@vscode/vsce 3.9.3-2 → 3.9.3-3

package/README.md

@@ -58,6 +58,31 @@ Or you can also set them in the `package.json`, so that you avoid having to rety
 }
 ```
 
+### Trusted publishing
+
+`vsce publish --oidc` publishes from GitHub Actions without storing a Personal Access Token. Configure a trusted
+publishing policy for the repository and workflow on the Visual Studio Marketplace, then grant the workflow permission
+to request an OIDC token:
+
+```yaml
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - run: npm ci
+      - run: npx @vscode/vsce publish --oidc
+```
+
+OIDC publishing requests a GitHub Actions token for the `marketplace.visualstudio.com` audience and exchanges it for a
+short-lived Marketplace credential. It does not fall back to a PAT when token acquisition or exchange fails.
+
 ## Development
 
 First clone this repository, then:

package/dist/vsce.d.ts

@@ -174,6 +174,10 @@ export declare interface IPublishOptions {
      */
     readonly pat?: string;
     readonly azureCredential?: boolean;
+    /**
+     * Use OpenID Connect trusted publishing to acquire a short-lived Marketplace credential.
+     */
+    readonly oidc?: boolean;
     readonly allowProposedApi?: boolean;
     readonly noVerify?: boolean;
     readonly allowProposedApis?: string[];

package/out/main.js

@@ -173,6 +173,10 @@ module.exports = function (argv) {
         .description('Publishes an extension')
         .option('-p, --pat <token>', 'Personal Access Token (defaults to VSCE_PAT environment variable)', process.env['VSCE_PAT'])
         .option('--azure-credential', 'Use Microsoft Entra ID for authentication')
+        .addOption(new commander_1.Option('--oidc', 'Use OpenID Connect trusted publishing for authentication').conflicts([
+        'pat',
+        'azureCredential',
+    ]))
         .option('-t, --target <targets...>', `Target architectures. Valid targets: ${ValidTargets}`)
         .option('--ignore-other-target-folders', `Ignore other target folders. Valid only when --target <target> is provided.`)
         .option('--readme-path <path>', 'Path to README file (defaults to README.md)')
@@ -209,9 +213,10 @@ module.exports = function (argv) {
         .option('--skip-duplicate', 'Fail silently if version already exists on the marketplace')
         .option('--skip-license', 'Allow publishing without license file')
         .option('--follow-symlinks', 'Recurse into symlinked directories instead of treating them as files')
-        .action((version, { pat, azureCredential, target, ignoreOtherTargetFolders, readmePath, changelogPath, message, gitTagVersion, updatePackageJson, packagePath, manifestPath, signaturePath, sigzipPath, githubBranch, gitlabBranch, baseContentUrl, baseImagesUrl, yarn, verify, noVerify, allowProposedApis, allowAllProposedApis, allowPackageSecrets, allowPackageAllSecrets, allowPackageEnvFile, ignoreFile, dependencies, preRelease, allowStarActivation, allowMissingRepository, allowUnusedFilesPattern, skipDuplicate, skipLicense, signTool, followSymlinks, }) => main((0, publish_1.publish)({
-        pat,
+        .action((version, { pat, azureCredential, oidc, target, ignoreOtherTargetFolders, readmePath, changelogPath, message, gitTagVersion, updatePackageJson, packagePath, manifestPath, signaturePath, sigzipPath, githubBranch, gitlabBranch, baseContentUrl, baseImagesUrl, yarn, verify, noVerify, allowProposedApis, allowAllProposedApis, allowPackageSecrets, allowPackageAllSecrets, allowPackageEnvFile, ignoreFile, dependencies, preRelease, allowStarActivation, allowMissingRepository, allowUnusedFilesPattern, skipDuplicate, skipLicense, signTool, followSymlinks, }) => main((0, publish_1.publish)({
+        pat: oidc ? undefined : pat,
         azureCredential,
+        oidc,
         version,
         targets: target,
         ignoreOtherTargetFolders,

package/out/oidc.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OIDC_AUDIENCE = void 0;
+exports.getOIDCCredential = getOIDCCredential;
+const util_1 = require("./util");
+exports.OIDC_AUDIENCE = 'marketplace.visualstudio.com';
+class GitHubActionsOIDCTokenProvider {
+    constructor() {
+        this.name = 'GitHub Actions';
+    }
+    isAvailable(environment) {
+        return environment['GITHUB_ACTIONS']?.toLowerCase() === 'true';
+    }
+    async getToken(audience, { environment, request }) {
+        const requestUrl = environment['ACTIONS_ID_TOKEN_REQUEST_URL'];
+        const requestToken = environment['ACTIONS_ID_TOKEN_REQUEST_TOKEN'];
+        if (!requestUrl || !requestToken) {
+            throw new Error('GitHub Actions did not provide an OIDC token request URL and token. Add `permissions: id-token: write` to the workflow or job.');
+        }
+        let tokenUrl;
+        try {
+            tokenUrl = new URL(requestUrl);
+        }
+        catch {
+            throw new Error('GitHub Actions provided an invalid ACTIONS_ID_TOKEN_REQUEST_URL.');
+        }
+        tokenUrl.searchParams.set('audience', audience);
+        const result = await requestJSON('GitHub Actions OIDC token request', tokenUrl.toString(), request, {
+            method: 'GET',
+            headers: {
+                Accept: 'application/json',
+                Authorization: `Bearer ${requestToken}`,
