diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..879090e
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,44 @@
+# Version control
+.git
+
+# IDE and editor files
+.idea
+.vscode
+.DS_Store
+
+# Build caches
+.eslintcache
+*.tsbuildinfo
+
+# Build outputs
+build/
+dist/
+output/
+out/
+tmp/
+client/out/
+server/out/
+shared/out/
+syntaxes/out/
+
+# Dependencies
+node_modules/
+
+# Dockerfile is passed explicitly via --file; excluding it here just keeps
+# it out of the build context (avoids cache busting on Dockerfile edits).
+Dockerfile*
+*.log
+*.tgz
+*.vsix
+
+# Git hooks
+.husky
+
+# GitHub workflows
+.github/
+
+# SDD specs
+.sdd/
+
+# Test coverage
+coverage/
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
deleted file mode 100644
index d53fc16..0000000
--- a/.github/workflows/check.yml
+++ /dev/null
@@ -1,97 +0,0 @@
-name: Check code
-
-env:
-  NODE_VERSION: 22
-  PNPM_VERSION: 10.7.1
-
-on:
-  push:
-    branches:
-      - master
-  pull_request:
-    branches:
-      - master
-
-jobs:
-  check_code:
-    name: Run type checking, linting, and tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out to repository
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: ${{ env.PNPM_VERSION }}
-          run_install: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: List files
-        run: ls -alt
-
-      - name: Build shared library
-        run: pnpm --filter @vscode-adblock-syntax/shared build
-
-      - name: Check TypeScript types
-        run: pnpm test:compile
-
-      - name: Run markdownlint
-        run: pnpm lint:md
-
-      - name: Run ESLint
-        run: pnpm lint:code
-
-      - name: Run Vitest tests
-        run: pnpm test
-
-      - name: Build extension
-        run: pnpm build
-
-      - name: Package extension
-        run: pnpm package
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: vscode-adblock-build
-          path: |
-            out/vscode-adblock.vsix
-            syntaxes/out/adblock.plist
-          retention-days: 30
-
-  notify:
-    name: Send Slack notification on failure
-    needs: check_code
-    # Run this job only if the previous job failed and the event was triggered by the 'AdguardTeam/VscodeAdblockSyntax' repository
-    # Note: 'always()' is needed to run the notify job even if the test job was failed
-    if:
-      ${{
-        always() &&
-        needs.check_code.result == 'failure' &&
-        github.repository == 'AdguardTeam/VscodeAdblockSyntax' &&
-        (
-          github.event_name == 'push' ||
-          github.event_name == 'workflow_dispatch' ||
-          github.event.pull_request.head.repo.full_name == github.repository
-        )
-      }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Slack notification
-        uses: 8398a7/action-slack@v3
-        with:
-          status: failure
-          fields: workflow, repo, message, commit, author, eventName, ref, job
-          job_name: check_code
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..07ffc54
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,47 @@
+name: CI
+
+description: Lints, tests, builds, and packages the .vsix on pull requests and pushes to master.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+
+# Cancel in-progress CI runs for the same ref when a new push occurs,
+# preventing redundant builds and saving CI resources.
+concurrency:
+  group: ci-ext-vscode-adblock-syntax-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Lint, test, build
+    runs-on: team-extensions
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      # Stamp a dev version BEFORE the Docker builds so package.json is
+      # consistent across test-output and build-output layers. package.json
+      # has no committed version — CI injects one derived from CHANGELOG.
+      - name: Set dev version
+        uses: AdGuardSoftwareLimited/ext-shared-actions/.github/actions/set-dev-version@master
+
+      - name: Build and test via Docker
+        run: DOCKER_BUILDKIT=1 docker build --progress plain --target test-output .
+
+      - name: Build release artifacts
+        run: |
+          DOCKER_BUILDKIT=1 docker build --progress plain \
+            --target build-output \
+            --output ./artifacts \
+            .
+
+      - name: Upload vsix package
+        uses: actions/upload-artifact@v4
+        with:
+          name: vscode-adblock-vsix
+          path: |
+            artifacts/vscode-adblock.vsix
+            artifacts/adblock.plist
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
new file mode 100644
index 0000000..6613e2a
--- /dev/null
+++ b/.github/workflows/mirror.yml
@@ -0,0 +1,24 @@
+name: Mirror
+
+description: Mirrors code to the public repo on every push to master.
+
+on:
+  push:
+    branches:
+      - master
+
+# `contents: read` — checkout source repo
+# `actions: write` — disable workflows in the public mirror
+# `id-token: write` — Octopass token for push to public repo
+permissions:
+  contents: read
+  actions: write
+  id-token: write
+
+jobs:
+  mirror:
+    uses: AdGuardSoftwareLimited/actions/.github/workflows/mirror.yml@master
+    with:
+      team: extensions
+      target_repo: git@github.com:AdguardTeam/VscodeAdblockSyntax.git
+    secrets: inherit
diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
new file mode 100644
index 0000000..58f3d74
--- /dev/null
+++ b/.github/workflows/prepare-release.yml
@@ -0,0 +1,29 @@
+name: Prepare release
+
+description: >-
+  Opens a release PR that finalizes CHANGELOG.md for the given tag.
+  After merge, publish-release.yml takes over. Odd minor (e.g. v2.1.x) =
+  Marketplace pre-release; even minor (e.g. v2.2.x) = stable.
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: >-
+          Release tag WITH "v" prefix. Odd minor = pre-release channel
+          (e.g. v2.1.5); even minor = stable (e.g. v2.2.0).
+        required: true
+        type: string
+
+# `contents: write` — push the release-bump branch
+# `id-token: write` — Octopass OIDC for PR creation
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  create-release-pr:
+    uses: AdGuardSoftwareLimited/actions/.github/workflows/create-release-pr.yml@master
+    with:
+      tag: ${{ inputs.tag }}
+      team: extensions
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
new file mode 100644
index 0000000..ceb20b5
--- /dev/null
+++ b/.github/workflows/publish-release.yml
@@ -0,0 +1,196 @@
+name: Publish release
+
+description: >-
+  Tags the release commit, builds and packages the .vsix, publishes to
+  VS Marketplace and Open VSX, mirrors to the public repo, creates a
+  GitHub Release, and notifies Slack.
+
+  Note: ext-shared-actions/publish-release.yml is npm-only and is not used
+  here. This workflow reuses org building blocks (tag-from-changelog,
+  mirror-and-release, slack) with a local vsce/ovsx publish step.
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [master]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Ref to publish manually
+        required: false
+        type: string
+
+# Serialize release runs: a manual dispatch must not race the automatic
+# post-merge run during tagging, publishing, and mirroring.
+concurrency:
+  group: publish-release
+  cancel-in-progress: false
+
+jobs:
+  # Only release-bump merges (or manual dispatch) should tag/publish. Without
+  # this, every closed PR against master would start this workflow and rely on
+  # tag-from-changelog internals to no-op.
+  tag:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true &&
+       startsWith(github.event.pull_request.head.ref, 'release-bump/'))
+    uses: AdGuardSoftwareLimited/actions/.github/workflows/tag-from-changelog.yml@master
+    with:
+      ref: ${{ inputs.ref || github.event.pull_request.merge_commit_sha || github.ref_name }}
+      team: extensions
+    permissions:
+      contents: write
+
+  build:
+    name: Test and package
+    needs: tag
+    runs-on: team-extensions
+    outputs:
+      marketplace_prerelease: ${{ steps.flags.outputs.marketplace_prerelease }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.ref || github.event.pull_request.merge_commit_sha || github.ref_name }}
+
+      - name: Inject version into package.json
+        run: npm pkg set version="${{ needs.tag.outputs.version }}"
+
+      # Marketplace / Open VSX only accept major.minor.patch (no -alpha/-beta).
+      # This project uses odd minor versions as the pre-release track (2.1.x),
+      # matching the legacy Bamboo prerelease plans. Also honor semver
+      # prerelease identifiers if a future release uses them.
+      - name: Detect marketplace pre-release
+        id: flags
+        run: |
+          VERSION="${{ needs.tag.outputs.version }}"
+          SEMVER_PRE="${{ needs.tag.outputs.prerelease }}"
+          MINOR="$(echo "${VERSION}" | cut -d. -f2)"
+          MARKETPLACE_PRE=false
+          if [ "${SEMVER_PRE}" = "true" ]; then
+            MARKETPLACE_PRE=true
+          elif [ -n "${MINOR}" ] && [ $((MINOR % 2)) -eq 1 ]; then
+            MARKETPLACE_PRE=true
+          fi
+          echo "marketplace_prerelease=${MARKETPLACE_PRE}" >> "${GITHUB_OUTPUT}"
+          echo "Version ${VERSION}: marketplace pre-release=${MARKETPLACE_PRE}"
+
+      - name: Lint, test, and package via Docker
+        run: |
+          DOCKER_BUILDKIT=1 docker build --progress plain \
+            --target build-output \
+            --build-arg VERSION="${{ needs.tag.outputs.version }}" \
+            --build-arg PRE_RELEASE="${{ steps.flags.outputs.marketplace_prerelease }}" \
+            --output ./artifacts \
+            .
+
+      - name: Upload vsix package
+        uses: actions/upload-artifact@v4
+        with:
+          name: vscode-adblock-vsix
+          path: |
+            artifacts/vscode-adblock.vsix
+            artifacts/adblock.plist
+
+  publish-marketplaces:
+    name: Publish to VS Marketplace and Open VSX
+    needs: [tag, build]
+    runs-on: team-extensions
+    # Marketplaces still use PATs (vsce/ovsx). PATs live in Vault; this job
+    # authenticates to Vault via GitHub OIDC (jwt). See DEPLOYMENT.md.
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.ref || github.event.pull_request.merge_commit_sha || github.ref_name }}
+
+      - name: Download vsix artifact
+        uses: actions/download-artifact@v5
+        with:
+          name: vscode-adblock-vsix
+          path: artifacts
+
+      - name: Fetch marketplace PATs from Vault
+        id: vault
+        uses: hashicorp/vault-action@v4
+        with:
+          url: ${{ vars.VAULT_URL }}
+          method: jwt
+          path: jwt
+          role: ext-vscode-adblock-syntax
+          secrets: |
+            secret/data/ci-secrets/ext-vscode-adblock-syntax vsce_pat | VSCE_PAT ;
+            secret/data/ci-secrets/ext-vscode-adblock-syntax ovsx_pat | OVSX_PAT ;
+
+      - name: Install dependencies (publish CLIs)
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Publish to Visual Studio Marketplace
+        env:
+          VSCE_PAT: ${{ steps.vault.outputs.VSCE_PAT }}
+        run: |
+          if [ -z "${VSCE_PAT}" ]; then
+            echo "VSCE_PAT was not returned from Vault" >&2
+            exit 1
+          fi
+          PRE_ARGS=()
+          if [ "${{ needs.build.outputs.marketplace_prerelease }}" = "true" ]; then
+            PRE_ARGS+=(--pre-release)
+          fi
+          # https://code.visualstudio.com/api/working-with-extensions/publishing-extension
+          pnpm exec vsce publish --pat "${VSCE_PAT}" --no-dependencies "${PRE_ARGS[@]}" \
+            -i artifacts/vscode-adblock.vsix
+
+      - name: Publish to Open VSX
+        env:
+          OVSX_PAT: ${{ steps.vault.outputs.OVSX_PAT }}
+        run: |
+          if [ -z "${OVSX_PAT}" ]; then
+            echo "OVSX_PAT was not returned from Vault" >&2
+            exit 1
+          fi
+          PRE_ARGS=()
+          if [ "${{ needs.build.outputs.marketplace_prerelease }}" = "true" ]; then
+            PRE_ARGS+=(--pre-release)
+          fi
+          # https://github.com/eclipse/openvsx/wiki/Publishing-Extensions
+          pnpm exec ovsx publish artifacts/vscode-adblock.vsix \
+            -p "${OVSX_PAT}" \
+            "${PRE_ARGS[@]}"
+
+  mirror-and-release:
+    needs: [tag, build, publish-marketplaces]
+    uses: AdGuardSoftwareLimited/actions/.github/workflows/mirror-and-release.yml@master
+    with:
+      team: extensions
+      target_repo: AdguardTeam/VscodeAdblockSyntax
+      tag: ${{ needs.tag.outputs.tag }}
+      changelog: ${{ needs.tag.outputs.changelog }}
+      artifact_name: vscode-adblock-vsix
+      # Mark the GitHub Release as a prerelease for odd-minor / semver pre tags.
+      prerelease: ${{ needs.build.outputs.marketplace_prerelease == 'true' }}
+    secrets: inherit
+    permissions:
+      actions: write
+      contents: write
+      id-token: write
+
+  notify:
+    name: Notify
+    needs: [tag, mirror-and-release]
+    if: needs.mirror-and-release.result == 'success'
+    runs-on: team-extensions
