Use locked VSCE installs and verify VSIX signatures

[Sean McManus (sean-mcmanus)]

Summary

Install the Extension Pack and Themes packaging tools from their reviewed npm lockfiles, while retaining the explicit @vscode/vsce-sign rebuild required by ignore-scripts=true. Verify each detached VSIX/manifest/P7S triplet immediately after signing and again before Marketplace upload.

Marketplace signature validation remains the authoritative release gate. The post-sign check fails earlier, before a malformed or mismatched triplet becomes a pipeline artifact or enters manual release validation; the release-job check detects an incorrect or damaged triplet at the build-to-release transfer boundary and reports the failure locally before upload. These checks improve artifact assurance and failure diagnosis rather than replacing Marketplace verification.

This separates and extends the deterministic packaging work first exercised in #14701.

This PR was investigated and created by GitHub Copilot in VS Code. Any message starting with ✨Copilot: was sent by Copilot.

Release-job dependencies

Release jobs consume artifacts rather than checking out source. The package job publishes a small vsce artifact containing only the project's package.json, package-lock.json, and checked-in .npmrc. The publish job declares both vsix and vsce as pipeline-artifact inputs from the same vsixBuild run and installs the locked tooling in the downloaded vsce directory. It retains the signer rebuild, binary-existence check, and signature verification before upload.

A new package build is required to produce the vsce artifact before retrying publishing; older package artifacts do not contain it.

Packaging network regression

Restore Permissive,CFSClean,CFSClean2,CFSClean3 in both package entrypoints, reverting the package-pipeline portion of #14728. These jobs do not select DefaultDeny; their three CFSClean* policies supply deny rules but no allow rules. Removing the base allow policy therefore blocks the Azure DevOps connectivity needed by NuGet authentication, before packaging starts.

This restores the previously working network baseline while retaining all three feed restrictions. It is not a new least-privilege allowlist, and the separate component-governance pipeline is unchanged.

Validation

• Ran clean lock-backed installs, rebuilt the signer, packaged both VSIXes, and generated both manifests with VSCE 4.0.0. Package locks remained unchanged.
• Parsed the changed YAML, checked the producer/consumer artifact contract, and ran git diff --check.
• Reproduced the original release-job checkout rejection with an Azure template preview; the corrected Extension Pack publish pipeline passes preview from the pushed source without a YAML override. Both package producers also pass preview. The Themes release YAML was validated through the enabled sibling definition's preview endpoint.
• Copied each project's exact three-file tooling payload into a fresh directory with no checkout. Both passed npm ci --include=dev --include=optional, explicit signer rebuild, tool-version/binary checks, and input-hash checks.
• A hosted Extension Pack package run passed after the network-policy restoration.

All template previews were non-executing and created no runs. End-to-end publishing with the new tooling artifact still requires validation.

[Copilot]

Pull request overview

Uses reviewed VSCE lockfiles for deterministic packaging and verifies signed VSIX triplets at both release boundaries.

Changes:

• Replaces ad hoc VSCE installs with npm ci.
• Rebuilds the signer and verifies signatures after signing and before publishing.
• Configures each release pipeline’s source directory.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
Build/publish/jobs_publish_vsix.yml	Installs locked dependencies and verifies signatures before upload.
Build/publish/cpptools_themes.yml	Selects the Themes lockfile directory.
Build/publish/cpptools_extension_pack.yml	Selects the Extension Pack lockfile directory.
Build/package/jobs_package_vsix.yml	Uses locked installs and verifies newly signed artifacts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.