Publish Visual Studio Marketplace extensions securely with Trusted Publishing

Microsoft has introduced Trusted Publishing for Visual Studio Marketplace, a new method for publishing Visual Studio Code and Visual Studio extensions via GitHub Actions or Azure Pipelines without the need for a long-lived personal access token (PAT). This approach utilizes federated identity to authenticate the release workflow, eliminating the need to store or rotate publishing secrets.

Why Trusted Publishing?

Traditionally, automated publishing to the Marketplace required storing a PAT as a CI/CD secret. Trusted Publishing provides a more secure alternative:

• No long-lived secrets—there is no need to store or rotate publishing credentials.
• Short-lived access—for GitHub Actions, the Marketplace issues a temporary credential that expires after 15 minutes.
• Federated identity—the Marketplace trusts a configured GitHub workflow or Azure Pipelines workload identity.

Existing PAT-based publishing methods remain functional, allowing users to transition to Trusted Publishing at their convenience.

How It Works

1. The CI/CD system presents its federated identity to Visual Studio Marketplace.
2. The Marketplace verifies the GitHub Trusted Publishing policy or the Azure Pipelines workload identity.
3. The publishing tool uses the verified identity to publish the extension without a PAT.

This process is automated when publishing with OIDC, removing the need to manage a PAT.

Supported CI/CD Providers

Provider	Status	Authentication and Setup
GitHub Actions	Supported	Create a policy on the publisher’s Trusted Publishing page and publish with GitHub OIDC.
Azure Pipelines	Supported	Configure a Microsoft Entra-backed WIF service connection and add its identity as a publisher contributor. No Marketplace policy is required.

Getting Started with GitHub Actions

To begin, create a Marketplace policy that identifies the GitHub repository and workflow permitted to publish.

1. Create a Trusted Publishing Policy

1. Sign in to Visual Studio Marketplace.
2. Open the publisher that owns your extension.
3. Select Trusted Publishing.
4. Expand Create, then fill in the required fields.

Field	Value
Policy name	A descriptive name such as Release workflow.
Repository owner	The exact GitHub organization or user login, such as contoso.
Repository	The repository name, such as sample-extension.
Workflow	The workflow filename under .github/workflows, such as publish.yml.
Environment (optional)	If applicable, enter the exact name of the GitHub environment, such as production.

Select Create.

For private repositories, the configured workflow must run within 48 hours of creating the policy. The first successful token exchange activates the policy.

Publishing from Azure Pipelines

Azure Pipelines utilizes an Azure DevOps service connection with Workload Identity Federation (WIF) instead of a GitHub Trusted Publishing policy. Users should:

1. Configure an Azure Pipelines service connection that uses Workload Identity Federation.
2. Add that identity to your Visual Studio Marketplace publisher and grant it the Contributor role.
3. Configure the publishing step to use the WIF service connection.

This setup allows the pipeline to publish extensions without the need for a Marketplace PAT.

Migrating from a PAT

If a GitHub Actions workflow already publishes with vsce, migration is straightforward:

1. Create a Trusted Publishing policy for the repository and workflow.
2. Add id-token: write to the publishing job.
3. Update the publishing command to use OIDC.
4. Run the workflow and verify the OIDC publish succeeds.
5. After verification, remove the Marketplace PAT from the workflow and repository secrets.

For Azure Pipelines, configure the WIF service connection, update the publishing step, and remove the PAT only after the federated publish succeeds.

Try Trusted Publishing Today

Trusted Publishing simplifies automated extension releases, making them easier to maintain and inherently safer by eliminating the need for long-lived publishing secrets.

For complete setup instructions and troubleshooting guidance, users can visit the Trusted Publishing documentation.

Related link: learn.microsoft.com

 

Source: Microsoft Developer Blogs