+    steps:
+      - name: Send Slack notification
+        uses: AdGuardSoftwareLimited/actions/actions/slack@master
+        with:
+          channel: '#adguard-extension-vcs'
+          message: >-
+            :white_check_mark: *adguard.adblock* *v${{ needs.tag.outputs.version }}*
+            published to VS Marketplace / Open VSX —
+            <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|view run>
+          color: good
diff --git a/.markdownlintignore b/.markdownlintignore
index 386ef0e..19e8983 100644
--- a/.markdownlintignore
+++ b/.markdownlintignore
@@ -1,3 +1,3 @@
 node_modules/
 out/
-LICENSE.md
\ No newline at end of file
+LICENSE.md
diff --git a/AGENTS.md b/AGENTS.md
index 4476ad1..1b07c34 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -93,7 +93,9 @@ It is published to the VSCode Marketplace and Open VSX as `adguard.adblock`.
 ├── tools/                          # Repo build/utility scripts — see tools/AGENTS.md
 ├── test/static/                    # Static fixtures (sample rules, aglint test workspace)
 ├── icons/                          # Extension icons
-└── bamboo-specs/                   # CI/CD pipeline configuration
+├── Dockerfile                      # Multi-stage CI image (test-output / build-output .vsix)
+├── DEPLOYMENT.md                   # Release pipeline, secrets, Docker targets
+└── .github/workflows/              # CI, prepare-release, publish-release, mirror
 ```
 
 Each package has its own `AGENTS.md` with package-specific structure and
@@ -112,6 +114,13 @@ Run from the repository root unless noted. The package manager is pnpm v10.
 - **Clean**: `pnpm clean` (removes generated files / `node_modules`).
 - **Package extension**: `pnpm package` (produces `out/vscode-adblock.vsix`);
   `pnpm package:pre` for a pre-release build.
+- **CI in Docker**: `docker build --target test-output .` (typecheck, lint,
+  test, build); `docker build --target build-output --build-arg VERSION=… --output ./artifacts .`
+  for the `.vsix`. See [DEPLOYMENT.md](DEPLOYMENT.md).
+
+Root `package.json` has **no `version` field** — CI injects it from
+`CHANGELOG.md` before packaging (`vsce` requires a version). Local packages
+need `npm pkg set version=…` or the Docker `VERSION` build arg.
 
 Per-package commands use workspace filters, e.g.:
 
@@ -204,7 +213,7 @@ Layered architecture across the monorepo:
 | Shared contracts | Types/enums used by client and server | [shared/src/index.ts](shared/src/index.ts) |
 | Language server | LSP handlers, linting orchestration, AGLint integration | [server/src/server.ts](server/src/server.ts) |
 | Grammar | TextMate grammar source + compiler | [syntaxes/scripts/build.ts](syntaxes/scripts/build.ts) |
-| Build tooling | Repo-wide build/clean scripts | [tools/build-txt.ts](tools/build-txt.ts) |
+| Build tooling | Repo-wide build/clean scripts | [tools/clean.ts](tools/clean.ts) |
 
 Dependency flow:
 
@@ -321,10 +330,11 @@ for AI agents that consume this documentation as context.
 
 ### Other
 
-- **Versioning**: the extension uses an odd/even minor scheme — even minor
-  versions are releases, odd minor versions are pre-releases (see
-  [DEVELOPMENT.md](DEVELOPMENT.md)). Marketplaces accept only
-  `major.minor.patch`.
+- **Versioning**: root `package.json` has no committed `version` (CI injects
+  it from `CHANGELOG.md`). The extension uses an odd/even minor scheme — even
+  minor versions are releases, odd minor versions are Marketplace pre-releases
+  (see [DEVELOPMENT.md](DEVELOPMENT.md) and [DEPLOYMENT.md](DEPLOYMENT.md)).
+  Marketplaces accept only `major.minor.patch`.
 - **Git hooks**: Husky runs linters and tests on commit; do not bypass hooks
   with `--no-verify`.
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f1d0c30..83cdeb9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [Keep a Changelog]: https://keepachangelog.com/en/1.0.0/
 [Semantic Versioning]: https://semver.org/spec/v2.0.0.html
 
-## Unreleased
+## [Unreleased]
 
 ### Changed
 
@@ -25,7 +25,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#151]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/151
 [#156]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/156
 
-## [2.1.4] (prerelease) - 2025-12-26
+## [2.1.4] - 2025-12-26
 
 ### Added
 
@@ -33,9 +33,8 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 [#140]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/140
 [#155]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/155
-[2.1.4]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/2.1.3...2.1.4
 
-## [2.1.3] (prerelease) - 2025-12-15
+## [2.1.3] - 2025-12-15
 
 ### Changed
 
@@ -45,9 +44,8 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 > **Note:** Starting from v2.1.0, we follow an odd/even versioning scheme for pre-releases.
 > Version 2.1.x will be the pre-release track, and 2.2.0 will be the next stable release.
 
-[2.1.3]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/2.0.4...2.1.3
 
-## [2.0.4] (prerelease) - 2025-11-28
+## [2.0.4] - 2025-11-28
 
 ### Changed
 
@@ -57,9 +55,8 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 - Loading AGLint on Windows.
 
-[2.0.4]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/2.0.3...2.0.4
 
-## [2.0.3] (prerelease) - 2025-11-28
+## [2.0.3] - 2025-11-28
 
 ### Added
 
@@ -81,14 +78,13 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
   This removed `useExternalAglintPackages` setting.
 - `packageManager` setting. It is now detected automatically.
 
-[2.0.3]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/1.1.17...2.0.3
 [#112]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/112
 [#117]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/117
 [#126]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/126
 [#127]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/127
 [#129]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/129
 
-## 1.1.17 - 2024-05-05
+## [1.1.17] - 2024-05-05
 
 ### Added
 
@@ -100,7 +96,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 [#149]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/149
 
-## 1.1.16 - 2025-03-31
+## [1.1.16] - 2025-03-31
 
 ### Added
 
@@ -112,13 +108,13 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 [#147]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/147
 
-## 1.1.15 - 2024-12-20
+## [1.1.15] - 2024-12-20
 
 ### Changed
 
 - Updated integrated [AGLint] to v2.1.3.
 
-## 1.1.14 - 2024-09-21
+## [1.1.14] - 2024-09-21
 
 ### Added
 
@@ -130,19 +126,19 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 [#138]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/138
 
-## 1.1.13 - 2024-09-20
+## [1.1.13] - 2024-09-20
 
 ### Changed
 
 - Updated integrated [AGLint] to v2.1.0.
 
-## 1.1.12 - 2024-09-04
+## [1.1.12] - 2024-09-04
 
 ### Changed
 
 - Updated integrated [AGLint] to v2.0.10.
 
-## 1.1.11 - 2024-08-23
+## [1.1.11] - 2024-08-23
 
 ### Added
 
@@ -150,13 +146,13 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 [FiltersCompiler#226]: https://github.com/AdguardTeam/FiltersCompiler/issues/226
 
-## 1.1.10 - 2024-04-26
+## [1.1.10] - 2024-04-26
 
 ### Changed
 
 - Updated integrated [AGLint] to v2.0.9.
 
-## 1.1.8 - 2024-04-03
+## [1.1.8] - 2024-04-03
 
 ### Fixed
 
@@ -164,7 +160,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 [#132]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/132
 
-## 1.1.7 - 2024-01-10
+## [1.1.7] - 2024-01-10
 
 ### Added
 
@@ -178,7 +174,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#122]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/122
 [#123]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/123
 
-## 1.1.6 - 2024-01-04
+## [1.1.6] - 2024-01-04
 
 ### Fixed
 
@@ -186,7 +182,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 [#113]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/113
 
-## 1.1.5 - 2023-11-10
+## [1.1.5] - 2023-11-10
 
 ### Added
 
@@ -205,7 +201,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#102]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/102
 [#119]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/119
 
-## 1.1.3 - 2023-11-08
+## [1.1.3] - 2023-11-08
 
 ### Added
 
@@ -229,20 +225,20 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#114]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/114
 [#115]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/115
 
-## 1.1.2 - 2023-09-07
+## [1.1.2] - 2023-09-07
 
 ### Changed
 
 - Updated integrated [AGLint] to v2.0.5.
 
-## 1.1.1 - 2023-08-30
+## [1.1.1] - 2023-08-30
 
 ### Changed
 
 - Updated integrated [AGLint] to v2.0.4.
 
 
-## 1.1.0 - 2023-08-14
+## [1.1.0] - 2023-08-14
 
 ### Added
 
@@ -274,7 +270,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#107]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/107
 [#108]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/108
 
-## 1.0.1 - 2023-04-25
+## [1.0.1] - 2023-04-25
 
 ### Added
 
@@ -295,7 +291,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#56]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/56
 [#59]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/59
 
-## 0.0.28 - 2022-11-11
+## [0.0.28] - 2022-11-11
 
 ### Added
 
@@ -314,7 +310,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#53]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/53
 [#54]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/54
 
-## 0.0.27 - 2022-08-15
+## [0.0.27] - 2022-08-15
 
 ### Added
 
@@ -327,7 +323,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#25]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/25
 [#49]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/49
 
-## 0.0.26 - 2022-05-29
+## [0.0.26] - 2022-05-29
 
 ### Added
 
@@ -335,7 +331,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 [#47]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/47
 
-## 0.0.25 - 2021-11-11
+## [0.0.25] - 2021-11-11
 
 ### Added
 
@@ -343,7 +339,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 [#46]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/46
 
-## 0.0.23 - 2021-05-31
+## [0.0.23] - 2021-05-31
 
 ### Fixed
 
@@ -351,7 +347,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 [#44]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/44
 
-## 0.0.22 - 2021-05-30
+## [0.0.22] - 2021-05-30
 
 ### Added
 
@@ -376,13 +372,13 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#42]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/42
 [#43]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/43
 
-## 0.0.21 - 2020-10-05
+## [0.0.21] - 2020-10-05
 
 ### Added
 
 - Support for `$denyallow` and `$redirect-rule` modifiers.
 
-## 0.0.20 - 2020-10-05
+## [0.0.20] - 2020-10-05
 
 ### Added
 
@@ -400,7 +396,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#34]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/34
 [#35]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/35
 
-## 0.0.19 - 2019-05-26
+## [0.0.19] - 2019-05-26
 
 ### Added
 
@@ -415,13 +411,13 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#28]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/28
 [#29]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/29
 
-## 0.0.18 - 2019-05-17
+## [0.0.18] - 2019-05-17
 
 ### Fixed
 
 - Domains with `-` are marked as invalid [#27].
 
-## 0.0.16 - 2019-05-16
+## [0.0.16] - 2019-05-16
 
 ### Changed
 
@@ -437,7 +433,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#26]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/26
 [#27]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/27
 
-## 0.0.15 - 2019-04-06
+## [0.0.15] - 2019-04-06
 
 ### Added
 
@@ -450,7 +446,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#14]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/14
 [#18]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/18
 
-## 0.0.14 - 2019-04-06
+## [0.0.14] - 2019-04-06
 
 ### Added
 
@@ -464,13 +460,13 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#19]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/19
 [#20]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/20
 
-## 0.0.12 - 2018-10-18
+## [0.0.12] - 2018-10-18
 
 ### Added
 
 - Hints and pre-processor syntax.
 
-## 0.0.11 - 2018-08-30
+## [0.0.11] - 2018-08-30
 
 ### Fixed
 
@@ -478,7 +474,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 [#13]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/13
 
-## 0.0.9 - 2018-08-30
+## [0.0.9] - 2018-08-30
 
 ### Added
 
@@ -493,7 +489,7 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#11]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/11
 [#12]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/12
 
-## 0.0.8 - 2018-01-16
+## [0.0.8] - 2018-01-16
 
 ### Added
 
@@ -508,26 +504,26 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 [#6]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/6
 [#8]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/8
 
-## 0.0.6 - 2018-01-15
+## [0.0.6] - 2018-01-15
 
 ### Changed
 
 - Improve extension's description & meta data.
 
-## 0.0.5 - 2017-12-29
+## [0.0.5] - 2017-12-29
 
 ### Fixed
 
 - `punycode` domains handling.
 
