From ff752e8e67fa011a5f72a125740c8321a5084cd2 Mon Sep 17 00:00:00 2001 From: madhur310 Date: Mon, 26 Oct 2026 10:51:58 -0700 Subject: [PATCH 1/2] fix(release): migrate Open VSX publishing to OIDC trusted publishing - W-24666922 openvsx-publish-release-vsix.yml and vscode-promote-prerelease.yml both ran `ovsx publish` against a PAT (-p $OVSX_PAT / $IDEE_OVSX_PAT). Switches both to `ovsx publish --trusted-publishing`, which exchanges this job's GitHub Actions OIDC ID token for a short-lived publish token instead -- requires `id-token: write`, which both workflows now grant. Open VSX's trusted-publisher config binds one identity per extension to the exact workflow file that requests the OIDC token (its job_workflow_ref). vscode-promote-prerelease.yml's `ovsx` leg previously ran its own `ovsx publish` inline, inside the same matrix job as `vsce` -- a different file from openvsx-publish-release-vsix.yml, which the stable release path uses. That would mean two different job_workflow_ref values for the same extension's Open VSX publishes, which a single trusted-publisher entry can't match. Split the `ovsx` leg out of that matrix job (GitHub Actions won't let a `uses:`-based job share a matrix with per-leg different targets) into its own `publish-ovsx` job that delegates to openvsx-publish-release-vsix.yml via `uses:`, instead of duplicating the ovsx-publish logic. Every Open VSX publish for a given extension -- stable, stable hotfix, prerelease, prerelease/emergency hotfix -- now requests its OIDC token from that one file. openvsx-publish-release-vsix.yml gained `vsix-name-pattern` and `exclude-web-vsix` inputs (both optional, default-compatible) so the delegated call can reproduce vscode-promote-prerelease.yml's existing filtering for monorepo/multi-extension callers. vsce/Marketplace publishing (VSCE_PERSONAL_ACCESS_TOKEN) is untouched. --- .../openvsx-publish-release-vsix.yml | 32 ++++++-- .../workflows/vscode-promote-prerelease.yml | 81 +++++++++---------- 2 files changed, 64 insertions(+), 49 deletions(-) diff --git a/.github/workflows/openvsx-publish-release-vsix.yml b/.github/workflows/openvsx-publish-release-vsix.yml index f366ff7..c98160b 100644 --- a/.github/workflows/openvsx-publish-release-vsix.yml +++ b/.github/workflows/openvsx-publish-release-vsix.yml @@ -12,10 +12,16 @@ on: required: false default: false type: boolean - secrets: - IDEE_OVSX_PAT: - description: Open VSX publishing token - required: true + vsix-name-pattern: + description: Glob of downloaded VSIX file names to publish + required: false + default: '*.vsix' + type: string + exclude-web-vsix: + description: Exclude *-web-* VSIXs from publishing + required: false + default: 'false' + type: string permissions: contents: read @@ -23,6 +29,11 @@ permissions: jobs: publish: runs-on: ubuntu-latest + permissions: + contents: read + # ovsx exchanges this job's OIDC ID token for a short-lived Open VSX publishing token + # (--trusted-publishing below) -- without this, there is no token to exchange. + id-token: write steps: - name: Download release VSIXs id: release @@ -33,8 +44,9 @@ jobs: - name: Publish VSIXs env: DRY_RUN: ${{ inputs.dry-run }} - IDEE_OVSX_PAT: ${{ secrets.IDEE_OVSX_PAT }} PRE_RELEASE: ${{ steps.release.outputs.pre-release }} + VSIX_PATTERN: ${{ inputs.vsix-name-pattern }} + EXCLUDE_WEB: ${{ inputs.exclude-web-vsix }} run: | # Open VSX can hang the same way as vsce; retry per VSIX. # --skip-duplicate