ci(build): skip already-published registry versions on release re-runs

Author: burner1024

.github/workflows/build.yml

@@ -167,12 +167,17 @@ jobs:
 
       # Use pre-built VSIX for publishing: pnpm package (scripts/package.sh)
       # dereferences pnpm symlinks that vsce can't follow.
+      # skipDuplicate makes a release-tag re-run idempotent: a registry that
+      # already carries this version is skipped instead of failing the job, so
+      # a partial release (e.g. one registry's token expired) can be completed
+      # by re-running the tag without tripping over the registries that succeeded.
       - name: Publish to Open VSX Registry
         if: "startsWith(github.ref, 'refs/tags/')"
         uses: HaaLeo/publish-vscode-extension@ca5561daa085dee804bf9f37fe0165785a9b14db # v2
         with:
           pat: ${{ secrets.OPEN_VSX_TOKEN }}
           extensionFile: ${{ env.VSIX_PATH }}
+          skipDuplicate: true
 
       - name: Publish to Visual Studio Marketplace
         if: "startsWith(github.ref, 'refs/tags/')"
@@ -181,6 +186,7 @@ jobs:
           pat: ${{ secrets.VS_MARKETPLACE_TOKEN }}
           registryUrl: https://marketplace.visualstudio.com
           extensionFile: ${{ env.VSIX_PATH }}
+          skipDuplicate: true
 
       # @bgforge/mls-server declares a runtime dependency on @bgforge/format
       # (workspace:*, substituted with format's concrete version on publish). The

zizmor.yml

@@ -12,7 +12,7 @@ rules:
       # provenance attestation against the trusted builder's published tag, so a
       # SHA pin would make the resulting attestation unverifiable. Documented
       # in-line at the `uses:` line itself (build.yml, provenance job).
-      - build.yml:216
+      - build.yml:222
   cache-poisoning:
     ignore:
       # actions/setup-node's `cache: pnpm` restores the pnpm store from the