Add marketplace publish step to CI workflow with README in VSIX

- Include README.md in VSIX packaging (added to vsix_staging in build step)
- Add README.md as Microsoft.VisualStudio.Services.Content.Details asset in manifest
- Add markdown content type to Content_Types.xml
- Add publishManifest.json for VsixPublisher.exe
- Add publish-to-marketplace step in CI (runs on push to master/main)
- Step uses VsixPublisher.exe with MARKETPLACE_PAT secret

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Jordan Pierce

.github/workflows/build.yml

@@ -41,6 +41,7 @@ jobs:
         Copy-Item "vsix_template\extension.vsixmanifest" $staging
         Copy-Item "vsix_template\OffensiveVS360.pkgdef" $staging
         Copy-Item "vsix_template\Content_Types.xml" "$staging\[Content_Types].xml"
+        Copy-Item "README.md" $staging
 
         Get-ChildItem -Recurse $staging | ForEach-Object { Write-Host $_.FullName }
         Compress-Archive -Path "$staging\*" -DestinationPath "OffensiveVS360.vsix" -Force
@@ -53,3 +54,47 @@ jobs:
         path: OffensiveVS360.vsix
         if-no-files-found: error
         retention-days: 30
+
+    - name: Publish to Visual Studio Marketplace
+      if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
+      shell: pwsh
+      env:
+        MARKETPLACE_PAT: ${{ secrets.MARKETPLACE_PAT }}
+      run: |
+        # Find VsixPublisher.exe from the Visual Studio installation
+        $vsixPublisher = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" `
+          -latest -products * -requires Microsoft.VisualStudio.Component.VSSDK `
+          -find "VSSDK\VisualStudioIntegration\Tools\Bin\VsixPublisher.exe" 2>$null
+
+        if (-not $vsixPublisher) {
+          # Try common VS 2022 paths
+          $candidates = @(
+            "${env:ProgramFiles}\Microsoft Visual Studio\2022\Enterprise\VSSDK\VisualStudioIntegration\Tools\Bin\VsixPublisher.exe",
+            "${env:ProgramFiles}\Microsoft Visual Studio\2022\Professional\VSSDK\VisualStudioIntegration\Tools\Bin\VsixPublisher.exe",
+            "${env:ProgramFiles}\Microsoft Visual Studio\2022\Community\VSSDK\VisualStudioIntegration\Tools\Bin\VsixPublisher.exe",
+            "${env:ProgramFiles(x86)}\Microsoft Visual Studio\2022\BuildTools\VSSDK\VisualStudioIntegration\Tools\Bin\VsixPublisher.exe"
+          )
+          foreach ($c in $candidates) {
+            if (Test-Path $c) { $vsixPublisher = $c; break }
+          }
+        }
+
+        if (-not $vsixPublisher) {
+          Write-Error "VsixPublisher.exe not found. Install Visual Studio SDK component."
+          exit 1
+        }
+
+        Write-Host "Using VsixPublisher: $vsixPublisher"
+        Write-Host "Publishing OffensiveVS360.vsix to Visual Studio Marketplace..."
+
+        & $vsixPublisher publish `
+          -payload "OffensiveVS360.vsix" `
+          -publishManifest "vsix_template\publishManifest.json" `
+          -personalAccessToken "$env:MARKETPLACE_PAT" `
+          -ignoreWarnings "VSIXValidatorWarning01,VSIXValidatorWarning02,VSIXValidatorWarning03"
+
+        if ($LASTEXITCODE -ne 0) {
+          Write-Error "VsixPublisher failed with exit code $LASTEXITCODE"
+          exit $LASTEXITCODE
+        }
+        Write-Host "Successfully published to Visual Studio Marketplace."

vsix_template/Content_Types.xml

@@ -4,4 +4,5 @@
   <Default Extension="pkgdef"  ContentType="text/plain" />
   <Default Extension="png"     ContentType="image/png" />
   <Override PartName="/extension.vsixmanifest" ContentType="text/xml" />
+  <Default Extension="md" ContentType="text/markdown" />
 </Types>

vsix_template/extension.vsixmanifest

@@ -26,5 +26,6 @@ Requires an O360 SAST server endpoint and API token.</Description>
   <Assets>
     <Asset Type="Microsoft.VisualStudio.VsPackage" Path="OffensiveVS360.pkgdef" />
     <Asset Type="Microsoft.VisualStudio.MefComponent" Path="OffensiveVS360.dll" />
+    <Asset Type="Microsoft.VisualStudio.Services.Content.Details" Path="README.md" />
   </Assets>
 </PackageManifest>

vsix_template/publishManifest.json

@@ -0,0 +1,23 @@
+{
+  "categories": [
+    "Tools",
+    "Tools/Coding",
+    "Tools/Programming Languages"
+  ],
+  "priceCategory": "free",
+  "galleryFlags": [
+    "public"
+  ],
+  "identity": {
+    "internalName": "OffensiveVS360"
+  },
+  "overview": "README.md",
+  "publisher": "Offensive360",
+  "tags": [
+    "security",
+    "sast",
+    "vulnerability",
+    "appsec",
+    "devsecops"
+  ]
+}