ci(vscode): deliver verified VSIX artifacts

.github/workflows/publish-vscode-plugin.yml

@@ -0,0 +1,71 @@
+name: Publish Verified VSIX
+
+on:
+  workflow_dispatch:
+    inputs:
+      confirm_publish:
+        description: 'Publish the freshly verified VSIX to the configured Marketplace publisher'
+        required: true
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-vscode-plugin-marketplace
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    if: ${{ github.repository == 'desirecore/super-doc' && github.ref == 'refs/heads/main' && inputs.confirm_publish }}
+    environment: vscode-marketplace
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js 20.20.0
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.20.0'
+          cache: yarn
+
+      - name: Require the explicit Marketplace credential
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+        run: test -n "$VSCE_PAT"
+
+      - name: Install locked tooling only
+        run: yarn --frozen-lockfile --ignore-scripts
+
+      - name: Install locked VSIX tooling only
+        run: npm ci --prefix packages/vscodePlugin/tools --ignore-scripts
+
+      - name: Prepare published SuperDoc assets and compile the extension only
+        run: yarn build:vscodePlugin
+
+      - name: Stage and package a single VSIX
+        run: |
+          stage_dir="$RUNNER_TEMP/vscode-plugin-marketplace-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          archive="$RUNNER_TEMP/cherry-markdown-${GITHUB_SHA}.vsix"
+          node scripts/stage-vscode-plugin-marketplace.mjs --out "$stage_dir"
+          cd "$stage_dir"
+          "$GITHUB_WORKSPACE/packages/vscodePlugin/tools/node_modules/.bin/vsce" package --no-dependencies --no-yarn --out "$archive"
+          echo "VSIX_ARCHIVE=$archive" >> "$GITHUB_ENV"
+
+      - name: Verify the exact archive to be published
+        run: node scripts/verify-vscode-vsix.mjs --archive "$VSIX_ARCHIVE"
+
+      - name: Upload the verified release archive
+        uses: actions/upload-artifact@v4
+        with:
+          name: cherry-markdown-vsix-${{ github.sha }}
+          path: ${{ env.VSIX_ARCHIVE }}
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Publish the verified archive only
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+        run: ./packages/vscodePlugin/tools/node_modules/.bin/vsce publish --packagePath "$VSIX_ARCHIVE" --pat "$VSCE_PAT"

.github/workflows/release.yaml

@@ -54,12 +54,6 @@ jobs:
     with:
       client_version: ${{ needs.release.outputs.publishedClientVersion }}
 
-  build-vscodePlugin-release:
-    needs: release
-    if: ${{ contains(needs.release.outputs.publishedPackages, '"name":"cherry-markdown-vscode-plugin"') }}
-    uses: ./.github/workflows/release-vscode-plugin-build.yaml
-    secrets: inherit
-
   # 强制同步 main 到 dev,以 main 为准,覆盖 dev 的所有内容
   sync-main-to-dev:
     needs: release

.github/workflows/vscode-plugin-vsix.yml

@@ -0,0 +1,84 @@
+name: VSIX Delivery
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'packages/vscodePlugin/**'
+      - 'scripts/prepare-vscode-plugin-resources.mjs'
+      - 'scripts/stage-vscode-plugin-marketplace.mjs'
+      - 'scripts/verify-vscode-vsix.mjs'
+      - 'scripts/run-vscode-extension-host-smoke.mjs'
+      - '.github/workflows/vscode-plugin-vsix.yml'
+      - '.github/workflows/publish-vscode-plugin.yml'
+      - 'package.json'
+      - 'yarn.lock'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: vscode-plugin-vsix-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  package-vsix:
+    name: Package, verify, and smoke-test VSIX
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js 20.20.0
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.20.0'
+          cache: yarn
+
+      - name: Install locked tooling only
+        run: yarn --frozen-lockfile --ignore-scripts
+
+      - name: Install locked VSIX tooling only
+        run: npm ci --prefix packages/vscodePlugin/tools --ignore-scripts
+
+      - name: Prepare published SuperDoc assets and compile the extension only
+        run: yarn build:vscodePlugin
+
+      - name: Stage the Marketplace manifest
+        run: |
+          stage_dir="$RUNNER_TEMP/vscode-plugin-marketplace-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          archive="$RUNNER_TEMP/cherry-markdown-${GITHUB_SHA}.vsix"
+          node scripts/stage-vscode-plugin-marketplace.mjs --out "$stage_dir"
+          echo "VSIX_STAGE_DIR=$stage_dir" >> "$GITHUB_ENV"
+          echo "VSIX_ARCHIVE=$archive" >> "$GITHUB_ENV"
+
+      - name: Package the staged VSIX with locked local vsce
+        run: |
+          cd "$VSIX_STAGE_DIR"
+          "$GITHUB_WORKSPACE/packages/vscodePlugin/tools/node_modules/.bin/vsce" package --no-dependencies --no-yarn --out "$VSIX_ARCHIVE"
+
+      - name: Verify the archive before upload
+        run: node scripts/verify-vscode-vsix.mjs --archive "$VSIX_ARCHIVE"
+
+      - name: Upload the exact verified VSIX
+        uses: actions/upload-artifact@v4
+        with:
+          name: cherry-markdown-vsix-${{ github.sha }}
+          path: ${{ env.VSIX_ARCHIVE }}
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Unpack the verified archive for the Extension Host
+        run: |
+          extension_dir="$RUNNER_TEMP/vsix-extension-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          mkdir "$extension_dir"
+          unzip -q "$VSIX_ARCHIVE" -d "$extension_dir"
+          echo "VSIX_EXTENSION_DIR=$extension_dir/extension" >> "$GITHUB_ENV"
+
+      - name: Install and activate the packaged extension once
+        env:
+          VSCODE_TEST_CACHE: ${{ runner.temp }}/vscode-extension-host-cache
+        run: |
+          timeout 8m xvfb-run -a node scripts/run-vscode-extension-host-smoke.mjs \
+            --archive "$VSIX_ARCHIVE" \
+            --extension "$VSIX_EXTENSION_DIR"

