feat(cursor): publish releases to Open VSX with OIDC

[Abhijeet Prasad (AbhiPrasad)]

Cursor production releases currently update the generated distribution repository without publishing the extension to Open VSX. Add a separate job to Release Plugin that packages the exact approved merge commit, saves the VSIX as a workflow artifact, and publishes that same file using GitHub Actions OIDC.

The job runs only for production Cursor releases after distribution publication succeeds. Keeping it outside the reusable distribution workflow excludes sandbox releases and lets maintainers retry a failed Open VSX publish with Re-run failed jobs without repeating completed tag/deploy jobs.

Upgrade and lock ovsx to 1.2.0 for trusted publishing, validate the extension's registry identity, and package the Cursor extension in CI. Document setup and recovery in the generated contributor guide and monorepo release instructions.

Required configuration

• Create the monorepo GitHub environment openvsx-cursor, with deployment branches restricted to main.
• An Open VSX owner of braintrustdata with a signed Publisher Agreement must register a GitHub Actions trusted publisher for braintrustdata.braintrust:
  • Organization: braintrustdata
  • Repository: braintrust-coding-agent-plugins
  • Workflow filename: release.yml
  • Environment: openvsx-cursor
• No additional publishing secret is needed; do not supply OVSX_PAT to the job. Existing Braintrust Bot secrets continue handling distribution deployment.

Validation

• make validate-cursor
• Locked dependency installation and npm run package; inspected VSIX identity, version, compiled entrypoint, and package exclusions.
• Actionlint on the production, reusable, sandbox, and CI workflows; git diff --check.
• Exercised the actual pinned ovsx CLI against a local mock: GitHub OIDC request, extension-scoped token exchange, exact VSIX upload, registry refusal, and missing OIDC credentials.

Live Open VSX publication has not been run; the first production release after configuration will verify the real registry registration.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T20:23:12.644928Z	afcaa08	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.