Skip to content

Commit 0f4ee16

Browse files
author
CodeKing
committed
fix(ci): stop auto pre-release on main push and fail early on bad VSCE_PAT
1 parent 825404c commit 0f4ee16

4 files changed

Lines changed: 169 additions & 4 deletions

File tree

‎.github/workflows/marketplace-publish.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,29 @@ jobs:
7474
test "$package_name" = "zoo-code"
7575
test "$publisher" = "ZooCodeOrganization"
7676
77+
- name: Validate VSCE_PAT secret
78+
env:
79+
VSCE_PAT: ${{ secrets.VSCE_PAT }}
80+
run: |
81+
set -euo pipefail
82+
83+
if [ -z "${VSCE_PAT:-}" ]; then
84+
echo "::error::VSCE_PAT secret is missing."
85+
echo "Create an Azure DevOps Personal Access Token with Marketplace (Publish) scope"
86+
echo "for publisher ZooCodeOrganization, then add it as a marketplace-production"
87+
echo "environment secret named VSCE_PAT. Docs: docs/MARKETPLACE_PUBLISH.md"
88+
exit 1
89+
fi
90+
91+
if [ "${#VSCE_PAT}" -lt 20 ]; then
92+
echo "::error::VSCE_PAT secret is too short to be a valid Marketplace PAT."
93+
echo "Replace the secret with a real Azure DevOps PAT that can publish as ZooCodeOrganization."
94+
echo "Docs: docs/MARKETPLACE_PUBLISH.md"
95+
exit 1
96+
fi
97+
98+
echo "VSCE_PAT secret is present (value not logged)."
99+
77100
- name: Validate publish ref
78101
run: |
79102
if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ] && [ "$GITHUB_REF_NAME" != "main" ]; then

‎.github/workflows/nightly-publish.yml‎

Lines changed: 49 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
11
name: Publish Pre-release Extension
22

33
on:
4-
push:
5-
branches: [main]
6-
workflow_dispatch: # Allows manual triggering.
4+
# Intentional only: baseline syncs to main must not auto-deploy.
5+
# Run from Actions → "Publish Pre-release Extension" → Run workflow.
6+
workflow_dispatch:
7+
# Optional scheduled pre-release (UTC). Comment out if not desired.
8+
# schedule:
9+
# - cron: "0 6 * * *"
710

811
permissions:
912
contents: read
@@ -41,6 +44,31 @@ jobs:
4144
exit 1
4245
fi
4346
47+
- name: Validate VSCE_PAT secret
48+
env:
49+
VSCE_PAT: ${{ secrets.VSCE_PAT }}
50+
run: |
51+
set -euo pipefail
52+
53+
if [ -z "${VSCE_PAT:-}" ]; then
54+
echo "::error::VSCE_PAT secret is missing."
55+
echo "Create an Azure DevOps Personal Access Token with Marketplace (Publish) scope"
56+
echo "for publisher ZooCodeOrganization, then add it as a repository or"
57+
echo "marketplace-prerelease environment secret named VSCE_PAT."
58+
echo "Docs: docs/MARKETPLACE_PUBLISH.md"
59+
exit 1
60+
fi
61+
62+
# Empty/placeholder tokens often surface as unauthorized dummy GUIDs from Azure.
63+
if [ "${#VSCE_PAT}" -lt 20 ]; then
64+
echo "::error::VSCE_PAT secret is too short to be a valid Marketplace PAT."
65+
echo "Replace the secret with a real Azure DevOps PAT that can publish as ZooCodeOrganization."
66+
echo "Docs: docs/MARKETPLACE_PUBLISH.md"
67+
exit 1
68+
fi
69+
70+
echo "VSCE_PAT secret is present (value not logged)."
71+
4472
- name: Set pre-release version
4573
id: version
4674
env:
@@ -105,5 +133,22 @@ jobs:
105133
VSCE_PAT: ${{ secrets.VSCE_PAT }}
106134
VERSION_NUMBER: ${{ steps.version.outputs.number }}
107135
run: |
108-
npx @vscode/vsce publish --pre-release --packagePath "bin/zoo-code-${VERSION_NUMBER}.vsix"
136+
set -euo pipefail
137+
set +e
138+
output=$(npx @vscode/vsce publish --pre-release --packagePath "bin/zoo-code-${VERSION_NUMBER}.vsix" 2>&1)
139+
status=$?
140+
set -e
141+
echo "$output"
142+
143+
if [ $status -ne 0 ]; then
144+
if echo "$output" | grep -Eqi "Personal Access Token verification has failed|not authorized|Unauthorized|401|403"; then
145+
echo "::error::Marketplace rejected VSCE_PAT for publisher ZooCodeOrganization."
146+
echo "Create/replace a PAT with Marketplace Publish scope for that publisher,"
147+
echo "store it as secret VSCE_PAT on the marketplace-prerelease environment,"
148+
echo "then re-run this workflow from main."
149+
echo "Docs: docs/MARKETPLACE_PUBLISH.md"
150+
fi
151+
exit $status
152+
fi
153+
109154
echo "Published ZooCodeOrganization.zoo-code ${VERSION_NUMBER} as a VS Code Marketplace pre-release"

