Developer details automated VS Code extension publishing without persistent tokens

·1 views

A developer has documented a method for publishing VS Code extensions without storing a long-lived personal access token. The process involves separating packaging, authentication, federation, publisher access, and Marketplace verification into distinct steps. Authentication is handled using GitHub Actions OIDC tokens exchanged through Microsoft Entra ID, avoiding client secrets in the repository. The developer encountered and resolved issues with workflow subjects and publisher permissions during the release of version 0.0.2. The key lesson emphasizes that a successful build does not guarantee authentication or publishing rights.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Base DeFi vault loses $6M in wstETH due to compromised access control

On October 4, 2026, an unnamed DeFi vault on the Base network suffered a $6 million exploit. An attacker compromised the vault's whitelist controls via its multisignature wallet, adding a malicious contract to the approved list. Within minutes, the attacker withdrew approximately 1,783 aBaswstETH tokens from the vault across six transactions. Security firms Blockaid, Spot On Chain, and PeckShield tracked the stolen assets to a specific address on Base. The vulnerability was isolated to the vault's application-level controls, not the underlying Aave protocol or Base network.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Hiring Humans for Tasks Need Trust Systems: Identity, Escrow, Reputation

A new form of commerce is emerging where AI agents hire humans via platforms to complete physical tasks. This model, exemplified by platforms like AgentHands, creates a unique trust challenge as the employer is software and interactions are impersonal. Essential safeguards include identity verification for workers to confirm they are real individuals. Payment escrow is used to secure funds before work begins and release them only upon completion. Additionally, a two-way reputation system is needed to evaluate both worker reliability and the AI agent's payment history.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Article advises using NHTSA cab-type data without making unsupported marketing claims.

A technical article outlines guidelines for displaying cab-type data from the NHTSA's vPIC vehicle database. It emphasizes that the database provides specific catalog labels like 'Crew' or 'Extended' but does not include details on seat counts or door configurations. The author warns against using this limited data to invent marketing claims about passenger capacity or vehicle features. The article provides code examples showing how to display the data or indicate when it is not provided. It concludes by advising developers to resist product pressure to embellish the basic catalog information.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI agents hiring humans for physical tasks sparks debate over work dignity

A new phenomenon has emerged where AI agents post and pay for physical tasks humans can perform, such as taking photos at specific locations. This shift introduces software as the direct hiring entity, replacing traditional company intermediaries. Observers note the language used—terms like 'gigs' and 'errands' rather than 'jobs'—can diminish the perceived dignity and standing of the work. While some see this as dehumanizing, others appreciate the direct, transparent terms without office politics. The core debate centers on whether the actual payment and conditions match the weight of the work being performed.

0 comments Read more at DEV Community