ovsx 1.1.0 → 1.2.0

package/src/oidc.ts

@@ -0,0 +1,107 @@
+/******************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation.
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License 2.0 which is available at
+ * https://www.eclipse.org/legal/epl-2.0.
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *****************************************************************************/
+
+import * as http from 'http';
+import * as followRedirects from 'follow-redirects';
+import { TrustedPublishingOptions } from './trusted-publishing-options';
+import { configuredTimeout, redactUrl, statusError } from './util';
+
+/**
+ * Whether an OIDC ID token can be obtained without user interaction.
+ */
+export function hasIdTokenSource(options: TrustedPublishingOptions): boolean {
+    return Boolean(options.idToken) || isGitHubActionsIdTokenAvailable();
+}
+
+/**
+ * Obtains an OIDC ID token for the given audience from the surrounding CI system.
+ */
+export async function getIdToken(audience: string, options: TrustedPublishingOptions): Promise<string> {
+    // CI systems such as GitLab CI provide the ID token directly as an environment variable
+    if (options.idToken) {
+        return options.idToken;
+    }
+    if (isGitHubActionsIdTokenAvailable()) {
+        return getGitHubActionsIdToken(audience);
+    }
+    throw new Error('No OIDC ID token available for trusted publishing.\n'
+        + "On GitHub Actions, grant the job the 'id-token: write' permission.\n"
+        + 'On other CI systems, pass the ID token via the --idToken argument '
+        + 'or the OVSX_ID_TOKEN environment variable.');
+}
+
+function isGitHubActionsIdTokenAvailable(): boolean {
+    return Boolean(process.env.ACTIONS_ID_TOKEN_REQUEST_URL && process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN);
+}
+
+async function getGitHubActionsIdToken(audience: string): Promise<string> {
+    // the request URL already carries an api-version query parameter, so keep its query intact
+    const url = new URL(process.env.ACTIONS_ID_TOKEN_REQUEST_URL!);
+    url.searchParams.set('audience', audience);
+    const response = await getJson<GitHubIdTokenResponse>(url, {
+        'Authorization': `Bearer ${process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN}`,
+        'Accept': 'application/json'
+    });
+    if (!response.value) {
+        throw new Error('GitHub Actions did not return an OIDC ID token.');
+    }
+    return response.value;
+}
+
+/**
+ * Minimal JSON GET that is not bound to the registry: the request must not carry any registry
+ * credentials, as it is sent to the CI system's token service.
+ */
+function getJson<T>(url: URL, headers: http.OutgoingHttpHeaders): Promise<T> {
+    return new Promise((resolve, reject) => {
+        const protocol = url.protocol === 'https:' ? followRedirects.https : followRedirects.http;
+        // OVSX_TIMEOUT covers this request too. Read here rather than taken from the registry's
+        // options, since this one carries none of the registry's configuration - only the clock is
+        // shared, and having two of those to explain would be worse.
+        const timeout = configuredTimeout();
+        const request = protocol.request(url, { method: 'GET', headers, timeout }, response => {
+            response.setEncoding('utf-8');
+            let json = '';
+            // See Registry.getJsonResponse: a connection lost mid-body never fires 'end', so the
+            // response's own error has to be what settles the promise.
+            response.on('error', reject);
+            response.on('data', chunk => json += chunk);
+            response.on('end', () => {
+                if (response.statusCode !== undefined && (response.statusCode < 200 || response.statusCode > 299)) {
+                    reject(statusError(response));
+                } else {
+                    try {
+                        resolve(JSON.parse(json));
+                    } catch (err) {
+                        reject(err);
+                    }
+                }
+            });
+        });
+        request.on('error', reject);
+        // The timeout option only raises an event, so the request has to be destroyed for it to mean
+        // anything; the error then arrives at the handler above.
+        request.on('timeout', () => {
+            // Rejected before the teardown, so the timeout is what the caller sees rather than
+            // whichever error destroying the request happens to raise first.
+            reject(new Error(`No response from ${redactUrl(url)} for ${timeout} ms.`));
+            request.destroy();
+        });
+        request.end();
+    });
+}
+
+interface GitHubIdTokenResponse {
+    count?: number;
+    value?: string;
+}

package/src/publish-options.ts

@@ -8,8 +8,9 @@
  * SPDX-License-Identifier: EPL-2.0
  ********************************************************************************/
 import { RegistryOptions } from './registry-options';
+import { TrustedPublishingOptions } from './trusted-publishing-options';
 
