[debug-certificate-manager] Reimplement Certificate Manager VS Code Extension

.vscode/launch.json

@@ -85,6 +85,19 @@
 				"${workspaceFolder}/vscode-extensions/rush-vscode-extension/dist/**/*.js"
 			]
 			// "preLaunchTask": "npm: build:watch - vscode-extensions/rush-vscode-extension"
+		},
+		{
+			"name": "Launch Debug Certificate Manager VS Code Extension",
+			"type": "extensionHost",
+			"request": "launch",
+			"cwd": "${workspaceFolder}/vscode-extensions/debug-certificate-manager-vscode-extension/dist/vsix/unpacked",
+			"args": [
+				"--extensionDevelopmentPath=${workspaceFolder}/vscode-extensions/debug-certificate-manager-vscode-extension/dist/vsix/unpacked"
+			],
+			"sourceMaps": true,
+			"outFiles": [
+				"${workspaceFolder}/vscode-extensions/debug-certificate-manager-vscode-extension/**"
+			]
 		}
 	]
 }

README.md

@@ -218,12 +218,9 @@ These GitHub repositories provide supplementary resources for Rush Stack:
 | [/rigs/local-node-rig](./rigs/local-node-rig/) | A rig package for Node.js projects that build using Heft inside the RushStack repository. |
 | [/rigs/local-web-rig](./rigs/local-web-rig/) | A rig package for Web projects that build using Heft inside the RushStack repository. |
 | [/rush-plugins/rush-litewatch-plugin](./rush-plugins/rush-litewatch-plugin/) | An experimental alternative approach for multi-project watch mode |
+| [/vscode-extensions/debug-certificate-manager-vscode-extension](./vscode-extensions/debug-certificate-manager-vscode-extension/) | VS Code extension to manage debug TLS certificates and sync them to the VS Code workspace. Works with VS Code remote development (Codespaces, SSH, Dev Containers, WSL, VS Code Tunnels). |
 | [/vscode-extensions/rush-vscode-command-webview](./vscode-extensions/rush-vscode-command-webview/) | Part of the Rush Stack VSCode extension, provides a UI for invoking Rush commands |
 | [/vscode-extensions/rush-vscode-extension](./vscode-extensions/rush-vscode-extension/) | Enhanced experience for monorepos that use the Rush Stack toolchain |
-| [/vscode-extensions/tls-sync-vscode-extension-pack](./vscode-extensions/tls-sync-vscode-extension-pack/) |  |
-| [/vscode-extensions/tls-sync-vscode-shared](./vscode-extensions/tls-sync-vscode-shared/) |  |
-| [/vscode-extensions/tls-sync-vscode-ui-extension](./vscode-extensions/tls-sync-vscode-ui-extension/) |  |
-| [/vscode-extensions/tls-sync-vscode-workspace-extension](./vscode-extensions/tls-sync-vscode-workspace-extension/) |  |
 | [/vscode-extensions/vscode-shared](./vscode-extensions/vscode-shared/) |  |
 | [/webpack/webpack-deep-imports-plugin](./webpack/webpack-deep-imports-plugin/) | This plugin creates a bundle and commonJS files in a 'lib' folder mirroring modules in another 'lib' folder. |
 <!-- GENERATED PROJECT SUMMARY END -->

common/changes/@rushstack/debug-certificate-manager/bmiddha-tls-sync-v2_2025-07-24-22-08.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/debug-certificate-manager",
+      "comment": "Read CertificateStore configuration from .vscode/debug-certificate-manager.json",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/debug-certificate-manager"
+}

common/changes/@rushstack/heft-vscode-extension-plugin/bmiddha-tls-sync-v2_2025-07-24-22-08.json

@@ -0,0 +1,15 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-vscode-extension-plugin",
+      "comment": "Add support for generating extension manifest.",
+      "type": "minor"
+    },
+    {
+      "packageName": "@rushstack/heft-vscode-extension-plugin",
+      "comment": "Add VSIX publish plugin.",
+      "type": "minor"
+    }
+  ],
+  "packageName": "@rushstack/heft-vscode-extension-plugin"
+}

common/changes/@rushstack/heft-vscode-extension-rig/bmiddha-tls-sync-v2_2025-07-25-06-09.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@rushstack/heft-vscode-extension-rig",
+      "comment": "Add publish vsix plugin configuration.",
+      "type": "patch"
+    }
+  ],
+  "packageName": "@rushstack/heft-vscode-extension-rig"
+}

common/config/azure-pipelines/vscode-extension-publish.yaml

@@ -9,17 +9,13 @@ parameters:
   - name: ExtensionPublishConfig
     type: object
     default:
-      - key: 'tls-sync-vscode-ui-extension'
+      - key: 'debug-certificate-manager-vscode-extension'
         vsixPath: 'dist/vsix/packaged.vsix'
-        projectPath: '$(Build.SourcesDirectory)/vscode-extensions/tls-sync-vscode-ui-extension'
-      - key: 'tls-sync-vscode-workspace-extension'
-        vsixPath: 'dist/vsix/packaged.vsix'
-        projectPath: '$(Build.SourcesDirectory)/vscode-extensions/tls-sync-vscode-workspace-extension'
-      - key: 'tls-sync-vscode-extension-pack'
-        vsixPath: 'dist/vsix/packaged.vsix'
-        projectPath: '$(Build.SourcesDirectory)/vscode-extensions/tls-sync-vscode-extension-pack'
+        manifestPath: 'dist/vsix/extension-manifest.json'
+        projectPath: '$(Build.SourcesDirectory)/vscode-extensions/debug-certificate-manager-vscode-extension'
       - key: 'rush-vscode-extension'
         vsixPath: 'dist/vsix/packaged.vsix'
+        manifestPath: 'dist/vsix/extension-manifest.json'
         projectPath: '$(Build.SourcesDirectory)/vscode-extensions/rush-vscode-extension'
 
