Automate release pipeline: one-trigger workflow with marketplace publish and proper release notes

[Copilot]

Release process required 6+ manual steps (version bump → trigger workflow → download VSIX → run publish.ps1 → commit changelog). The CHANGELOG.md in the published extension was always stale because it was synced after the VSIX was already packaged. Release notes were frequently empty because the workflow extracted them from the (empty) CHANGELOG.md via sed.

Release workflow (release.yml)

• Fix empty release notes: Replace sed-based CHANGELOG.md extraction with GitHub's generate-notes API, which produces rich notes from merged PRs using .github/release.yml categories
• Fix stale changelog in VSIX: Insert generated notes into CHANGELOG.md in the workspace before npx vsce package, so the extension ships with current notes
• Add publish job: Downloads VSIX from the GitHub release and publishes via npx vsce publish using VSCE_PAT secret. Only runs on workflow_dispatch (not tag push)
• Add update-changelog job: Runs sync-changelog.js against the newly created release and opens a PR to update the repo's CHANGELOG.md
• Add publish_marketplace input: Defaults to true; set to false to create a release without publishing
• Upload VSIX as workflow artifact (90-day retention) for direct download from the Actions run

Tag pushes still trigger build + GitHub release only (no marketplace publish), preserving backward compatibility.

Other changes

• sync-release-notes.yml: Remove release: [published, edited] trigger — the release workflow now handles automated sync, this becomes manual-only to avoid duplicate PRs
• CONTRIBUTING.md: Rewrite release process docs to reflect one-step workflow
• publish.ps1: Mark as manual fallback in header
• scripts/pre-release.js: Simplify post-run instructions and checklist template

Security

workflow_dispatch already requires write access. Marketplace publish is gated on VSCE_PAT secret. Tag pushes cannot trigger marketplace publish.

Original prompt

Our current flow of releasing updates needs some love. We now update the package.json manually with a version bump, run the release workflow and then download the vsix that is created.

Then we place the downloaded file in the right place in the local repository, and run the publish script. That script runs the update for the changelog, which is commuted after that and send in with a pr.

That means the changelog in the extension is always out of date.

Additionally the release notes now miss some info, not sure why the latest versions often show as empty.

Look at the setup and propose the fixes that are needed to make this smoother. I want to make this a one trigger action, but also want to have control over when this happens, with all the security steps in front of it to prevent users without write access from being able to trigger this somehow.

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.