@vscode/vsce 3.9.3-1 → 3.9.3-11

package/README.md

@@ -15,14 +15,7 @@ Read the [**Documentation**](https://code.visualstudio.com/api/working-with-exte
 
 ### Linux
 
-In order to save credentials safely, this project uses [`keytar`](https://www.npmjs.com/package/keytar) which uses `libsecret`, which you may need to install before publishing extensions. Setting the `VSCE_STORE=file` environment variable will revert back to the file credential store. Using the `VSCE_PAT` environment variable will also avoid using `keytar`.
-
-Depending on your distribution, you will need to run the following command:
-
-- Debian/Ubuntu: `sudo apt-get install libsecret-1-dev`
-- Alpine: `apk add libsecret`
-- Red Hat-based: `sudo yum install libsecret-devel`
-- Arch Linux: `sudo pacman -S libsecret`
+In order to save credentials safely, this project uses [`@napi-rs/keyring`](https://www.npmjs.com/package/@napi-rs/keyring), which uses the system Secret Service and falls back to the Linux kernel keyring. Setting the `VSCE_STORE=file` environment variable will revert back to the file credential store. Using the `VSCE_PAT` environment variable will also avoid using the system credential store.
 
 ## Usage
 
@@ -58,6 +51,31 @@ Or you can also set them in the `package.json`, so that you avoid having to rety
 }
 ```
 
+### Trusted publishing
+
+`vsce publish --oidc` publishes from GitHub Actions without storing a Personal Access Token. Configure a trusted
+publishing policy for the repository and workflow on the Visual Studio Marketplace, then grant the workflow permission
+to request an OIDC token:
+
+```yaml
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npm ci
+      - run: npx @vscode/vsce publish --oidc
+```
+
+OIDC publishing requests a GitHub Actions token for the `marketplace.visualstudio.com` audience and exchanges it for a
+short-lived Marketplace credential. It does not fall back to a PAT when token acquisition or exchange fails.
+
 ## Development
 
 First clone this repository, then:

package/dist/vsce.d.ts

@@ -174,6 +174,10 @@ export declare interface IPublishOptions {
      */
     readonly pat?: string;
     readonly azureCredential?: boolean;
+    /**
+     * Use OpenID Connect trusted publishing to acquire a short-lived Marketplace credential.
+     */
+    readonly oidc?: boolean;
     readonly allowProposedApi?: boolean;
     readonly noVerify?: boolean;
     readonly allowProposedApis?: string[];

package/out/main.js

@@ -173,6 +173,9 @@ module.exports = function (argv) {
         .description('Publishes an extension')
         .option('-p, --pat <token>', 'Personal Access Token (defaults to VSCE_PAT environment variable)', process.env['VSCE_PAT'])
         .option('--azure-credential', 'Use Microsoft Entra ID for authentication')
+        .addOption(new commander_1.Option('--oidc', 'Use OpenID Connect trusted publishing for authentication')
+        .conflicts(['pat', 'azureCredential'])
+        .hideHelp(true))
         .option('-t, --target <targets...>', `Target architectures. Valid targets: ${ValidTargets}`)
         .option('--ignore-other-target-folders', `Ignore other target folders. Valid only when --target <target> is provided.`)
         .option('--readme-path <path>', 'Path to README file (defaults to README.md)')
@@ -209,9 +212,10 @@ module.exports = function (argv) {
         .option('--skip-duplicate', 'Fail silently if version already exists on the marketplace')
         .option('--skip-license', 'Allow publishing without license file')
         .option('--follow-symlinks', 'Recurse into symlinked directories instead of treating them as files')
-        .action((version, { pat, azureCredential, target, ignoreOtherTargetFolders, readmePath, changelogPath, message, gitTagVersion, updatePackageJson, packagePath, manifestPath, signaturePath, sigzipPath, githubBranch, gitlabBranch, baseContentUrl, baseImagesUrl, yarn, verify, noVerify, allowProposedApis, allowAllProposedApis, allowPackageSecrets, allowPackageAllSecrets, allowPackageEnvFile, ignoreFile, dependencies, preRelease, allowStarActivation, allowMissingRepository, allowUnusedFilesPattern, skipDuplicate, skipLicense, signTool, followSymlinks, }) => main((0, publish_1.publish)({
-        pat,
+        .action((version, { pat, azureCredential, oidc, target, ignoreOtherTargetFolders, readmePath, changelogPath, message, gitTagVersion, updatePackageJson, packagePath, manifestPath, signaturePath, sigzipPath, githubBranch, gitlabBranch, baseContentUrl, baseImagesUrl, yarn, verify, noVerify, allowProposedApis, allowAllProposedApis, allowPackageSecrets, allowPackageAllSecrets, allowPackageEnvFile, ignoreFile, dependencies, preRelease, allowStarActivation, allowMissingRepository, allowUnusedFilesPattern, skipDuplicate, skipLicense, signTool, followSymlinks, }) => main((0, publish_1.publish)({
+        pat: oidc ? undefined : pat,
         azureCredential,
+        oidc,
         version,
         targets: target,
         ignoreOtherTargetFolders,

package/out/npm.js

@@ -32,9 +32,6 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectYarn = detectYarn;
 exports.getDependencies = getDependencies;
@@ -42,8 +39,8 @@ exports.getLatestVersion = getLatestVersion;
 const path = __importStar(require("path"));
 const fs = __importStar(require("fs"));
 const cp = __importStar(require("child_process"));
-const parse_semver_1 = __importDefault(require("parse-semver"));
 const util_1 = require("./util");
+const packageSpec_1 = require("./packageSpec");
 const exists = (file) => fs.promises.stat(file).then(_ => true, _ => false);
 function parseStdout({ stdout }) {
     return stdout.split(/[\r\n]/).filter(line => !!line)[0];
@@ -87,7 +84,7 @@ function asYarnDependency(prefix, tree, prune) {
     }
     let name;
     try {
-        const parseResult = (0, parse_semver_1.default)(tree.name);
