Clarify in docs the recommendations around bundling/minifying extensions during publish

[DanTup]

A long time ago I started bundling/minifying my extension code, as appeared to be recommended by VS Code for performance reasons. The examples on https://code.visualstudio.com/api/working-with-extensions/bundling-extension still show minification settings (and I think vsce warns if you have large or large numbers of files).

However recently one of my extension published recently failed to publish (with what I presume was a false-positive or failed virus check) and while trying to understand this, the VS Marketplace team told me:

Please be aware that our team is in the process of enforcing stricter obfuscation policies to enhance transparency and security within the VS Marketplace. Our recommendation is to remove the obfuscation to ensure successful publication.

And later:

Avoid Obfuscation: Do not obfuscate your code unless absolutely necessary. Obfuscation may trigger security reviews or takedowns.

I'm happy to remove the minification of my code, but I feel like these recommendations conflict, and I think it should be documented better (at least here, but ideally on the page linked above) so it's easier for extension authors to ensure they're doing the right thing.

[jrieken]

IMO we continue to recommend to minify and bundle your extensions (because it helps with installing and running performance) and I think that's not what obfuscation means in this context

[DanTup]

IMO we continue to recommend to minify and bundle your extensions (because it helps with installing and running performance) and I think that's not what obfuscation means in this context

This text came from the marketplace team when I asked them to review my failed extension publish. It specifically says " Our recommendation is to remove the obfuscation" but there is no obfuscation in the extension, only minification (and actually, the extension that was rejected only contained a few lines of code entirely!). I'm not sure they have the same understanding, so I'll ping them this issue and see they can clarify.

Thanks!

[isidorn]

I can help with the Marketplace team. Let me check with them.

[DanTup]

hmm, I went back and reviewed the publish versions of both Dart and Flutter extensions, and it turns out I'm not even minifying them (because it results in worse stack traces - Dart-Code/Dart-Code#2919).

So now I'm wondering if the response from the marketplace team was a pasted response and not based on the contents of the extension.