Publish to marketplace before creating GitHub release

- Marketplace publish is the fragile step (external service, PAT expiry);
  running it first avoids orphaned GH releases when it fails
- Recovery via `npm run retag` is now sufficient -- no version bump needed
- Update docs to reflect new step order and simplified recovery

Author: j-256

.github/workflows/ci.yml

@@ -175,16 +175,16 @@ jobs:
           fi
           echo "All VSIX contents verified"
 
+      - name: Publish to marketplace
+        if: ${{ !inputs.dry_run && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main') }}
+        run: npm run publish -- --packagePath git-crypt-vscode-*.vsix
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+
       - name: Create or update GitHub release
         if: startsWith(github.ref, 'refs/tags/v') && !inputs.dry_run
         run: |
           gh release create "$GITHUB_REF_NAME" git-crypt-vscode-*.vsix --title "$GITHUB_REF_NAME" --generate-notes ||
           gh release upload "$GITHUB_REF_NAME" git-crypt-vscode-*.vsix --clobber
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Publish to marketplace
-        if: ${{ !inputs.dry_run && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main') }}
-        run: npm run publish -- --packagePath git-crypt-vscode-*.vsix
-        env:
-          VSCE_PAT: ${{ secrets.VSCE_PAT }}

CLAUDE.md

@@ -48,9 +48,9 @@ Tests create a temporary git-crypt repo via `test/fixture.ts` (requires `git-cry
 1. **preversion** -- branch guard (must be on `main`), build, test
 2. Version bump, commit, `v*` tag
 3. **postversion** -- pushes commit + tag to origin
-4. CI: tests -> build static binaries -> package platform-specific + universal VSIX -> GitHub release -> marketplace publish
+4. CI: tests -> build static binaries -> package platform-specific + universal VSIX -> marketplace publish -> GitHub release
 
-Recovery from CI failure: `npm run retag` (force-moves tag to HEAD, re-triggers CI). If marketplace publish fails after GH release succeeds, bump version and release again (marketplace rejects same-version re-publishes).
+Recovery from CI failure: `npm run retag` (force-moves tag to HEAD, re-triggers CI). Marketplace publish runs before GH release creation, so a publish failure leaves no orphaned release to clean up.
 
 Dry runs: `gh workflow run ci.yml --ref dev` runs the full build/package pipeline with `dry_run=true` (default). Marketplace publish is also guarded against non-main branches.
 

CONTRIBUTING.md

@@ -60,8 +60,8 @@ CI then takes over:
 6. Validates the tag is on `main` and matches package.json version
 7. Builds static git-crypt binaries for macOS (arm64) and Linux (x64, arm64)
 8. Packages platform-specific VSIX files (with bundled binary) and a universal VSIX (without)
-9. Creates a GitHub release with all VSIX files attached
-10. Publishes all VSIX files to the VS Code Marketplace
+9. Publishes all VSIX files to the VS Code Marketplace
+10. Creates a GitHub release with all VSIX files attached
 
 ### Dry Runs
 
@@ -75,19 +75,13 @@ This runs with `dry_run=true` (the default), which builds binaries, packages VSI
 
 ### Recovery
 
-**CI fails before publish** (tests, build, packaging): fix the issue and retag:
+**CI fails before or during publish**: fix the issue and retag:
 
 ```bash
 npm run retag
 ```
 
-This force-moves the tag to the current commit and pushes it, re-triggering CI.
-
-**Marketplace publish fails after GitHub release succeeds**: the marketplace rejects same-version re-publishes, so `retag` alone won't work. Bump the version and release again:
-
-```bash
-npm version patch
-```
+This force-moves the tag to the current commit and pushes it, re-triggering CI. Marketplace publish runs before GitHub release creation, so a publish failure leaves no orphaned release to clean up.
 
 ### Branches