ci(vscode): add tag, GitHub Release, and Slack bookkeeping to combined publish workflow

.cline/skills/publish-extension/SKILL.md

@@ -107,15 +107,17 @@ gh api repos/cline/cline/actions/runs/<run-id>/pending_deployments
 
 ### Post-publish
 
-1. Verify the marketplace serves the new version (query from rule 1).
-2. This workflow does **not** tag or create a GitHub release — do it manually:
+1. Verify the marketplace serves the new version (query from rule 1) — expect minutes-to-an-hour of validation lag after "Published" appears in the logs.
+2. Tag, GitHub Release (with the .vsix attached), and the Slack release-bot post happen **automatically** after a real publish (all `continue-on-error` — the publish itself already succeeded, so bookkeeping failures leave the run green). Verify they landed; the known failure is the tag push when the built commit touches `.github/workflows/**` (default token cannot create such refs — no grantable permission fixes it). Manual fallback:
 
    ```bash
    git tag v<VERSION> <main-sha-built>   # ask before pushing
    git push origin v<VERSION>
-   gh release create v<VERSION> --title "v<VERSION>" --notes "<curated notes from CHANGELOG>"
+   gh release create v<VERSION> --title "v<VERSION>" --notes "<changelog section>" <path-to.vsix>
    ```
 
+   A real publish also **hard-fails early** if root `CHANGELOG.md` on the built main revision doesn't start with `## [<VERSION>]` — the release prep PR must be merged before dispatching.
+
 3. Thorough artifact check (`gh run download <run-id>`): union `package.json` is `saoudrizwan.claude-dev@<VERSION>`, `next/package.json` and `legacy/package.json` carry the SAME version, `grep -c 'phc_' extension/extension.js` ≥ 1 (loader key inlined), no leftover `process.env.TELEMETRY_SERVICE_API_KEY` / `process.env.CLINE_ROLLOUT_VARIANT` literals in either bundle's dist (leftovers = a build ran without its env and telemetry is silently dead).
 4. Monitor: `extension.rollout.bundle_activated` in `otel.otel_logs` filtered to `extension_version = '<VERSION>'` (stable cohort is cleanly separable — nightly versions are timestamps). Watch the next/legacy ratio and the crash-fallback rate; Metabase dashboards 17 (rollout + task error rate) and 19 (error deep dive). `extension.rollout.loader_decision` (incl. `double_failure`) is PostHog-only, not in ClickHouse.
 5. Dial the flag per the rollout plan (e.g. 0% at publish → 1% → up), verifying each change with the probe from rule 2. Announce demotions ahead of time — dialing down also demotes nightly dogfooders unless they set `"cline-nightly.rollout.bundleOverride": "next"`.

.github/workflows/ext-vscode-ab-package.yml

@@ -126,6 +126,10 @@ jobs:
         needs: [test-next, test-legacy]
         runs-on: ubuntu-latest
         environment: publish
+        # contents: write is required by the post-publish bookkeeping (tag +
+        # GitHub Release), mirroring the standalone publish workflows.
+        permissions:
+            contents: write
         steps:
             # Refuse to publish a next bundle the test-next gate did not cover.
             # The reusable suite tests the dispatch revision (main), so publishing
@@ -148,6 +152,21 @@ jobs:
                   path: next-src
                   lfs: true
 
