ci: publish releases through trusted publishing

.github/workflows/release.yml

@@ -4,12 +4,19 @@ on:
   push:
     tags:
       - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to publish (for example v1.11.1)'
+        required: true
+        type: string
 
 permissions:
   contents: write
 
 jobs:
   github-release:
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     timeout-minutes: 20
 
@@ -47,3 +54,43 @@ jobs:
             --title "Super CLI $GITHUB_REF_NAME"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Download the released VSIX
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          VSIX="vscode-super-cli-${RELEASE_TAG#v}.vsix"
+          mkdir -p .release
+          gh release download "$RELEASE_TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --pattern "$VSIX" \
+            --pattern "$VSIX.sha256" \
+            --dir .release
+          (cd .release && sha256sum -c "$VSIX.sha256")
+
+      - name: Publish to Visual Studio Marketplace
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          npx --yes @vscode/vsce@4.1.0 publish \
+            --packagePath ".release/vscode-super-cli-${RELEASE_TAG#v}.vsix" \
+            --oidc --skip-duplicate
+
+      - name: Publish to Open VSX
+        env:
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          npx --yes ovsx@1.3.0 publish \
+            --packagePath ".release/vscode-super-cli-${RELEASE_TAG#v}.vsix" \
+            --trusted-publishing --skip-duplicate

AGENTS.md

@@ -263,7 +263,9 @@ both embedded manifests use the source `publisher`, `name`, and `version`; this
 named extension artifact from being sent to Super CLI's publication path. After the reviewed commit is
 pushed, pushing its matching `v<version>` tag triggers `.github/workflows/release.yml`, which repeats
 the audit and identity-verified package build and publishes the GitHub VSIX together with its SHA-256
-file. Marketplace and Open VSX remain separate, owner-controlled publications of the reviewed version.
+file. Marketplace and Open VSX are published from that released VSIX by manually dispatching the same
+workflow with the release tag; it authenticates through OIDC trusted publishing, so no long-lived
+registry token is stored in the repository.
 On Windows use the CLI wrapper under VS Code's `bin` directory (`code.cmd`) for isolated install
 checks, and first verify that `--version` prints the editor version: the desktop `Code.exe` is not a
 substitute for the CLI wrapper even when PowerShell resolves it first.

CONTRIBUTING.md

@@ -95,5 +95,6 @@ Thanks for your interest in improving Super CLI.
    the desktop `Code.exe` binary.
 5. Commit and push the reviewed files, then push the matching `v<version>` tag. The release workflow
    rebuilds and verifies the package, creates its SHA-256 file, and publishes both to GitHub Releases.
-6. Publish the same reviewed version to the intended extension registries using owner-controlled
-   credentials, then verify the public version and artifact identity on each registry.
+6. After the release exists, dispatch the Release workflow with that release tag. It publishes the
+   released VSIX to the Visual Studio Marketplace and Open VSX through OIDC trusted publishing, then
+   verify the public version and artifact identity on each registry.