ci(vscode): add tag, GitHub Release, and Slack bookkeeping to combined publish workflow

.github/workflows/ext-vscode-ab-package.yml

@@ -126,6 +126,10 @@ jobs:
         needs: [test-next, test-legacy]
         runs-on: ubuntu-latest
         environment: publish
+        # contents: write is required by the post-publish bookkeeping (tag +
+        # GitHub Release), mirroring the standalone publish workflows.
+        permissions:
+            contents: write
         steps:
             # Refuse to publish a next bundle the test-next gate did not cover.
             # The reusable suite tests the dispatch revision (main), so publishing
@@ -148,6 +152,21 @@ jobs:
                   path: next-src
                   lfs: true
 
+            # Fail fast (before the ~20-min build) if a real publish is missing
+            # its changelog entry — same contract the standalone publish
+            # workflows enforce. Build-only rehearsals are exempt.
+            - name: Verify changelog entry
+              if: ${{ github.event.inputs.publish == 'true' }}
+              working-directory: next-src
+              run: |
+                  EXPECTED_HEADING="## [${{ github.event.inputs.version }}]"
+                  FIRST_HEADING=$(grep -m 1 '^## \[' CHANGELOG.md || true)
+                  if [[ "$FIRST_HEADING" != "$EXPECTED_HEADING" ]]; then
+                    echo "Error: CHANGELOG.md must start with '$EXPECTED_HEADING' before publishing (found '$FIRST_HEADING')."
+                    exit 1
+                  fi
+                  echo "Found changelog entry for ${{ github.event.inputs.version }}"
+
             # Pin to the revision test-legacy actually tested (see that job's
             # outputs comment) — never re-resolve the mutable branch name here.
             - name: Checkout legacy source
@@ -304,3 +323,88 @@ jobs:
                     exit 1
                   fi
                   vsce publish --no-dependencies --packagePath "claude-dev-${{ github.event.inputs.version }}.vsix"
+
+            # ---- Post-publish bookkeeping (tag / GitHub Release / Slack) ----
+            # Mirrors the standalone publish workflows. Every step here is
+            # continue-on-error: the Marketplace publish above already happened,
+            # and a red run after a successful publish is exactly the confusion
+            # the nightly workflow taught us to avoid (tag pushes fail whenever
+            # the built commit touches .github/workflows/** — no grantable
+            # permission fixes that; push the tag manually in that case, see
+            # the publish-extension skill).
+
+            - name: Extract changelog entry
+              id: changelog
+              if: ${{ github.event.inputs.publish == 'true' }}
+              continue-on-error: true
+              working-directory: next-src
+              run: |
+                  CONTENT=$(awk '/^## \[/{if(found) exit; found=1; next} found{print}' CHANGELOG.md)
+                  {
+                    echo "content<<CHANGELOG_EOF"
+                    echo "$CONTENT"
+                    echo "CHANGELOG_EOF"
+                  } >> "$GITHUB_OUTPUT"
+
+            - name: Resolve previous release tag
+              id: prev_tag
+              if: ${{ github.event.inputs.publish == 'true' }}
+              continue-on-error: true
+              working-directory: next-src
+              run: |
+                  # ls-remote needs no local tag objects; take the highest v* tag
+                  # below the one being released.
+                  PREV=$(git ls-remote --tags origin 'v*' \
+                    | awk -F/ '{print $NF}' | grep -v '\^{}' \
+                    | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
+                    | grep -vx "v${{ github.event.inputs.version }}" \
+                    | sort -V | tail -1)
+                  echo "prev_tag=$PREV" >> "$GITHUB_OUTPUT"
+
+            - name: Create and push release tag
+              if: ${{ github.event.inputs.publish == 'true' }}
+              continue-on-error: true
+              working-directory: next-src
+              run: |
+                  TAG="v${{ github.event.inputs.version }}"
+                  git tag "$TAG" HEAD
+                  git push origin "refs/tags/$TAG"
+                  echo "Pushed $TAG at $(git rev-parse HEAD)"
+
+            - name: Create GitHub Release
+              if: ${{ github.event.inputs.publish == 'true' }}
+              continue-on-error: true
+              uses: softprops/action-gh-release@v1
+              with:
+                  tag_name: v${{ github.event.inputs.version }}
+                  files: staging/claude-dev-${{ github.event.inputs.version }}.vsix
+                  body: |
+                      ${{ steps.changelog.outputs.content }}
+
+                      **Full Changelog**: https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.prev_tag }}...v${{ github.event.inputs.version }}
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Post release to Slack
+              if: ${{ github.event.inputs.publish == 'true' }}
+              continue-on-error: true
+              uses: slackapi/slack-github-action@v3.0.1
+              with:
+                  method: chat.postMessage
+                  token: ${{ secrets.SLACK_RELEASE_BOT_TOKEN }}
+                  payload: |
+                    channel: "C0APVKGGZFC"
+                    text: "Cline v${{ github.event.inputs.version }}"
+                    blocks:
+                      - type: "section"
+                        text:
+                          type: "mrkdwn"
+                          text: "*Cline v${{ github.event.inputs.version }}*"
+                      - type: "section"
+                        text:
+                          type: "mrkdwn"
+                          text: ${{ toJSON(steps.changelog.outputs.content) }}
+                      - type: "context"
+                        elements:
+                          - type: "mrkdwn"
+                            text: "Full Changelog: https://github.com/${{ github.repository }}/compare/${{ steps.prev_tag.outputs.prev_tag }}...v${{ github.event.inputs.version }}"