| [ecd-tools-wg] 🚀 Trusted publishing is live on Open VSX |
Dear community,
We're launching trusted publishing on Open VSX. You can now publish your VS Code extension from GitHub Actions without storing a token.
Why does it matter?
Until now, publishing from CI meant keeping an OVSX_PAT in your repo secrets: a long-lived token that can publish anything your account can, and that never expires unless you rotate it.
With trusted publishing, you tell Open VSX which workflow is allowed to publish your extension. At release time, the workflow exchanges a signed GitHub identity token for a publishing token that lasts about 5 minutes and works for that one extension only. There's nothing stored, so nothing to leak or rotate.
Getting started
Make sure you own the verified namespace, have signed the Publisher Agreement, and have at least one published version of your extension.
Register your workflow under Settings > Trusted Publishers.
Add id-token: write to your workflow and run npx ovsx publish --trusted-publishing.
Delete your OVSX_PAT secret. If it's still there, it takes priority.
Questions? Just hit reply. We read every message.