+        const parseResult = (0, packageSpec_1.parsePackageSpec)(tree.name);
         name = parseResult.name;
     }
     catch (err) {
@@ -105,8 +102,8 @@ function asYarnDependency(prefix, tree, prune) {
 }
 function selectYarnDependencies(deps, packagedDependencies) {
     const index = new (class {
+        data = Object.create(null);
         constructor() {
-            this.data = Object.create(null);
             for (const dep of deps) {
                 if (this.data[dep.name]) {
                     throw Error(`Dependency seen more than once: ${dep.name}`);
@@ -123,9 +120,7 @@ function selectYarnDependencies(deps, packagedDependencies) {
         }
     })();
     const reached = new (class {
-        constructor() {
-            this.values = [];
-        }
+        values = [];
         add(dep) {
             if (this.values.indexOf(dep) < 0) {
                 this.values.push(dep);

package/out/oidc.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OIDC_AUDIENCE = void 0;
+exports.getOIDCCredential = getOIDCCredential;
+const util_1 = require("./util");
+exports.OIDC_AUDIENCE = 'marketplace.visualstudio.com';
+class GitHubActionsOIDCTokenProvider {
+    name = 'GitHub Actions';
+    isAvailable(environment) {
+        return environment['GITHUB_ACTIONS']?.toLowerCase() === 'true';
+    }
+    async getToken(audience, { environment, request }) {
+        const requestUrl = environment['ACTIONS_ID_TOKEN_REQUEST_URL'];
+        const requestToken = environment['ACTIONS_ID_TOKEN_REQUEST_TOKEN'];
+        if (!requestUrl || !requestToken) {
+            throw new Error('GitHub Actions did not provide an OIDC token request URL and token. Add `permissions: id-token: write` to the workflow or job.');
+        }
+        let tokenUrl;
+        try {
+            tokenUrl = new URL(requestUrl);
+        }
+        catch {
+            throw new Error('GitHub Actions provided an invalid ACTIONS_ID_TOKEN_REQUEST_URL.');
+        }
+        tokenUrl.searchParams.set('audience', audience);
+        const result = await requestJSON('GitHub Actions OIDC token request', tokenUrl.toString(), request, {
+            method: 'GET',
+            headers: {
+                Accept: 'application/json',
+                Authorization: `Bearer ${requestToken}`,
+            },
+        });
+        if (!isRecord(result) || typeof result.value !== 'string' || !result.value) {
+            throw new Error('GitHub Actions OIDC token request returned an invalid response without a token.');
+        }
+        return result.value;
+    }
+}
+const oidcTokenProviders = [new GitHubActionsOIDCTokenProvider()];
+async function getOIDCCredential(publisherName, options = {}) {
+    const environment = options.environment ?? process.env;
+    const request = options.request ?? defaultRequest;
+    const provider = oidcTokenProviders.find(candidate => candidate.isAvailable(environment));
+    if (!provider) {
+        throw new Error('No supported OIDC provider was detected. OIDC publishing currently supports GitHub Actions only.');
+    }
+    const oidcToken = await provider.getToken(exports.OIDC_AUDIENCE, { environment, request });
+    return await exchangeOIDCToken(publisherName, oidcToken, options.marketplaceUrl ?? (0, util_1.getMarketplaceUrl)(), request);
+}
+async function exchangeOIDCToken(publisherName, oidcToken, marketplaceUrl, request) {
+    const result = await requestJSON('Marketplace OIDC token exchange', `${marketplaceUrl.replace(/\/$/, '')}/_apis/gallery/token`, request, {
+        method: 'POST',
+        headers: {
+            Accept: 'application/json',
+            Authorization: `Bearer ${oidcToken}`,
+            'Content-Type': 'application/json',
+            'User-Agent': 'vsce',
+        },
+        body: JSON.stringify({ publisherName }),
+    });
+    if (!isRecord(result) || typeof result.credential !== 'string' || !result.credential) {
+        throw new Error('Marketplace OIDC token exchange returned an invalid response without a credential.');
+    }
+    return result.credential;
+}
+async function defaultRequest(url, request) {
+    const response = await fetch(url, request);
+    return {
+        statusCode: response.status,
+        statusMessage: response.statusText,
+        readBody: () => response.text(),
+    };
+}
+async function requestJSON(operation, url, request, init) {
+    let response;
+    try {
+        response = await request(url, init);
+    }
+    catch (error) {
+        throw new Error(`${operation} failed: ${getErrorMessage(error)}`);
+    }
+    let body;
+    try {
+        body = await response.readBody();
+    }
+    catch (error) {
+        throw new Error(`${operation} failed while reading the response: ${getErrorMessage(error)}`);
+    }
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+        const status = `${response.statusCode}${response.statusMessage ? ` ${response.statusMessage}` : ''}`;
+        throw new Error(`${operation} failed with ${status}${getResponseDetails(body)}`);
+    }
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new Error(`${operation} returned an invalid JSON response.`);
+    }
+}
+function getResponseDetails(body) {
+    const trimmedBody = body.trim();
+    if (!trimmedBody) {
+        return '.';
+    }
+    try {
+        const parsed = JSON.parse(trimmedBody);
+        if (isRecord(parsed)) {
+            const message = parsed.message ?? parsed.error_description ?? parsed.error;
+            if (typeof message === 'string' && message) {
+                return `: ${message}`;
+            }
+        }
+    }
+    catch {
+        // Use the plain response body below.
+    }
+    return `: ${trimmedBody.slice(0, 500)}`;
+}
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+//# sourceMappingURL=oidc.js.map