ci: publish to Marketplace with a PAT instead of Entra OIDC

The blinkk publisher is owned by a personal Microsoft account, so the
OIDC service principal cannot be added as a publisher member (TF14045 /
InvalidAccessException). Switch release-ci.mjs to vsce publish --pat
(VSCE_PAT, falling back to AZURE_PAT), drop the azure/login step and
id-token permission, exclude .env and dev files from the VSIX, and update
the publishing docs.

Author: jeremydw

.github/workflows/release.yml

@@ -16,9 +16,6 @@ permissions:
   # Required by changesets to push the version commit and open the release PR.
   contents: write
   pull-requests: write
-  # Required to mint a short-lived Microsoft Entra ID token via OIDC for
-  # azure/login (no stored Marketplace PAT).
-  id-token: write
 
 jobs:
   release:
@@ -59,23 +56,11 @@ jobs:
           pnpm test
           pnpm run build
 
-      # Sign in to Microsoft Entra ID via OIDC workload identity federation.
-      # This stores a short-lived credential that `vsce publish
-      # --azure-credential` (DefaultAzureCredential) uses to authenticate to the
-      # Marketplace. No long-lived PAT is stored. Skipped when these repo
-      # variables are unset (e.g. on the version-PR run, where nothing is
-      # published).
-      - name: Azure login (OIDC)
-        if: vars.AZURE_CLIENT_ID != ''
-        uses: azure/login@v2
-        with:
-          client-id: ${{ vars.AZURE_CLIENT_ID }}
-          tenant-id: ${{ vars.AZURE_TENANT_ID }}
-          allow-no-subscriptions: true
-
       # When there are pending changesets, this opens (or updates) a
       # "Version Packages" PR. When that PR is merged, this step instead runs
-      # the `publish` command to package and publish the extension.
+      # the `publish` command to package and publish the extension. Publishing
+      # authenticates to the Marketplace with the VSCE_PAT secret (a Marketplace
+      # PAT with the Marketplace > Manage scope).
       - name: Create Release Pull Request or Publish
         id: changesets
         uses: changesets/action@v1
@@ -86,5 +71,7 @@ jobs:
           title: 'ci: release'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Open VSX still uses a token (it is not part of Entra ID); optional.
+          # Marketplace PAT used by `vsce publish` (Marketplace > Manage scope).
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+          # Open VSX still uses its own token; optional.
           OVSX_PAT: ${{ secrets.OVSX_PAT }}

.vscodeignore

@@ -12,10 +12,18 @@ eslint.config.js
 .editorconfig
 .gitignore
 .github/**
+docs/**
+scripts/**
+.changeset/**
+CHANGELOG.md
+CONTRIBUTING.md
+SECURITY.md
 pnpm-lock.yaml
 pnpm-workspace.yaml
 package-lock.json
 .npmrc
+.env
+.env.*
 **/*.map
 **/*.ts
 **/.DS_Store

docs/PUBLISHING.md

@@ -1,138 +1,54 @@
-# Publishing setup (Microsoft Entra ID, no PAT)
+# Publishing setup (Marketplace PAT)
 
-This repo publishes to the VS Code Marketplace from GitHub Actions using
-**Microsoft Entra ID workload identity federation (OIDC)** — there is no
-long-lived Personal Access Token stored anywhere. (Global Azure DevOps PATs are
-retired on December 1, 2026.)
+This repo publishes to the VS Code Marketplace from GitHub Actions using a
+**Marketplace Personal Access Token (PAT)** stored as the `VSCE_PAT` repo
+secret. `vsce publish --pat` uses it to authenticate.
+
+> A previous iteration used Microsoft Entra ID / OIDC workload identity
+> federation. That path requires adding a service principal as a member of the
+> publisher, which is not supported when the publisher is owned by a personal
+> Microsoft account. The PAT flow below works regardless.
 
 How it works at release time:
 
 1. The version PR merges to `main`.
-2. `.github/workflows/release.yml` runs `azure/login@v2` with OIDC, which
-   exchanges a GitHub-issued token for a short-lived Microsoft Entra token.
-3. `vsce publish --azure-credential` uses that token to publish.
+2. `.github/workflows/release.yml` runs the changesets action, which calls
+   `pnpm run release:ci`.
+3. `release-ci.mjs` packages the extension and runs `vsce publish --pat`,
+   reading the token from `VSCE_PAT` (or `AZURE_PAT` as a fallback).
 
