How did I automate a VS Code Marketplace release without a PAT?

Описание и применение

Автоматизированный процесс публикации расширения VS Code без PAT, использующий OIDC, Microsoft Entra и проверку пакета.

Задача

Publish a VS Code extension from a Git tag without storing a long‑lived Marketplace token and diagnose failures when the build passes but publishing fails.

Результат

Secure, automated VS Code Marketplace release pipeline that eliminates PAT usage, ensures package integrity, aligns federation subjects, grants publisher permissions, and verifies published artifacts.

Рабочий процесс

• 1. Verify package integrity: run TypeScript compilation, tests, build, metadata validation, and vsce package without cloud credentials.
• 2. Authenticate via OIDC: use vsce publish --oidc, then switch to GitHub Actions OIDC token exchanged through Microsoft Entra and pass to vsce publish --azure-credential.
• 3. Align federation subject: dispatch a second workflow on main to validate tag, match package.json, confirm commit on main, and build from tag.
• 4. Authorize identity: fetch identity ID from Marketplace profile API, add as Contributor to publisher, then perform publisher access check and publish.
• 5. Publish and verify: compare SHA‑256 of GitHub Release asset with fresh build, retain original VSIX, send artifact to Marketplace, and confirm metadata update.

Доказательства

My workflow ran TypeScript compilation, 39 tests, a build, release metadata validation and vsce package in a job that had no cloud credentials.

Источник

I switched to a GitHub Actions OIDC token exchanged through Microsoft Entra and passed the resulting Entra identity to vsce publish --azure-credential.

Источник

I fetched the identity ID from the Marketplace profile API and the publisher owner added it to the moewolf publisher as a Contributor.

Источник