Open VSX Publish requirements — check extension before publishing

Six release errors in one sample package.json: that is what Open VSX Publish Gate reports for a VS Code extension author who publishes to the Visual Studio Marketplace and wants the same build on Open VSX, where VSCodium, Cursor, Windsurf and Gitpod users install from.

Migrate from Marketplace-only publishing to Open VSX: the date first

The official vsce publishing page now carries this line: "On December 1, 2026, global Personal Access Tokens (PATs) in Azure DevOps are retired." The same page still tells you to create the publishing PAT with Organization set to All accessible organizations. That is a global PAT. If your release job runs vsce publish -p $VSCE_PAT, it stops working on December 1, 2026. The replacement is vsce publish --azure-credential, which signs in with Microsoft Entra ID.

Many teams use that deadline to move the release job anyway, and add Open VSX in the same pull request. That is where the second set of problems shows up.

What the sample package.json contained

The sample is an extension called py-lens. The gate reads the file once and reports 10 findings: 6 errors, 3 warnings and 1 info.

The 6 errors:

• "version": "2.1.0-beta.3" - vsce refuses semver pre-release tags. Use "2.1.0" and publish with --pre-release.
• "icon": "images/icon.svg" - vsce stops with "SVGs can't be used as icons". Use a PNG.
• a badge on http://img.shields.io - vsce wants HTTPS badge URLs.
• an SVG badge from badges.example-ci.dev - that host is not on the vsce trusted list of 32 hosts.
• ms-python.vscode-pylance in extensionDependencies - it returns 404 on open-vsx.org, so VSCodium users cannot install py-lens. The gate suggests detachhead.basedpyright.
• ms-vscode-remote.remote-ssh in extensionPack - also 404 on open-vsx.org. The gate suggests jeanp413.open-remote-ssh.

The 3 warnings: the publish script passes $VSCE_PAT, nothing runs ovsx publish, and there is no repository field. The info finding is the missing license field.

Why vsce alone does not show this

vsce package throws on the first error it meets. Six errors means six rounds of fix, re-run, read the next error. And vsce never checks Open VSX at all: a Pylance dependency packages without a word, then breaks installs in VSCodium. The gate prints every finding with its line and the replacement line in one pass, from 16 rules.

The four-line move to Open VSX

1. Sign the Eclipse Publisher Agreement on open-vsx.org and create an access token. Store it as OVSX_PAT.
2. Run npx ovsx create-namespace <publisher> -p $OVSX_PAT. Your publisher field is the namespace.
3. Add "publish:ovsx": "ovsx publish -p $OVSX_PAT" to scripts.
4. In GitHub Actions, HaaLeo/publish-vscode-extension publishes to Open VSX by default. Set registryUrl: https://marketplace.visualstudio.com only on the Marketplace step.

The gate also reads the workflow file. If it sees vsce publish or a Marketplace registryUrl with a VSCE_PAT secret, it flags the PAT. If nothing reaches open-vsx.org, it prints the ovsx step to add.

Free, and what comes next

The free check covers the file you have open, in full, in VS Code or in the web version. Nothing is hidden. The full version adds the whole workspace: every extension manifest and workflow in the repo, a dated migration report, and a CI gate that fails a build adding a new blocker.

Sources: the vsce publishing page on code.visualstudio.com, the Open VSX publishing wiki, the vsce source (package.js), and open-vsx.org/api lookups made on 2026-09-30.