[openvsx-dev] Release automation

[Thomas Neidhart <thomas.neidhart@xxxxxxxxxxxxxxxxxxxxxx>]

Hi,

I would like to propose that we automate the releases for openvsx as much as possible by building and publishing the relevant artifacts (openvsx-server, openvsx-webui docker images, ovsx npm package, openvsx-webui npm package) by GitHub workflows and upload them to npm via trusted publishing.

For that purpose I have created an issue: https://github.com/eclipse/openvsx/issues/1494

and opened a HelpDesk ticket to create an npm account for the project:

https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/6965

Currently, the npm packages are uploaded manually afaict but we should be working on a release process that is more streamlined and does not require humans in the loop. As a side-effect it will also produce attestation from where the uploaded packages are coming from.

Could you please comment on the help desk ticket if you have any concerns about it or wether you would approve that action?

Also we need to add the newly created npm account as the owner / contributor of the 2 already published packages so that we can continue publishing.

Best,

Thomas