## How to Publish an Extension This guide describes publishing to the public registry at [open-vsx.org](https://open-vsx.org/), which is now managed by the [Eclipse Foundation](https://www.eclipse.org/) ([see the announcement](https://blogs.eclipse.org/post/brian-king/open-vsx-registry-under-new-management)). Similar steps may apply to registries that are hosted elsewhere, but make sure to pass the correct URL to the [`ovsx`](https://www.npmjs.com/package/ovsx) tool. If you are the author of the extension you wish to publish, proceed with the steps below. If you are not the author, we suggest you first reach out to the author with an issue in their GitHub repo to request that they publish their extension to [open-vsx.org](https://open-vsx.org/). We've drafted a [template](https://github.com/open-vsx/publish-extensions/blob/master/docs/external_contribution_request.md) with suggested content for the issue. #### 1. Create an Eclipse account An eclipse.org account is necessary to sign a Publisher Agreement with the Eclipse Foundation. [Use this form to register](https://accounts.eclipse.org/user/register). It is important to fill in the _GitHub Username_ field and to use exactly the same GitHub account as when you log in to open-vsx.org. #### 2. Log in and sign the Publisher Agreement Log in to [open-vsx.org](https://open-vsx.org): click on the account icon on the top right corner, then authorize the application with your GitHub account. Navigate to the [open-vsx.org Profile](https://open-vsx.org/user-settings/profile) page (click on your avatar → _Settings_). Click on _Log in with Eclipse_ and then authorize the application to access your eclipse.org account. If the Eclipse login process is successful, you will see a button labeled _Show Publisher Agreement_ on your open-vsx.org profile page. Click that button, read the agreement text to the bottom and click _Agree_ if you consent to publishing under these terms. Note that the "Eclipse Contributor Agreement" (ECA) is a different agreement used to contribute code to Eclipse open-source projects. #### 3. Create an access token Navigate to the [open-vsx.org Access Tokens](https://open-vsx.org/user-settings/tokens) page (click on your avatar → _Settings_ → _Access Tokens_). Click _Generate New Token_ and enter a description. We recommend to generate a new token for each environment where you want to publish, e.g. a local machine, cloud IDE, or CI build. The description will help you to identify a token in case you want to revoke it (you don't need it anymore or you suspect it has been stolen). Click _Generate Token_ and copy the generated value to a safe place, e.g. an encrypted file or the secret variables of your cloud IDE / CI settings. Note that the value is never displayed again after you close the dialog! In case you lose a token, delete it and generate a new one. An access token can be used to publish as many extensions as you like, until it is deleted. #### 4. Create the namespace The `publisher` field in your extension's package.json file defines the namespace in which the extension will be made available. You need to create the namespace in the registry before any extension can be published to it. This is done with the [`ovsx`](https://www.npmjs.com/package/ovsx) CLI tool. The easiest way to use it is through [npx](https://www.npmjs.com/package/npx), which makes sure you always use the latest version of the tool. Alternatively, install it globally with `npm i -g ovsx`. Run the following command, replacing `` with the value of your extension's `publisher` and replacing `` with the previously generated access token value. ``` npx ovsx create-namespace -p ``` Creating a namespace does _not_ automatically assign you as verified owner. If you want the published extensions to be marked as _verified_, you can [claim ownership of the namespace](./Namespace-Access). #### 5. Package and upload The publishing process involves the two steps package and upload. Both can be done with the same [`ovsx`](https://www.npmjs.com/package/ovsx) CLI tool that is used to create a namespace. If you have an already packaged `.vsix` file, you can publish it by simply running the following command, replacing `` with the path to your extension package and replacing `` with the previously generated access token value. ``` npx ovsx publish -p ``` In order to build and publish an extension from source, first make sure to prepare the project accordingly, typically by running `npm install` or `yarn`. Then run the following command in the root directory of the extension. ``` npx ovsx publish -p ``` The `ovsx` tool uses [vsce](https://www.npmjs.com/package/vsce) internally to package extensions, which runs the `vscode:prepublish` script defined in the package.json as part of that process. If the extension uses [Yarn](https://yarnpkg.com) to run scripts, add the argument `--yarn`. #### Extension scanning If the registry has [extension scanning](./Extension-Scanning) enabled, your extension is checked automatically during publishing. Possible checks include: - **Secret detection** — Scans for leaked API keys, tokens, and passwords. If secrets are found and the check is enforced, publishing is rejected. You can suppress false positives by adding an inline marker comment (e.g., `// secret-detector:ignore`) on the flagged line. - **Blocklist check** — Compares file hashes against known-bad files. If a match is found, publishing is rejected. - **Namespace similarity** — Prevents typosquatting by detecting names too similar to existing extensions. If your extension is rejected by a scan, the error message will tell you which check failed and why. Fix the issue and try publishing again. #### See the result If the `ovsx` tool reported that publishing was successful, you should find your extension on [open-vsx.org](https://open-vsx.org). Please check all metadata for correctness. ----- ### GitHub Action You can find a [GitHub action](https://docs.github.com/en/actions) that allows publishing to Open VSX at [HaaLeo/publish-vscode-extension](https://github.com/HaaLeo/publish-vscode-extension#readme).