@vscode/vsce

The Visual Studio Code Extension Manager

This tool assists in packaging and publishing Visual Studio Code extensions.

Read the Documentation on the VS Code website.

Requirements

Node.js at least 22.x.x.

Linux

In order to save credentials safely, this project uses keytar which uses libsecret, which you may need to install before publishing extensions. Setting the VSCE_STORE=file environment variable will revert back to the file credential store. Using the VSCE_PAT environment variable will also avoid using keytar.

Depending on your distribution, you will need to run the following command:

• Debian/Ubuntu: sudo apt-get install libsecret-1-dev
• Alpine: apk add libsecret
• Red Hat-based: sudo yum install libsecret-devel
• Arch Linux: sudo pacman -S libsecret

Usage

$ npx @vscode/vsce --version

@vscode/vsce is meant to be mainly used as a command-line tool. It can also be used as a library since it exposes a small API. When using @vscode/vsce as a library, be sure to sanitize any user input used in API calls to prevent security issues.

Supported package managers:

• npm >=6
• yarn >=1 <2

Configuration

You can configure the behavior of vsce by using CLI flags (run vsce --help to list them all). Example:

$ npx @vscode/vsce publish --baseImagesUrl https://my.custom/base/images/url

Or you can also set them in the package.json, so that you avoid having to retype the common options again. Example:

// package.json
{
  "vsce": {
    "baseImagesUrl": "https://my.custom/base/images/url",
    "dependencies": true,
    "yarn": false
  }
}

Trusted publishing

vsce publish --oidc publishes from GitHub Actions without storing a Personal Access Token. Configure a trusted publishing policy for the repository and workflow on the Visual Studio Marketplace, then grant the workflow permission to request an OIDC token:

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm ci
      - run: npx @vscode/vsce publish --oidc

OIDC publishing requests a GitHub Actions token for the marketplace.visualstudio.com audience and exchanges it for a short-lived Marketplace credential. It does not fall back to a PAT when token acquisition or exchange fails.

Development

First clone this repository, then:

$ npm install
$ npm run watch:build # or `watch:test` to also build tests

Once the watcher is up and running, you can run out of sources with:

$ node vsce

Tests can be executed with:

$ npm test

Note: Yarn is required to run the tests.