From 663487ed54ee2dbadd2d63a06c1a556e051b18e6 Mon Sep 17 00:00:00 2001 From: maasa Date: Sat, 4 Jul 2026 09:39:15 +0900 Subject: [PATCH 1/3] ci(vscode): publish the extension to the Marketplace on difit releases Add a publish-vscode workflow that runs when a GitHub release is published (same trigger as the npm publish workflow): - Rewrites the extension version to the released difit version, so the bundled extension always tracks the CLI release - Builds and packages the VSIX via the existing package:vscode script - Publishes to the VS Code Marketplace with the VSCE_PAT secret, and to Open VSX when an OVSX_PAT secret is configured - Attaches the .vsix to the GitHub release for manual installs Co-Authored-By: Claude Fable 5 --- .github/workflows/publish-vscode.yml | 66 ++++++++++++++++++++++++++++ packages/vscode/README.md | 4 ++ 2 files changed, 70 insertions(+) create mode 100644 .github/workflows/publish-vscode.yml diff --git a/.github/workflows/publish-vscode.yml b/.github/workflows/publish-vscode.yml new file mode 100644 index 00000000..57122a72 --- /dev/null +++ b/.github/workflows/publish-vscode.yml @@ -0,0 +1,66 @@ +name: Publish VS Code Extension + +on: + release: + types: + - published + workflow_dispatch: + +permissions: + contents: read + +jobs: + publish: + name: Publish to VS Code Marketplace + runs-on: ubuntu-latest + permissions: + # Required to attach the .vsix to the GitHub release. + contents: write + + steps: + - name: Checkout repository + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + + - name: Setup Node.js + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: '24' + + - name: Setup pnpm + uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 + with: + version: 11.6.0 + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + # The extension bundles difit, so its Marketplace version tracks the + # difit version being released. The repository keeps a placeholder + # version; it is only rewritten here at publish time. + - name: Sync extension version with difit + run: | + VERSION=$(node -p "require('./package.json').version") + (cd packages/vscode && npm pkg set version="$VERSION") + echo "Publishing difit-vscode $VERSION" + + - name: Package VS Code extension + run: pnpm run package:vscode + + - name: Publish to VS Code Marketplace + working-directory: packages/vscode + env: + VSCE_PAT: ${{ secrets.VSCE_PAT }} + run: pnpm exec vsce publish --no-dependencies --packagePath difit-vscode-*.vsix + + - name: Publish to Open VSX + if: ${{ secrets.OVSX_PAT != '' }} + working-directory: packages/vscode + env: + OVSX_PAT: ${{ secrets.OVSX_PAT }} + run: pnpm dlx ovsx publish difit-vscode-*.vsix -p "$OVSX_PAT" + + - name: Attach VSIX to GitHub release + if: github.event_name == 'release' + env: + GH_TOKEN: ${{ github.token }} + run: gh release upload "${{ github.event.release.tag_name }}" packages/vscode/difit-vscode-*.vsix --clobber diff --git a/packages/vscode/README.md b/packages/vscode/README.md index e958b437..a5e40f24 100644 --- a/packages/vscode/README.md +++ b/packages/vscode/README.md @@ -30,3 +30,7 @@ pnpm run build # builds the difit client assets into dist/client pnpm -C packages/vscode run build # bundles the extension into packages/vscode/dist pnpm -C packages/vscode run package # produces the .vsix ``` + +## Release + +Publishing is automated: when a difit GitHub release is published, the `Publish VS Code Extension` workflow rebuilds the extension, sets its version to the released difit version, publishes it to the VS Code Marketplace (and Open VSX when `OVSX_PAT` is configured), and attaches the `.vsix` to the GitHub release. The `version` field in this package.json is a placeholder; it is rewritten in CI at publish time. From bb3df6f05ebdb3e3c38a52dd9b696cb5049e2502 Mon Sep 17 00:00:00 2001 From: maasa Date: Sat, 4 Jul 2026 09:56:48 +0900 Subject: [PATCH 2/3] ci(vscode): use Entra ID secure publishing instead of a Marketplace PAT Switch the Marketplace publish step to the officially recommended secure automated publishing flow: the workflow's release environment exchanges a GitHub OIDC token for a Microsoft Entra ID credential via azure/login (workload identity federation), and vsce publishes with --azure-credential. Azure DevOps global PATs retire on 