-## 0.0.4 - 2017-12-29
+## [0.0.4] - 2017-12-29
 
 ### Fixed
 
 - CSS selector regular expression.
 - CSS rules detection.
 
-## 0.0.2 - 2017-12-29
+## [0.0.2] - 2017-12-29
 
 ### Fixed
 
@@ -536,10 +532,55 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 
 [#1]: https://github.com/AdguardTeam/VscodeAdblockSyntax/issues/1
 
-## 0.0.1 - 2017-12-29
+## [0.0.1] - 2017-12-29
 
 ### Added
 
 - Initial release
 
 [AGLint]: https://github.com/AdguardTeam/AGLint/blob/master/CHANGELOG.md
+
+[Unreleased]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v2.1.4...HEAD
+[2.1.4]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v2.1.3...v2.1.4
+[2.1.3]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v2.0.4...v2.1.3
+[2.0.4]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v2.0.3...v2.0.4
+[2.0.3]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.17...v2.0.3
+[1.1.17]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.16...v1.1.17
+[1.1.16]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.15...v1.1.16
+[1.1.15]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.14...v1.1.15
+[1.1.14]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.13...v1.1.14
+[1.1.13]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.12...v1.1.13
+[1.1.12]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.11...v1.1.12
+[1.1.11]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.10...v1.1.11
+[1.1.10]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.8...v1.1.10
+[1.1.8]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.7...v1.1.8
+[1.1.7]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.6...v1.1.7
+[1.1.6]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.5...v1.1.6
+[1.1.5]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.3...v1.1.5
+[1.1.3]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.2...v1.1.3
+[1.1.2]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.1...v1.1.2
+[1.1.1]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.1.0...v1.1.1
+[1.1.0]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v1.0.1...v1.1.0
+[1.0.1]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.28...v1.0.1
+[0.0.28]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.27...v0.0.28
+[0.0.27]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.26...v0.0.27
+[0.0.26]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.25...v0.0.26
+[0.0.25]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.23...v0.0.25
+[0.0.23]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.22...v0.0.23
+[0.0.22]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.21...v0.0.22
+[0.0.21]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.20...v0.0.21
+[0.0.20]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.19...v0.0.20
+[0.0.19]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.18...v0.0.19
+[0.0.18]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.16...v0.0.18
+[0.0.16]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.15...v0.0.16
+[0.0.15]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.14...v0.0.15
+[0.0.14]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.12...v0.0.14
+[0.0.12]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.11...v0.0.12
+[0.0.11]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.9...v0.0.11
+[0.0.9]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.8...v0.0.9
+[0.0.8]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.6...v0.0.8
+[0.0.6]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.5...v0.0.6
+[0.0.5]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.4...v0.0.5
+[0.0.4]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.2...v0.0.4
+[0.0.2]: https://github.com/AdguardTeam/VscodeAdblockSyntax/compare/v0.0.1...v0.0.2
+[0.0.1]: https://github.com/AdguardTeam/VscodeAdblockSyntax/releases/tag/v0.0.1
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 57fbb3d..314ceae 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -11,4 +11,11 @@ For detailed setup instructions, build commands, testing, and the full
 development workflow, see [DEVELOPMENT.md](DEVELOPMENT.md). For code guidelines
 and architecture, see [AGENTS.md](AGENTS.md).
 
+## Releasing
+
+`package.json` intentionally has no `version` field — the release version is
+derived from `CHANGELOG.md` and injected by CI before packaging the `.vsix`.
+Releases are fully automated via GitHub Actions (VS Marketplace + Open VSX +
+public mirror). See [DEPLOYMENT.md](DEPLOYMENT.md) for the complete pipeline.
+
 [contribute]: https://adguard.com/contribute.html
diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md
new file mode 100644
index 0000000..7e209be
--- /dev/null
+++ b/DEPLOYMENT.md
@@ -0,0 +1,180 @@
+# Deployment — adguard.adblock (VS Code extension)
+
+- [Deployment Summary](#deployment-summary)
+- [Release Pipeline](#release-pipeline)
+- [CI/CD](#cicd)
+- [Environment Variables and Secrets](#environment-variables-and-secrets)
+- [Infrastructure Dependencies](#infrastructure-dependencies)
+- [Integrations](#integrations)
+- [Error Reporting](#error-reporting)
+- [Docker Build](#docker-build)
+- [Gaps and Follow-ups](#gaps-and-follow-ups)
+
+## Deployment Summary
+
+| Parameter | Value |
+| --- | --- |
+| **Marketplace id** | `adguard.adblock` |
+| **Artifact** | `vscode-adblock.vsix` |
+| **Public mirror** | `AdguardTeam/VscodeAdblockSyntax` |
+| **Publish targets** | VS Marketplace, Open VSX |
+| **Slack channel** | `#adguard-extension-vcs` |
+| **Runner label** | `team-extensions` |
+
+## Release Pipeline
+
+This is a **VS Code extension**, not an npm package. The shared
+[ext-shared-actions][ext-shared-actions] `publish-release.yml` (npm OIDC +
+`.tgz`) is **not** used. The repo-local
+[`.github/workflows/publish-release.yml`](.github/workflows/publish-release.yml)
+reuses org building blocks and adds a local vsce/ovsx publish step.
+
+In short:
+
+1. A maintainer runs `prepare-release.yml` manually with a target tag
+   (e.g. `v2.2.0` or `v2.1.5`) to open a release-bump PR that finalizes
+   `CHANGELOG.md`.
+2. Merging the release-bump PR triggers `publish-release.yml`, which:
+   - tags the release commit from `CHANGELOG.md` (`tag-from-changelog`);
+   - builds, tests, and packages the `.vsix` in Docker;
+   - publishes to **VS Marketplace** (`vsce publish`) and **Open VSX**
+     (`ovsx publish`);
+   - mirrors the tag to `AdguardTeam/VscodeAdblockSyntax` and creates a
+     GitHub Release with the `.vsix` attached (`mirror-and-release`);
+   - notifies Slack (`#adguard-extension-vcs`).
+
+### Pre-releases
+
+VS Marketplace / Open VSX accept only `major.minor.patch` (no `-alpha` /
+`-beta` suffixes). This project keeps the **odd/even minor** scheme:
+
+- even minor (`2.0.x`, `2.2.x`) — stable release;
+- odd minor (`2.1.x`, `2.3.x`) — Marketplace / Open VSX **pre-release**
+  channel (`vsce`/`ovsx --pre-release`), GitHub Release marked prerelease.
+
+This replaces the separate Bamboo build-prerelease / deploy-prerelease plans.
+Keep pre-release versions numerically higher than the latest stable so the
+editor does not downgrade pre-release users.
+
+## CI/CD
+
+| Workflow | Trigger | Purpose |
+| --- | --- | --- |
+| `ci.yml` | PRs and pushes to `master` | Lint, test, build; upload `.vsix` |
+| `prepare-release.yml` | Manual (`workflow_dispatch`) | Open release-bump PR for changelog |
+| `publish-release.yml` | Release PR merged or re-run | Tag, build, publish, mirror, Slack |
+| `mirror.yml` | Push to `master` | Mirror to `AdguardTeam/VscodeAdblockSyntax` |
+
+Self-hosted jobs run on the `team-extensions` runner label. Org reusable
+workflows come from [AdGuardSoftwareLimited/actions][actions].
+
+**Concurrency**: `ci.yml` uses
+`ci-ext-vscode-adblock-syntax-${{ github.ref }}` with
+`cancel-in-progress: true`. `publish-release.yml` uses `publish-release`
+with `cancel-in-progress: false` to serialize releases.
+
+## Environment Variables and Secrets
+
+Runtime extension code needs no CI-specific environment variables.
+
+Publish still uses long-lived marketplace PATs (`vsce` / `ovsx` do not use
+Marketplace OIDC here). The PATs are **not** GitHub Actions secrets — CI
+loads them from Vault via GitHub OIDC (JWT):
+
+| Item | Value |
+| --- | --- |
+| Vault URL | `vars.VAULT_URL` (org variable) |
+| Auth | `method: jwt`, `path: jwt` |
+| Role | `ext-vscode-adblock-syntax` |
+| Secret path | `secret/data/ci-secrets/ext-vscode-adblock-syntax` |
+| Fields | `vsce_pat`, `ovsx_pat` (lowercase) |
+
+- **`vsce_pat`** — Azure DevOps PAT with Marketplace publish scope for the
+  `adguard` publisher (was Bamboo `vsceTokenPassword`).
+- **`ovsx_pat`** — Open VSX personal access token (was Bamboo
+  `openVsxTokenPassword`).
+
+The publish job needs `permissions.id-token: write` so
+`hashicorp/vault-action@v4` can mint the JWT. Octopass / Slack / mirror
+credentials stay on the shared org workflows (see
+[Gaps and Follow-ups](#gaps-and-follow-ups)).
+
+## Infrastructure Dependencies
+
+Stateless VS Code extension — no database, cache, or message queue.
+Distribution is via VS Marketplace, Open VSX, and the public GitHub mirror.
+
+## Integrations
+
+| Integration | Purpose | Configuration |
+| --- | --- | --- |
+| **Vault (ci-secrets)** | Marketplace PATs at publish time | OIDC JWT → role `ext-vscode-adblock-syntax` |
+| **VS Marketplace** | Extension distribution | Vault `vsce_pat` + `vsce publish --pat` |
+| **Open VSX** | Extension distribution | Vault `ovsx_pat` + `ovsx publish` |
+| **GitHub mirror** | Public mirror + Release | Octopass OIDC via shared workflows |
+| **Slack** | Release notifications | `#adguard-extension-vcs` |
+
+## Error Reporting
+
+This project does **not** use an error reporting service (Sentry, Bugsnag,
+or equivalent). Failures surface in CI logs and marketplace publish errors.
+
+## Docker Build
+
+The `Dockerfile` uses multi-stage builds based on `adguard/node-ssh:22.22--0`:
+
+| Stage | Purpose | Key Steps |
+| --- | --- | --- |
+| `base` | Shared foundation | Node.js 22, pnpm from base image |
+| `deps` | Dependency cache | Workspace manifests + frozen install |
+| `source` | Full source | Copies project files over `deps` |
+| `test-output` | CI validation | Typecheck, lint, test, production build |
+| `build-output` | Artifact creation | Validation + `pnpm package` / `package:pre` |
+
+The pnpm store cache is mounted at `/pnpm-store` with id `vscode-adblock-pnpm`.
+
+### Local Build Commands
+
+```bash
+# Run CI validation (typecheck + lint + test + build)
+docker build --target test-output .
+
+# Produce the release artifact
+docker build --platform linux/amd64 --target build-output \
+   --build-arg VERSION=0.0.0-dev --output ./artifacts .
+# → ./artifacts/vscode-adblock.vsix
+```
+
+`package.json` intentionally has no `version` field — CI injects the release
+version before packaging, and `vsce` requires one. Pass a placeholder via the
+`VERSION` build arg for local packaging. Set `PRE_RELEASE=true` to package with
+`vsce --pre-release`.
+
+## Gaps and Follow-ups
+
+Out of scope for this repository PR / already handled outside it:
+
+1. **Vault ci-secrets** — `ci-secrets/ext-vscode-adblock-syntax` with role
+   `ext-vscode-adblock-syntax` and fields `vsce_pat` / `ovsx_pat` (done by
+   infra). Confirm the JWT role is bound to this repo +
+   `publish-release.yml` (or the expected `job_workflow_ref`) before the
+   first release.
+2. **Optional GitHub Environment** — e.g. `marketplace` with required
+   reviewers in `terraform-github` (similar to the `npm` environment used by
+   library packages). Not wired yet so the first publish is not blocked on a
+   missing environment.
+3. **Octopass grants** — ensure `ext-vscode-adblock-syntax` is on
+   `common-mirroring`, `keepchangelog-release-flow`, and
+   `public-release-create` in microservices `grants.yaml` (private +
+   `AdguardTeam/VscodeAdblockSyntax`). See
+   https://github.com/AdGuardSoftwareLimited/microservices/pull/243.
+4. **disallow-issue-refs** — add `ext-vscode-adblock-syntax` to the org
+   ruleset in `terraform-github` (mirrored repo must not use bare `#123` in
+   commits). See
+   https://github.com/AdGuardSoftwareLimited/terraform-github/pull/226.
+5. **Shared actions gap** — there is no org-wide
+   `deploy-to-vscode-marketplace` reusable workflow yet. Publish steps live
+   in this repo until one exists.
+
+[ext-shared-actions]: https://github.com/AdGuardSoftwareLimited/ext-shared-actions
+[actions]: https://github.com/AdGuardSoftwareLimited/actions
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index ab190c3..f211173 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -92,7 +92,8 @@ packages plus supporting folders:
 ├── tools/          # Repo build/utility scripts
 ├── test/           # Static fixtures (sample rules, AGLint test workspace)
 ├── icons/          # Extension icons
-└── bamboo-specs/   # CI/CD pipeline configuration
+├── Dockerfile      # Multi-stage CI image (lint/test/build + .vsix package)
+└── .github/        # GitHub Actions (CI, release, mirror)
 ```
 
