From 93b9b7e5be2de1141ba630357b61834c599eecd0 Mon Sep 17 00:00:00 2001
From: Michael Gasperini <michael@mikesoft.it>
Date: Sun, 1 Nov 2026 00:36:54 +0100
Subject: [PATCH] ci: publish releases through trusted publishing

---
 .github/workflows/release.yml | 47 +++++++++++++++++++++++++++++++++++
 AGENTS.md                     |  4 +--
 2 files changed, 49 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 267305a..0cc7663 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,12 +4,19 @@ on:
   push:
     tags:
       - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to publish (for example v0.1.10)'
+        required: true
+        type: string
 
 permissions:
   contents: write
 
 jobs:
   github-release:
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     timeout-minutes: 20
 
@@ -47,3 +54,43 @@ jobs:
             --title "Codex CLI Launcher $GITHUB_REF_NAME"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Download the released VSIX
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          VSIX="vscode-codex-cli-launcher-${RELEASE_TAG#v}.vsix"
+          mkdir -p .release
+          gh release download "$RELEASE_TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --pattern "$VSIX" \
+            --pattern "$VSIX.sha256" \
+            --dir .release
+          (cd .release && sha256sum -c "$VSIX.sha256")
+
+      - name: Publish to Visual Studio Marketplace
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          npx --yes @vscode/vsce@4.1.0 publish \
+            --packagePath ".release/vscode-codex-cli-launcher-${RELEASE_TAG#v}.vsix" \
+            --oidc --skip-duplicate
+
+      - name: Publish to Open VSX
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          npx --yes ovsx@1.3.0 publish \
+            --packagePath ".release/vscode-codex-cli-launcher-${RELEASE_TAG#v}.vsix" \
+            --trusted-publishing --skip-duplicate
diff --git a/AGENTS.md b/AGENTS.md
index fa8396b..192a153 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -48,7 +48,7 @@ out/              generated compiler output (never edit, never commit)
 | Dependency audit | `npm run audit` |
 | Build the VSIX | `npm run package` |
 
-There is no dev server, no deploy step, and no publish script. Publishing is a manual maintainer action through `vsce` and `ovsx`; see `docs/releasing.md`.
+There is no dev server and no publish script. After the GitHub Release exists, the owner dispatches the Release workflow with the release tag; it publishes the released VSIX to the Marketplace and Open VSX through OIDC trusted publishing. See `docs/releasing.md`.
 
 ## Launch lifecycle
 
@@ -70,7 +70,7 @@ Every launch instead creates a disposal scope with `createLaunchSession`. Regist
 
 The extension reads no environment variables at runtime. `VSCODE_TEST_VERSION` only selects the VS Code build used by the integration test.
 
-Marketplace and Open VSX tokens (`VSCE_PAT`, `OVSX_PAT`) belong to the maintainer's local environment. Never commit them, never echo them, never add them to workflows, issue comments, or release notes. No repository secret is required by any workflow in this repository.
+No long-lived publishing token is required or stored in this repository, and no registry secret is configured in GitHub Actions: the Release workflow exchanges a short-lived OIDC token at publish time. Never commit or echo publishing tokens, and never add them to workflows, issue comments, or release notes.
 
 ## Generated and protected files