+            },
+        });
+        if (!isRecord(result) || typeof result.value !== 'string' || !result.value) {
+            throw new Error('GitHub Actions OIDC token request returned an invalid response without a token.');
+        }
+        return result.value;
+    }
+}
+const oidcTokenProviders = [new GitHubActionsOIDCTokenProvider()];
+async function getOIDCCredential(publisherName, options = {}) {
+    const environment = options.environment ?? process.env;
+    const request = options.request ?? defaultRequest;
+    const provider = oidcTokenProviders.find(candidate => candidate.isAvailable(environment));
+    if (!provider) {
+        throw new Error('No supported OIDC provider was detected. OIDC publishing currently supports GitHub Actions only.');
+    }
+    const oidcToken = await provider.getToken(exports.OIDC_AUDIENCE, { environment, request });
+    return await exchangeOIDCToken(publisherName, oidcToken, options.marketplaceUrl ?? (0, util_1.getMarketplaceUrl)(), request);
+}
+async function exchangeOIDCToken(publisherName, oidcToken, marketplaceUrl, request) {
+    const result = await requestJSON('Marketplace OIDC token exchange', `${marketplaceUrl.replace(/\/$/, '')}/_apis/gallery/token`, request, {
+        method: 'POST',
+        headers: {
+            Accept: 'application/json',
+            Authorization: `Bearer ${oidcToken}`,
+            'Content-Type': 'application/json',
+            'User-Agent': 'vsce',
+        },
+        body: JSON.stringify({ publisherName }),
+    });
+    if (!isRecord(result) || typeof result.credential !== 'string' || !result.credential) {
+        throw new Error('Marketplace OIDC token exchange returned an invalid response without a credential.');
+    }
+    return result.credential;
+}
+async function defaultRequest(url, request) {
+    const response = await fetch(url, request);
+    return {
+        statusCode: response.status,
+        statusMessage: response.statusText,
+        readBody: () => response.text(),
+    };
+}
+async function requestJSON(operation, url, request, init) {
+    let response;
+    try {
+        response = await request(url, init);
+    }
+    catch (error) {
+        throw new Error(`${operation} failed: ${getErrorMessage(error)}`);
+    }
+    let body;
+    try {
+        body = await response.readBody();
+    }
+    catch (error) {
+        throw new Error(`${operation} failed while reading the response: ${getErrorMessage(error)}`);
+    }
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+        const status = `${response.statusCode}${response.statusMessage ? ` ${response.statusMessage}` : ''}`;
+        throw new Error(`${operation} failed with ${status}${getResponseDetails(body)}`);
+    }
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new Error(`${operation} returned an invalid JSON response.`);
+    }
+}
+function getResponseDetails(body) {
+    const trimmedBody = body.trim();
+    if (!trimmedBody) {
+        return '.';
+    }
+    try {
+        const parsed = JSON.parse(trimmedBody);
+        if (isRecord(parsed)) {
+            const message = parsed.message ?? parsed.error_description ?? parsed.error;
+            if (typeof message === 'string' && message) {
+                return `: ${message}`;
+            }
+        }
+    }
+    catch {
+        // Use the plain response body below.
+    }
+    return `: ${trimmedBody.slice(0, 500)}`;
+}
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+//# sourceMappingURL=oidc.js.map

package/out/publish.js

@@ -53,8 +53,10 @@ const form_data_1 = __importDefault(require("form-data"));
 const path_1 = require("path");
 const cockatiel_1 = require("cockatiel");
 const auth_1 = require("./auth");
+const oidc_1 = require("./oidc");
 const tmpName = (0, util_1.promisify)(tmp.tmpName);
 async function publish(options = {}) {
+    validateAuthenticationOptions(options);
     if (options.packagePath) {
         if (options.version) {
             throw new Error(`Both options not supported simultaneously: 'packagePath' and 'version'.`);
@@ -260,6 +262,10 @@ function validateManifestForPublishing(manifest, options) {
     return { ...manifest, publisher: (0, validation_1.validatePublisher)(manifest.publisher) };
 }
 async function getPAT(publisher, options) {
+    validateAuthenticationOptions(options);
+    if (options.oidc) {
+        return await (0, oidc_1.getOIDCCredential)(publisher);
+    }
     if (options.pat) {
         return options.pat;
     }
@@ -268,4 +274,15 @@ async function getPAT(publisher, options) {
     }
     return (await (0, store_1.getPublisher)(publisher)).pat;
 }
+function validateAuthenticationOptions(options) {
+    if (!options.oidc) {
+        return;
+    }
+    if (options.pat) {
+        throw new Error(`The '--oidc' and '--pat' options cannot be used together.`);
+    }
+    if (options.azureCredential) {
+        throw new Error(`The '--oidc' and '--azure-credential' options cannot be used together.`);
+    }
+}
 //# sourceMappingURL=publish.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vscode/vsce",
-	"version": "3.9.3-2",
+	"version": "3.9.3-3",
 	"description": "VS Code Extensions Manager",
 	"repository": {
 		"type": "git",