ci: put the Marketplace publish behind an approval gate - #23
Merged
Conversation
The publish job ran with `VSCE_PAT` and no gate: a release published on GitHub went straight to the Marketplace. vscode-ext-kit and health-data-dotnet have both had a protected environment for this; these three never got one. The `marketplace-publish` environment requires a review before the job starts, and restricts deployments to `v*` tags. That pattern is not a guess — every release run in this repository's history is `event=release` on a `v<version>` tag, and it mirrors the two environments that already exist. What this does not do yet: `VSCE_PAT` is still a repository secret, so this gates when the token is used rather than which job can name it. Moving it onto the environment needs the token value. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The publish job ran with
VSCE_PATand no gate — a GitHub release went straight to the Marketplace with nothing in between.vscode-ext-kit(npm-publish) andhealth-data-dotnet(release) have both had a protected environment for this. These three never got one.What was created
A
marketplace-publishenvironment with:tag: v*Both mirror the two environments that already exist, which use exactly
required_reviewers+tag: v*. The tag pattern is not a guess: every publish run in this repository's history isevent=releaseon av<version>ref, checked across the full run list for all three repos before setting it. A pattern that did not match would silently block releases instead of gating them.The environment was created and then read back to confirm the protection rules actually applied, rather than trusting the create call.
What this does not do
VSCE_PATis still a repository secret, so this gates when the token is used, not which job can name it. Moving it onto the environment needs the token value, so it is left as a follow-up:marketplace-publish→ add secretVSCE_PATVSCE_PATWorth knowing: the exposure today is narrower than it looks. Secrets are only materialised into steps that reference them, and no other workflow here references
VSCE_PAT— so this is defence in depth against a future workflow, not an open hole.Cost
Every release now needs one approval click before it reaches the Marketplace.
🤖 Generated with Claude Code