From 1ab408e33631c350770297e5efb8f55b7df6d963 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ant=C3=98n=20Ustin=C3=98ff?= <a.a.ustinoff@gmail.com>
Date: Thu, 22 Oct 2026 17:25:11 +0400
Subject: [PATCH] ci: protect extension releases and validate VSIX packaging

Co-authored-by: ziqqineyo <a.a.ustinoff@yandex.ru>
---
 .github/AUTOMATION.md          | 14 ++++++++++++++
 .github/workflows/checkout.yml | 28 +++++++++++++---------------
 .github/workflows/deploy.yml   | 32 +++++++++++++++++++++++++++-----
 3 files changed, 54 insertions(+), 20 deletions(-)

diff --git a/.github/AUTOMATION.md b/.github/AUTOMATION.md
index 2d89526..7c4bad3 100644
--- a/.github/AUTOMATION.md
+++ b/.github/AUTOMATION.md
@@ -3,6 +3,20 @@
 This repository uses reusable actions pinned to
 `ziqq/actions@ccd1a799683cd461a45d9303ac6fcb2792f8f5d2`.
 
+## Extension validation and publication
+
+Pull request CI packages the extension as a VSIX using Node.js 22 and
+`@vscode/vsce@4.0.0`. The package currently has no test or lint npm scripts.
+
+Publication runs only when an existing version tag is pushed. The tag must be
+`v<package.json version>`, and the first version in `CHANGELOG.md` must match.
+The workflow does not create tags or change the package version.
+
+The deploy job uses the `release` environment and the existing `VSCE_PAT` secret.
+Before the next release, configure the environment with a required reviewer and
+a tag-only `v*` deployment policy, then protect the release tags. Keep the
+repository secrets until a separate credential migration is approved.
+
 ## Semantic labels
 
 `.github/labels.json` is the repository-owned source of truth. Automation uses
diff --git a/.github/workflows/checkout.yml b/.github/workflows/checkout.yml
index 3979a3f..fd848e1 100644
--- a/.github/workflows/checkout.yml
+++ b/.github/workflows/checkout.yml
@@ -21,6 +21,9 @@ on:
       - "**.js"
       - "**.mjs"
 
+permissions:
+  contents: read
+
 jobs:
   checkout:
     name: "Checkout VS Code Extension"
@@ -39,7 +42,9 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
         #with:
         #  sparse-checkout: |
         #    .github
@@ -51,24 +56,17 @@ jobs:
         #    CHANGELOG.md
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: 18.x
+          node-version: 22.x
 
       - name: Install Dependencies
-        run: npm install
-
-      - name: Run Tests
-        run: xvfb-run -a npm test
-        if: runner.os == 'Linux'
-
-      - name: Run Tests
-        run: npm test
-        if: runner.os != 'Linux'
-
-      - name: Lint Code
         run: |
-          npm run lint
+          npm ci
+          npm install -g @vscode/vsce@4.0.0
+
+      - name: Package extension
+        run: vsce package --out "$RUNNER_TEMP/codepen-theme.vsix"
 
   notify:
     name: Notify CI result
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 9fe46e0..b4efc77 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -8,10 +8,14 @@ on:
   #  types:
   #    - created
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     name: "Deploy VS Code Extension"
     runs-on: ubuntu-latest
+    environment: release
     defaults:
       run:
         working-directory: ./
@@ -19,19 +23,37 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
       - name: Install Node.js
         id: node-setup
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
-          node-version: 20.x
+          node-version: 22.x
+
+      - name: Validate release tag
+        run: |
+          node <<'NODE'
+          const fs = require('node:fs');
+          const { version } = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+          const changelog = fs.readFileSync('CHANGELOG.md', 'utf8');
+          const changelogVersion = changelog.match(/^##\s+(\S+)/m)?.[1];
+          if (process.env.GITHUB_REF_TYPE !== 'tag' ||
+              process.env.GITHUB_REF_NAME !== `v${version}` ||
+              changelogVersion !== version) {
+            console.error('The release tag, package.json and first changelog version must match.');
+            process.exit(1);
+          }
+          console.log(`Validated existing release tag v${version}.`);
+          NODE
 
       - name: Install Dependencies
         id: install
         run: |
-          npm install
-          npm install -g @vscode/vsce
+          npm ci
+          npm install -g @vscode/vsce@4.0.0
 
       - name: Publish
         id: publish