makes a retry a no-op if the first attempt committed. @@ -54,7 +66,7 @@ jobs: } while IFS= read -r -d '' vsix; do - args=("$vsix" -p "$IDEE_OVSX_PAT" --skip-duplicate) + args=("$vsix" --trusted-publishing --skip-duplicate) pre_release_suffix='' if [ "$PRE_RELEASE" = true ]; then args+=(--pre-release) @@ -70,4 +82,10 @@ jobs: echo "::error::Failed to publish $vsix after 3 attempts" exit 1 fi - done < <(find extensions -type f -name '*.vsix' -print0) + done < <( + if [ "$EXCLUDE_WEB" = "true" ]; then + find extensions -type f -name "$VSIX_PATTERN" ! -iname '*-web-*' -print0 + else + find extensions -type f -name "$VSIX_PATTERN" -print0 + fi + ) diff --git a/.github/workflows/vscode-promote-prerelease.yml b/.github/workflows/vscode-promote-prerelease.yml index 3a35377..df5252e 100644 --- a/.github/workflows/vscode-promote-prerelease.yml +++ b/.github/workflows/vscode-promote-prerelease.yml @@ -36,7 +36,9 @@ name: Promote Nightly to Pre-release # Requirements - calling repository must have: # - Nightly tags matching *-nightly.* (e.g., v1.2.3-nightly.20260629) # - GitHub releases for each nightly tag with VSIX file(s) attached -# - Secrets: IDEE_GH_TOKEN, VSCE_PERSONAL_ACCESS_TOKEN, IDEE_OVSX_PAT +# - Secrets: IDEE_GH_TOKEN, VSCE_PERSONAL_ACCESS_TOKEN +# - Open VSX publishes via OIDC trusted publishing (--trusted-publishing) -- no secret needed, +# but the registry's trusted-publisher config must list this workflow file # # Workflow: downloads VSIX → publishes to both marketplaces → creates tracking tag @@ -116,18 +118,13 @@ permissions: contents: write packages: write actions: read + # ovsx exchanges this for a short-lived Open VSX publishing token (--trusted-publishing in the + # publish job below); vsce/Marketplace still uses VSCE_PERSONAL_ACCESS_TOKEN. + id-token: write jobs: - publish: + publish-vsce: runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - include: - - registry: vsce - publish-tool: vsce - - registry: ovsx - publish-tool: ovsx steps: - name: Checkout uses: actions/checkout@v6 @@ -151,15 +148,13 @@ jobs: --dir ./vsix-artifacts \ --repo "${{ github.repository }}" - - name: Publish to ${{ matrix.registry }} + - name: Publish to Visual Studio Marketplace env: NIGHTLY_TAG: ${{ inputs.release-tag }} VSIX_PATTERN: ${{ inputs.vsix-name-pattern || '*.vsix' }} EXCLUDE_WEB: ${{ inputs.exclude-web-vsix || 'false' }} - PUBLISH_TOOL: ${{ matrix.publish-tool }} DRY_RUN: ${{ inputs.dry-run || 'false' }} VSCE_PERSONAL_ACCESS_TOKEN: ${{ secrets.VSCE_PERSONAL_ACCESS_TOKEN }} - OVSX_PAT: ${{ secrets.IDEE_OVSX_PAT }} run: | set -uo pipefail @@ -177,20 +172,13 @@ jobs: exit 1 fi - if [ "$PUBLISH_TOOL" = "ovsx" ]; then - MARKETPLACE_NAME="Open VSX Registry" - TOKEN="$OVSX_PAT" - else - MARKETPLACE_NAME="Visual Studio Marketplace" - TOKEN="$VSCE_PERSONAL_ACCESS_TOKEN" - fi - + TOKEN="$VSCE_PERSONAL_ACCESS_TOKEN" if [ "$DRY_RUN" != "true" ] && [ -z "$TOKEN" ]; then - echo "::error::Token for $PUBLISH_TOOL is not set" + echo "::error::Token for vsce is not set" exit 1 fi - echo "Publishing ${#VSIX_FILES[@]} VSIX(s) as pre-release to $MARKETPLACE_NAME:" + echo "Publishing ${#VSIX_FILES[@]} VSIX(s) as pre-release to Visual Studio Marketplace:" printf ' %s\n' "${VSIX_FILES[@]}" RUN_ID="${{ github.run_id }}" @@ -199,7 +187,7 @@ jobs: FAILED=0 # Marketplace gallery requests can sit until typed-rest-client's 180s - # socket timeout. vsce/ovsx have no timeout flag; retry per