From 8f200f9cd866d1b4c3934f2957be9c8653ebfa82 Mon Sep 17 00:00:00 2001
From: Deepak Sharma <chaiwithcode@gmail.com>
Date: Tue, 29 Sep 2026 22:48:14 +0100
Subject: [PATCH] ci: prepare Open VSX submission

---
 .github/workflows/open-vsx.yml | 72 ++++++++++++++++++++++++++++++++++
 .github/workflows/release.yml  |  2 +-
 CONTRIBUTING.md                |  2 +
 docs/open-vsx.md               | 24 ++++++++++++
 4 files changed, 99 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/open-vsx.yml
 create mode 100644 docs/open-vsx.md

diff --git a/.github/workflows/open-vsx.yml b/.github/workflows/open-vsx.yml
new file mode 100644
index 0000000..18c3994
--- /dev/null
+++ b/.github/workflows/open-vsx.yml
@@ -0,0 +1,72 @@
+name: Publish Open VSX
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing XBridge GitHub release tag (for example, v1.4.2)
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Publish release VSIX to Open VSX
+    runs-on: ubuntu-latest
+    env:
+      RELEASE_TAG: ${{ inputs.tag }}
+
+    steps:
+      - name: Set up Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22
+
+      - name: Check configuration and release tag
+        env:
+          OVSX_PAT: ${{ secrets.OVSX_PAT }}
+        run: |
+          if [ -z "$OVSX_PAT" ]; then
+            echo "::error::Add an Open VSX access token as the OVSX_PAT repository secret."
+            exit 1
+          fi
+          if [[ ! "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Use an existing XBridge release tag such as v1.4.2."
+            exit 1
+          fi
+
+      - name: Download and verify the GitHub release VSIX
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION="${RELEASE_TAG#v}"
+          PACKAGE="builds/xbridge-${VERSION}.vsix"
+          mkdir -p builds
+          gh release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --pattern "xbridge-${VERSION}.vsix" --dir builds
+          test -s "$PACKAGE"
+          IDENTITY=$(unzip -p "$PACKAGE" extension/package.json | node -e 'let data = ""; process.stdin.on("data", chunk => data += chunk).on("end", () => { const manifest = JSON.parse(data); console.log(`${manifest.publisher}.${manifest.name}@${manifest.version}`); })')
+          if [ "$IDENTITY" != "chaiwithcode.xbridge@$VERSION" ]; then
+            echo "::error::The release VSIX identity does not match chaiwithcode.xbridge@$VERSION."
+            exit 1
+          fi
+
+      - name: Create the namespace if needed
+        env:
+          OVSX_PAT: ${{ secrets.OVSX_PAT }}
+        run: |
+          HTTP_STATUS=$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' https://open-vsx.org/api/chaiwithcode)
+          case "$HTTP_STATUS" in
+            200) echo "The chaiwithcode namespace already exists." ;;
+            404) npx --yes ovsx@1.1.1 create-namespace chaiwithcode ;;
+            *) echo "::error::Open VSX namespace lookup returned HTTP $HTTP_STATUS."; exit 1 ;;
+          esac
+
+      - name: Publish to Open VSX
+        env:
+          OVSX_PAT: ${{ secrets.OVSX_PAT }}
+        run: |
+          VERSION="${RELEASE_TAG#v}"
+          npx --yes ovsx@1.1.1 publish "builds/xbridge-${VERSION}.vsix" --skip-duplicate
+          echo "[Check the Open VSX listing](https://open-vsx.org/extension/chaiwithcode/xbridge)" >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a5d4069..320d6a2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,6 +54,6 @@ jobs:
 
       - name: Publish to Open VSX
         if: env.OVSX_PAT != ''
-        run: npx ovsx publish builds/*.vsix --skip-duplicate
+        run: npx --yes ovsx@1.1.1 publish builds/*.vsix --skip-duplicate
         env:
           OVSX_PAT: ${{ secrets.OVSX_PAT }}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6c0f69f..d2bbb7d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -99,6 +99,8 @@ git switch -c feature/my-feature
 
 Open the pull request against `develop`. When preparing a release, create `release/<version>` from `develop`, complete final verification, and open a pull request into `main`. After release, merge `main` back into `develop` so both branches contain the release commit and tag.
 
+Maintainers preparing the second registry listing can follow the [Open VSX publishing guide](docs/open-vsx.md).
+
 ---
 
 ## Submitting Pull Requests
diff --git a/docs/open-vsx.md b/docs/open-vsx.md
new file mode 100644
index 0000000..541f96c
--- /dev/null
+++ b/docs/open-vsx.md
@@ -0,0 +1,24 @@
+# Publishing XBridge to Open VSX
+
+Open VSX is a separate registry from the Visual Studio Marketplace. XBridge's extension ID is `chaiwithcode.xbridge` in both registries, but the Marketplace publisher account and token do not authorize Open VSX publishing.
+
+## One-time publisher setup
+
+1. Follow the [Open VSX publisher guide](https://github.com/eclipse-openvsx/openvsx/wiki/Publishing-Extensions): sign in to [open-vsx.org](https://open-vsx.org/) with the GitHub account that owns XBridge, connect the matching Eclipse account, and accept the Open VSX Publisher Agreement.
+2. Generate an Open VSX access token in your Open VSX account settings. Add it to this repository's GitHub Actions secrets as `OVSX_PAT`. Do not put the token in the repository, a command argument, or an issue.
+3. Merge the `Publish Open VSX` workflow into the repository's default branch. In GitHub Actions, run **Publish Open VSX** with an existing GitHub release tag such as `v1.4.2`. The workflow downloads that release's VSIX, verifies its publisher, name, and version, creates the `chaiwithcode` namespace if necessary, and uploads the exact release artifact. Re-running it skips a duplicate version.
+4. Inspect the [XBridge Open VSX listing](https://open-vsx.org/extension/chaiwithcode/xbridge), including the icon, description, README, license, and version. If you want the verified-publisher shield, [claim ownership of the namespace](https://github.com/eclipse-openvsx/openvsx/wiki/Namespace-Access); creating the namespace alone does not grant that status.
+
+The existing `v1.4.2` GitHub release contains `xbridge-1.4.2.vsix`. Its SHA-256 is `aa68331c49396d0014bae908e4348b0995f995b1d9c67e159d5a5f03add700cc`. Use that release artifact for a first `v1.4.2` submission. A new package built from `develop` includes README screenshots that are not yet on the default branch, so those links would remain unavailable until a later release merges the assets into `main`.
+
+## Future releases
+
+The tag-triggered [release workflow](../.github/workflows/release.yml) builds one VSIX for the GitHub release, the Visual Studio Marketplace, and Open VSX. When `OVSX_PAT` is configured, its Open VSX step publishes the same VSIX after a `v*` tag is pushed. Each registry accepts a given extension version only once; use a new version for updated contents.
+
+The [Open VSX CLI](https://github.com/eclipse-openvsx/openvsx/blob/main/cli/README.md) also supports publishing an already packaged VSIX locally with `OVSX_PAT` set in the environment:
+
+```sh
+npx --yes ovsx@1.1.1 publish path/to/xbridge-version.vsix --skip-duplicate
+```
+
+The manual GitHub workflow is preferred for a release because it uses the exact VSIX already attached to that release. After publication, verify the version through the listing or the [registry API](https://open-vsx.org/api/chaiwithcode/xbridge).