 You only do the setup below **once**.
 
 ---
 
-## Prerequisites
-
-- An Azure subscription + Entra (Azure AD) tenant (a free Azure account is
-  fine). Sign in: <https://portal.azure.com>.
-- The `blinkk` publisher created at
-  <https://marketplace.visualstudio.com/manage> (publisher ID must equal
-  `"publisher": "blinkk"` in `package.json`).
-- Azure CLI installed locally (`brew install azure-cli`) and `az login` done,
-  **or** use the Azure Portal equivalents.
-- `gh` authenticated for setting the repo variables.
-
----
-
-## 1. Create an Entra app registration
-
-```bash
-az ad app create --display-name "vscode-agent-platform-connector-publisher"
-```
-
-Note the `appId` (this is the **client ID**) from the output. Then create a
-service principal for it:
-
-```bash
-APP_ID="<appId from above>"
-az ad sp create --id "$APP_ID"
-```
-
-Get your tenant ID:
-
-```bash
-az account show --query tenantId -o tsv
-```
-
-## 2. Add a federated credential for this GitHub repo
-
-This is what lets GitHub Actions authenticate as the app without a secret.
-Create a file `federated.json`:
-
-```json
-{
-  "name": "github-release-main",
-  "issuer": "https://token.actions.githubusercontent.com",
-  "subject": "repo:blinkk/vscode-agent-platform-connector:ref:refs/heads/main",
-  "description": "GitHub Actions release workflow on main",
-  "audiences": ["api://AzureADTokenExchange"]
-}
-```
-
-```bash
-az ad app federated-credential create --id "$APP_ID" --parameters federated.json
-```
-
-> The `subject` must exactly match the workflow's trigger. `ref:refs/heads/main`
-> covers pushes to `main` (which is where the publish step runs). If you later
-> publish from tags or environments, add additional federated credentials with
-> the matching subject (e.g. `repo:OWNER/REPO:environment:production`).
-
-## 3. Authorize the identity in the Marketplace publisher
-
-The Entra identity must be a member of the `blinkk` publisher with
-**Contributor**.
-
-1. Go to <https://marketplace.visualstudio.com/manage/publishers/blinkk>.
-2. Open the **Members** (or **Security**) tab → **Add**.
-3. Add the app registration (search by its display name / client ID) and assign
-   the **Contributor** role.
-
-> If the Marketplace UI only lets you add users (not app registrations
-> directly), add the app's **service principal**; some tenants surface it by the
-> display name set in step 1.
-
-## 4. Set the GitHub repo variables
-
-These are **variables**, not secrets — they are identifiers, not credentials:
+## 1. Create a Marketplace PAT
 
