feat: prepare store releases for VS Code, Open VSX and Zed

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           bun-version: 1.4.0
       - name: Prepare pinned Rust toolchain
-        run: rustup toolchain install 1.93.1 --profile minimal --component rustfmt --target wasm32-wasip2
+        run: rustup toolchain install 1.90 --profile minimal --component rustfmt --target wasm32-wasip2
       - run: bun install --frozen-lockfile
       - run: bun run verify
       - name: Package VS Code

.github/workflows/release.yml

@@ -0,0 +1,153 @@
+name: Release
+# A version tag packages one VSIX, attaches it to a GitHub release and
+# publishes that same file to Open VSX and the Visual Studio Marketplace.
+# docs/releasing.md covers the one-time store setup and the Zed registry.
+on:
+  push:
+    tags: ["v[0-9]+.[0-9]+.[0-9]+"]
+permissions:
+  contents: read
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  package:
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          package-manager-cache: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.4.0
+      - name: Prepare pinned Rust toolchain
+        run: rustup toolchain install 1.90 --profile minimal --component rustfmt --target wasm32-wasip2
+      - run: bun install --frozen-lockfile
+      - name: Check that the tag names the manifest version
+        id: version
+        run: |
+          version="$(node -p 'require("./vscode/package.json").version')"
+          if [ "$GITHUB_REF_NAME" != "v$version" ]; then
+            echo "::error::Tag $GITHUB_REF_NAME does not match manifest version $version."
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+      - run: bun run verify
+      - name: Package VS Code extension
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          mkdir -p artifacts
+          bun run --cwd vscode package -- --out "../artifacts/rootform-$VERSION.vsix"
+          cd artifacts && sha256sum "rootform-$VERSION.vsix" > SHA256SUMS
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vsix
+          path: artifacts/
+          if-no-files-found: error
+
+  github-release:
+    needs: package
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vsix
+          path: artifacts
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.package.outputs.version }}
+        run: >-
+          gh release create "$GITHUB_REF_NAME" artifacts/*
+          --repo "$GITHUB_REPOSITORY" --verify-tag
+          --title "Rootform editors $VERSION"
+          --notes "VS Code and Zed extensions $VERSION. Changes: https://github.com/$GITHUB_REPOSITORY/blob/$GITHUB_REF_NAME/vscode/CHANGELOG.md"
+
+  open-vsx:
+    needs: package
+    runs-on: ubuntu-24.04
+    environment: release
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          package-manager-cache: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.4.0
+      - run: bun install --frozen-lockfile
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vsix
+          path: artifacts
+      # The first release creates the namespace with the bootstrap token.
+      - name: Create the Open VSX namespace
+        working-directory: vscode
+        env:
+          OVSX_PAT: ${{ secrets.OVSX_PAT }}
+        run: |
+          namespace="$(node -p 'require("./package.json").publisher')"
+          status="$(curl -sS -o /dev/null -w '%{http_code}' "https://open-vsx.org/api/$namespace")"
+          if [ "$status" = "404" ] && [ -n "$OVSX_PAT" ]; then
+            ./node_modules/.bin/ovsx create-namespace "$namespace"
+          fi
+      # Trusted publishing exchanges this job's OIDC token. OVSX_PAT exists only
+      # to bootstrap the first version and takes precedence while it is set.
+      - name: Publish to Open VSX
+        working-directory: vscode
+        env:
+          OVSX_PAT: ${{ secrets.OVSX_PAT }}
+          VERSION: ${{ needs.package.outputs.version }}
+        run: ./node_modules/.bin/ovsx publish --packagePath "../artifacts/rootform-$VERSION.vsix" --skip-duplicate
+
+  vs-marketplace:
+    needs: package
+    # Runs once the Entra ID identity is configured; until then the VSIX from
+    # the GitHub release is uploaded on the Marketplace publisher page.
+    if: vars.AZURE_CLIENT_ID != ''
+    runs-on: ubuntu-24.04
+    environment: release
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          package-manager-cache: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.4.0
+      - run: bun install --frozen-lockfile
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: vsix
+          path: artifacts
+      - uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
+      - name: Publish to the Visual Studio Marketplace
+        working-directory: vscode
+        env:
+          VERSION: ${{ needs.package.outputs.version }}
+        run: ./node_modules/.bin/vsce publish --azure-credential --packagePath "../artifacts/rootform-$VERSION.vsix" --skip-duplicate

README.md

@@ -1,23 +1,53 @@
 # Rootform editors
 
-Thin VS Code and Zed integrations for `.rf.hcl`, powered by `rootform lsp`.
-The extensions do not include or download Rootform.
+VS Code and Zed extensions for Rootform `.rf.hcl` source, powered by
+`rootform lsp` from a local Rootform CLI. The extensions do not include or
+download Rootform; language semantics come from Rootform's compiler, and the
+clients own syntax presentation, launch and lifecycle.
 
-Use a compatible local Rootform executable during development. Editor package
-instructions live in [VS Code](vscode/README.md) and [Zed](zed/README.md).
+- [VS Code](vscode/README.md), for the Visual Studio Marketplace and Open VSX
+- [Zed](zed/README.md), for the Zed extension registry
+
+## Development
 
 ```sh
 bun install --frozen-lockfile
 bun run verify
 ```
 
-Real integration qualification requires `ROOTFORM_BINARY` set to an explicitly
-provided Rootform executable. Language semantics come from Rootform's compiler;
-the clients only own syntax presentation, launch and lifecycle.
+`verify` checks that both manifests share one version and description, checks
+formatting, builds and unit-tests the VS Code client, tests the Zed queries
+against the pinned HCL grammar and builds the Zed package for `wasm32-wasip2`
+with Rust 1.90, the toolchain the Zed registry packages with.
+
+Real integration qualification uses an explicitly provided Rootform executable
+and a local VS Code. Nothing is downloaded:
+
+```sh
+VSCODE_EXECUTABLE_PATH="/Applications/Visual Studio Code.app/Contents/MacOS/Code" \
+ROOTFORM_BINARY="/absolute/path/to/rootform" \
+bun run --cwd vscode test:integration
+```
+
+The runner uses a temporary multi-root fixture workspace with unique VS Code
+user-data and extension directories. The fixture source is synthetic.
 
-Source is [Apache-2.0](LICENSE). Third-party syntax dependencies retain their
-original licenses.
+To try the Zed package, run `zed: install dev extension` in Zed and select the
+`zed/` directory. Zed may need network access to prepare the pinned HCL
+grammar and `wasi-sdk` while building it; the language server always comes
+from the local Rootform executable.
 
 Native editor runtime qualification currently covers macOS arm64. The Zed
-package also builds for `wasm32-wasip2`; Linux and Windows editor runtimes have
-not yet been qualified.
+package also builds for `wasm32-wasip2`; Linux and Windows editor runtimes
+have not yet been qualified.
+
+## Releasing
+
+[Releasing](docs/releasing.md) covers versioning, the release workflow and
+publication to each store.
+
+## License
+
+Source is [Apache-2.0](LICENSE). Third-party dependencies retain their original
+licenses. Rootform name and logo: trademark rights reserved, see
+[TRADEMARKS.md](https://github.com/rootform-dev/rootform/blob/dev/TRADEMARKS.md).