From 396dae08efd4348583113287fab2a88a85881d82 Mon Sep 17 00:00:00 2001 From: Asher Date: Wed, 28 Oct 2026 10:57:46 -0800 Subject: [PATCH 1/5] chore: use oidc to publish to vs code marketplace --- .github/workflows/release.yaml | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 508958713a..55b70614eb 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -75,25 +75,23 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 5 outputs: - vsce: ${{ steps.check.outputs.vsce }} ovsx: ${{ steps.check.outputs.ovsx }} steps: - name: Check which tokens are set id: check env: - VSCE_PAT: ${{ secrets.VSCE_PAT }} OVSX_PAT: ${{ secrets.OVSX_PAT }} run: | - echo "vsce=$([ -n "$VSCE_PAT" ] && echo true || echo false)" >> "$GITHUB_OUTPUT" echo "ovsx=$([ -n "$OVSX_PAT" ] && echo true || echo false)" >> "$GITHUB_OUTPUT" publish-vscode: name: Publish to VS Marketplace - needs: [package, tokens] - if: needs.tokens.outputs.vsce == 'true' + needs: package runs-on: ubuntu-24.04 timeout-minutes: 10 environment: publish + permissions: + id-token: write steps: - name: Setup Node.js uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 @@ -118,9 +116,8 @@ jobs: - name: Publish to VS Marketplace env: - VSCE_PAT: ${{ secrets.VSCE_PAT }} VSIX: ${{ needs.package.outputs.vsix }} - run: vsce publish $PRE_RELEASE_FLAG --packagePath "$VSIX" + run: vsce publish $PRE_RELEASE_FLAG --packagePath "$VSIX" --oidc publish-ovsx: name: Publish to Open VSX From cd33060e9ffa7adbad0975866a7c7fc6ec4a6c4a Mon Sep 17 00:00:00 2001 From: Asher Date: Wed, 28 Oct 2026 13:26:47 -0800 Subject: [PATCH 2/5] Remove tokens step entirely --- .github/workflows/release.yaml | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 55b70614eb..2e63f8e170 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -68,22 +68,6 @@ jobs: path: ${{ steps.package.outputs.vsix }} if-no-files-found: error - # Job-level `if` can't read secrets, and the package job runs dependency - # code, so a separate job reports which marketplace tokens are set. - tokens: - name: Check Marketplace Tokens - runs-on: ubuntu-24.04 - timeout-minutes: 5 - outputs: - ovsx: ${{ steps.check.outputs.ovsx }} - steps: - - name: Check which tokens are set - id: check - env: - OVSX_PAT: ${{ secrets.OVSX_PAT }} - run: | - echo "ovsx=$([ -n "$OVSX_PAT" ] && echo true || echo false)" >> "$GITHUB_OUTPUT" - publish-vscode: name: Publish to VS Marketplace needs: package @@ -121,8 +105,7 @@ jobs: publish-ovsx: name: Publish to Open VSX - needs: [package, tokens] - if: needs.tokens.outputs.ovsx == 'true' + needs: package runs-on: ubuntu-24.04 timeout-minutes: 10 environment: publish From 30ba268ce9978400717b2b5a5e56a8390712be6d Mon Sep 17 00:00:00 2001 From: Asher Date: Wed, 28 Oct 2026 13:30:08 -0800 Subject: [PATCH 3/5] Skip publish steps on forks --- .github/workflows/release.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 2e63f8e170..12ff599fad 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -71,6 +71,7 @@ jobs: publish-vscode: name: Publish to VS Marketplace needs: package + if: github.repository == 'coder/vscode-coder' runs-on: ubuntu-24.04 timeout-minutes: 10 environment: publish @@ -106,6 +107,7 @@ jobs: publish-ovsx: name: Publish to Open VSX needs: package + if: github.repository == 'coder/vscode-coder' runs-on: ubuntu-24.04 timeout-minutes: 10 environment: publish From 031b1cad39e53b297b4f9d2352d1bb40efb59242 Mon Sep 17 00:00:00 2001 From: Asher Date: Wed, 28 Oct 2026 13:38:27 -0800 Subject: [PATCH 4/5] Bump @vscode/vsce to 4.1.0 --- package.json | 2 +- pnpm-lock.yaml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 4a1b4711f0..38609b33b2 100644 --- a/package.json +++ b/package.json @@ -849,7 +849,7 @@ "@vscode/codicons": "catalog:", "@vscode/test-cli": "^0.0.15", "@vscode/test-electron": "^3.1.0", - "@vscode/vsce": "^4.0.0", + "@vscode/vsce": "^4.1.0", "babel-plugin-react-compiler": "catalog:", "bufferutil": "^4.1.0", "coder": "link:vendor/coder", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c74a2ddcd3..2aa366a5f4 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -382,8 +382,8 @@ importers: specifier: ^3.1.0 version: 3.1.0(supports-color@8.1.1) '@vscode/vsce': - specifier: ^4.0.0 - version: 4.0.0(supports-color@8.1.1) + specifier: ^4.1.0 + version: 4.1.0(supports-color@8.1.1) babel-plugin-react-compiler: specifier: 'catalog:' version: 1.0.0 @@ -2965,8 +2965,8 @@ packages: '@vscode/vsce-sign@2.1.0': resolution: {integrity: sha512-9AQrqazrBgTgRSuwleLVXUrIUphY02/SFCh2TKYoLV/xifJAdblhdmEmw5gUrYSPQ3sRwNs9iyCMD14sATEE6g==} - '@vscode/vsce@4.0.0': - resolution: {integrity: sha512-NImwuLaenMmb5D5Jer9/lzi/F9ZQUBOp8Azhj/BVYcTFgixv8KehFXqEUDjQlD2tAiw2E6dDGyjTuAB//di60A==} + '@vscode/vsce@4.1.0': + resolution: {integrity: sha512-iWNykEfLWTAU7FC2iBiE0vJvnJDpGm3GlL89dsBtRs62F+8tkPtq80Imi0QSFHjNBWu4QIdYII+3F9v/ZQRExw==} engines: {node: '>= 22'} hasBin: true @@ -7434,7 +7434,7 @@ snapshots: '@vscode/vsce-sign-win32-arm64': 2.0.6 '@vscode/vsce-sign-win32-x64': 2.0.6 - '@vscode/vsce@4.0.0(supports-color@8.1.1)': + '@vscode/vsce@4.1.0(supports-color@8.1.1)': dependencies: '@azure/identity': 4.14.0(supports-color@8.1.1) '@napi-rs/keyring': 1.3.0 From 8288e9509b949eab4a30eaa83123ecf586b77119 Mon Sep 17 00:00:00 2001 From: Asher Date: Wed, 28 Oct 2026 13:41:13 -0800 Subject: [PATCH 5/5] Comment on what id-token is for --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 12ff599fad..d73862dd22 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -76,7 +76,7 @@ jobs: timeout-minutes: 10 environment: publish permissions: - id-token: write + id-token: write # Allows generating an OIDC token. steps: - name: Setup Node.js uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0