 The dependency direction is one-way: `client` and `server` depend on `shared`;
@@ -191,9 +192,8 @@ Run from the repository root with pnpm v10:
 | `pnpm lint:code` | Lint code with ESLint (cached). |
 | `pnpm lint:md` | Lint Markdown with markdownlint. |
 | `pnpm clean` | Remove generated files / `node_modules`. |
-| `pnpm package` | Package the extension into `out/vscode-adblock.vsix`. |
+| `pnpm package` | Package the extension into `out/vscode-adblock.vsix` (requires `version` in package.json). |
 | `pnpm package:pre` | Package a pre-release build (`--pre-release`). |
-| `pnpm increment` | Increment the patch version (used by CI). |
 
 ### Updating syntax highlighting
 
@@ -236,12 +236,23 @@ Each package guide documents its own commands:
 
 ### Versioning
 
+`package.json` has **no committed `version` field**. The release version is
+taken from `CHANGELOG.md` and injected by CI before packaging. For a local
+`.vsix`, set a version first:
+
+```bash
+npm pkg set version=0.0.0-dev
+pnpm build && pnpm package
+```
+
 The extension uses an **odd/even minor** scheme: even minor versions are
-releases (`2.0.0`, `2.2.0`), odd minor versions are pre-releases (`2.1.0`,
-`2.3.0`). VSCode Marketplace and Open VSX accept only `major.minor.patch` — no
-`-alpha`/`-beta` suffixes. Always keep pre-release versions higher than the
+releases (`2.0.0`, `2.2.0`), odd minor versions are Marketplace / Open VSX
+pre-releases (`2.1.0`, `2.3.0`). Registries accept only `major.minor.patch` —
+no `-alpha`/`-beta` suffixes. Always keep pre-release versions higher than the
 latest release so VSCode does not downgrade pre-release users.
 
