ci(nightly): tag and push vscode-nightly-v<version> for each nightly build

Both nightly publish workflows (publish-nightly.yml and publish-nightly-sdk.yml)
publish to the saoudrizwan.cline-nightly extension with version
'${major}.${minor}.${unix-timestamp}'. Until now nothing on the git side
recorded which commit a given marketplace version was built from, which
made post-hoc 'what's in version X.Y.<timestamp>?' triage essentially
require reverse-engineering the GitHub Actions run history.

Follow the technique from publish.yml (the stable release workflow): after
a successful publish, configure a github-actions[bot] git identity, create
an annotated tag pointing at the build SHA, and push it to origin.

Changes:

- scripts/publish-nightly.mjs: when running under GitHub Actions (i.e.
  GITHUB_OUTPUT is set), append 'version=${newVersion}' to that file so
  the calling workflow can read steps.publish.outputs.version. The
  generated version is computed in exactly one place (Math.floor(
  Date.now()/1000)), eliminating drift risk between the published vsix
  and the tag.

- publish-nightly.yml: give the publish step id 'publish'; add a
  'Tag and push nightly build' step that creates and pushes
  vscode-nightly-v${VERSION}. The workflow already has 'contents: write'
  permissions and a credentialled checkout, so 'git push origin' just works.

- publish-nightly-sdk.yml: bump 'contents: read' -> 'contents: write';
  add the same tagging step, but push using an explicit
  https://x-access-token:${GITHUB_TOKEN}@github.com/... URL rather than
  relying on a persisted credential. This lets us keep
  'persist-credentials: false' on the SDK source checkout (defense in
  depth: that token cannot inadvertently push to
  dpc/sdk-migration-simpler-login). Tag refs (refs/tags/*) are the only
  thing this token gets used to push.

Tag namespace 'vscode-nightly-v...' is intentionally distinct from the
'vX.Y.Z' tags used for stable VS Code releases, and reserves room for
future 'jetbrains-nightly-v...' / 'cli-nightly-v...' tag families.
Existing stable 'vX.Y.Z' tags are left untouched.

.github/workflows/publish-nightly-sdk.yml

@@ -6,7 +6,9 @@ on:
     workflow_dispatch:
 
 permissions:
-    contents: read
+    # contents: write is needed so the final step can push a build tag
+    # (`vscode-nightly-v<version>`) marking what was shipped.
+    contents: write
     packages: write
     checks: write
     pull-requests: write
@@ -56,6 +58,7 @@ jobs:
                   done
 
             - name: Publish SDK nightly extension
+              id: publish
               env:
                   VSCE_PAT: ${{ secrets.VSCE_PAT }}
                   OVSX_PAT: ${{ secrets.OVSX_PAT }}
@@ -70,3 +73,43 @@ jobs:
                   OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
                   OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
               run: npm run publish:marketplace:nightly
+
+            # Tag the commit that was actually built and shipped, so we can
+            # later answer "what was in nightly version X.Y.<timestamp>?".
+            # The version comes from scripts/publish-nightly.mjs, which writes
+            # `version=<the-new-version>` to $GITHUB_OUTPUT. Tag namespace is
+            # `vscode-nightly-v<version>` to distinguish from the plain `vX.Y.Z`
+            # tags used for stable VS Code releases.
+            #
+            # We push using an explicit ${{ secrets.GITHUB_TOKEN }} URL rather
+            # than relying on a persisted git credential, so we can keep
+            # `persist-credentials: false` on the source checkout above
+            # (defense-in-depth: that token cannot inadvertently push to
+            # `dpc/sdk-migration-simpler-login`). Tag refs (`refs/tags/*`) are
+            # the only thing this token is used to push.
+            - name: Tag and push nightly build
+              if: success() && steps.publish.outputs.version != ''
+              env:
+                  NIGHTLY_VERSION: ${{ steps.publish.outputs.version }}
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+              run: |
+                  TAG="vscode-nightly-v${NIGHTLY_VERSION}"
+                  TAG_REF="refs/tags/${TAG}"
+                  BUILD_SHA=$(git rev-parse HEAD)
+
+                  if git ls-remote --exit-code --tags origin "${TAG_REF}" >/dev/null 2>&1; then
+                    echo "Tag ${TAG} already exists on origin; skipping push."
+                    exit 0
+                  fi
+
+                  git config user.name "github-actions[bot]"
+                  git config user.email "github-actions[bot]@users.noreply.github.com"
+                  git tag -a "${TAG}" "${BUILD_SHA}" \
+                    -m "Cline (Nightly SDK) VS Code extension ${NIGHTLY_VERSION}" \
+                    -m "Built and published by ${GITHUB_WORKFLOW} run ${GITHUB_RUN_ID}." \
+                    -m "Workflow file: .github/workflows/publish-nightly-sdk.yml" \
+                    -m "Source ref: ${SDK_NIGHTLY_REF}"
+                  git push \
+                    "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \
+                    "${TAG_REF}"
+                  echo "Tagged build commit ${BUILD_SHA} as ${TAG} and pushed to origin."

