`. vsce is already here -- scripts/build.mjs shells out to it -- but ovsx was supplied by the action and has to become a real dependency. Pinned exactly, like vsce, so Renovate manages both from this lockfile rather than a version floating in the shared workflow. npm audit is unchanged: same 4 pre-existing findings, all via mocha, none from ovsx. Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
4 tasks
jimisola
added a commit
that referenced
this pull request
Aug 23, 2026
Every repo in the org now pins to a tag here rather than @main (#25), which makes two things load-bearing that were nowhere written down: that consumers pin @<sha> # <version> rather than @<tag>, and that merging to main releases nothing until someone tags. The second already bit: 1.0.0 was tagged before #99 merged, so the consumers pinned to it are still on the old VS Code publish path. A tag that lags main means fixes reach nobody and Renovate has nothing to propose. Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #98.
Description
Replaces
HaaLeo/publish-vscode-extensionwith the registries' own CLIs —vsce(Microsoft) andovsx(Eclipse Foundation).The forcing issue is authentication. Azure DevOps retires global PATs on 2026-12-01, and the action declares
patasrequired: truewith no Entra ID support — it cannot follow us onto the thing that replaces the token it depends on.vsce3.9.2 already has--azure-credential.Two other problems resolve as a side effect:
using: 'node20', which is what emits the "Node 20 is being deprecated" warning on every publish. Arun:step uses the job's own Node — nousing:to deprecate.What changes
HaaLeo@v2.0.0npx --no-install ovsx publishHaaLeo@v2.0.0npx --no-install vsce publish --packagePathVSCE_PATonlyVSCE_PAT, or Entra via newazure-credentialinputdryRunAuth is unchanged in this PR.
azure-credentialdefaults tofalse, so publishing keeps working exactly as today; flipping it is one line once the Azure side exists. Deliberately not switching now — that would break releases until Entra is set up.--no-installis load-bearing: both CLIs come from the extension's devDependencies via thenpm ciabove, so a missing one fails clearly instead of silently fetching an unpinned version from the network into a job holding publish credentials.Open VSX is Eclipse-run and unaffected by any of this —
OVSX_PATstays a PAT.Companion
reqstool-vscodeneedsovsxadded to devDependencies (@vscode/vsceis already there at 3.9.2). Merge that first, or the first publish after this fails on--no-install.Checklist
git commit -s).Test plan
yamllint,zizmorandcheck-permissions.pyclean locally — every interpolation goes throughenv:, so there is no template-injection surface in the newrun:steps.vsce publish --packagePathand--azure-credentialwere verified againstvsce@3.9.2's actual--helpoutput, not assumed.The real test is a
reqstool-vscoderelease withdry-runfirst, then a real one. I have not dispatched either — the last publish path change this week broke twice in ways only a real dispatch surfaced, so this deserves a dry run before a live release.