.vsix attached. Registry
publishing is layered on top and is opt-in — each registry is gated on its own
token, and the workflow skips one cleanly when its token is absent.
There are two registries, and they are independent:
Cutting a release
release bumps packages/glua-lsp/package.json, commits, and creates an
annotated v<version> tag. Pushing the tag runs the release workflow:
typecheck, test, build, package, GitHub release, then publish.
The workflow refuses to build when the tag and the manifest version disagree.
That mismatch produces a release whose filename and contents contradict each
other, and you only find out after the tag is public. The script exists so you
cannot hit it by hand.
v0.2.0-beta.1) is published as a GitHub prerelease
and is not pushed to either marketplace.
Open VSX
The registry Cursor, VSCodium, Gitpod and Theia install from. Free, and the only account involved is GitHub.1
Sign in and create a token
Sign in to open-vsx.org with GitHub, then
Settings → Access Tokens → Generate New Token. Copy it now; it is not
shown again.
2
Sign the publisher agreement
Open VSX requires the Eclipse Foundation Publisher Agreement before your
first publish. There is a prompt in the UI, it is free, and it is a one-off.
3
Claim the namespace
The namespace must match the
publisher field in the manifest.4
Add the token to GitHub
Repository Settings → Secrets and variables → Actions → New repository
secret, named
OVSX_PAT.Open VSX namespaces are unverified by default, which shows as a small warning
on the listing. You can request verification through the Eclipse Foundation
once the extension is up, but it is not required to publish or install.
VS Code Marketplace
1
Create an Azure DevOps organisation
Sign in at dev.azure.com with a Microsoft account.
The organisation itself is only a container for the token; its name does not
appear anywhere public.
2
Create a Personal Access Token
In Azure DevOps: User settings → Personal access tokens → New Token.
- Organization:
All accessible organizations— this matters, a single-org token will not work - Scopes:
Custom defined→ Marketplace → Manage - Expiration: as long as you are comfortable with; you will need to rotate it
3
Create the publisher
Go to the Marketplace publisher page
and create a publisher. The ID is what goes in Change it if you want a different ID, and make sure it matches the one you
registered.
package.json, and it is
public and permanent — renaming later means a new extension page and losing
your installs.The manifest currently says:packages/glua-lsp/package.json
4
Add the token to GitHub
In the repository: Settings → Secrets and variables → Actions → New
repository secret, named
VSCE_PAT.Before the first publish
A checklist:- Publisher ID matches what you registered
- Icon is present at
packages/glua-lsp/resources/icon.png. Regenerate withpnpm run generate-iconafter changing the palette - README in
packages/glua-lsp/is what the listing shows, not the one at the repository root - LICENSE is in the package, not just at the root
pnpm run packagereports no warnings
What gets shipped
.vscodeignore keeps source, tests and tooling out. The published package is
around 920 KB, most of which is the bundled Garry’s Mod API dataset. Check
before publishing: