Should we have an official llvm account for pulishing plugins on the vscode marketplace

[tstellar]

We need an account to publish on the vscode marketplace. mlir-vscode currently uses a third-party account as does https://github.com/clangd/vscode-clangd Would it make sense to have an 'official' llvm account for publishing the plugins especially for mlir-vscode since it's being published directory from the llvm organization git repository.

[ChristianKuehnel]

From the discussions around the MLIR extension, I learned that we need a "Publisher ID" and we can then allow multiple user accounts to publish under that ID: https://github.com/microsoft/vscode/issues/3670#issuecomment-200277260

We probably also need to agree to some policy on when which extensions we want to have under the LLVM Publisher ID.

[sam-mccall]

A few thoughts from a maintainer of the clangd extension (also @kadircet), though the publishing was set up before my time...

• As Christian said, the publicly-visible thing is the publisher ID, not the (Microsoft) accounts that have access to it.
• Moving an existing extension to a different publisher isn't possible/useful, it's effectively a new extension. (VSCode will see it as a different extension, existing users won't get updates). So there's a cost to this for vscode-clangd's ~200K users, and will be a cost to vscode-mlir users depending how soon we sort this out.
• Publishers are just an ID, some metadata, and an ACL (list of microsoft accounts). To the extent you see llvm-vs-code-extensions as third-party, could we fix that by changing the ACL?
• Within a publisher, there's no meaningful security boundary between extensions - a token which can publish one can publish them all. Nevertheless as an extension maintainer having permissions on the publisher is important (e.g. to respond on the Q&A page).
• Unfortunately the ability to edit ACLs directly is broken for several years now, we have to email [email protected] when we want a change.
• IMO extensions don't belong in the monorepo, so we moved them out. They're not version-locked, their CI/testing requirements are disjoint, extension users found it too hard to find/use the bug tracker. We've accepted several PRs from people who AFAIK don't know C++, CMake, ninja, phabricator! We'd be happy to also move clangd/vscode-clangd into the llvm org if that's desirable. However admin access to the repos is important.