package.json

@@ -21,7 +21,8 @@
     "postbuild": "tsx scripts/post-build.ts",
     "dev:client": "yarn workspace @cherry-markdown/client tauri dev",
     "build:client": "yarn workspace @cherry-markdown/client tauri build",
-    "build:vscodePlugin": "yarn workspace cherry-markdown-vscode-plugin build",
+    "prepare:vscodePlugin": "node scripts/prepare-vscode-plugin-resources.mjs",
+    "build:vscodePlugin": "yarn workspace cherry-markdown-vscode-plugin build:production && yarn prepare:vscodePlugin",
     "example:react": "yarn workspace @cherry-markdown/react_demo dev",
     "test": "yarn workspace @desirecore/super-doc test",
     "test:update": "yarn workspace @desirecore/super-doc test:update",

packages/vscodePlugin/.vscodeignore

@@ -2,6 +2,8 @@
 out/**
 node_modules/**
 src/**
+test/**
+tools/**
 .gitignore
 .yarnrc
 vsc-extension-quickstart.md

packages/vscodePlugin/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Change Log
 
+## 0.1.3
+
+### Patch Changes
+
+- package the extension from verified `@desirecore/super-doc@0.2.15` runtime assets with a reproducible VSIX verification and Extension Host smoke workflow
+
 ## 0.1.2
 
 ### Patch Changes

packages/vscodePlugin/package.json

@@ -2,7 +2,7 @@
   "name": "cherry-markdown-vscode-plugin",
   "displayName": "Cherry Markdown",
   "description": "A markdown previewer powered by [cherry-markdown](https://github.com/Tencent/cherry-markdown) for VSCode",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "publisher": "cherryMarkdownPublisher",
   "license": "Apache-2.0",
   "keywords": [
@@ -172,11 +172,11 @@
     }
   },
   "scripts": {
-    "build": "vsce package",
-    "vscode:prepublish": "yarn package",
+    "build": "yarn build:production",
+    "vscode:prepublish": "yarn build:production",
     "compile": "rspack build",
     "watch": "rspack build --watch",
-    "package": "rspack build --mode production --devtool hidden-source-map",
+    "build:production": "rspack build --mode production --devtool hidden-source-map",
     "lint": "cd ../.. && npx prettier --check packages/vscodePlugin/src/**/*.ts && npx eslint packages/vscodePlugin/src/**/*.ts",
     "lint:fix": "cd ../.. && npx prettier --write packages/vscodePlugin/src/**/*.ts && npx eslint packages/vscodePlugin/src/**/*.ts --fix"
   },
@@ -191,7 +191,7 @@
   "dependencies": {
     "@types/mathjax": "0.0.37",
     "axios": "^1.18.1",
-    "@desirecore/super-doc": "*",
+    "@desirecore/super-doc": "0.2.15",
     "html-to-image": "^1.11.13",
     "katex": "^0.16.47",
     "mathjax": "^3.2.2",

packages/vscodePlugin/publish_manual.md

@@ -1,14 +1,22 @@
-# 发布插件
-
-```bash
-// 安装vsce
-npm install -g @vscode/vsce
-// 登录
-vsce login CherryMarkdown
-// 根据提示输入token
-// token在这里：https://dev.azure.com/cherry-markdown/_usersSettings/tokens
-cd ./vscodePlugin
-修改package.json里的version：`"version": "0.0.14",`
-// 执行发布命令
-vsce publish
-```
+# 发布 VSIX
+
+生产 Marketplace 发布的唯一入口是 GitHub Actions 的 **Publish Verified VSIX** 工作流。禁止使用全局 `vsce`、本地发布命令、PR preview 发布或其他分支上的工作流。
+
+## 发布前提
+
+1. 待发布提交必须位于 `main`。工作流会同时验证仓库为 `desirecore/super-doc`、ref 为 `refs/heads/main`，并要求手动填写 `confirm_publish=true`。
+2. 先完成该提交的 **VSIX Delivery** 工作流。它必须已生成并验证归档、上传 artifact，并通过 VSIX 安装与 Extension Host smoke。
+3. 在仓库设置中创建受保护的 `vscode-marketplace` Environment：
+   - 配置外部环境 reviewers，要求发行负责人审批；
+   - Deployment branches 只允许受保护的 `main`；
+   - 只在该 Environment 中保存 `VSCE_PAT`，不要把 token 放到 repository 或 workflow secrets。
+4. 确认 `packages/vscodePlugin/package.json` 的版本尚未在 Marketplace 发布。
+
+## 操作
+
+1. 在 GitHub Actions 选择 **Publish Verified VSIX**。
+2. 选择 `main`，并将 `confirm_publish` 设为 `true`。
+3. 等待 `vscode-marketplace` Environment 审批。工作流会用锁定的本地 VSCE 重新构建、验证并上传本次将发布的 artifact。
+4. 仅在归档验证通过后，工作流才会使用该 artifact 和 Environment 中的 `VSCE_PAT` 执行 `vsce publish --packagePath`。
+
+发布 workflow 不会自动触发，也不会从 fork、PR 或非 `main` ref 发布。