From e2ba6b30bed2c7830e4992db6bfa1dc485f37fd3 Mon Sep 17 00:00:00 2001
From: Johann Schopplich <johann@schopplich.com>
Date: Sat, 3 Oct 2026 07:38:26 +0200
Subject: [PATCH] ci: publish to Open VSX with trusted publishing

---
 .github/workflows/release.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0cbfa3b..ee4ebe6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,6 +36,9 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -63,6 +66,4 @@ jobs:
           VSCE_PAT: ${{ secrets.VSCE_PAT }}
 
       - name: Publish to Open VSX
-        run: pnpm exec ovsx publish toon.vsix
-        env:
-          OVSX_PAT: ${{ secrets.OVSX_PAT }}
+        run: pnpm exec ovsx publish toon.vsix --trusted-publishing