Skip to content

History / Trusted Publishing

Revisions

  • Rename the token lifetime setting to ovsx.trusted-publishing.token-expiration It moved out of the access-token namespace, and it must now be positive: issued publishing tokens always expire. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

    @netomi netomi committed Sep 1, 2026
  • Document the active-version requirement and automatic deletion Trusted publishing needs the extension to have an active version, not only at registration: every token exchange looks it up among the active ones, so deleting all versions makes a registration stop working while still being listed. Also record the two cases where the registry deletes a registration by itself - its author losing namespace ownership, and the extension being purged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

    @netomi netomi committed Sep 1, 2026
  • Add Trusted Publishing page Covers registering a trusted publisher, publishing from GitHub Actions and GitLab CI, what the registry verifies and matches, the properties of the issued token, the security model, and the server configuration for operators. Linked from Home. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

    @netomi netomi committed Sep 1, 2026