 resources:
@@ -62,13 +58,49 @@ extends:
                     --to tag:vsix
 
               - ${{ if parameters.shouldPublish }}:
+                  - task: AzureCLI@2
+                    displayName: 'Get managed identity user info'
+                    inputs:
+                      azureSubscription: 'rushstack-vscode-publish'
+                      scriptType: bash
+                      scriptLocation: inlineScript
+                      inlineScript: |
+                        az rest -u https://app.vssps.visualstudio.com/_apis/profile/profiles/me --resource 499b84ac-1321-427f-aa17-267ca6975798
+
                   - ${{ each extension in parameters.ExtensionPublishConfig }}:
+                      - bash: cp ${{ extension.manifestPath }} ${{ extension.projectPath }}/extension.signature.p7s
+                        workingDirectory: ${{ extension.projectPath }}
+                        displayName: 'Prepare manifest for signing: ${{ extension.key }}'
+
+                      - task: EsrpCodeSigning@5
+                        displayName: 'ESRP CodeSigning'
+                        inputs:
+                          connectedservicename: '' # TODO
+                          AppRegistrationClientId: '' # TODO
+                          AppRegistrationTenantId: '' # TODO
+                          AuthAKVName: '' # TODO
+                          AuthCertName: '' # TODO
+                          AuthSignCertName: '' # TODO
+                          FolderPath: '${{ extension.projectPath }}'
+                          Pattern: 'extension.signature.p7s'
+                          signConfigType: inlineSignParams
+                          inlineOperation: |
+                            [
+                                {
+                                    "keyCode": "CP-401405",
+                                    "operationSetCode": "VSCodePublisherSign",
+                                    "parameters": [],
+                                    "toolName": "sign",
+                                    "toolVersion": "1.0"
+                                }
+                            ]
+
                       - task: AzureCLI@2
                         displayName: 'Publish VSIX: ${{ extension.key }}'
                         inputs:
                           azureSubscription: rushstack-vscode-publish
                           scriptType: 'bash'
                           scriptLocation: 'inlineScript'
                           inlineScript: |
-                            node node_modules/@rushstack/heft-vscode-extension-rig/node_modules/@rushstack/heft-vscode-extension-plugin/node_modules/@vscode/vsce/vsce publish --no-dependencies --azure-credential --packagePath ${{ extension.vsixPath }}
+                            node node_modules/@rushstack/heft/lib/start.js publish-vsix --vsix-path ${{ extension.vsixPath }} --manifest-path ${{ extension.projectPath }}/extension.manifest --signature-path ${{ extension.projectPath }}/extension.signature.p7s
                           workingDirectory: ${{ extension.projectPath }}

common/config/rush/version-policies.json

@@ -105,15 +105,5 @@
     "version": "5.156.0",
     "nextBump": "minor",
     "mainProject": "@microsoft/rush"
-  },
-  {
-    // This policy is used for the TLS Sync VS Code extensions.
-    // Updating them in lockstep is necessary for the UI and Workspace extensions to work together.
-    // The Workspace and UI extensions perform a ping-pong version check to ensure they are compatible.
-    "policyName": "tls-sync-vscode-extensions",
-    "definitionName": "lockStepVersion",
-    "version": "0.0.1",
-    "nextBump": "minor",
-    "mainProject": "tls-sync-vscode-extension-pack"
   }
 ]

heft-plugins/heft-vscode-extension-plugin/heft-plugin.json

@@ -1,10 +1,38 @@
 {
   "$schema": "https://developer.microsoft.com/json-schemas/heft/v0/heft-plugin.schema.json",
-
   "taskPlugins": [
     {
       "pluginName": "vscode-extension-package-plugin",
-      "entryPoint": "./lib/VSCodeExtensionPackagePlugin.js"
+      "entryPoint": "./lib/VSCodeExtensionPackagePlugin.js",
+      "parameterScope": "package"
+    },
+    {
+      "pluginName": "vscode-extension-publish-plugin",
+      "entryPoint": "./lib/VSCodeExtensionPublishPlugin.js",
+      "parameterScope": "publish-vsix",
+      "parameters": [
+        {
+          "longName": "--vsix-path",
+          "parameterKind": "string",
+          "argumentName": "RELATIVE_PATH",
+          "description": "Use this parameter to control which VSIX file will be used for publishing.",
+          "required": true
+        },
+        {
+          "longName": "--manifest-path",
+          "parameterKind": "string",
+          "argumentName": "RELATIVE_PATH",
+          "description": "Use this parameter to control which manifest file will be used for publishing.",
+          "required": true
+        },
+        {
+          "longName": "--signature-path",
+          "parameterKind": "string",
+          "argumentName": "RELATIVE_PATH",
+          "description": "Use this parameter to control which signature file will be used for publishing.",
+          "required": true
+        }
+      ]
     }
   ]
 }