2026-12-01, so no long-lived publishing secret is stored. Also remove the manual vscode-release Codex skill, which is superseded by the automated workflow. Co-Authored-By: Claude Fable 5 --- .codex/skills/vscode-release/SKILL.md | 46 ------------------- .../skills/vscode-release/agents/openai.yaml | 4 -- .github/workflows/publish-vscode.yml | 21 +++++++-- packages/vscode/README.md | 2 + 4 files changed, 19 insertions(+), 54 deletions(-) delete mode 100644 .codex/skills/vscode-release/SKILL.md delete mode 100644 .codex/skills/vscode-release/agents/openai.yaml diff --git a/.codex/skills/vscode-release/SKILL.md b/.codex/skills/vscode-release/SKILL.md deleted file mode 100644 index f24665df..00000000 --- a/.codex/skills/vscode-release/SKILL.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -name: vscode-release -description: Execute the VS Code extension release workflow when the user asks to publish/release the difit VS Code extension. Run local VSIX build and smoke verification first, ask for explicit OK in Japanese, then publish with vsce. -metadata: - internal: true ---- - -# VS Code Extension Release Workflow - -Follow this workflow for the current repository. - -## Prepare local build verification - -1. Verify release target files in `packages/vscode` and confirm current branch state. -2. Run `pnpm install --frozen-lockfile`. -3. Run `pnpm -C packages/vscode run package`. -4. Read `packages/vscode/package.json` and confirm the current extension version. -5. Confirm the VSIX exists at `packages/vscode/difit-vscode-.vsix`. -6. Ask the user to smoke test the local VSIX install in VS Code: - - Install from VSIX. - - Confirm the `difit` command opens review correctly. - - Confirm the toolbar button/icon appears and works. -7. Ask for explicit OK in Japanese before publishing. - -## Release after explicit OK - -Treat the locally verified build result at OK time as the source of truth. Do not skip rebuilding after version changes. - -1. Bump extension version in `packages/vscode/package.json`: - - `pnpm -C packages/vscode version patch --no-git-tag-version` -2. Re-run `pnpm -C packages/vscode run package` and confirm the new VSIX filename. -3. Commit `packages/vscode/package.json` with an English message: `chore(vscode): release vX.Y.Z`. -4. Create tag `vscode-vX.Y.Z`. -5. Push `main` and tags: `git push origin main --tags`. -6. If push is rejected by non-fast-forward: - - Run `git pull --rebase origin main`. - - Retry `git push origin main --tags`. -7. Publish to Visual Studio Marketplace: - - `pnpm -C packages/vscode exec vsce publish` - - Use the already bumped version from `packages/vscode/package.json`. - -## Output to user - -- Respond in Japanese. -- Report local build verification result, released version, created tag, and publish result. -- Mention if any recovery step was required (for example, rebase due to non-fast-forward). diff --git a/.codex/skills/vscode-release/agents/openai.yaml b/.codex/skills/vscode-release/agents/openai.yaml deleted file mode 100644 index f4293055..00000000 --- a/.codex/skills/vscode-release/agents/openai.yaml +++ /dev/null @@ -1,4 +0,0 @@ -interface: - display_name: 'VSCode Release' - short_description: 'Run VS Code extension release with local VSIX verification.' - default_prompt: 'Use $vscode-release to verify local VSIX build, ask for explicit OK, and publish the VS Code extension.' diff --git a/.github/workflows/publish-vscode.yml b/.github/workflows/publish-vscode.yml index 57122a72..7bb92d00 100644 --- a/.github/workflows/publish-vscode.yml +++ b/.github/workflows/publish-vscode.yml @@ -13,9 +13,14 @@ jobs: publish: name: Publish to VS Code Marketplace runs-on: ubuntu-latest + # Must match the federated credential subject configured on the Entra ID + # identity (repo:yoshiko-pg/difit:environment:release). + environment: release permissions: - # Required to attach the .vsix to the GitHub release. + # Attach the .vsix to the GitHub release. contents: write + # Issue the OIDC token for Entra ID workload identity federation. + id-token: write steps: - name: Checkout repository @@ -46,11 +51,19 @@ jobs: - name: Package VS Code extension run: pnpm run package:vscode + # Secure automated publishing: no PAT. The workflow exchanges its OIDC + # token