[madhur310]

Summary

• Adds publishOpenVSXTrusted.yml — the one top-level workflow both stable and prerelease now use to actually run ovsx publish.
• publishOpenVSX.yml loses its own publish job (moved to the new file); verify-published can no longer needs: it (cross-workflow-run dependencies aren't possible), relying instead on its existing poll-loop tolerance.
• promote-to-prerelease.yml gains a trigger-openvsx-publish job that dispatches publishOpenVSXTrusted.yml via gh workflow run for the nightly being promoted.

Context

Open VSX's trusted-publisher check matches the OIDC token's workflow_ref claim — the top-level workflow that initiated the run — not job_workflow_ref (confirmed against eclipse-openvsx/openvsx's GitHubTrustedPublishingProviderSupport.matches() and TrustedPublishingService.registerTrustedPublisher(), which hard-rejects a second trusted-publisher registration per extension, server-side). Stable (publishOpenVSX.yml, fires on release: types: [released]) and prerelease (promote-to-prerelease.yml, fires on schedule) were two different top-level files, so no single trusted-publisher registration could ever cover both.

publishOpenVSXTrusted.yml is deliberately not nested via uses: under either existing file: stable triggers it directly via its own release event (a sibling of publishOpenVSX.yml, not nested inside it — multiple workflow files independently reacting to the same event is normal), and promote-to-prerelease.yml dispatches it via gh workflow run (a genuinely new, independently initiated run, not a uses: call) — so both runs' workflow_ref is publishOpenVSXTrusted.yml either way.

It deliberately has no environment: publish (unlike publishOpenVSX.yml's prepare-release-metadata): that environment has a required_reviewers protection rule, which would otherwise turn every automated weekly prerelease into one requiring manual approval.

vscode-promote-prerelease.yml's own inline ovsx leg is being removed in a parallel github-workflows PR (salesforcecli/github-workflows#199), since Open VSX publishing for prerelease now happens via this dispatch instead.

Two uses: refs in this PR are temporarily pinned to the github-workflows PR branch (salesforcecli/github-workflows@ms/W-24666922-ovsx-trusted-publishing) instead of @main, to validate end-to-end before that PR merges — marked TEMPORARY in both files. Must switch back to @main before this PR merges, coordinated with that PR's merge.

Validation

• actionlint on all three files: zero new findings vs. develop (same pre-existing shellcheck notices only).
• Real end-to-end dispatch confirmed: ran publishOpenVSXTrusted.yml directly (pinned to the github-workflows test branch) against an already-published, --skip-duplicate-safe nightly tag, covering all 17 Open VSX-published extensions in this repo — no new content reached the registry. Run 41499926285 / publish job: 🔐 Trusted publishing token issued for ... logged for every extension, zero ❌ No trusted publisher matches errors.
• Trusted publisher registered on open-vsx.org for each extension against publishOpenVSXTrusted.yml (via the registration-only #8555, merged, to get the workflow name onto develop first).

Test plan

• Dry-run promote-to-prerelease.yml and confirm trigger-openvsx-publish is skipped under dry-run: true
• Manually dispatch publishOpenVSXTrusted.yml against an existing nightly tag; confirmed real (non-dry-run) run against an already-published, --skip-duplicate-safe tag succeeds with no new content published — see Validation above
• Switch both temporary uses: refs back to @main once fix(release): migrate Open VSX publishing to OIDC trusted publishing - W-24666922 salesforcecli/github-workflows#199 merges
• Register the Open VSX trusted publisher for each extension against publishOpenVSXTrusted.yml

@W-24666922@

Manual test plan

Nothing worth manually testing.