v0.2.0 - Set up Marketplace + Open VSX publishing

Status: Completed
Date: 2026-07-11

Goal

Establish an automated release-publish pipeline for the markleon VS Code extension, triggered when a GitHub release is published, and harden the CI that gates it.

Summary of Changes

• Rewrote the publish workflow to fit a pnpm-based VS Code extension: trigger release: published, pnpm --frozen-lockfile, real gates (typecheck + lint + test).
• Publishes a single packaged .vsix to the VS Code Marketplace (vsce) and Open VSX (ovsx, idempotent namespace create).
• npm Trusted Publishing via OIDC — no stored token, automatic provenance; runs last so it can't block the extension publish.
• Repaired the Dependabot auto-merge workflow (fetch-metadata@v5 → @v3).
• Upgraded to TypeScript 6 and @types/node 24 (LTS line); explicit "types": ["node", "vscode"]; Dependabot pins @types/node majors to the Node LTS line.
• Added "packageManager": "pnpm@10.21.0" for pnpm/action-setup in CI.

Breaking Changes

None (user-facing extension behavior unchanged).

Deprecations

Azure DevOps retires global PATs on 2026-12-01; VSCE_PAT must migrate to Entra ID/OIDC before then.