.github/workflows/publish-nightly.yml

@@ -59,6 +59,7 @@ jobs:
                   done
 
             - name: Publish Nightly Extension
+              id: publish
               env:
                   VSCE_PAT: ${{ secrets.VSCE_PAT }}
                   OVSX_PAT: ${{ secrets.OVSX_PAT }}
@@ -73,3 +74,33 @@ jobs:
                   OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
                   OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
               run: npm run publish:marketplace:nightly
+
+            # Tag the commit that was actually built and shipped, so we can
+            # later answer "what was in nightly version X.Y.<timestamp>?".
+            # The version comes from scripts/publish-nightly.mjs, which writes
+            # `version=<the-new-version>` to $GITHUB_OUTPUT. Tag namespace is
+            # `vscode-nightly-v<version>` to distinguish from the plain `vX.Y.Z`
+            # tags used for stable VS Code releases.
+            - name: Tag and push nightly build
+              if: success() && steps.publish.outputs.version != ''
+              env:
+                  NIGHTLY_VERSION: ${{ steps.publish.outputs.version }}
+              run: |
+                  TAG="vscode-nightly-v${NIGHTLY_VERSION}"
+                  TAG_REF="refs/tags/${TAG}"
+                  BUILD_SHA=$(git rev-parse HEAD)
+
+                  if git ls-remote --exit-code --tags origin "${TAG_REF}" >/dev/null 2>&1; then
+                    echo "Tag ${TAG} already exists on origin; skipping push."
+                    exit 0
+                  fi
+
+                  git config user.name "github-actions[bot]"
+                  git config user.email "github-actions[bot]@users.noreply.github.com"
+                  git tag -a "${TAG}" "${BUILD_SHA}" \
+                    -m "Cline (Nightly) VS Code extension ${NIGHTLY_VERSION}" \
+                    -m "Built and published by ${GITHUB_WORKFLOW} run ${GITHUB_RUN_ID}." \
+                    -m "Workflow file: .github/workflows/publish-nightly.yml" \
+                    -m "Source ref: ${GITHUB_REF}"
+                  git push origin "${TAG_REF}"
+                  echo "Tagged build commit ${BUILD_SHA} as ${TAG} and pushed to origin."

scripts/publish-nightly.mjs

@@ -330,6 +330,21 @@ class NightlyPublisher {
 		const newVersion = this.generateVersion(currentVersion)
 		log.info(`New version: ${newVersion}`)
 
+		// When running under GitHub Actions, surface the generated version
+		// via $GITHUB_OUTPUT so the workflow can tag the build commit with
+		// the same version that ends up on the marketplace. Tagging in the
+		// workflow (rather than here) keeps git side-effects out of this
+		// script's local-dev path.
+		const githubOutputPath = process.env.GITHUB_OUTPUT
+		if (githubOutputPath) {
+			try {
+				fs.appendFileSync(githubOutputPath, `version=${newVersion}\n`)
+				log.info(`Wrote version to GITHUB_OUTPUT: ${githubOutputPath}`)
+			} catch (error) {
+				log.warn(`Failed to write version to GITHUB_OUTPUT: ${error.message}`)
+			}
+		}
+
 		// Update package.json fields
 		pkg.version = newVersion
 		pkg.name = config.nightlyName