VSIX. + # socket timeout. vsce has no timeout flag; retry per VSIX. # --skip-duplicate makes a retry a no-op if the first attempt committed. publish_with_retry() { local attempt @@ -218,11 +206,11 @@ jobs: for VSIX in "${VSIX_FILES[@]}"; do NAME=$(basename "$VSIX") - echo "::group::$NAME → $MARKETPLACE_NAME" + echo "::group::$NAME → Visual Studio Marketplace" # Audit trail (mirrors the publish-vsix action's per-file record) HASH=$(sha256sum "$VSIX" 2>/dev/null | cut -d' ' -f1 || echo "unknown") - echo "[AUDIT] actor=$ACTOR repo=$REPO run_id=$RUN_ID tool=$PUBLISH_TOOL file=$NAME hash=$HASH pre_release=true dry_run=$DRY_RUN" + echo "[AUDIT] actor=$ACTOR repo=$REPO run_id=$RUN_ID tool=vsce file=$NAME hash=$HASH pre_release=true dry_run=$DRY_RUN" if [ "$DRY_RUN" = "true" ]; then echo "🔍 DRY RUN - would publish $NAME (pre-release)" @@ -230,32 +218,41 @@ jobs: continue fi - if [ "$PUBLISH_TOOL" = "vsce" ]; then - if VSCE_PAT="$TOKEN" publish_with_retry npx @vscode/vsce publish --packagePath "$VSIX" --skip-duplicate --pre-release; then - echo "✅ Published $NAME to $MARKETPLACE_NAME" - else - echo "::error::Failed to publish $NAME to $MARKETPLACE_NAME" - FAILED=1 - fi + if VSCE_PAT="$TOKEN" publish_with_retry npx @vscode/vsce publish --packagePath "$VSIX" --skip-duplicate --pre-release; then + echo "✅ Published $NAME to Visual Studio Marketplace" else - if publish_with_retry npx ovsx publish "$VSIX" -p "$TOKEN" --skip-duplicate --pre-release; then - echo "✅ Published $NAME to $MARKETPLACE_NAME" - else - echo "::error::Failed to publish $NAME to $MARKETPLACE_NAME" - FAILED=1 - fi + echo "::error::Failed to publish $NAME to Visual Studio Marketplace" + FAILED=1 fi echo "::endgroup::" done if [ "$FAILED" -ne 0 ]; then - echo "::error::One or more VSIX publishes failed for $PUBLISH_TOOL" + echo "::error::One or more VSIX publishes failed for vsce" exit 1 fi - echo "✅ All ${#VSIX_FILES[@]} VSIX(s) processed for $MARKETPLACE_NAME" + echo "✅ All ${#VSIX_FILES[@]} VSIX(s) processed for Visual Studio Marketplace" + + # ovsx publishing delegates to the shared workflow stable releases already use (rather than + # running its own `ovsx publish`), so every Open VSX publish for this extension -- prerelease + # and stable alike -- requests its OIDC token from the same job_workflow_ref. Open VSX's + # trusted-publisher config is one identity per extension, keyed on that exact file, so two + # different files here would mean only one of the two publish paths could ever be trusted. + publish-ovsx: + permissions: + contents: read + id-token: write + uses: salesforcecli/github-workflows/.github/workflows/openvsx-publish-release-vsix.yml@main + with: + release-tag: ${{ inputs.release-tag }} + vsix-name-pattern: ${{ inputs.vsix-name-pattern || '*.vsix' }} + exclude-web-vsix: ${{ inputs.exclude-web-vsix || 'false' }} + # This workflow's own dry-run input is a string ('true'/'false'); the callee's is boolean. + dry-run: ${{ (inputs.dry-run || 'false') == 'true' }} + secrets: inherit tag-promoted: - needs: publish + needs: [publish-vsce, publish-ovsx] runs-on: ubuntu-latest steps: - name: Checkout From 665cbd8ebfd908b8da076d6349306be1cab5f520 Mon Sep 17 00:00:00 2001 From: madhur310 Date: Mon, 26 Oct 2026 14:42:32 -0700 Subject: [PATCH 2/2] Revert: drop vscode-promote-prerelease.yml ovsx job-split - W-24666922 Open VSX's trusted-publisher check matches the OIDC token's workflow_ref claim (the