VS Code publishing: confirm VSCE_PAT scope before 2026-12-01, then move to Entra ID

[jimisola]

Re-filed from reqstool/.github-private#33, which was lost when that repo was retired. The org no longer has a writable private repo, so this is public — see the note at the end on what that changes.

Public counterpart: reqstool/.github#98.

Why this has a deadline

Azure DevOps is retiring global personal access tokens:

Date	What happens
2026-03-15	Creating or regenerating a global PAT blocked — already past
2026-12-01	All existing global PATs stop working

If VSCE_PAT is a global PAT, this repo becomes unpublishable on 1 December. The failure mode is the unpleasant one: it fails at the publish step, after tag, build, assets and approval have all already succeeded.

If it is already organization-scoped with Marketplace > Manage, the deadline does not apply and item 2 is ordinary hygiene rather than a countdown.

1. Determine whether VSCE_PAT is global or organization-scoped

This decides whether anything below is urgent, and it needs someone with Azure DevOps access.

Check under User settings → Personal access tokens. The scope is not visible from GitHub, so no repo — and no amount of poking at this one — can answer it.

If it is global, the cheap stopgap is reissuing it as an organization-scoped PAT with Marketplace > Manage and updating the secret. That buys time without touching any workflow: the publish path reads VSCE_PAT and does not care how it was issued.

2. Move to Entra ID and drop the stored token

The real fix, and consistent with the rest of the org — npm and PyPI both publish via OIDC with no stored credential.

reqstool/.github's typescript-publish-to-vscode.yml already accepts the switch:

azure-credential: true    # defaults to false

which runs vsce publish --azure-credential --packagePath … instead of using VSCE_PAT. vsce@3.9.2 is already pinned here and carries the flag.

Deliberately not yet written, because it could not be verified without a tenant to test against:

• Entra app registration and federated credential for the marketplace publisher
• Almost certainly an azure/login step before the publish step
• Almost certainly id-token: write on the publish job, which currently declares only what the PAT path needs

Note on visibility

The original was filed privately because it concerns publishing credentials and Azure tenant configuration, and GitHub has no maintainer-only visibility on a public repo's issues. That original also recorded that nothing in it discloses more than the public reqstool/.github#98, which already states VSCE_PAT may be a global PAT.

So the text above is safe here. Tenant-specific detail — directory or application IDs, federated credential subjects — should not be added to this issue. If any is needed, it belongs somewhere non-public.

[jimisola]

Step-by-step for item 1 — determine the VSCE_PAT scope

Everything below needs Azure DevOps access. None of it is answerable from GitHub: the token's scope is not exposed anywhere in the repo or its secrets.

Find the token

1. Go to https://dev.azure.com and sign in as the account that created the publisher token.
2. Top right, click your avatar → Personal access tokens. (Direct: https://dev.azure.com/<your-org>/_usersSettings/tokens — or https://aex.dev.azure.com/me if you are unsure which org.)
3. Find the token used for publishing. It may not be named VSCE_PAT — that is only the GitHub secret's name. Look for one whose scope includes Marketplace, created around when publishing was first set up.

Read its scope — this is the whole question

Click the token and look at Organization:

What it says	Meaning	Action
All accessible organizations	Global PAT — stops working 2026-12-01	Reissue, see below
A single named org	Organization-scoped	No deadline; nothing urgent

Also confirm Scopes includes Marketplace → Manage. Publishing needs Manage; Acquire or Publish alone is not enough for vsce publish.

If no token looks like a match, or the list is empty, the token likely belongs to a different account — a publisher is owned by one identity. Check who created the marketplace publisher at https://marketplace.visualstudio.com/manage.

If it is global — the stopgap

Do not try to regenerate it. Regenerating a global PAT has been blocked since 2026-03-15; only creating a new one works.

1. + New Token
2. Organization: pick the single org that owns the publisher — not "All accessible organizations"
3. Scopes: Custom defined → Marketplace → Manage
4. Expiry: your call; note that a shorter one means this recurs
5. Create, then copy the value — it is shown once

Then update the GitHub secret:

gh secret set VSCE_PAT --repo reqstool/reqstool-vscode
# paste the token, then Ctrl-D

No workflow change is needed. The publish path reads VSCE_PAT and does not care how the token was issued.

Verify without cutting a release

The publish step only runs on a real release, so the honest check is a dry run of the same call the workflow makes:

npx @vscode/vsce@3.9.2 verify-pat <publisher-name>

with VSCE_PAT set in the environment. It answers whether the token is valid for that publisher, and does not publish anything.

Report back here

Worth recording in this issue either way — "organization-scoped, Marketplace > Manage, expires " is exactly the sentence that stops someone re-checking this in November. Do not paste the token, its ID, or the org name if you would rather keep the tenant out of a public issue.

---

What decides urgency

• Organization-scoped → the 2026-12-01 deadline does not apply. Item 2 (Entra ID) becomes ordinary hygiene, worth doing whenever, and this issue can be relabelled accordingly.
• Global → the stopgap above is a ~10 minute job and removes the deadline entirely. Item 2 then proceeds at its own pace rather than against a clock.

Either way the useful outcome of this first step is knowing which of those two situations you are in — right now nobody does.