‎docs/MARKETPLACE_PUBLISH.md‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# Marketplace Publish Setup
2+
3+
This fork publishes the VS Code extension as:
4+
5+
- **Publisher:** `ZooCodeOrganization`
6+
- **Extension name:** `zoo-code`
7+
- **Item:** `ZooCodeOrganization.zoo-code`
8+
9+
## Why the pre-release deploy failed
10+
11+
Failed run (example): [Publish Pre-release Extension #1](https://github.com/hacker-b2k/Zoo-Code/actions/runs/29723609703)
12+
13+
Evidence from that run:
14+
15+
1. Checkout / install / build / package / VSIX validation: **success**
16+
2. Publish step: **failure**
17+
3. Exact Azure Marketplace error:
18+
19+
```text
20+
The Personal Access Token verification has failed.
21+
Additional information: TF400813: The user 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa'
22+
is not authorized to access this resource.
23+
```
24+
25+
That dummy GUID almost always means:
26+
27+
- `VSCE_PAT` secret is missing, empty, expired, or
28+
- the PAT is valid for a different publisher / Azure org and cannot publish as `ZooCodeOrganization`.
29+
30+
## Secrets required
31+
32+
### Environment: `marketplace-prerelease` (pre-release)
33+
34+
| Secret | Required | Purpose |
35+
| ----------------- | -------- | ----------------------------------------------- |
36+
| `VSCE_PAT` | **Yes** | Azure DevOps PAT with **Marketplace → Publish** |
37+
| `POSTHOG_API_KEY` | Optional | Telemetry key baked into package |
38+
39+
### Environment: `marketplace-production` (stable)
40+
41+
| Secret | Required | Purpose |
42+
| ----------------- | ---------------- | ---------------------- |
43+
| `VSCE_PAT` | **Yes** | Same as above |
44+
| `OVSX_PAT` | Yes for Open VSX | Open VSX publish token |
45+
| `POSTHOG_API_KEY` | Optional | Telemetry key |
46+
47+
## Create a correct VSCE_PAT
48+
49+
1. Sign in to Azure DevOps as the account that owns / can publish for **ZooCodeOrganization**.
50+
2. User settings → Personal access tokens → New token.
51+
3. Organization: the Azure org linked to the VS Marketplace publisher.
52+
4. Scopes: **Marketplace → Manage** (or at least **Publish**).
53+
5. Create token and copy it once.
54+
55+
## Install the secret on this GitHub repo
56+
57+
GitHub → `hacker-b2k/Zoo-Code` → **Settings** → **Environments** → **marketplace-prerelease**
58+
59+
Add secret:
60+
61+
```text
62+
Name: VSCE_PAT
63+
Value: <the Azure DevOps PAT>
64+
```
65+
66+
Also add the same secret under **marketplace-production** if you publish stable releases.
67+
68+
Repository-level secret with the same name also works if the environment is configured to inherit it, but environment secret is preferred.
69+
70+
## Publish pre-release (after secret is set)
71+
72+
Pre-release is **manual** so ordinary `main` baseline syncs do not create failed deployments.
73+
74+
1. Ensure `main` has the code you want to publish.
75+
2. GitHub → **Actions** → **Publish Pre-release Extension**
76+
3. **Run workflow** → branch **main**
77+
4. Confirm green deployment under **Deployments → marketplace-prerelease**
78+
79+
## Verify locally (optional)
80+
81+
```bash
82+
# package only (no publish)
83+
pnpm --filter @roo-code/build build
84+
pnpm --filter @roo-code/vscode-webview build
85+
pnpm --filter ./src exec vsce package --pre-release --no-dependencies --out ../bin
86+
87+
# publish only if you have a real PAT in your shell
88+
export VSCE_PAT=... # never commit this
89+
npx @vscode/vsce publish --pre-release --packagePath bin/zoo-code-<version>.vsix
90+
```
91+
92+
## Important
93+
94+
- A GitHub token is **not** a `VSCE_PAT`.
95+
- The PAT must be allowed to publish as **`ZooCodeOrganization`**.
96+
- If you do not control that publisher, either get access or change publisher identity via a deliberate product decision (not done by this fix).

‎docs/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
| [`ARCHITECTURE.md`](ARCHITECTURE.md) | Deep technical architecture of the extension. |
2222
| [`DEV_SETUP.md`](DEV_SETUP.md) | Zero-to-running dev environment guide. |
2323
| [`BRANCH_AND_UPSTREAM_POLICY.md`](BRANCH_AND_UPSTREAM_POLICY.md) | **Official branch model + forbidden systems + upstream rules** |
24+
| [`MARKETPLACE_PUBLISH.md`](MARKETPLACE_PUBLISH.md) | Fix/setup VSCE_PAT + pre-release/stable marketplace publish |
2425

2526
---
2627

0 commit comments

Comments
 (0)