-export interface PublishCommonOptions extends RegistryOptions {
+export interface PublishCommonOptions extends RegistryOptions, TrustedPublishingOptions {
     /**
      * Path to the vsix file to be published. Cannot be used together with `packagePath`.
      */
@@ -26,6 +27,12 @@ export interface PublishCommonOptions extends RegistryOptions {
      * Should use `yarn` instead of `npm`. Only valid with `packagePath`.
      */
     yarn?: boolean;
+    /**
+     * Recurse into symlinked directories when collecting the files to pack, instead of packing each
+     * symlink as a file. Needed for a `node_modules` built out of symlinks, as pnpm's is. Only valid
+     * with `packagePath`.
+     */
+    followSymlinks?: boolean;
     /**
      * Mark this package as a pre-release. Only valid with `packagePath`.
      */

package/src/publish.ts

@@ -7,31 +7,53 @@
  *
  * SPDX-License-Identifier: EPL-2.0
  ********************************************************************************/
+import * as fs from 'fs';
 import { createVSIX, IPackageOptions } from '@vscode/vsce';
 import { getPAT } from './pat';
-import { createTempFile, addEnvOptions } from './util';
+import { createTempFile, addEnvOptions, addTrustedPublishingEnvOptions, formatBytes, StatusError } from './util';
 import { Extension, Registry } from './registry';
 import { checkLicense } from './check-license';
 import { readVSIXPackage } from './zip';
 import { PublishOptions, PublishCommonOptions } from './publish-options';
+import { getTrustedPublishingToken, refreshTrustedPublishingToken, useTrustedPublishing } from './trusted-publishing';
 
 /**
  * Publishes an extension.
  */
 export async function publish(options: PublishOptions = {}): Promise<PromiseSettledResult<void>[]> {
     addEnvOptions(options);
+    addTrustedPublishingEnvOptions(options);
+
+    // Looked up once and shared by every target/package below, rather than once per artifact.
+    const maxExtensionSize = await getMaxExtensionSize(new Registry(options));
+
     const internalPublishOptions: InternalPublishOptions[] = [];
     const packagePaths = options.packagePath || [undefined];
     const targets = options.targets || [undefined];
     for (const packagePath of packagePaths) {
         for (const target of targets) {
-            internalPublishOptions.push({ ...options, packagePath: packagePath, target: target });
+            internalPublishOptions.push({ ...options, packagePath: packagePath, target: target, maxExtensionSize });
         }
     }
 
     return Promise.allSettled(internalPublishOptions.map(publishOptions => doPublish(publishOptions)));
 }
 
+/**
+ * Looks up the registry's configured extension size limit, so an oversized package can be rejected
+ * locally before the upload instead of after transferring the whole payload.
+ *
+ * Best-effort: registries that don't expose `/api/version`, or don't report a limit, return
+ * `undefined` here, and the upload proceeds to let the server enforce its own limit as before.
+ */
+async function getMaxExtensionSize(registry: Registry): Promise<number | undefined> {
+    try {
+        return (await registry.getRegistryVersion()).maxExtensionSize || undefined;
+    } catch {
+        return undefined;
+    }
+}
+
 async function doPublish(options: InternalPublishOptions = {}): Promise<void> {
     // if the packagePath is a link to a vsix, don't need to package it
     if (options.packagePath?.endsWith('.vsix')) {
@@ -47,14 +69,24 @@ async function doPublish(options: InternalPublishOptions = {}): Promise<void> {
         console.warn("Ignoring option '--pre-release' for prepackaged extension.");
     }
 
