From ff3d6b18f65a39e5b77ba6bc57f7e8d4d85af88f Mon Sep 17 00:00:00 2001
From: Savannah Ostrowski <savannah@python.org>
Date: Thu, 26 Feb 2026 14:50:23 -0800
Subject: [PATCH 1/3] Add metadata for OpenVSX publishing

---
 .github/workflows/publish.yml | 4 ++++
 package.json                  | 1 +
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 311ec56..12b1456 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -16,3 +16,7 @@ jobs:
         run: bun run publish:marketplace
         env:
           VSCE_PAT: ${{ secrets.VSCE_PAT }}
+      - name: Publish to Open VSX
+        run: bun run publish:openvsx
+        env:
+          OVSX_PAT: ${{ secrets.OVSX_PAT }}
diff --git a/package.json b/package.json
index 859373e..548f4f1 100644
--- a/package.json
+++ b/package.json
@@ -334,6 +334,7 @@
     "watch": "bun run esbuild.js --watch",
     "package": "vsce package",
     "publish:marketplace": "vsce publish",
+    "publish:openvsx": "ovsx publish",
     "lint": "biome check --write --unsafe --no-errors-on-unmatched --files-ignore-unknown=true src/",
     "test": "bun run compile && vscode-test",
     "test:coverage": "bash scripts/test-coverage.sh",

From f9369e54c570bfe63aed087b3f101617a1ea66dc Mon Sep 17 00:00:00 2001
From: Savannah Ostrowski <savannah@python.org>
Date: Thu, 26 Feb 2026 14:56:13 -0800
Subject: [PATCH 2/3] Use separate jobs

---
 .github/workflows/publish.yml | 33 ++++++++++++++++++++++++++-------
 package.json                  |  1 -
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 12b1456..fb311df 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,18 +5,37 @@ on:
     types: [published]
 
 jobs:
-  publish:
+  build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2.1.2
       - run: bun install
       - run: bun run package
+      - uses: actions/upload-artifact@v4
+        with:
+          name: vsix
+          path: ./*.vsix
+
+  publish-marketplace:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: vsix
+          path: dist
       - name: Publish to VS Code Marketplace
-        run: bun run publish:marketplace
-        env:
-          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+        run: npx vsce publish --pat ${{ secrets.VSCE_PAT }} --packagePath ./dist/*.vsix
+
+  publish-openvsx:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: vsix
+          path: dist
       - name: Publish to Open VSX
-        run: bun run publish:openvsx
-        env:
-          OVSX_PAT: ${{ secrets.OVSX_PAT }}
+        run: npx ovsx publish --pat ${{ secrets.OVSX_PAT }} --packagePath ./dist/*.vsix
+        timeout-minutes: 2
diff --git a/package.json b/package.json
index 548f4f1..859373e 100644
--- a/package.json
+++ b/package.json
@@ -334,7 +334,6 @@
     "watch": "bun run esbuild.js --watch",
     "package": "vsce package",
     "publish:marketplace": "vsce publish",
-    "publish:openvsx": "ovsx publish",
     "lint": "biome check --write --unsafe --no-errors-on-unmatched --files-ignore-unknown=true src/",
     "test": "bun run compile && vscode-test",
     "test:coverage": "bash scripts/test-coverage.sh",

From 58ed320bdadadef98a2d27b986093b57c5de32f4 Mon Sep 17 00:00:00 2001
From: Savannah Ostrowski <savannah@python.org>
Date: Thu, 26 Feb 2026 14:58:18 -0800
Subject: [PATCH 3/3] Pin shas

---
 .github/workflows/publish.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index fb311df..ca49bc1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -12,7 +12,7 @@ jobs:
       - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2.1.2
       - run: bun install
       - run: bun run package
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7.0.0
         with:
           name: vsix
           path: ./*.vsix
@@ -21,7 +21,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 #v8.0.0
         with:
           name: vsix
           path: dist
@@ -32,7 +32,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 #v8.0.0
         with:
           name: vsix
           path: dist