+Releases are automated via GitHub Actions — see [DEPLOYMENT.md](DEPLOYMENT.md).
+
 ## Troubleshooting
 
 - **Changes not visible in the Extension Development Host**: reload the host
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..f676513
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,92 @@
+# Multi-stage Dockerfile for the VS Code adblock extension monorepo.
+# Dependencies are cached until package manifests / lockfile change.
+# Each stage can be built independently via --target.
+
+FROM adguard/node-ssh:22.22--0 AS base
+SHELL ["/bin/bash", "-lc"]
+
+WORKDIR /extension
+
+# pnpm store directory — set once here, no need for pnpm config set in every RUN
+ENV npm_config_store_dir=/pnpm-store
+
+# ============================================================================
+# Stage: deps
+# Cached until package.json / workspace manifests / lockfile change
+# ============================================================================
+FROM base AS deps
+
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY client/package.json ./client/
+COPY server/package.json ./server/
+COPY shared/package.json ./shared/
+COPY syntaxes/package.json ./syntaxes/
+COPY tools/package.json ./tools/
+COPY test/static/aglint/package.json ./test/static/aglint/
+
+# --ignore-scripts: skips husky install (prepare script) which requires a git repo
+RUN --mount=type=cache,target=/pnpm-store,id=vscode-adblock-pnpm \
+    pnpm install \
+        --frozen-lockfile \
+        --ignore-scripts \
+        --prefer-offline
+
+# ============================================================================
+# Stage: source
+# Cached until source code changes
+# ============================================================================
+FROM deps AS source
+
+COPY . /extension
+
+# ============================================================================
+# Stage: test-output
+# Runs typecheck, lint, tests, and production build.
+# Used as the CI validation target: `docker build --target test-output .`
+# fails if any step fails.
+# ============================================================================
+FROM source AS test-output
+
+RUN --mount=type=cache,target=/pnpm-store,id=vscode-adblock-pnpm \
+    pnpm --filter @vscode-adblock-syntax/shared build && \
+    pnpm test:compile && \
+    pnpm lint:md && \
+    pnpm lint:code && \
+    pnpm test && \
+    pnpm build
+
+# ============================================================================
+# Stage: build
+# Builds the extension and packages a .vsix for publishing / release assets.
+# ============================================================================
+FROM source AS build
+
+# Optional package version for local builds. CI injects the release version
+# into package.json before building the image; locally this arg is required
+# because package.json has no version field and vsce needs one.
+ARG VERSION=""
+
+# When true, package with `vsce package --pre-release` (Marketplace pre-release).
+ARG PRE_RELEASE="false"
+
+RUN --mount=type=cache,target=/pnpm-store,id=vscode-adblock-pnpm \
+    if [ -n "${VERSION}" ]; then npm pkg set version="${VERSION}"; fi && \
+    pnpm --filter @vscode-adblock-syntax/shared build && \
+    pnpm test:compile && \
+    pnpm lint:md && \
+    pnpm lint:code && \
+    pnpm test && \
+    pnpm build && \
+    if [ "${PRE_RELEASE}" = "true" ]; then \
+        pnpm package:pre; \
+    else \
+        pnpm package; \
+    fi && \
+    mkdir -p /out/artifacts && \
+    cp out/vscode-adblock.vsix /out/artifacts/ && \
+    if [ -f syntaxes/out/adblock.plist ]; then \
+        cp syntaxes/out/adblock.plist /out/artifacts/; \
+    fi
+
+FROM scratch AS build-output
+COPY --from=build /out/artifacts/ /
diff --git a/README.md b/README.md
index cdbf56e..3a4e73c 100644
--- a/README.md
+++ b/README.md
@@ -202,6 +202,10 @@ Made with ❤️ by [AdGuard][adguard]
 
 </div>
 
+> **Note:** Development takes place in a private repository and is mirrored to
+> [AdguardTeam/VscodeAdblockSyntax][mirror] for public visibility. Issues and
+> feature requests should be opened on the public mirror.
+
 <!-- Link Definitions -->
 [adguard]: https://adguard.com
 [aglint]: https://github.com/AdguardTeam/AGLint
@@ -216,6 +220,7 @@ Made with ❤️ by [AdGuard][adguard]
 [license]: LICENSE.md
 [linguist]: https://github.com/github/linguist
 [marketplace]: https://marketplace.visualstudio.com/items?itemName=adguard.adblock
+[mirror]: https://github.com/AdguardTeam/VscodeAdblockSyntax
 [openvsx]: https://open-vsx.org/extension/adguard/adblock
 
