From f70b3d27f183c8a5d20f6890a998140243280282 Mon Sep 17 00:00:00 2001 From: madhur310 Date: Thu, 12 Nov 2026 14:36:55 -0800 Subject: [PATCH] docs: clarify OIDC vs PAT publishing in README - W-24756661 VSCE_PERSONAL_ACCESS_TOKEN is only needed for PAT-based publishing, not OIDC. The Trusted Publishing policy must be registered against the calling repo's own workflow filename, not the composite action's -- the prior wording was ambiguous about which file "this exact workflow filename" referred to. Co-Authored-By: Claude Sonnet 5 --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 17da627..01aecb7 100644 --- a/README.md +++ b/README.md @@ -491,7 +491,7 @@ Before using these workflows, ensure your repository has: 1. **Required Secrets** (configured as GitHub Actions secrets): - `IDEE_GH_TOKEN` - Personal Access Token with repo permissions for creating releases and pushing tags - - `VSCE_PERSONAL_ACCESS_TOKEN` - VS Code Marketplace Personal Access Token ([create one](https://code.visualstudio.com/api/working-with-extensions/publishing-extension#get-a-personal-access-token)) + - `VSCE_PERSONAL_ACCESS_TOKEN` - VS Code Marketplace Personal Access Token for PAT-based publishing (not needed with OIDC; [create one](https://code.visualstudio.com/api/working-with-extensions/publishing-extension#get-a-personal-access-token)) - `IDEE_OVSX_PAT` - Open VSX Personal Access Token ([create one](https://open-vsx.org/user-settings/tokens)) 2. **Repository Structure**: @@ -795,7 +795,7 @@ jobs: dry-run: true # Download and inspect without publishing ``` -This requires a Trusted Publishing policy registered for the calling repo + this exact workflow filename on the Marketplace publisher management page. +This requires a Trusted Publishing policy registered for the calling repo + the calling workflow's filename (e.g., `publishVSCode.yml`) on the Marketplace publisher management page. ### openvsx-publish-release-vsix