Repository navigation
Conversation
…- W-24666922 A caller migrating Open VSX publishing to OIDC trusted publishing needs its ovsx publish step to run from the same top-level workflow file for every release channel (Open VSX's trusted-publisher match keys off the OIDC token's workflow_ref claim -- the run's initiating workflow -- and only allows one trusted-publisher registration per extension). This workflow's own inline ovsx publish, run as part of the caller's prerelease-promotion workflow, can't share that workflow_ref with a separate stable-release workflow. Adds an optional skip-ovsx input (default 'false', so every existing caller is unaffected) that lets a caller opt its ovsx leg out entirely, e.g. because it publishes Open VSX itself via a separate trusted-publishing dispatch instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
skip-ovsxinput (default'false') tovscode-promote-prerelease.yml, gating its inlineovsx publishstep. Every existing caller is unaffected by default.Context
A caller migrating Open VSX publishing to OIDC trusted publishing needs the actual
ovsx publishstep to run from the same top-level workflow file for every release channel — Open VSX's trusted-publisher match keys off the OIDC token'sworkflow_refclaim (the run's initiating workflow), and only allows one trusted-publisher registration per extension (confirmed server-side ineclipse-openvsx/openvsx'sTrustedPublishingService.registerTrustedPublisher).forcedotcom/salesforcedx-vscodeis doing exactly this: it's adding a dedicated top-level workflow (publishOpenVSXTrusted.yml) that both its stable-release path (direct trigger) and its prerelease-promotion path (explicitworkflow_dispatch) use as the single initiating workflow for Open VSX. For that to work,vscode-promote-prerelease.yml's own inlineovsxleg — which runs as part of the caller's prerelease-promotion run, not a separately initiated one — needs to stay out of the way entirely, not just get skipped by a dry-run flag.skip-ovsx: 'true'letssalesforcedx-vscode's caller opt out cleanly while every other consumer of this shared workflow keeps today's PAT-based behavior unchanged.Validation
actionlint: same single pre-existing shellcheck notice as before this change (confirmed viagit stash/diff againstmain), zero new findings.Test plan
forcedotcom/salesforcedx-vscode'spromote-to-prerelease.ymlcall addsskip-ovsx: 'true'and confirms theovsxmatrix leg logs the skip message and exits 0 without needingIDEE_OVSX_PATskip-ovsxconfirms unchanged behavior@W-24666922@