Skip to content

Limit marketplace publishing tokens to the publish steps #1297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
graygilmore wants to merge 3 commits into
base: main
Choose a base branch
from
+16 −7
Draft

Limit marketplace publishing tokens to the publish steps #1297

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3bc49a0
Remove unused NPM_TOKEN from the manual VS Code release workflow
graygilmore Sep 11, 2026
c05c2be
Scope marketplace tokens to the steps that publish
graygilmore Sep 11, 2026
91ad85f
Scope GitHub credentials in release workflows
fredericoo Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,6 @@ on:
concurrency: ${{ github.workflow }}-${{ github.ref }}

env:
VSCE_PAT: ${{ secrets.VSCE_PAT }}
OVSX_PAT: ${{ secrets.OPENVSX_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
npm_config_registry: "https://registry.npmjs.org"

jobs:
Expand All @@ -26,6 +23,7 @@ jobs:
with:
submodules: true
fetch-depth: 0
persist-credentials: false

- name: Setup pnpm
uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
Expand Down Expand Up @@ -81,10 +79,17 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
NPM_CONFIG_PROVENANCE: true

- name: Clear GitHub credentials before marketplace publish
run: rm -f "$HOME/.netrc"

- name: VS Code Marketplace publish
if: steps.changesets.outputs.hasChangesets == 'false' && steps.marketplace-version.outputs.version != steps.package-version.outputs.version
run: pnpm publish:vsce
env:
VSCE_PAT: ${{ secrets.VSCE_PAT }}

- name: Open VSX Registry publish
if: steps.changesets.outputs.hasChangesets == 'false' && steps.marketplace-version.outputs.version != steps.package-version.outputs.version
run: pnpm publish:ovsx
env:
OVSX_PAT: ${{ secrets.OPENVSX_TOKEN }}
12 changes: 8 additions & 4 deletions .github/workflows/vscode-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,11 @@ name: VS Code Release Workflow in a pinch
on: workflow_dispatch

env:
VSCE_PAT: ${{ secrets.VSCE_PAT }}
OVSX_PAT: ${{ secrets.OPENVSX_TOKEN }}
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
npm_config_registry: "https://registry.npmjs.org"

permissions:
contents: read

jobs:
publish-packages:
runs-on: ubuntu-latest
Expand All @@ -17,6 +16,7 @@ jobs:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
submodules: true
persist-credentials: false

- name: Setup pnpm
uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
Expand All @@ -40,6 +40,10 @@ jobs:

- name: VS Code Marketplace publish
run: pnpm publish:vsce
env:
VSCE_PAT: ${{ secrets.VSCE_PAT }}

- name: Open VSX Registry publish
run: pnpm publish:ovsx
env:
OVSX_PAT: ${{ secrets.OPENVSX_TOKEN }}
Loading