ci: ship a verifiable VSIX to releases and add gated Marketplace/Open VSX publish - #240
Open
Muhammad Ahmad Ali (MhAhmadAli) wants to merge 2 commits into
Open
Conversation
The release workflow already attached a VSIX to a tagged release, but stopped there: no checksum, no provenance, no size gate, and no path to either marketplace. Enterprises that cannot build locally still had nothing to verify. - attach a .sha256 next to the VSIX and attest its build provenance, so consumers can run gh attestation verify against the downloaded file - run check-size in the release job, not just CI, so an oversized VSIX cannot reach a release - publish the exact release bytes via --packagePath to the VS Code Marketplace and to Open VSX, which serves VS Code OSS builds - keep both publish steps inert until a maintainer opts in with the PUBLISH_MARKETPLACE / PUBLISH_OPENVSX repository variables - narrow workflow permissions to read and elevate only the release job
The package carried 2.5 MB of README screenshots plus AGENTS.md, skills/ and .claude/, none of which are read at runtime. assets/icon.png stays, since it is both the extension icon and the chat participant icon. Packaged output drops from 3.35 MB to 1.04 MB across 94 to 73 files.
Author
|
@microsoft-github-policy-service agree |
github-actions
Bot
requested review from
TamasBoncz,
Aymen (aymenfurter) and
Sanjay Singh (san360)
August 21, 2026 09:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Towards #92. Also unblocks the duplicate cluster #123, #130 and #140 once a tag is pushed.
Re-opening of #225, which was closed on a blocked CLA before it could be reviewed. The CLA is being agreed on this PR; the content is unchanged apart from a rebase onto current
main.What I found
The automation for "Option 1 — prebuilt VSIX via GH releases" already exists.
release.ymlbuilds, tests, packages and attaches the.vsixon anyv*.*.*tag. It has simply never run: the repo has zero tags, and the file has only ever been touched by Dependabot and by the SHA-pinning pass in #223. So the gap is not a missing pipeline — it is (a) no tag has been cut, (b) nothing publishes to a marketplace, and (c) nothing about the artifact is verifiable, which is what the issue's enterprise angle actually asks for.This PR closes (b) and (c), and tightens the artifact before the first publish makes it permanent. It deliberately does not touch the README — advertising a release that does not exist yet is exactly the bug reported in #123. That doc flip belongs in the PR that lands alongside the first tag.
Changes
.github/workflows/release.yml.sha256beside the VSIX and attach both to the release.actions/attest-build-provenance, SHA-pinned per Pin GitHub Actions to full-length commit SHAs #223), so anyone can rungh attestation verify ai-engineer-coach-<version>.vsix --repo microsoft/AI-Engineering-Coachon the download.check-sizein the release job, not only in CI, so an oversized VSIX cannot reach a release.--packagePath, so the bytes on the release, on the Marketplace and on Open VSX are byte-identical and the checksum/attestation cover all three. Open VSX matters for VS Code OSS builds (VSCodium, Antigravity), which cannot reach the Microsoft Marketplace — see bug: Unable to install extension for VSCode OSS Version: 1.107.0 #41.vars.PUBLISH_MARKETPLACE/vars.PUBLISH_OPENVSX, so this merges inert and stays a no-op until maintainers opt in. Secrets are passed throughenv:rather than interpolated intorun:.contents: read, elevated only on the release job..vscodeignoreThe package was carrying 2.5 MB of README screenshots plus
AGENTS.md,skills/and.claude/, none of which are read at runtime.assets/icon.pngstays — it is both the extension icon and the chat participant icon (src/chat/participant.ts).Verification
npm ci && npm run package && npm run check-size, measured on this branch and on currentmainfor the baseline:maindist/andassets/icon.pngare intact;check-sizepasses both budgets. The workflow YAML parses clean.What still needs a maintainer
git tag v0.1.0 && git push origin v0.1.0produces the first release on its own, even with zero further changes. That alone resolves Documentation: Download from releases as the preferred option? #123/Cut first release so README .vsix install path works #130/There is no release page that the instructions talk about in the github? #140.package.jsonclaimspublisher: "ai-engineer-coach", which has to exist on the Marketplace and be owned by the org. This sets the permanent extension ID, so it is worth deciding before the first publish.@vscode/vsce(3.9.2) supportsVSCE_PATand--azure-credential(Entra ID), but not--oidc— trusted publishing only exists onvscemain / the 3.9.3 prereleases. Note Azure DevOps retires global PATs on 2026-12-01, soVSCE_PATis a stopgap and--azure-credentialis the durable path. Happy to switch the step over if that is the preference.One thing worth flagging separately
engines.vscodeis^1.125.0, while the README badge says 1.115+,README.extension.mdsays 1.85+ andskills/package-extension.mdsays ^1.120.0. Once this is on the Marketplace,enginesbecomes load-bearing: everyone below 1.125 gets "not compatible", which reproduces #41 for the published artifact. Settling on a real minimum needs an API-usage audit, so I left it alone rather than guessing.