Repository navigation
Marketplace publishing identity #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Marketplace publishing identity | |
| # Manual, identity-only setup check. This workflow never builds or uploads a | |
| # package and never grants publisher permissions. The profile ID is not a token. | |
| on: | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| identify: | |
| name: Read the Marketplace User ID | |
| if: github.repository == 'LiveSplit/SplitScript' && github.ref == 'refs/heads/master' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| environment: vscode-marketplace | |
| permissions: | |
| id-token: write | |
| steps: | |
| - name: Check the publishing identity configuration | |
| env: | |
| MARKETPLACE_CLIENT_ID: ${{ vars.MARKETPLACE_CLIENT_ID }} | |
| MARKETPLACE_TENANT_ID: ${{ vars.MARKETPLACE_TENANT_ID }} | |
| run: | | |
| if [[ -z "$MARKETPLACE_CLIENT_ID" || -z "$MARKETPLACE_TENANT_ID" ]]; then | |
| echo 'Configure MARKETPLACE_CLIENT_ID and MARKETPLACE_TENANT_ID in the vscode-marketplace environment.' >&2 | |
| exit 1 | |
| fi | |
| - name: Sign in as the publishing app using GitHub OIDC | |
| uses: azure/login@v3 | |
| with: | |
| client-id: ${{ vars.MARKETPLACE_CLIENT_ID }} | |
| tenant-id: ${{ vars.MARKETPLACE_TENANT_ID }} | |
| allow-no-subscriptions: true | |
| - name: Read the app's Marketplace profile ID | |
| run: | | |
| # Authenticate as the app, not as its human owner. Print only the | |
| # non-secret profile ID required by the Marketplace Members form. | |
| profile_id=$(az rest \ | |
| --method get \ | |
| --url https://app.vssps.visualstudio.com/_apis/profile/profiles/me \ | |
| --resource 499b84ac-1321-427f-aa17-267ca6975798 \ | |
| --query id --output tsv --only-show-errors) | |
| if [[ ! "$profile_id" =~ ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ ]]; then | |
| echo 'Marketplace returned a missing or invalid profile ID.' >&2 | |
| exit 1 | |
| fi | |
| echo "Marketplace User ID: $profile_id" | |
| { | |
| echo '## Marketplace publishing identity' | |
| echo | |
| printf 'Marketplace **User ID**: `%s`\n' "$profile_id" | |
| echo | |
| echo 'Add this ID as a **Contributor** under the **LiveSplit** publisher’s **Members** tab.' | |
| echo 'This check does not grant access or publish an extension. No access tokens are printed.' | |
| } >> "$GITHUB_STEP_SUMMARY" |