@mnci/cli 4.12.4 → 4.13.0

package/README.md

@@ -1479,10 +1479,18 @@ extension:
   Linux binaries. Unix file modes survive into the package, so the binary stays
   executable. Resolve it at runtime from `context.extensionPath` + `bin/`.
 - **`nx-release-publish`** runs `vsce publish --packagePath <every vsix>
-  --skip-duplicate` when `VSCE_PAT` is set (a Marketplace personal access token, as
-  a CI secret) and skips with a message otherwise. It depends on `package`, so it
-  ships the version `nx release` just wrote. The CI release step passes `VSCE_PAT`
-  through in both providers.
+  --skip-duplicate` with a Marketplace credential, and skips with a message without
+  one. It depends on `package`, so it ships the version `nx release` just wrote. Two
+  credentials work, and Entra ID wins when both are configured:
+  - **Microsoft Entra ID, no secret (GitHub Actions).** When the `AZURE_CLIENT_ID`
+    and `AZURE_TENANT_ID` repository variables exist, the release job signs in with
+    `azure/login` through OIDC (`id-token: write`) and publishes with
+    `vsce publish --azure-credential`. Nothing is stored and nothing expires. Setup
+    is below.
+  - **`VSCE_PAT`**, a Marketplace personal access token as a CI secret, in both
+    providers. Creating one needs an Azure DevOps organization, which now needs an
+    Azure subscription, and global PATs are reported to retire on 2026-12-01. Azure
+    Pipelines has only this route for now.
 - **Debugging**: an `<name>: debug` launch entry (`extensionHost`) opens a second
   VS Code window with the extension loaded, after the `<name>: build (development)`
   task, which keeps source maps.
@@ -1493,6 +1501,35 @@ Both targets run `tools/vscode-extension.cjs`, a workspace file mnci owns (like
 `package.json` `bin` and runs them with `node`, with no shell, so a workspace path
 containing spaces works on Windows.
 
+### Publishing with Microsoft Entra ID (one-time setup)
+
+Think of it as a guest list rather than a key. GitHub vouches for "a job in
+`<owner>/<repo>` on `main`", Entra ID checks that against the federated credential
+and issues a short-lived token, and the Marketplace accepts the token because the
+identity is a member of the publisher.
+
+1. **A tenant.** A free Azure account creates one. No billable resource is needed.
+2. **An app registration** (Entra admin center → App registrations → New
+   registration, single tenant, no redirect URI). Prefer it to a managed identity:
+   it lives in the tenant, not a subscription, so a lapsed trial does not stop
+   publishing. Note its Application (client) ID and Directory (tenant) ID.
+3. **A federated credential** on it (Certificates & secrets → Federated
+   credentials → GitHub Actions deploying Azure resources): your owner and
+   repository, entity type *Branch*, branch `main`. Repositories created after
+   2026-07-15 (or opted in) send GitHub's immutable subject, which carries the
+   numeric IDs: `repo:<owner>@<owner_id>/<repo>@<repo_id>:ref:refs/heads/main`.
+   The form asks for both IDs; `GET /repos/<owner>/<repo>` returns them as
+   `owner.id` and `id`.
+4. **Repository variables** (Settings → Secrets and variables → Actions →
+   Variables, not Secrets): `AZURE_CLIENT_ID` and `AZURE_TENANT_ID`.
+5. **The identity as a publisher member.** The Marketplace's Members page wants
+   the identity's Azure DevOps profile ID, which only the identity can read, so read
+   it from a workflow run on `main` after `azure/login`:
+   `az rest -u https://app.vssps.visualstudio.com/_apis/profile/profiles/me
+   --resource 499b84ac-1321-427f-aa17-267ca6975798 --query id -o tsv`. Add that ID
+   under Members with the **Contributor** role, then confirm with
+   `npx @vscode/vsce verify-pat --azure-credential <publisher>` in the same job.
+
 Not built yet: integration tests through `@vscode/test-cli` (they download VS Code
 and need a display, so they would be gated like the Go and Flutter sections).
 

