Use locked VSCE installs and verify VSIX signatures

[Sean McManus (sean-mcmanus)]

Summary

Install the Extension Pack and Themes packaging tools from their reviewed npm lockfiles, while retaining the explicit @vscode/vsce-sign rebuild required by ignore-scripts=true. Verify each detached VSIX/manifest/P7S triplet immediately after signing and again before Marketplace upload.

Marketplace signature validation remains the authoritative release gate. The post-sign check fails earlier, before a malformed or mismatched triplet becomes a pipeline artifact or enters manual release validation; the release-job check detects an incorrect or damaged triplet at the build-to-release transfer boundary and reports the failure locally before upload. These checks improve artifact assurance and failure diagnosis rather than replacing Marketplace verification.

This separates and extends the deterministic packaging work first exercised in #14701.

This PR was investigated and created by GitHub Copilot in VS Code. Any message starting with ✨Copilot: was sent by Copilot.

Validation

• Ran clean npm ci --include=dev --include=optional installs for ExtensionPack and Themes.
• Rebuilt @vscode/vsce-sign, confirmed the platform signer was installed, and confirmed VSCE 3.9.2 was selected from each lockfile.
• Packaged both VSIXes and generated both manifests.
• Confirmed both package locks remained byte-for-byte unchanged.
• Parsed all changed YAML and ran git diff --check.

The draft package runs will exercise the Windows vsce-sign.exe path and hosted VSCodePublisher signing before publication.

[Copilot]

Pull request overview

Uses reviewed VSCE lockfiles for deterministic packaging and verifies signed VSIX triplets at both release boundaries.

Changes:

• Replaces ad hoc VSCE installs with npm ci.
• Rebuilds the signer and verifies signatures after signing and before publishing.
• Configures each release pipeline’s source directory.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
Build/publish/jobs_publish_vsix.yml	Installs locked dependencies and verifies signatures before upload.
Build/publish/cpptools_themes.yml	Selects the Themes lockfile directory.
Build/publish/cpptools_extension_pack.yml	Selects the Extension Pack lockfile directory.
Build/package/jobs_package_vsix.yml	Uses locked installs and verifies newly signed artifacts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.