 <!-- Resource Links -->
diff --git a/bamboo-specs/bamboo.yaml b/bamboo-specs/bamboo.yaml
deleted file mode 100644
index 83d7aee..0000000
--- a/bamboo-specs/bamboo.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-!include 'test.yaml'
----
-!include 'increment.yaml'
----
-!include 'build.yaml'
----
-!include 'build-prerelease.yaml'
----
-!include 'deploy.yaml'
----
-!include 'deploy-prerelease.yaml'
----
-!include 'permissions.yaml'
----
-!include 'permissions-prerelease.yaml'
diff --git a/bamboo-specs/build-prerelease.yaml b/bamboo-specs/build-prerelease.yaml
deleted file mode 100644
index 89bc629..0000000
--- a/bamboo-specs/build-prerelease.yaml
+++ /dev/null
@@ -1,129 +0,0 @@
----
-version: 2
-plan:
-  project-key: AJL
-  key: VSCODEADBLOCKSYNTAXBUILDPRERELEASE
-  name: vscode adblock syntax - build prerelease
-variables:
-  dockerNode: adguard/node-ssh:22.22--0
-
-stages:
-  - Build:
-      manual: false
-      final: false
-      jobs:
-        - Build
-
-Build:
-  key: BUILD
-  other:
-    clean-working-dir: true
-  docker:
-    image: ${bamboo.dockerNode}
-    volumes:
-      ${system.PNPM_DIR}: "${bamboo.cachePnpm}"
-  tasks:
-    - checkout:
-        force-clean-build: true
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -e
-            set -x
-
-            # Fix mixed logs
-            exec 2>&1
-
-            ls -laht
-
-            # Set cache directory
-            pnpm config set store-dir ${bamboo.cachePnpm}
-
-            # Install dependencies
-            pnpm install
-
-            # Build shared library first (required by client and server)
-            pnpm --filter @vscode-adblock-syntax/shared build
-
-            # Check TypeScript types
-            pnpm test:compile
-
-            # Run markdownlint
-            pnpm lint:md
-
-            # Run ESLint
-            pnpm lint:code
-
-            # Run Vitest tests
-            pnpm test
-
-            # Create production build
-            pnpm build
-
-            # Package build into .vsix file
-            pnpm package:pre
-
-            # Show tree of files in .vsix file
-            pnpm exec vsce ls --tree
-
-            # Create build.txt file with version
-            pnpm exec tsx tools/build-txt.ts
-    - inject-variables:
-        file: out/build.txt
-        scope: RESULT
-        namespace: inject
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |
-            set -e
-
-            # Extract related changes from changelog
-            pnpm exec changelog-tools extract --extract-version ${bamboo.inject.version} > ./EXTRACTED_CHANGES.md
-    - any-task:
-        plugin-key: com.atlassian.bamboo.plugins.vcs:task.vcs.tagging
-        configuration:
-          selectedRepository: defaultRepository
-          tagName: v${bamboo.inject.version}
-  final-tasks:
-    - script:
-        interpreter: SHELL
-        scripts:
-          - "./bamboo-specs/scripts/cleanup.sh out/vscode-adblock.vsix,syntaxes/out/adblock.plist,EXTRACTED_CHANGES.md,out/build.txt"
-  # Store the .vsix file as a build artifact
-  artifacts:
-    - name: vscode-adblock.vsix
-      location: out
-      pattern: vscode-adblock.vsix
-      shared: true
-      required: true
-    - name: EXTRACTED_CHANGES.md
-      location: .
-      pattern: EXTRACTED_CHANGES.md
-      shared: true
-      required: true
-    - name: adblock.plist
-      location: syntaxes/out
-      pattern: adblock.plist
-      shared: true
-      required: true
-    - name: build.txt
-      location: out
-      pattern: build.txt
-      shared: true
-      required: true
-  requirements:
-    - extension: 'true'
-
-triggers: []
-
-branches:
-  create: manually
-  delete: never
-  link-to-jira: true
-
-labels: []
-
-other:
-  concurrent-build-plugin: system-default
diff --git a/bamboo-specs/build.yaml b/bamboo-specs/build.yaml
deleted file mode 100644
index ac16ade..0000000
--- a/bamboo-specs/build.yaml
+++ /dev/null
@@ -1,129 +0,0 @@
----
-version: 2
-plan:
-  project-key: AJL
-  key: VSCODEADBLOCKSYNTAXBUILD
-  name: vscode adblock syntax - build release
-variables:
-  dockerNode: adguard/node-ssh:22.22--0
-
-stages:
-  - Build:
-      manual: false
-      final: false
-      jobs:
-        - Build
-
-Build:
-  key: BUILD
-  other:
-    clean-working-dir: true
-  docker:
-    image: ${bamboo.dockerNode}
-    volumes:
-      ${system.PNPM_DIR}: "${bamboo.cachePnpm}"
-  tasks:
-    - checkout:
-        force-clean-build: true
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -e
-            set -x
-
-            # Fix mixed logs
-            exec 2>&1
-
-            ls -laht
-
-            # Set cache directory
-            pnpm config set store-dir ${bamboo.cachePnpm}
-
-            # Install dependencies
-            pnpm install
-
-            # Build shared library first (required by client and server)
-            pnpm --filter @vscode-adblock-syntax/shared build
-
-            # Check TypeScript types
-            pnpm test:compile
-
-            # Run markdownlint
-            pnpm lint:md
-
-            # Run ESLint
-            pnpm lint:code
-
-            # Run Vitest tests
-            pnpm test
-
-            # Create production build
-            pnpm build
-
-            # Package build into .vsix file
-            pnpm package
-
-            # Show tree of files in .vsix file
-            pnpm exec vsce ls --tree
-
-            # Create build.txt file with version
-            pnpm exec tsx tools/build-txt.ts
-    - inject-variables:
-        file: out/build.txt
-        scope: RESULT
-        namespace: inject
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |
-            set -e
-
-            # Extract related changes from changelog
-            pnpm exec changelog-tools extract --extract-version ${bamboo.inject.version} > ./EXTRACTED_CHANGES.md
-    - any-task:
-        plugin-key: com.atlassian.bamboo.plugins.vcs:task.vcs.tagging
-        configuration:
-          selectedRepository: defaultRepository
-          tagName: v${bamboo.inject.version}
-  final-tasks:
-    - script:
-        interpreter: SHELL
-        scripts:
-          - "./bamboo-specs/scripts/cleanup.sh out/vscode-adblock.vsix,syntaxes/out/adblock.plist,EXTRACTED_CHANGES.md,out/build.txt"
-  # Store the .vsix file as a build artifact
-  artifacts:
-    - name: vscode-adblock.vsix
-      location: out
-      pattern: vscode-adblock.vsix
-      shared: true
-      required: true
-    - name: EXTRACTED_CHANGES.md
-      location: .
-      pattern: EXTRACTED_CHANGES.md
-      shared: true
-      required: true
-    - name: adblock.plist
-      location: syntaxes/out
-      pattern: adblock.plist
-      shared: true
-      required: true
-    - name: build.txt
-      location: out
-      pattern: build.txt
-      shared: true
-      required: true
-  requirements:
-    - extension: 'true'
-
-triggers: []
-
-branches:
-  create: manually
-  delete: never
-  link-to-jira: true
-
-labels: []
-
-other:
-  concurrent-build-plugin: system-default
diff --git a/bamboo-specs/deploy-prerelease.yaml b/bamboo-specs/deploy-prerelease.yaml
deleted file mode 100644
index 9d70ad6..0000000
--- a/bamboo-specs/deploy-prerelease.yaml
+++ /dev/null
@@ -1,124 +0,0 @@
----
-version: 2
-deployment:
-  name: VSCode Adblock Syntax - Deploy Prerelease
-  source-plan: AJL-VSCODEADBLOCKSYNTAXBUILDPRERELEASE
-release-naming: ${bamboo.inject.version}
-environments:
-  - marketplace.visualstudio.com
-  - open-vsx.org
-  - GitHub
-
-marketplace.visualstudio.com:
-  docker:
-    image: adguard/node-ssh:22.22--0
-    volumes:
-      ${system.PNPM_DIR}: "${bamboo.cachePnpm}"
-  triggers: []
-  tasks:
-    - checkout:
-        force-clean-build: 'true'
-    - artifact-download:
-        artifacts:
-          - name: vscode-adblock.vsix
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -e
-            set -x
-
-            # Fix mixed logs
-            exec 2>&1
-
-            ls -laht
-
-            # Set cache directory
-            pnpm config set store-dir ${bamboo.cachePnpm}
-
-            # Install dependencies
-            pnpm install
-
-            # https://code.visualstudio.com/api/working-with-extensions/publishing-extension#publish-an-extension
-            # https://github.com/microsoft/vscode-vsce/issues/421#issuecomment-1038911725
-            pnpm vsce publish --no-dependencies -p ${bamboo.vsceTokenPassword} --pre-release -i vscode-adblock.vsix
-  final-tasks:
-    - script:
-        interpreter: SHELL
-        scripts:
-          - "./bamboo-specs/scripts/cleanup.sh"
-  requirements:
-    - extension: 'true'
-
-open-vsx.org:
-  docker:
-    image: adguard/node-ssh:22.22--0
-    volumes:
-      ${system.PNPM_DIR}: "${bamboo.cachePnpm}"
-  triggers: []
-  tasks:
-    - checkout:
-        force-clean-build: 'true'
-    - artifact-download:
-        artifacts:
-          - name: vscode-adblock.vsix
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -e
-            set -x
-
-            # Fix mixed logs
-            exec 2>&1
-
-            ls -laht
-
-            # Set cache directory
-            pnpm config set store-dir ${bamboo.cachePnpm}
-
-            # Install dependencies
-            pnpm install
-
-            # https://github.com/eclipse/openvsx/wiki/Publishing-Extensions#5-package-and-upload
-            pnpm ovsx publish vscode-adblock.vsix -p ${bamboo.openVsxTokenPassword} --pre-release
-  final-tasks:
-    - script:
-        interpreter: SHELL
-        scripts:
-          - "./bamboo-specs/scripts/cleanup.sh"
-  requirements:
-    - extension: 'true'
-
-GitHub:
-  triggers: []
-  tasks:
-    - clean
-    - checkout:
-        repository: bamboo-deploy-publisher
-        path: bamboo-deploy-publisher
-        force-clean-build: true
-    - artifact-download:
-        artifacts:
-          - name: vscode-adblock.vsix
-          - name: EXTRACTED_CHANGES.md
-          - name: adblock.plist
-          - name: build.txt
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -x
-            set -e
-
-            # Fix mixed logs
-            exec 2>&1
-
-            ls -laht
-
-            # publish to Github Releases
-            GITHUB_TOKEN="${bamboo.githubPublicRepoPassword}" \
-            ./bamboo-deploy-publisher/deploy.sh vscode-adblock-syntax-github-prerelease
-  final-tasks: []
-  requirements:
-    - extension: 'true'
diff --git a/bamboo-specs/deploy.yaml b/bamboo-specs/deploy.yaml
deleted file mode 100644
index 3f78a7f..0000000
--- a/bamboo-specs/deploy.yaml
+++ /dev/null
@@ -1,124 +0,0 @@
----
-version: 2
-deployment:
-  name: VSCode Adblock Syntax - Deploy
-  source-plan: AJL-VSCODEADBLOCKSYNTAXBUILD
-release-naming: ${bamboo.inject.version}
-environments:
-  - marketplace.visualstudio.com
-  - open-vsx.org
-  - GitHub
-
-marketplace.visualstudio.com:
-  docker:
-    image: adguard/node-ssh:22.22--0
-    volumes:
-      ${system.PNPM_DIR}: "${bamboo.cachePnpm}"
-  triggers: []
-  tasks:
-    - checkout:
-        force-clean-build: 'true'
-    - artifact-download:
-        artifacts:
-          - name: vscode-adblock.vsix
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -e
-            set -x
-
-            # Fix mixed logs
-            exec 2>&1
-
-            ls -laht
-
-            # Set cache directory
-            pnpm config set store-dir ${bamboo.cachePnpm}
-
-            # Install dependencies
-            pnpm install
-
-            # https://code.visualstudio.com/api/working-with-extensions/publishing-extension#publish-an-extension
-            # https://github.com/microsoft/vscode-vsce/issues/421#issuecomment-1038911725
-            pnpm vsce publish --no-dependencies -p ${bamboo.vsceTokenPassword} -i vscode-adblock.vsix
-  final-tasks:
-    - script:
-        interpreter: SHELL
-        scripts:
-          - "./bamboo-specs/scripts/cleanup.sh"
-  requirements:
-    - extension: 'true'
-
-open-vsx.org:
-  docker:
-    image: adguard/node-ssh:22.22--0
-    volumes:
-      ${system.PNPM_DIR}: "${bamboo.cachePnpm}"
-  triggers: []
-  tasks:
-    - checkout:
-        force-clean-build: 'true'
-    - artifact-download:
-        artifacts:
-          - name: vscode-adblock.vsix
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -e
-            set -x
-
-            # Fix mixed logs
-            exec 2>&1
-
-            ls -laht
-
-            # Set cache directory
-            pnpm config set store-dir ${bamboo.cachePnpm}
-
-            # Install dependencies
-            pnpm install
-
-            # https://github.com/eclipse/openvsx/wiki/Publishing-Extensions#5-package-and-upload
-            pnpm ovsx publish vscode-adblock.vsix -p ${bamboo.openVsxTokenPassword}
-  final-tasks:
-    - script:
-        interpreter: SHELL
-        scripts:
-          - "./bamboo-specs/scripts/cleanup.sh"
-  requirements:
-    - extension: 'true'
-
-GitHub:
-  triggers: []
-  tasks:
-    - clean
-    - checkout:
-        repository: bamboo-deploy-publisher
-        path: bamboo-deploy-publisher