+            # Fail fast (before the ~20-min build) if a real publish is missing
+            # its changelog entry — same contract the standalone publish
+            # workflows enforce. Build-only rehearsals are exempt.
+            - name: Verify changelog entry
+              if: ${{ github.event.inputs.publish == 'true' }}
+              working-directory: next-src
+              run: |
+                  EXPECTED_HEADING="## [${{ github.event.inputs.version }}]"
+                  FIRST_HEADING=$(grep -m 1 '^## \[' CHANGELOG.md || true)
+                  if [[ "$FIRST_HEADING" != "$EXPECTED_HEADING" ]]; then
+                    echo "Error: CHANGELOG.md must start with '$EXPECTED_HEADING' before publishing (found '$FIRST_HEADING')."
+                    exit 1
+                  fi
+                  echo "Found changelog entry for ${{ github.event.inputs.version }}"
+
             # Pin to the revision test-legacy actually tested (see that job's
             # outputs comment) — never re-resolve the mutable branch name here.
             - name: Checkout legacy source
@@ -304,3 +323,88 @@ jobs:
                     exit 1
                   fi
                   vsce publish --no-dependencies --packagePath "claude-dev-${{ github.event.inputs.version }}.vsix"
+
+            # ---- Post-publish bookkeeping (tag / GitHub Release / Slack) ----
+            # Mirrors the standalone publish workflows. Every step here is
+            # continue-on-error: the Marketplace publish above already happened,
+            # and a red run after a successful publish is exactly the confusion
+            # the nightly workflow taught us to avoid (tag pushes fail whenever
+            # the built commit touches .github/workflows/** — no grantable
+            # permission fixes that; push the tag manually in that case, see
+            # the publish-extension skill).
+
+            - name: Extract changelog entry
+              id: changelog
+              if: ${{ github.event.inputs.publish == 'true' }}
+              continue-on-error: true
+              working-directory: next-src
+              run: |
+                  CONTENT=$(awk '/^## \[/{if(found) exit; found=1; next} found{print}' CHANGELOG.md)
+                  {
+                    echo "content<<CHANGELOG_EOF"
+                    echo "$CONTENT"
+                    echo "CHANGELOG_EOF"
+                  } >> "$GITHUB_OUTPUT"
+
+            - name: Resolve previous release tag
+              id: prev_tag
+              if: ${{ github.event.inputs.publish == 'true' }}
+              continue-on-error: true
+              working-directory: next-src
+              run: |
+                  # ls-remote needs no local tag objects; take the highest v* tag
+                  # below the one being released.
+                  PREV=$(git ls-remote --tags origin 'v*' \
+                    | awk -F/ '{print $NF}' | grep -v '\^{}' \
+                    | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
+                    | grep -vx "v${{ github.event.inputs.version }}" \
+                    | sort -V | tail -1)
+                  echo "prev_tag=$PREV" >> "$GITHUB_OUTPUT"
+
+            - name: Create and push release tag
+              if: ${{ github.event.inputs.publish == 'true' }}
+              continue-on-error: true
+              working-directory: next-src
+              run: |
+                  TAG="v${{ github.event.inputs.version }}"
+                  git tag "$TAG" HEAD
+                  git push origin "refs/tags/$TAG"
+                  echo "Pushed $TAG at $(git rev-parse HEAD)"
+
+            - name: Create GitHub Release
+              if: ${{ github.event.inputs.publish == 'true' }}
+              continue-on-error: true
+              uses: softprops/action-gh-release@v1
+              with:
+                  tag_name: v${{ github.event.inputs.version }}
+                  files: staging/claude-dev-${{ github.event.inputs.version }}.vsix
+                  body: |
+                      ${{ steps.changelog.outputs.content }}
+
+                      **Full Changelog**: https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.prev_tag }}...v${{ github.event.inputs.version }}
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Post release to Slack
+              if: ${{ github.event.inputs.publish == 'true' }}
+              continue-on-error: true
+              uses: slackapi/slack-github-action@v3.0.1
+              with:
+                  method: chat.postMessage
+                  token: ${{ secrets.SLACK_RELEASE_BOT_TOKEN }}
+                  payload: |
+                    channel: "C0APVKGGZFC"
+                    text: "Cline v${{ github.event.inputs.version }}"
+                    blocks:
+                      - type: "section"
+                        text:
+                          type: "mrkdwn"
+                          text: "*Cline v${{ github.event.inputs.version }}*"
+                      - type: "section"
+                        text:
+                          type: "mrkdwn"
+                          text: ${{ toJSON(steps.changelog.outputs.content) }}
+                      - type: "context"
+                        elements:
+                          - type: "mrkdwn"
+                            text: "Full Changelog: https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.prev_tag }}...v${{ github.event.inputs.version }}"