-```bash
-gh variable set AZURE_CLIENT_ID --repo blinkk/vscode-agent-platform-connector --body "$APP_ID"
-gh variable set AZURE_TENANT_ID --repo blinkk/vscode-agent-platform-connector --body "$(az account show --query tenantId -o tsv)"
-```
-
-## 5. (Optional) Open VSX
-
-Open VSX is not part of Entra ID and still uses a token. Create one at
-<https://open-vsx.org> (Settings → Access Tokens) and add it as a secret:
+1. Sign in to 1. Sign in to 1. Sign in to 1. Sign in to 1. Sign in to 1. Sign in to 1. Sign in to 1. Sigin1. Sign in to 1. Sign in to 1-> **New 1. Sign in to 1. Sign in to 1. Sign in to 1. Sign in to 1. Sign in to 1. Se1. Sign in to 1. Sign in to 1. Sign in to 1. Sign in to 1. Sign in to 1.  1. Sign in to 1. Sign in to 1. Sign in to 1. Sign intore the PAT as a GitHub repo secret
 
 ```bash
-gh secret set OVSX_PAT --repo blinkk/vscode-agent-platform-connector
-```
-
-If `OVSX_PAT` is unset, CI simply skips the Open VSX publish.
-
----
-
-## Test the release flow
+gh secret set VSCE_PAT --repogh secret set VSCE_PAT --repogh secret set VSCE_PAT --repogh secret set VSC## 3gh secret set VSCE_PAT --repogh secret set VSCE_PAT --repogh secret set VSCEpegh secret set VSCE_PAT --repogh secret set VSCE_PAT --reecrgh secret set VSCE_PAT -et OVSXgh secret set VSCE_PAT --repogh-platgh secret set VSCE_PAT --repogh secret set VSCE_PAT --repogh secret set V.
+gh secret set VSCE_PAT -e flow
 
 1. Make a change + `pnpm changeset` + commit + push to `main`.
 2. CI opens a **"Version Packages"** PR.
-3. Merge it. CI bumps the version, then publishes to the Marketplace via OIDC.
+3. Merge it. CI bumps the version,3. Merge it. CI bumps the version,3.ia 3.e PAT.
 4. Confirm at
    <https://marketplace.visualstudio.com/items?itemName=blinkk.vscode-agent-platform-connector>.
 
 ## Manual publish (fallback)
 
+Export the PAT (or put it in a gitignored `.env` as `VSCE_PAT` / `AZURE_PAT`),
+then run the publish script:
+
 ```bash
-az login
-pnpm version        # if there are pending changesets
-pnpm release        # vsce publish --azure-credential
-pnpm release:ovsx   # optional, needs OVSX_PAT in env
+export VSCE_PAT=...        # or AZURE_PAT
+node ./scripts/release-ci.mjs
 ```
 
 ## Troubleshooting
 
-- **`AADSTS70021: No matching federated identity record found`** — the
-  `subject` in the federated credential doesn't match the workflow context.
-  Verify it is exactly `repo:blinkk/vscode-agent-platform-connector:ref:refs/heads/main`.
-- **403/401 from the Marketplace** — the app registration isn't a Contributor
-  member of the `blinkk` publisher, or the publisher ID doesn't match
-  `package.json`.
-- **`azure/login` skipped** — `AZURE_CLIENT_ID` repo variable is empty (the
-  `if: vars.AZURE_CLIENT_ID != ''` guard); set it per step 4.
+- **`InvalidAccessException: The requested operation is not allowed`** - the PAT
+  lacks the **Marketplace > Manage** scope, or the account is not a member of the
+  `blinkk` publisher.
+- **`.env files should not be packaged`** - ensure `.env` is listed in
+  `.vscodeignore` (it is). Never commit `.env`; it is gitignored.

scripts/release-ci.mjs

@@ -2,14 +2,15 @@
 /**
  * CI publish step invoked by changesets/action after a "Version Packages" PR
  * merges. Packages the extension once, then publishes the resulting .vsix to:
- *   - the VS Code Marketplace, via Microsoft Entra ID (the prior `azure/login`
- *     OIDC step in the workflow provides the credential; vsce uses
- *     DefaultAzureCredential with `--azure-credential`). No PAT required.
- *   - Open VSX (optional; only when OVSX_PAT is set, since Open VSX is not part
- *     of Entra ID).
+ *   - the VS Code Marketplace, via a Marketplace Personal Access Token in the
+ *     `VSCE_PAT` env var (or `AZURE_PAT` as a fallback). The PAT must belong to
+ *     an account that is a member of the target publisher with the
+ *     Marketplace > Manage scope.
+ *   - Open VSX (optional; only when OVSX_PAT is set, since Open VSX uses its own
+ *     token).
  *
- * For a manual publish from a workstation, run `az login` first (then this
- * script's vsce step authenticates the same way).
+ * For a manual publish from a workstation, export VSCE_PAT (or AZURE_PAT)
+ * first, then run this script.
  */
 import {execFileSync} from 'node:child_process';
 import {readFileSync} from 'node:fs';
@@ -25,12 +26,21 @@ function run(cmd, args) {
 // 1. Build the .vsix once.
 run('pnpm', ['exec', 'vsce', 'package', '--no-dependencies', '-o', vsix]);
 
-// 2. Publish to the VS Code Marketplace using Entra ID (no PAT).
+// 2. Publish to the VS Code Marketplace using a PAT.
+const pat = process.env.VSCE_PAT || process.env.AZURE_PAT;
+if (!pat) {
+  throw new Error(
+    'No Marketplace PAT found. Set VSCE_PAT (or AZURE_PAT) with a token that ' +
+      'has the Marketplace > Manage scope, as a repo secret in CI or in the ' +
+      'environment locally.'
+  );
+}
 run('pnpm', [
   'exec',
   'vsce',
   'publish',
-  '--azure-credential',
+  '--pat',
+  pat,
   '--no-dependencies',
   '--packagePath',
   vsix,