-        force-clean-build: true
-    - artifact-download:
-        artifacts:
-          - name: vscode-adblock.vsix
-          - name: EXTRACTED_CHANGES.md
-          - name: adblock.plist
-          - name: build.txt
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -x
-            set -e
-
-            # Fix mixed logs
-            exec 2>&1
-
-            ls -laht
-
-            # publish to Github Releases
-            GITHUB_TOKEN="${bamboo.githubPublicRepoPassword}" \
-            ./bamboo-deploy-publisher/deploy.sh vscode-adblock-syntax-github-release
-  final-tasks: []
-  requirements:
-    - extension: 'true'
diff --git a/bamboo-specs/increment.yaml b/bamboo-specs/increment.yaml
deleted file mode 100644
index d748309..0000000
--- a/bamboo-specs/increment.yaml
+++ /dev/null
@@ -1,61 +0,0 @@
----
-version: 2
-plan:
-  project-key: AJL
-  key: VSCODEADBLOCKSYNTAXINCR
-  name: vscode adblock syntax - increment
-variables:
-  dockerNode: adguard/node-ssh:22.22--0
-
-stages:
-  - Increment:
-      manual: true
-      final: false
-      jobs:
-        - Increment
-
-Increment:
-  key: INCR
-  docker:
-    image: '${bamboo.dockerNode}'
-    volumes:
-      ${system.PNPM_DIR}: "${bamboo.cachePnpm}"
-  other:
-    clean-working-dir: true
-  tasks:
-    - checkout:
-        force-clean-build: true
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -e
-            set -x
-
-            # Fix mixed logs
-            exec 2>&1
-
-            ls -laht
-
-            pnpm increment
-    - any-task:
-        plugin-key: com.atlassian.bamboo.plugins.vcs:task.vcs.commit
-        configuration:
-          commitMessage: 'skipci: Automatic increment build number'
-          selectedRepository: defaultRepository
-  final-tasks:
-    - script:
-        interpreter: SHELL
-        scripts:
-          - "./bamboo-specs/scripts/cleanup.sh"
-  requirements:
-    - extension: 'true'
-
-branches:
-  create: manually
-  delete: never
-  link-to-jira: true
-
-labels: []
-other:
-  concurrent-build-plugin: system-default
diff --git a/bamboo-specs/permissions-prerelease.yaml b/bamboo-specs/permissions-prerelease.yaml
deleted file mode 100644
index ec490c8..0000000
--- a/bamboo-specs/permissions-prerelease.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
----
-version: 2
-deployment:
-  name: VSCode Adblock Syntax - Deploy Prerelease
-deployment-permissions:
-  - groups:
-      - extensions-developers
-    permissions:
-      - view
-environment-permissions:
-  - marketplace.visualstudio.com:
-      - groups:
-          - extensions-developers
-        permissions:
-          - view
-          - deploy
-  - open-vsx.org:
-      - groups:
-          - extensions-developers
-        permissions:
-          - view
-          - deploy
-  - GitHub:
-      - groups:
-          - extensions-developers
-        permissions:
-          - view
-          - deploy
diff --git a/bamboo-specs/permissions.yaml b/bamboo-specs/permissions.yaml
deleted file mode 100644
index 5c8be25..0000000
--- a/bamboo-specs/permissions.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
----
-version: 2
-deployment:
-  name: VSCode Adblock Syntax - Deploy
-deployment-permissions:
-  - groups:
-      - extensions-developers
-    permissions:
-      - view
-environment-permissions:
-  - marketplace.visualstudio.com:
-      - groups:
-          - extensions-developers
-        permissions:
-          - view
-          - deploy
-  - open-vsx.org:
-      - groups:
-          - extensions-developers
-        permissions:
-          - view
-          - deploy
-  - GitHub:
-      - groups:
-          - extensions-developers
-        permissions:
-          - view
-          - deploy
diff --git a/bamboo-specs/scripts/cleanup.sh b/bamboo-specs/scripts/cleanup.sh
deleted file mode 100755
index bc65bb0..0000000
--- a/bamboo-specs/scripts/cleanup.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/bin/bash
-
-# Cleanup script that preserves specified artifacts
-# Usage: ./cleanup.sh "artifact1,artifact2,artifact3"
-
-# 'set' should be added to the beginning of each script to ensure that it runs with the correct options.
-# Please do not move it to some common file, like `setup-tests.sh`, because sourcing A script from B script
-# cannot change the options of B script.
-# -e: Exit immediately if any command exits with a non-zero status (i.e., if a command fails).
-# -x: Print each command to the terminal as it is executed, which is useful for debugging.
-set -ex
-
-# Fix mixed logs
-exec 2>&1
-
-echo "Size before cleanup:" && du -h | tail -n 1
-echo "Top 5 files:" && du -h | sort -hr | head -n 5
-
-# Parse artifacts from command line argument
-ARTIFACTS_ARG="${1:-}"
-if [ -z "$ARTIFACTS_ARG" ]; then
-  echo "No artifacts specified, cleaning entire workspace"
-  ARTIFACTS=""
-else
-  # Convert comma-separated string to space-separated
-  ARTIFACTS=$(echo "$ARTIFACTS_ARG" | tr ',' ' ')
-  echo "Preserving artifacts: $ARTIFACTS"
-fi
-
-TMP="$(mktemp -d)"
-trap 'rm -rf "$TMP"' EXIT
-
-# Stash artifacts to /tmp
-for f in $ARTIFACTS; do
-  [ -e "$f" ] || continue
-  echo "Stashing artifact: $f"
-  mkdir -p "$TMP/$(dirname "$f")"
-  mv "$f" "$TMP/$f"
-done
-
-# Clean entire workspace (including dotfiles and .git)
-find . -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +
-
-# Restore artifacts
-for f in $ARTIFACTS; do
-  [ -e "$TMP/$f" ] || continue
-  echo "Restoring artifact: $f"
-  mkdir -p "$(dirname "$f")"
-  mv "$TMP/$f" "$f"
-done
-
-echo "Size after cleanup:" && du -h | tail -n 1
-echo "Top 5 files:" && du -h | sort -hr | head -n 5
-
-echo "Cleanup completed successfully"
diff --git a/bamboo-specs/test.yaml b/bamboo-specs/test.yaml
deleted file mode 100644
index 2692ea9..0000000
--- a/bamboo-specs/test.yaml
+++ /dev/null
@@ -1,251 +0,0 @@
----
-version: 2
-plan:
-  project-key: AJL
-  key: VSCODEADBLOCKSYNTAXTEST
-  name: vscode adblock syntax - tests
-variables:
-  dockerNode: adguard/node-ssh:22.22--0
-
-# Package dependencies:
-# - Shared: no dependencies (base package)
-# - Syntaxes: no dependencies (independent)
-# - Client: depends on Shared
-# - Server: depends on Shared
-#
-# Stage 1:
-# - Test Shared (base package);
-# - Test Syntaxes (independent).
-#
-# Stage 2:
-# - Test Client (depends on Shared);
-# - Test Server (depends on Shared).
-#
-# Stage 3:
-# - Build & Package (final assembly and artifact creation).
-#
-# Note: Cleanup is performed after each stage to prevent disk space issues
-# and ensure clean state for subsequent builds.
-
-stages:
-  - Stage 1: &stage
-      manual: false
-      final: false
-      jobs:
-        - Test Shared
-        - Test Syntaxes
-  - Stage 2:
-      <<: *stage
-      jobs:
-        - Test Client
-        - Test Server
-  - Stage 3:
-      <<: *stage
-      jobs:
-        - Build and Package
-
-Test Shared:
-  key: TESTSHARED
-  docker: &docker
-    image: '${bamboo.dockerNode}'
-    volumes:
-      ${system.PNPM_DIR}: "${bamboo.cachePnpm}"
-  tasks:
-    - checkout:
-        force-clean-build: true
-    - script: &setup-script
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -ex
-
-            # Fix mixed logs
-            exec 2>&1
-
-            ls -alt
-
-            # Set cache directory
-            pnpm config set store-dir ${bamboo.cachePnpm}
-
-            # Install dependencies
-            pnpm install
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -ex
-
-            # Build shared library
-            pnpm --filter @vscode-adblock-syntax/shared build
-
-            # Run TypeScript type checking
-            pnpm --filter @vscode-adblock-syntax/shared exec tsc --noEmit
-
-            # Run ESLint
-            pnpm --filter @vscode-adblock-syntax/shared lint:code
-
-            # Run markdownlint
-            pnpm --filter @vscode-adblock-syntax/shared lint:md
-
-            # Run tests
-            pnpm --filter @vscode-adblock-syntax/shared test --run --no-color
-  final-tasks:
-    - script: &cleanup-script
-        interpreter: SHELL
-        scripts:
-          - "./bamboo-specs/scripts/cleanup.sh"
-  requirements: &requirements
-    - extension: 'true'
-
-Test Syntaxes:
-  key: TESTSYNTAXES
-  docker: *docker
-  tasks:
-    - checkout:
-        force-clean-build: true
-    - script: *setup-script
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -ex
-
-            # Build syntaxes
-            pnpm --filter @vscode-adblock-syntax/syntaxes build
-
-            # Run TypeScript type checking
-            pnpm --filter @vscode-adblock-syntax/syntaxes exec tsc --noEmit
-
-            # Run ESLint
-            pnpm --filter @vscode-adblock-syntax/syntaxes lint:code
-
-            # Run markdownlint
-            pnpm --filter @vscode-adblock-syntax/syntaxes lint:md
-
-            # Run tests
-            pnpm --filter @vscode-adblock-syntax/syntaxes test --run --no-color
-  final-tasks:
-    - script: *cleanup-script
-  requirements: *requirements
-
-Test Client:
-  key: TESTCLIENT
-  docker: *docker
-  tasks:
-    - checkout:
-        force-clean-build: true
-    - script: *setup-script
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -ex
-
-            # Build shared first (dependency)
-            pnpm --filter @vscode-adblock-syntax/shared build
-
-            # Build client
-            pnpm --filter @vscode-adblock-syntax/client build
-
-            # Run TypeScript type checking
-            pnpm --filter @vscode-adblock-syntax/client exec tsc --noEmit
-
-            # Run ESLint
-            pnpm --filter @vscode-adblock-syntax/client lint:code
-
-            # Run markdownlint
-            pnpm --filter @vscode-adblock-syntax/client lint:md
-
-            # Run tests
-            pnpm --filter @vscode-adblock-syntax/client test --run --no-color
-  final-tasks:
-    - script: *cleanup-script
-  requirements: *requirements
-
-Test Server:
-  key: TESTSERVER
-  docker: *docker
-  tasks:
-    - checkout:
-        force-clean-build: true
-    - script: *setup-script
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -ex
-
-            # Build shared first (dependency)
-            pnpm --filter @vscode-adblock-syntax/shared build
-
-            # Build server
-            pnpm --filter @vscode-adblock-syntax/server build
-
-            # Run TypeScript type checking
-            pnpm --filter @vscode-adblock-syntax/server exec tsc --noEmit
-
-            # Run ESLint
-            pnpm --filter @vscode-adblock-syntax/server lint:code
-
-            # Run markdownlint
-            pnpm --filter @vscode-adblock-syntax/server lint:md
-
-            # Run tests
-            pnpm --filter @vscode-adblock-syntax/server test --run --no-color
-  final-tasks:
-    - script: *cleanup-script
-  requirements: *requirements
-
-Build and Package:
-  key: BUILDPACKAGE
-  docker: *docker
-  tasks:
-    - checkout:
-        force-clean-build: true
-    - script: *setup-script
-    - script:
-        interpreter: SHELL
-        scripts:
-          - |-
-            set -ex
-
-            # Build all packages
-            pnpm build
-
-            # Final type check for all packages
-            pnpm test:compile
-
-            # Package into .vsix file
-            pnpm package
-
-            # Show tree of files in .vsix file
-            pnpm exec vsce ls --tree
-  final-tasks:
-    - script:
-        interpreter: SHELL
-        scripts:
-          - "./bamboo-specs/scripts/cleanup.sh out/vscode-adblock.vsix,syntaxes/out/adblock.plist"
-  artifacts:
-    - name: vscode-adblock.vsix
-      location: out
-      pattern: vscode-adblock.vsix
-      shared: true
-      required: true
-    - name: adblock.plist
-      location: syntaxes/out
-      pattern: adblock.plist
-      shared: true
-      required: true
-  requirements: *requirements
-
-branches:
-  create: for-pull-request
-  delete:
-    after-deleted-days: '1'
-    after-inactive-days: '5'
-  link-to-jira: true
-
-labels: []
-
-other:
-  concurrent-build-plugin: system-default
diff --git a/package.json b/package.json
index 2ed7ef8..10bb85e 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,6 @@
     "name": "adblock",
     "displayName": "Adblock/AdGuard/uBlock filters grammar",
     "description": "VS code extension that adds support for ad blocking rules syntax.",
-    "version": "2.1.4",
     "publisher": "adguard",
     "icon": "icons/aglint_128x128.png",
     "main": "./client/out/extension",
@@ -78,7 +77,6 @@
     "scripts": {
         "build": "cross-env NODE_ENV=production pnpm --recursive build",
         "clean": "tsx tools/clean.ts",
-        "increment": "pnpm version patch --no-git-tag-version",
         "lint": "pnpm --recursive lint",
         "lint:md": "markdownlint .",
         "lint:code": "eslint . --cache --ext .ts --ext .js",
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 9b75947..a95cfbc 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -6,12 +6,6 @@ packages:
   - tools
   - test/static/aglint
 