top-level/triggering workflow), not job_workflow_ref (the reusable workflow actually executing a job) -- confirmed against eclipse-openvsx/openvsx's TrustedPublishingService/ GitHubTrustedPublishingProviderSupport source. Consolidating this reusable workflow's ovsx leg onto openvsx-publish-release-vsix.yml never closed that gap: salesforcedx-vscode's stable and prerelease flows are started by two different top-level workflow files regardless of what runs underneath them, and Open VSX only allows one trusted-publisher registration per extension (a hard server-side check). The real fix has to live in salesforcedx-vscode's own top-level workflows instead, so this reusable workflow goes back to vsce-only. Keeps the openvsx-publish-release-vsix.yml PAT -> --trusted-publishing migration, which the new salesforcedx-vscode-side design still delegates to. --- .../workflows/vscode-promote-prerelease.yml | 81 ++++++++++--------- 1 file changed, 42 insertions(+), 39 deletions(-) diff --git a/.github/workflows/vscode-promote-prerelease.yml b/.github/workflows/vscode-promote-prerelease.yml index df5252e..3a35377 100644 --- a/.github/workflows/vscode-promote-prerelease.yml +++ b/.github/workflows/vscode-promote-prerelease.yml @@ -36,9 +36,7 @@ name: Promote Nightly to Pre-release # Requirements - calling repository must have: # - Nightly tags matching *-nightly.* (e.g., v1.2.3-nightly.20260629) # - GitHub releases for each nightly tag with VSIX file(s) attached -# - Secrets: IDEE_GH_TOKEN, VSCE_PERSONAL_ACCESS_TOKEN -# - Open VSX publishes via OIDC trusted publishing (--trusted-publishing) -- no secret needed, -# but the registry's trusted-publisher config must list this workflow file +# - Secrets: IDEE_GH_TOKEN, VSCE_PERSONAL_ACCESS_TOKEN, IDEE_OVSX_PAT # # Workflow: downloads VSIX → publishes to both marketplaces → creates tracking tag @@ -118,13 +116,18 @@ permissions: contents: write packages: write actions: read - # ovsx exchanges this for a short-lived Open VSX publishing token (--trusted-publishing in the - # publish job below); vsce/Marketplace still uses VSCE_PERSONAL_ACCESS_TOKEN. - id-token: write jobs: - publish-vsce: + publish: runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + include: + - registry: vsce + publish-tool: vsce + - registry: ovsx + publish-tool: ovsx steps: - name: Checkout uses: actions/checkout@v6 @@ -148,13 +151,15 @@ jobs: --dir ./vsix-artifacts \ --repo "${{ github.repository }}" - - name: Publish to Visual Studio Marketplace + - name: Publish to ${{ matrix.registry }} env: NIGHTLY_TAG: ${{ inputs.release-tag }} VSIX_PATTERN: ${{ inputs.vsix-name-pattern || '*.vsix' }} EXCLUDE_WEB: ${{ inputs.exclude-web-vsix || 'false' }} + PUBLISH_TOOL: ${{ matrix.publish-tool }} DRY_RUN: ${{ inputs.dry-run || 'false' }} VSCE_PERSONAL_ACCESS_TOKEN: ${{ secrets.VSCE_PERSONAL_ACCESS_TOKEN }} + OVSX_PAT: ${{ secrets.IDEE_OVSX_PAT }} run: | set -uo pipefail @@ -172,13 +177,20 @@ jobs: exit 1 fi - TOKEN="$VSCE_PERSONAL_ACCESS_TOKEN" + if [ "$PUBLISH_TOOL" = "ovsx" ]; then + MARKETPLACE_NAME="Open VSX Registry" + TOKEN="$OVSX_PAT" + else + MARKETPLACE_NAME="Visual Studio Marketplace" + TOKEN="$VSCE_PERSONAL_ACCESS_TOKEN" + fi + if [ "$DRY_RUN" != "true" ] && [ -z "$TOKEN" ]; then - echo "::error::Token for vsce is not set" + echo "::error::Token for $PUBLISH_TOOL is not set" exit 1 fi - echo "Publishing ${#VSIX_FILES[@]} VSIX(s) as pre-release to Visual Studio Marketplace:" + echo "Publishing ${#VSIX_FILES[@]} VSIX(s) as pre-release to $MARKETPLACE_NAME:" printf ' %s\n' "${VSIX_FILES[@]}" RUN_ID="${{ github.run_id }}" @@ -187,7 +199,7 @@ jobs: FAILED=0 # Marketplace gallery requests can sit until typed-rest-client's 180s - # socket timeout. vsce has no timeout flag; retry per VSIX. + # socket timeout. vsce/ovsx have no timeout flag; retry per VSIX. # --skip-duplicate makes a retry a no-op if the first attempt committed. publish_with_retry() { local attempt @@ -206,11 +218,11 @@ jobs: for VSIX in "${VSIX_FILES[@]}"; do NAME=$(basename "$VSIX") - echo "::group::$NAME → Visual Studio Marketplace" + echo "::group::$NAME → $MARKETPLACE_NAME" # Audit trail (mirrors the publish-vsix action's per-file record) HASH=$(sha256sum "$VSIX" 2>/dev/null | cut -d' ' -f1 || echo "unknown") - echo "[AUDIT] actor=$ACTOR repo=$REPO run_id=$RUN_ID tool=vsce file=$NAME hash=$HASH pre_release=true dry_run=$DRY_RUN" + echo "[AUDIT] actor=$ACTOR repo=$REPO run_id=$RUN_ID tool=$PUBLISH_TOOL file=$NAME hash=$HASH pre_release=true dry_run=$DRY_RUN" if [ "$DRY_RUN" = "true" ]; then echo "🔍 DRY RUN - would publish $NAME (pre-release)" @@ -218,41 +230,32 @@ jobs: continue fi - if VSCE_PAT="$TOKEN" publish_with_retry npx @vscode/vsce publish --packagePath "$VSIX" --skip-duplicate --pre-release; then - echo "✅ Published $NAME to Visual Studio Marketplace" + if [ "$PUBLISH_TOOL" = "vsce" ]; then + if VSCE_PAT="$TOKEN" publish_with_retry npx @vscode/vsce publish --packagePath "$VSIX" --skip-duplicate --pre-release; then + echo "✅ Published $NAME to $MARKETPLACE_NAME" + else + echo "::error::Failed to publish $NAME to $MARKETPLACE_NAME" + FAILED=1 + fi else - echo "::error::Failed to publish $NAME to Visual Studio Marketplace" - FAILED=1 + if publish_with_retry npx ovsx publish "$VSIX" -p "$TOKEN" --skip-duplicate --pre-release; then + echo "✅ Published $NAME to $MARKETPLACE_NAME" + else + echo "::error::Failed to publish $NAME to $MARKETPLACE_NAME" + FAILED=1 + fi fi echo "::endgroup::" done if [ "$FAILED" -ne 0 ]; then - echo "::error::One or more VSIX publishes failed for vsce" + echo "::error::One or more VSIX publishes failed for $PUBLISH_TOOL" exit 1 fi - echo "✅ All ${#VSIX_FILES[@]} VSIX(s) processed for Visual Studio Marketplace" - - # ovsx publishing delegates to the shared workflow stable releases already use (rather than - # running its own `ovsx publish`), so every Open VSX publish for this extension -- prerelease - # and stable alike -- requests its OIDC token from the same job_workflow_ref. Open VSX's - # trusted-publisher config is one identity per extension, keyed on that exact file, so two - # different files here would mean only one of the two publish paths could ever be trusted. - publish-ovsx: - permissions: - contents: read - id-token: write - uses: salesforcecli/github-workflows/.github/workflows/openvsx-publish-release-vsix.yml@main - with: - release-tag: ${{ inputs.release-tag }} - vsix-name-pattern: ${{ inputs.vsix-name-pattern || '*.vsix' }} - exclude-web-vsix: ${{ inputs.exclude-web-vsix || 'false' }} - # This workflow's own dry-run input is a string ('true'/'false'); the callee's is boolean. - dry-run: ${{ (inputs.dry-run || 'false') == 'true' }} - secrets: inherit + echo "✅ All ${#VSIX_FILES[@]} VSIX(s) processed for $MARKETPLACE_NAME" tag-promoted: - needs: [publish-vsce, publish-ovsx] + needs: publish runs-on: ubuntu-latest steps: - name: Checkout