package/dist/cli.js

@@ -1020,7 +1020,8 @@ var ACTION_VERSIONS = {
   "actions/checkout": "v7",
   "actions/setup-node": "v7",
   "actions/setup-dotnet": "v6",
-  "actions/upload-artifact": "v7"
+  "actions/upload-artifact": "v7",
+  "azure/login": "v3"
 };
 var NPM_VERSION = "11";
 var DOTNET_SDK_VERSION = "10.0.x";
@@ -1433,6 +1434,11 @@ permissions:
   # Lets the release step push the version tag nx release creates back to main,
   # and (github-only provider) create the GitHub Release itself.
   contents: write
+  # Lets azure/login exchange this job's OIDC token for a Microsoft Entra ID one,
+  # which is how a VS Code extension reaches the Marketplace with no stored secret.
+  # A token minted on a pull request cannot use it: the federated credential is
+  # pinned to refs/heads/main.
+  id-token: write
 
 jobs:
   ci:
@@ -1634,14 +1640,31 @@ ${npmAuthPreflight(registryKind) ? `
       # which is why 'nx release' pushes the tag itself here \u2014 see
       # releaseConfig's remarks for why that is safe on this Nx version and
       # why every other provider combination keeps the explicit push step below.` : ""}
+      # Signs in to Microsoft Entra ID as the Marketplace publishing identity (an
+      # app registration with a federated credential for this repository's main
+      # branch), so the release step publishes VS Code extensions with
+      # 'vsce publish --azure-credential' and no token. Runs only when the
+      # AZURE_CLIENT_ID and AZURE_TENANT_ID repository variables exist and the
+      # workspace has an extension (every one ships a .vscodeignore). No Azure
+      # subscription is needed. Setup: README, 'VS Code extensions'.
+      - uses: azure/login@${ACTION_VERSIONS["azure/login"]}
+        name: Sign in to Microsoft Entra ID (VS Code Marketplace)
+        if: \${{ ${onMain} && vars.AZURE_CLIENT_ID != '' && hashFiles('apps/*/.vscodeignore') != '' }}
+        with:
+          client-id: \${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: \${{ vars.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
+
       - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2, registryKind), nugetPublishEnvFragment(nugetFeedUrl2))}
         name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python + C# + VS Code)
         if: \${{ ${onMain} }}
         env:
           ${npmAuthName}: ${npmAuthValue}${pypiTokenEnvLine(registryKind, (name) => `\${{ secrets.${name} }}`, " ".repeat(10))}
           RELEASE_SPECIFIER: \${{ vars.RELEASE_SPECIFIER }}
-          # A VS Code extension publishes with it; tools/vscode-extension.cjs
-          # skips the Marketplace when it is unset.
+          # A VS Code extension publishes with Entra ID when the sign-in step
+          # above ran (VSCE_AUTH=entra), else with the VSCE_PAT token;
+          # tools/vscode-extension.cjs skips the Marketplace with neither.
+          VSCE_AUTH: \${{ vars.AZURE_CLIENT_ID != '' && 'entra' || '' }}
           VSCE_PAT: \${{ secrets.VSCE_PAT }}${githubReleases ? `
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}` : ""}
 ${githubReleases ? "" : `
@@ -3890,16 +3913,17 @@ function publishExtension (manifest, sidecar, dryRun) {
 
     return
   }
+  const entra = process.env.VSCE_AUTH === 'entra'
   const token = process.env.VSCE_PAT ?? ''
-  if (token === '' || /^\$\(.*\)$/.test(token)) {
-    console.log('VSCE_PAT is not set - skipping the Marketplace publish of ' + manifest.name + '. Add it as a CI secret to publish.')
+  if (!entra && (token === '' || /^\$\(.*\)$/.test(token))) {
+    console.log('No Marketplace credential - skipping the Marketplace publish of ' + manifest.name + '. Set the AZURE_CLIENT_ID and AZURE_TENANT_ID variables (Microsoft Entra ID) or the VSCE_PAT secret to publish.')
 
     return
   }
   const files = vsixFiles(project, sidecar)
   const missing = files.filter(file => !existsSync(file))
   if (missing.length > 0) fail('Nothing to publish: ' + missing.join(', ') + ' not found - run the package target first.')
-  run('@vscode/vsce', 'vsce', ['publish', '--packagePath', ...files, '--skip-duplicate'])
+  run('@vscode/vsce', 'vsce', ['publish', ...(entra ? ['--azure-credential'] : []), '--packagePath', ...files, '--skip-duplicate'])
 }
 
 const [command, projectRoot, ...rest] = process.argv.slice(2)