How did I automate a VS Code Marketplace release without a PAT?

Description and use

Automated VS Code extension release without PAT, using OIDC, Microsoft Entra, and package integrity checks.

Problem

Publish a VS Code extension from a Git tag without storing a long‑lived Marketplace token and diagnose failures when the build passes but publishing fails.

Outcome

Secure, automated VS Code Marketplace release pipeline that eliminates PAT usage, ensures package integrity, aligns federation subjects, grants publisher permissions, and verifies published artifacts.

Workflow

• 1. Verify package integrity: run TypeScript compilation, tests, build, metadata validation, and vsce package without cloud credentials.
• 2. Authenticate via OIDC: use vsce publish --oidc, then switch to GitHub Actions OIDC token exchanged through Microsoft Entra and pass to vsce publish --azure-credential.
• 3. Align federation subject: dispatch a second workflow on main to validate tag, match package.json, confirm commit on main, and build from tag.
• 4. Authorize identity: fetch identity ID from Marketplace profile API, add as Contributor to publisher, then perform publisher access check and publish.
• 5. Publish and verify: compare SHA‑256 of GitHub Release asset with fresh build, retain original VSIX, send artifact to Marketplace, and confirm metadata update.

Evidence

My workflow ran TypeScript compilation, 39 tests, a build, release metadata validation and vsce package in a job that had no cloud credentials.

Source

I switched to a GitHub Actions OIDC token exchanged through Microsoft Entra and passed the resulting Entra identity to vsce publish --azure-credential.

Source

I fetched the identity ID from the Marketplace profile API and the publisher owner added it to the moewolf publisher as a Contributor.

Source