-# AG-54210
-# minimumReleaseAge is in minutes; 10080 = 7 days.
-minimumReleaseAge: 10080
-minimumReleaseAgeExclude:
-  - '@adguard/*'
-
 catalog:
   "@adguard/aglint": ^4.0.0-beta.3
   "@adguard/agtree": ^2.3.0
@@ -69,3 +63,9 @@ catalog:
   vscode-textmate: ^9.3.0
   vscode-uri: ^3.1.0
   yaml: ^2.8.2
+
+# AG-54210
+# minimumReleaseAge is in minutes; 10080 = 7 days.
+minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - '@adguard/*'
diff --git a/tools/AGENTS.md b/tools/AGENTS.md
index b365b02..941c2c2 100644
--- a/tools/AGENTS.md
+++ b/tools/AGENTS.md
@@ -31,8 +31,6 @@ Markdown formatting, versioning, contribution rules) see the root
 A collection of small, standalone Node.js scripts used by the repo's build and
 maintenance workflows. Currently:
 
-- [build-txt.ts](build-txt.ts) — writes the extension version from the root
-  `package.json` into `out/build.txt` (used by CI/packaging).
 - [clean.ts](clean.ts) — dependency-free cleanup that removes `node_modules`
   from every workspace package.
 
@@ -46,7 +44,7 @@ These scripts are invoked from the repo root (e.g. `pnpm clean`) and run via
 - **Runtime**: Node.js (run-and-exit scripts).
 - **Primary Dependencies**: None — the scripts rely on Node.js built-ins
   (`node:fs`, `node:path`, `node:child_process`) and the `pnpm` CLI.
-- **Storage**: Filesystem only (writes `out/build.txt`, removes `node_modules`).
+- **Storage**: Filesystem only (removes `node_modules`).
 - **Testing**: None currently (no test runner configured for this package).
 - **Build**: None — scripts are executed in place via `tsx`.
 - **Project Type**: monorepo package (CLI/utility scripts).
@@ -57,7 +55,6 @@ These scripts are invoked from the repo root (e.g. `pnpm clean`) and run via
 tools/
 ├── package.json          # Minimal manifest (no build/test scripts)
 ├── tsconfig.json         # TypeScript config for the scripts
-├── build-txt.ts          # Writes version → out/build.txt
 └── clean.ts              # Removes node_modules from all workspace packages
 ```
 
@@ -90,8 +87,7 @@ Design as run-and-exit command-line scripts:
   Exit non-zero on failure (e.g. [clean.ts](clean.ts) calls `process.exit(1)` on
   error).
 - Use stdout for normal progress output and stderr for diagnostics and errors.
-- Fail fast with clear messages: validate required inputs early (e.g.
-  [build-txt.ts](build-txt.ts) throws if `package.json` has no `version`).
+- Fail fast with clear messages: validate required inputs early.
 - Keep startup fast and dependencies minimal — prefer Node.js built-ins so
   cleanup-style scripts can run even when package `node_modules` are absent.
 
@@ -99,7 +95,7 @@ Design as run-and-exit command-line scripts:
 
 These are independent, single-file scripts with no shared internal layering.
 
-- **Separation of Concerns** — one script per task (versioning, cleanup).
+- **Separation of Concerns** — one script per task (cleanup).
 - **Single Responsibility** — each file does exactly one job.
 - **Dependency Direction** — scripts depend only on Node.js built-ins and CLI
   tools (`pnpm`); they do not import from other workspace packages.
@@ -113,7 +109,6 @@ Dependency flow:
 
 ```mermaid
 flowchart LR
-    buildTxt["build-txt.ts"] --> fs["node:fs, node:path"] --> output["out/build.txt"]
     clean["clean.ts"] --> pnpm["pnpm CLI + node:fs"] --> removes["removes node_modules"]
 ```
 
@@ -144,10 +139,8 @@ maintenance scripts (especially cleanup) do not themselves depend on installed
 
 ### Configuration & Documentation
 
-- These scripts read configuration from the repo (root `package.json` version,
-  `pnpm ls` output); they take no environment variables or config files of their
-  own. When a script's inputs or outputs change (e.g. the `build.txt` location),
-  update this file and any CI configuration that consumes the output.
+- These scripts read configuration from the repo (`pnpm ls` output); they take
+  no environment variables or config files of their own.
 
 ### Markdown Formatting
 
diff --git a/tools/DEVELOPMENT.md b/tools/DEVELOPMENT.md
index d90bdc7..320fa6a 100644
--- a/tools/DEVELOPMENT.md
+++ b/tools/DEVELOPMENT.md
@@ -27,8 +27,6 @@ architecture, see [AGENTS.md](AGENTS.md).
 A collection of small, standalone, dependency-free Node.js scripts used by the
 repo's build and maintenance workflows:
 
-- [build-txt.ts](build-txt.ts) — writes the extension version from the root
-    `package.json` into `out/build.txt` (used by CI/packaging).
 - [clean.ts](clean.ts) — removes `node_modules` from every workspace package.
 
 The scripts are run via `tsx` and rely only on Node.js built-ins and the `pnpm`
@@ -51,7 +49,6 @@ example via the root `pnpm clean` command.
 
 ```bash
 pnpm clean                          # runs tsx tools/clean.ts (removes node_modules)
-pnpm exec tsx tools/build-txt.ts    # writes version -> out/build.txt
 ```
 
 ### Lint
@@ -77,10 +74,6 @@ pnpm test:compile
     exits non-zero on failure. Prefer Node.js built-ins (`node:fs`, `node:path`,
     `node:child_process`) so cleanup-style scripts run even without installed
     `node_modules`. Update [AGENTS.md](AGENTS.md) Project Structure/Overview.
-- **Grow non-trivial logic**: extract the logic into a testable function before
-    adding a test setup (no test runner is configured here yet).
-- **Change a script's inputs/outputs**: update any CI configuration that consumes
-    the output (e.g. the `build.txt` location).
 
 ## Troubleshooting
 
diff --git a/tools/build-txt.ts b/tools/build-txt.ts
deleted file mode 100644
index 40742a7..0000000
--- a/tools/build-txt.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-/**
- * @file Output the version number to a build.txt file.
- */
-import fs from 'node:fs';
-import path from 'node:path';
-
-const UPPER_LEVEL = '../';
-
-const OUTPUT_FOLDER_NAME = 'out';
-const OUTPUT_FILE_NAME = 'build.txt';
-const PKG_FILE_NAME = 'package.json';
-
-// Computed constants
-const outputFolderLocation = path.join(__dirname, UPPER_LEVEL, OUTPUT_FOLDER_NAME);
-const pkgFileLocation = path.join(__dirname, UPPER_LEVEL, PKG_FILE_NAME);
-
-// Read package.json
-const pkg = JSON.parse(fs.readFileSync(pkgFileLocation, 'utf-8'));
-
-if (!pkg.version) {
-    throw new Error('Missing required field "version" in package.json');
-}
-
-const main = (): void => {
-    const content = `version=${pkg.version}`;
-
-    // Create the output folder if it doesn't exist
-    if (!fs.existsSync(outputFolderLocation)) {
-        fs.mkdirSync(outputFolderLocation);
-    }
-
-    // Write the output file
-    const file = path.resolve(outputFolderLocation, OUTPUT_FILE_NAME);
-    fs.writeFileSync(file, content);
-
-    // eslint-disable-next-line no-console
-    console.log(`Wrote ${content} to ${file} was successful`);
-};
-
-main();