Repository navigation
package: hack/vsix makes the VSIX, and vsce goes - #12
Merged
Merged
Conversation
The Marketplace refuses an extension that uses a proposed API, so all this repository needed of vsce was a zip of five files and its XML manifest, at the price of half the lockfile (274 packages to 141) and the minimatch override. hack/vsix writes the same layout, with every entry at one fixed time and in a fixed order, so a tag's VSIX can be built again to the digest spin pins. The README's links are absolute, as vsce rewrote them: VS Code shows the packaged README with no repository to resolve a relative link against. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aledbf
force-pushed
the
vsix-without-vsce
branch
from
November 14, 2026 05:01
dfbf3f6 to
8204728
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Marketplace refuses an extension that uses a proposed API, so a release here is a GitHub release. All this repository used vsce for was a zip of five files plus its XML manifest. That came with roughly half the lockfile and the minimatch override from #9.
What changes
hack/vsix(Go, standard library only) writes the VSIX from the filestask packagenames:extension.vsixmanifest,[Content_Types].xmlandextension/…, with the README asreadme.md, the way vsce names it. Every entry has one fixed time and the entries are in a fixed order, so the same files give the same bytes. That means a tag's VSIX can be built again and checked against the digest spin pins. It refuses:package.jsonnot first, a missing file, a file type with no content type, a path outside the checkout,mainoriconnot packaged, and no LICENSE.task packageruns it, andtask testrunsgo test ./hack/....publish:githubstill runstask packageand is unchanged.@vscode/vsce, thepackagescript,.vscodeignore(the file list lives in the task now), thevsce-signallowBuilds entry and the minimatch override. Lockfile: 274 packages down to 141.Checked
lib/extension.js,LICENSE.txt,icon.pngandreadme.mdare byte-identical.package.jsondiffers only by the vsce dependency and script this PR removes.task packageruns give the same sha256.--install-extensioninto scratch--extensions-dir/--user-data-dir) and listsspin-stack.spinbox-remote@2.1.0.time.Now()as entry time, no XML escaping, and no check that main/icon are packaged.task cipasses locally.🤖 Generated with Claude Code