Repository navigation
feat(release): add OIDC trusted-publishing support to vscode-publish-release-vsix.yml - W-24756661 - #203
Closed
madhur310 wants to merge 3 commits into
Closed
feat(release): add OIDC trusted-publishing support to vscode-publish-release-vsix.yml - W-24756661#203madhur310 wants to merge 3 commits into
madhur310 wants to merge 3 commits into
Conversation
…release-vsix.yml - W-24756661 Adds an opt-in `oidc` input (default false, PAT path unchanged) so callers can publish via `vsce publish --oidc` instead of a VSCE_PERSONAL_ACCESS_TOKEN. Kept as a toggle rather than a straight swap (unlike the Open VSX migration) because this is genuinely untested: Microsoft only shipped Marketplace Trusted Publishing on 2026-10-28, and it's unknown yet whether the Marketplace matches the OIDC token's workflow_ref or job_workflow_ref claim when the publish step runs nested inside this cross-repo reusable workflow.
…sh-release-vsix.yml - W-24756661 Mirrors openvsx-publish-release-vsix.yml's filtering inputs (behavior-preserving defaults). Needed so apex-language-support's OIDC test workflow can exclude its web VSIX variant, same as its Open VSX equivalent already does.
…ase-vsix.yml - W-24756661 The toggle was unnecessary: publishVSCode.yml (the real caller) is pinned to @main, so it was already fully isolated from whatever this branch does -- the @Branch pin on the test workflow gave the same safety a toggle would, for free. Matches the Open VSX migration's pattern: test via a branch-pinned straight swap, only merge to main once validated.
1 of 2 tasks
Contributor
Author
|
Superseded by #207. A job-level reusable workflow can't support Marketplace OIDC trusted publishing regardless of what changes inside it -- the Marketplace's OIDC trust check keys off job_workflow_ref, which for a nested reusable workflow always points at salesforcecli/github-workflows rather than the calling repo, so the token exchange 401s no matter what. Confirmed via a live test in forcedotcom/salesforcedx-vscode. #207 adds an OIDC-safe composite action instead, which runs inline in the caller's own job so job_workflow_ref matches. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
vsix-name-pattern/exclude-web-vsixinputs tovscode-publish-release-vsix.yml(mirrorsopenvsx-publish-release-vsix.yml, behavior-preserving defaults) and swapsvsce publish -p $VSCE_PERSONAL_ACCESS_TOKENforvsce publish --oidc-- trusted publishing instead of a PAT. Removes theVSCE_PERSONAL_ACCESS_TOKENsecret input entirely.Why
Motivated by Microsoft's global Azure DevOps PAT retirement on 2026-12-01, which the existing
VSCE_PERSONAL_ACCESS_TOKENdepends on, and by vsce 4.1.0's new--oidcflag for the Marketplace's Trusted Publishing (shipped 2026-10-28, announcement).Why a straight swap is safe here
This file has exactly one real caller:
publishVSCode.ymlinsalesforcedx-vscode, pinned to@main. It won't see anything on this branch until this PR merges. Validation happens via a dedicated,workflow_dispatch-only test workflow in each calling repo (salesforcedx-vscode#8565,apex-language-support#797), pinned to this branch -- same pattern used for the Open VSX migration (#199): test via a branch-pinned swap, only merge tomainonce validated end-to-end.It's still unknown whether the Marketplace's trust check matches the OIDC token's
workflow_refclaim (top-level initiating workflow) orjob_workflow_ref(this reusable workflow itself, hosted in this repo) when the publish step runs nested cross-repo -- that's exactly what the two test PRs above are for.Test plan
actionlint: zero new findings vs.main--skip-duplicate-safe tag; confirm the Marketplace OIDC token exchange succeeds once a Trusted Publishing policy is registered for that repo/workflow@W-24756661@