ci: publish releases through trusted publishing

.github/workflows/release.yml

@@ -4,12 +4,19 @@ on:
   push:
     tags:
       - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to publish (for example v0.1.10)'
+        required: true
+        type: string
 
 permissions:
   contents: write
 
 jobs:
   github-release:
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     timeout-minutes: 20
 
@@ -47,3 +54,43 @@ jobs:
             --title "Codex CLI Launcher $GITHUB_REF_NAME"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Download the released VSIX
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          VSIX="vscode-codex-cli-launcher-${RELEASE_TAG#v}.vsix"
+          mkdir -p .release
+          gh release download "$RELEASE_TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --pattern "$VSIX" \
+            --pattern "$VSIX.sha256" \
+            --dir .release
+          (cd .release && sha256sum -c "$VSIX.sha256")
+
+      - name: Publish to Visual Studio Marketplace
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          npx --yes @vscode/vsce@4.1.0 publish \
+            --packagePath ".release/vscode-codex-cli-launcher-${RELEASE_TAG#v}.vsix" \
+            --oidc --skip-duplicate
+
+      - name: Publish to Open VSX
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          npx --yes ovsx@1.3.0 publish \
+            --packagePath ".release/vscode-codex-cli-launcher-${RELEASE_TAG#v}.vsix" \
+            --trusted-publishing --skip-duplicate

AGENTS.md

@@ -48,7 +48,7 @@ out/              generated compiler output (never edit, never commit)
 | Dependency audit | `npm run audit` |
 | Build the VSIX | `npm run package` |
 
-There is no dev server, no deploy step, and no publish script. Publishing is a manual maintainer action through `vsce` and `ovsx`; see `docs/releasing.md`.
+There is no dev server and no publish script. After the GitHub Release exists, the owner dispatches the Release workflow with the release tag; it publishes the released VSIX to the Marketplace and Open VSX through OIDC trusted publishing. See `docs/releasing.md`.
 
 ## Launch lifecycle
 
@@ -70,7 +70,7 @@ Every launch instead creates a disposal scope with `createLaunchSession`. Regist
 
 The extension reads no environment variables at runtime. `VSCODE_TEST_VERSION` only selects the VS Code build used by the integration test.
 
-Marketplace and Open VSX tokens (`VSCE_PAT`, `OVSX_PAT`) belong to the maintainer's local environment. Never commit them, never echo them, never add them to workflows, issue comments, or release notes. No repository secret is required by any workflow in this repository.
+No long-lived publishing token is required or stored in this repository, and no registry secret is configured in GitHub Actions: the Release workflow exchanges a short-lived OIDC token at publish time. Never commit or echo publishing tokens, and never add them to workflows, issue comments, or release notes.
 
 ## Generated and protected files