Repository navigation
add trusted publishing workflow - #84
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 Global Azure DevOps PATs are retired on December 1, 2026, so publishing moves to Marketplace trusted publishing. Publishing runs when a release is published, skips pre-releases, and fails if the tag doesn't match the
package.jsonversion.vsceis a dev dependency so the job that can get a publish token runs a locked dependency tree. The job uses amarketplaceenvironment limited tov*tags, and a tag ruleset lets only repo admins create those tags, because the Marketplace policy has no branch or tag field.This is unproven until the Marketplace policy exists and a release runs for real. So far, only the install and
vsce packagesteps and the version check have been run locally under Node 22.