for an Entra ID session, and vsce publishes with that credential. + # https://code.visualstudio.com/api/working-with-extensions/publishing-extension + - name: Azure login (workload identity federation) + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 + with: + client-id: ${{ secrets.AZURE_CLIENT_ID }} + tenant-id: ${{ secrets.AZURE_TENANT_ID }} + subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + - name: Publish to VS Code Marketplace working-directory: packages/vscode - env: - VSCE_PAT: ${{ secrets.VSCE_PAT }} - run: pnpm exec vsce publish --no-dependencies --packagePath difit-vscode-*.vsix + run: pnpm exec vsce publish --no-dependencies --azure-credential --packagePath difit-vscode-*.vsix - name: Publish to Open VSX if: ${{ secrets.OVSX_PAT != '' }} diff --git a/packages/vscode/README.md b/packages/vscode/README.md index a5e40f24..b8b5acfe 100644 --- a/packages/vscode/README.md +++ b/packages/vscode/README.md @@ -34,3 +34,5 @@ pnpm -C packages/vscode run package # produces the .vsix ## Release Publishing is automated: when a difit GitHub release is published, the `Publish VS Code Extension` workflow rebuilds the extension, sets its version to the released difit version, publishes it to the VS Code Marketplace (and Open VSX when `OVSX_PAT` is configured), and attaches the `.vsix` to the GitHub release. The `version` field in this package.json is a placeholder; it is rewritten in CI at publish time. + +Marketplace authentication uses [secure automated publishing](https://code.visualstudio.com/api/working-with-extensions/publishing-extension#secure-automated-publishing-to-visual-studio-marketplace) (Microsoft Entra ID workload identity federation + `vsce publish --azure-credential`) instead of a PAT: the workflow's `release` environment exchanges a GitHub OIDC token for an Entra ID credential of an identity that is a member of the `yoshiko-pg` publisher. Required repository secrets: `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, `AZURE_SUBSCRIPTION_ID`. From 04c15fc1687d00d208a72cbcb10403a7c1533c63 Mon Sep 17 00:00:00 2001 From: maasa Date: Sat, 4 Jul 2026 11:07:50 +0900 Subject: [PATCH 3/3] fix(vscode): publish as the existing yoshiko-pg.difit extension ID The Marketplace already has the extension published as yoshiko-pg.difit; keeping the package name difit-vscode would create a separate listing instead of updating it. Co-Authored-By: Claude Fable 5 --- .github/workflows/publish-vscode.yml | 8 ++++---- packages/vscode/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/publish-vscode.yml b/.github/workflows/publish-vscode.yml index 7bb92d00..d80e28da 100644 --- a/.github/workflows/publish-vscode.yml +++ b/.github/workflows/publish-vscode.yml @@ -46,7 +46,7 @@ jobs: run: | VERSION=$(node -p "require('./package.json').version") (cd packages/vscode && npm pkg set version="$VERSION") - echo "Publishing difit-vscode $VERSION" + echo "Publishing yoshiko-pg.difit $VERSION" - name: Package VS Code extension run: pnpm run package:vscode @@ -63,17 +63,17 @@ jobs: - name: Publish to VS Code Marketplace working-directory: packages/vscode - run: pnpm exec vsce publish --no-dependencies --azure-credential --packagePath difit-vscode-*.vsix + run: pnpm exec vsce publish --no-dependencies --azure-credential --packagePath difit-*.vsix - name: Publish to Open VSX if: ${{ secrets.OVSX_PAT != '' }} working-directory: packages/vscode env: OVSX_PAT: ${{ secrets.OVSX_PAT }} - run: pnpm dlx ovsx publish difit-vscode-*.vsix -p "$OVSX_PAT" + run: pnpm dlx ovsx publish difit-*.vsix -p "$OVSX_PAT" - name: Attach VSIX to GitHub release if: github.event_name == 'release' env: GH_TOKEN: ${{ github.token }} - run: gh release upload "${{ github.event.release.tag_name }}" packages/vscode/difit-vscode-*.vsix --clobber + run: gh release upload "${{ github.event.release.tag_name }}" packages/vscode/difit-*.vsix --clobber diff --git a/packages/vscode/package.json b/packages/vscode/package.json index 853301ea..2e67f777 100644 --- a/packages/vscode/package.json +++ b/packages/vscode/package.json @@ -1,5 +1,5 @@ { - "name": "difit-vscode", + "name": "difit", "displayName": "difit", "version": "0.1.0", "description": "GitHub-like diff review inside VS Code. difit is bundled — no extra install needed.",