split publsh into its own step

Author: bschnurr

build/templates/publish.yml

@@ -57,19 +57,30 @@ steps:
 
   # Assumes files already present at $(Build.ArtifactStagingDirectory)/publishFolder
 
+  # Step 1: Acquire token only (store secret variable MarketplaceAADToken)
   - task: AzureCLI@2
-    displayName: Acquire token & publish extension
+    displayName: Acquire Marketplace AAD token
     inputs:
       azureSubscription: ${{ parameters.azureSubscription }}
       scriptType: pscore
       scriptLocation: inlineScript
       inlineScript: |
-        # Hardcoded Azure DevOps Marketplace resource GUID
         $resource = "499b84ac-1321-427f-aa17-267ca6975798"
         Write-Host "Acquiring AAD token for resource: $resource"
         az rest -u https://app.vssps.visualstudio.com/_apis/profile/profiles/me --resource $resource | Out-Null
         $aadToken = az account get-access-token --query accessToken --resource $resource -o tsv
         if (-not $aadToken) { Write-Error 'Failed to acquire AAD token.'; exit 1 }
+        Write-Host "##vso[task.setvariable variable=MarketplaceAADToken;isSecret=true]$aadToken"
+        Write-Host "Token stored in secret variable MarketplaceAADToken"
+
+  # Step 2: Validate artifacts & publish
+  - task: PowerShell@2
+    displayName: Publish extension (vsce)
+    inputs:
+      targetType: inline
+      script: |
+        $aadToken = "$(MarketplaceAADToken)"
+        if (-not $aadToken) { Write-Error 'MarketplaceAADToken is empty (token acquisition failed).'; exit 1 }
 
         $root = "$(Build.ArtifactStagingDirectory)/${{ parameters.publishFolder }}"
         $vsixPath = Join-Path $root "${{ parameters.vsixName }}"
@@ -92,19 +103,19 @@ steps:
 
         if ('${{ parameters.preRelease }}' -eq 'True') {
           Write-Host 'Publishing as pre-release'
-          # disable for now
-          #npx @vscode/vsce@latest publish --pat $aadToken --packagePath $vsixPath --manifestPath $manifestPath --signaturePath $signaturePath $extraFlags --pre-release
+          # disabled for now; uncomment when ready
+          # vsce publish --pat $aadToken --packagePath $vsixPath --manifestPath $manifestPath --signaturePath $signaturePath $extraFlags --pre-release
         } else {
           Write-Host 'Publishing as stable release'
-          # disable for now
-          #npx @vscode/vsce@latest publish --pat $aadToken --packagePath $vsixPath --manifestPath $manifestPath --signaturePath $signaturePath $extraFlags
+          # disabled for now; uncomment when ready
+          # vsce publish --pat $aadToken --packagePath $vsixPath --manifestPath $manifestPath --signaturePath $signaturePath $extraFlags
         }
 
         if ($LASTEXITCODE -ne 0) {
           Write-Error "vsce publish failed with exit code $LASTEXITCODE"
           exit $LASTEXITCODE
         }
-        Write-Host 'Publish succeeded ✅'
+        Write-Host 'Publish step completed (publish command currently disabled).'
 
   - task: PowerShell@2
     displayName: Post-publish summary