From ade7716ac69e6a47e78b8a4a0af0d034de375ced Mon Sep 17 00:00:00 2001 From: kkdev92 Date: Thu, 13 Aug 2026 19:14:49 +0900 Subject: [PATCH] ci: put the Marketplace publish behind an approval gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The publish job ran with `VSCE_PAT` and no gate: a release published on GitHub went straight to the Marketplace. vscode-ext-kit and health-data-dotnet have both had a protected environment for this; these three never got one. The `marketplace-publish` environment requires a review before the job starts, and restricts deployments to `v*` tags. That pattern is not a guess — every release run in this repository's history is `event=release` on a `v` tag, and it mirrors the two environments that already exist. What this does not do yet: `VSCE_PAT` is still a repository secret, so this gates when the token is used rather than which job can name it. Moving it onto the environment needs the token value. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/publish.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 9ee6285..4958db9 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -38,6 +38,14 @@ jobs: publish: needs: test runs-on: ubuntu-latest + # Publishing to the Marketplace waits for an approval. The environment also + # restricts what may deploy to it to `v*` tags, which is the ref every + # release this workflow has ever run on. + # + # `VSCE_PAT` is still a repository secret, so this gates *when* it is used, + # not who can reference it. Moving the secret onto this environment is the + # step that would do that, and needs the token value. + environment: marketplace-publish steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1