+    await ensureWithinSizeLimit(options.extensionFile!, options.maxExtensionSize, registry.url);
+
+    // Set only when this publish obtained the token itself through trusted publishing, which is the one
+    // case where a refusal can be answered by asking for a new token.
+    let exchanged: { namespace: string; extension: string } | undefined;
     if (!options.pat) {
-        const namespace = (await readVSIXPackage(options.extensionFile!)).publisher;
-        options.pat = await getPAT(namespace, options);
+        const manifest = await readVSIXPackage(options.extensionFile!);
+        if (useTrustedPublishing(options)) {
+            exchanged = { namespace: manifest.publisher, extension: manifest.name };
+            options.pat = await getTrustedPublishingToken(registry, manifest.publisher, manifest.name, options);
+        } else {
+            options.pat = await getPAT(manifest.publisher, options);
+        }
     }
 
     let extension: Extension | undefined;
     try {
-        extension = await registry.publish(options.extensionFile!, options.pat);
+        extension = await doRegistryPublish(registry, options, exchanged);
     } catch (err) {
         if (options.skipDuplicate && err.message.endsWith('is already published.')) {
             console.log(err.message + ' Skipping publish.');
@@ -79,6 +111,59 @@ async function doPublish(options: InternalPublishOptions = {}): Promise<void> {
     }
 }
 
+/**
+ * Publishes the package, exchanging the ID token again if the registry refuses the trusted publishing
+ * token this was using. The issued token is short-lived and shared by every target platform of a
+ * release, so publishing a wide fan-out of large packages can outlive it and be refused partway
+ * through - having authorised the release and then failing it over an expiry would be the wrong call.
+ *
+ * Only ever retried once, and only for a token obtained here: nothing this can do makes a token the
+ * user supplied valid, and a second refusal means the token is not the problem.
+ */
+async function doRegistryPublish(
+    registry: Registry,
+    options: InternalPublishOptions,
+    exchanged: { namespace: string; extension: string } | undefined
+): Promise<Extension> {
+    try {
+        return await registry.publish(options.extensionFile!, options.pat!);
+    } catch (err) {
+        if (!exchanged || (err as StatusError)?.status !== 401) {
+            throw err;
+        }
+
+        console.log('The registry refused the publishing token, requesting a new one');
+        options.pat = await refreshTrustedPublishingToken(
+            registry,
+            exchanged.namespace,
+            exchanged.extension,
+            options,
+            options.pat!
+        );
+        return registry.publish(options.extensionFile!, options.pat);
+    }
+}
+
+/**
+ * Fails fast with an actionable message when the packaged extension is already known to exceed the
+ * registry's configured size limit, rather than uploading the whole file only to have the server
+ * reject it. `maxSize` is `undefined` when the limit couldn't be determined, in which case the check
+ * is skipped and the upload is left to the server to accept or reject.
+ */
+async function ensureWithinSizeLimit(extensionFile: string, maxSize: number | undefined, registryUrl: string): Promise<void> {
+    if (!maxSize) {
+        return;
+    }
+
+    const { size } = await fs.promises.stat(extensionFile);
+    if (size > maxSize) {
+        throw new Error(
+            `The extension package (${formatBytes(size)}) exceeds the size limit of ${formatBytes(maxSize)} `
+            + `accepted by the registry at ${registryUrl}.`
+        );
+    }
+}
+
 async function packageExtension(options: InternalPublishOptions, registry: Registry): Promise<void> {
     if (registry.requiresLicense) {
         await checkLicense(options.packagePath!);
@@ -92,6 +177,7 @@ async function packageExtension(options: InternalPublishOptions, registry: Regis
         baseContentUrl: options.baseContentUrl,
         baseImagesUrl: options.baseImagesUrl,
         useYarn: options.yarn,
+        followSymlinks: options.followSymlinks,
         dependencies: options.dependencies,
         preRelease: options.preRelease,
         allowMissingRepository: options.allowMissingRepository,
@@ -120,4 +206,10 @@ interface InternalPublishOptions extends PublishCommonOptions {
      * Whether to do dependency detection via npm or yarn
      */
     dependencies?: boolean;
+
+    /**
+     * The registry's configured extension size limit in bytes, looked up once via `/api/version` and
+     * shared across every target/package being published. `undefined` when it couldn't be determined.
+     */
+    maxExtensionSize?: number;
 }

package/src/registry-options.ts

@@ -33,4 +33,12 @@ export interface RegistryOptions {
      * Maximal request body size for publishing.
      */
     maxPublishSize?: number;
+    /**
+     * How long to wait, in milliseconds, for a request to make progress before giving up.
+     *
+     * This is an inactivity timeout rather than a deadline: any byte sent or received resets it, so
+     * a large package downloading slowly is not cut off, while a connection that has gone quiet does
+     * not hold the command open indefinitely. Zero disables it.
+     */
+    timeout?: number;
 }