Publish Visual Studio Marketplace extensions securely with Trusted Publishing
Visual Studio Marketplace now offers Trusted Publishing, which lets VS Code and Visual Studio extensions be published from GitHub Actions or Azure Pipelines without a long-lived personal access token. Publishing uses federated identity instead, so there is no secret to store or rotate. Extension authors who automate releases should review the setup and migration steps.
Key points
- For GitHub Actions, create a Trusted Publishing policy with the exact repository owner, repository name, workflow filename and optional environment.
- On private repositories, the policy must complete its first token exchange within 48 hours or it expires.
- Add id-token: write to the publishing job and switch the vsce publish command to OIDC.
- For Azure Pipelines, skip the Marketplace policy and use a Workload Identity Federation service connection with the Contributor role on the publisher.
- Keep the PAT until the first federated publish succeeds, then remove it from workflow and repository secrets.
Visual Studio Marketplace now offers Trusted Publishing, so VS Code and Visual Studio extensions can be released without a long-lived personal access token. The CI system presents its federated identity, and Marketplace verifies it before publishing. On GitHub Actions, a policy naming the repository, workflow file and optional environment is created first; the issued token lasts 15 minutes. Azure Pipelines instead uses a Workload Identity Federation service connection.
Existing PAT pipelines keep working, so migration can happen per repository. For GitHub, the publishing job gets id-token: write and vsce switches to OIDC. Private-repo policies must run within 48 hours of creation or they lapse. The author advises deleting the PAT only after the first federated publish succeeds.
Real-world use
- An open source team that publishes a VS Code extension on every release wants to remove the PAT from its GitHub Actions secrets.
- An enterprise team that publishes a Visual Studio extension from Azure Pipelines wants identity managed through a WIF service connection rather than a stored token.
Why it matters
Extension publishers can drop a long-lived secret that must be rotated and protected, reducing the damage if a CI workflow leaks. Existing PAT pipelines keep working, so migration can be done per repository.