VS Code publishing breaks on 2026-12-01: Azure DevOps retires global PATs

[jimisola]

Summary

reqstool-vscode publishes through HaaLeo/publish-vscode-extension, which is a dead end on
two independent counts. The second one has a hard deadline: 2026-12-01.

1. The PAT it depends on is being switched off

VS Code Marketplace authentication runs on Azure DevOps, and Azure DevOps is
retiring global Personal Access Tokens:

• 2026-03-15 — creating or regenerating a global PAT is already blocked (past)
• 2026-12-01 — existing global PATs stop working entirely

If VSCE_PAT is a global PAT, publishing reqstool-vscode stops working on 1 December,
at the publish step, after everything else in the release has succeeded.

Someone needs to check which kind of token VSCE_PAT is. That lives in Azure DevOps,
not GitHub, so it can't be determined from this repo. If it is already organization-scoped
with Marketplace > Manage, the deadline does not bite and this becomes housekeeping.

2. The action cannot follow us off PATs

HaaLeo/publish-vscode-extension@v2.0.0 declares pat as required: true and has no
Entra ID support. It also still declares using: 'node20' — which is what surfaces the
"Node 20 is being deprecated" warning on every publish — and its last commit was
2025-06-12, over a year ago, with no upstream issue tracking node24.

So the action blocks the migration it would need to survive.

The fix: publish with the registries' own CLIs

Registry	CLI	Maintainer	Version	Last published
VS Code Marketplace	@vscode/vsce	Microsoft	3.9.2	2026-08-11
Open VSX	ovsx	Eclipse Foundation	1.1.1	2026-08-09

Both are first-party and actively maintained. reqstool-vscode already depends on
@vscode/vsce@3.9.2 — scripts/build.mjs shells out to vsce package to build the VSIX —
so the publish half is the only part still going through a third party.

Running them as run: steps also retires the Node 20 warning for free: a run: step uses
the job's own Node, so there is no using: declaration to deprecate.

vsce 3.9.2 already carries the flag this migration needs:

--azure-credential    Use Microsoft Entra ID for authentication

Plan

• Swap to the CLIs, keeping PAT auth so nothing breaks today. Adds an
  azure-credential input, defaulting off, so switching is a one-line change later.
• Add ovsx to reqstool-vscode's devDependencies, so both CLIs are pinned in its
  lockfile and tracked by Renovate — same as @vscode/vsce already is.
• Determine whether VSCE_PAT is global or organization-scoped. This decides how
  urgent the rest is.
• Set up Entra ID for the marketplace publisher and flip azure-credential: true.
  Needs Azure-side work that cannot be done from these repos, and probably an
  azure/login step plus id-token: write on the publish job — worth confirming
  against the docs when it is done rather than guessing now.

Note that Open VSX is Eclipse-run and unaffected by any of this: OVSX_PAT stays a PAT
either way.

The first two are mechanical and land now. The last two need someone with Azure DevOps
access.