Support trusted publishing

[remcohaszing]

Package registries such as npm and PyPI support trusted publishers.

Given recent attacks on package registries, as well as the VSCode marketplace, I believe it would be a good idea for vsce to support this as well.

Also npm added staged publishing today. I believe it’s a good idea for the VSCode marketplace to have this as well.

[cooronx]

when will trust publishing(oidc) be ready on release? it seems PAT are retired on December 1, 2026. may be need some time to change it to oidc

[benibenj]

when will trust publishing(oidc) be ready on release? it seems PAT are retired on December 1, 2026. may be need some time to change it to oidc

cooronx I don't have the exact timeline, but it should be available soon. Possibly around September

[shyim]

Could we get than also an GitHub Action which publishes those? The DX of publishing plugins is the worse I see of all platforms so far 😭