feat(release): Wave 4 Phase I — unified release pipeline (npm + Marketplace + VS Code + Open VSX + smoke)

[faraa2m]

Summary

Wave 4 Phase I — extends the existing Changesets-driven release workflow into a unified pipeline that ships every artifact from one merge of the auto-generated "Version Packages" PR.

This is the last code PR before v1.0.0. After this merges, the next Version Packages PR (which currently bundles 11 accumulated changesets from Waves 1-4) becomes the v1.0.0 launch.

Release flow recap

The user does not run anything manually. Pipeline:

1. Push to main (any PR merge) → workflow runs.
2. If .changeset/ has unconsumed changesets → workflow opens (or updates) a "Version Packages" PR. Auto-bumps package.json versions, auto-generates CHANGELOG.md entries.
3. Merging the Version Packages PR triggers the workflow once more — publishes everything.

What this PR adds to step 3

• npm publish — already shipped (Wave 1).
• GitHub Release on the new tag — already shipped (Wave 1). Marketplace re-publishes the Action automatically.
• VS Code Marketplace via vsce publish (gated on VSCE_PAT).
• Open VSX via ovsx publish (gated on OVSX_PAT) — needed for Cursor + VSCodium.
• Marketplace verify HTTP probe (best-effort, never fails the run; logs warning if Marketplace listing isn't reachable yet).
• Vercel deploy hook (gated on VERCEL_DEPLOY_HOOK; redundant since Vercel auto-rebuilds on main, kept as belt-and-suspenders).
• smoke-test job in a fresh runner: asserts the just-published npm artifact runs (tokenometer --version) and emits valid SARIF (version: 2.1.0).

Steps gracefully skip with a clear notice when a secret is missing — the npm publish path always proceeds.

Local pre-release

New npm run smoke script runs the full sweep:

• lint
• typecheck
• 227 tests
• root build
• @tokenometer/web build
• benchmarks (drift check)
• CLI smoke: --version, SARIF v2.1.0 shape, --by-file, auto-detect

Required GitHub repo secrets (one-time setup before the v1.0.0 release)

Secret	Source	Required for
NPM_TOKEN	npmjs.com → Tokens (Automation type, OIDC-friendly)	npm publish — already configured
VSCE_PAT	dev.azure.com → publisher → Manage Tokens (scope: Marketplace → Acquire + Manage)	VS Code Marketplace publish
OVSX_PAT	open-vsx.org → User Settings → Access Tokens	Open VSX publish (Cursor users)
VERCEL_DEPLOY_HOOK	Vercel project → Settings → Git → Deploy Hooks	Vercel deploy (optional)

Test plan

• npm run lint — clean (89 files)
• npm run typecheck — clean
• npm test — 227/227 across 20 files
• npm run build — clean
• npm run build -w @tokenometer/web — clean
• npm run benchmarks — 10 prompts × 63 models × 5 formats match
• npm run smoke — full local sweep passes
• You: add VSCE_PAT, OVSX_PAT, optionally VERCEL_DEPLOY_HOOK to repo Settings → Secrets and variables → Actions
• Post-merge: confirm release workflow runs, opens the accumulated Version Packages PR (will bundle 11 changesets → v0.1.0+)
• When ready to ship v1.0.0: bump the changeset config or manually edit the Version Packages PR title to drop 0.1.0 for 1.0.0, then merge — workflow does the rest

Out of scope

• Content posts (Phase G) — pre-staged in ~/Downloads/tokenometer-content-todo.md. Manual posting after the v1.0.0 release is live.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tokenometer	Ready	Preview, Comment	May 10, 2026 4:38am