ci: ask Open VSX which key it signs with, every day

The keys are pinned in the app, so a key change at Open VSX is an outage for
every installed LevelCode until a release carries the new key. The release
gate asks the registry, but only when a release is cut. This asks daily
(.github/workflows/openvsx-key.yml runs extension-signature.mjs registry
--strict), so that day is known the day it comes and not from a bug report.

A failed run is the alarm; docs/EXTENSION-SIGNATURES.md says what to do then.
"Could not ask" is tried three times over ten minutes before it fails the run:
an outage is not news, but a check that has gone blind is.

Its own commit so that it can be reverted alone. It costs a few seconds of a
Linux runner a day. GitHub mails a failed scheduled run to whoever last edited
the schedule, and stops scheduling in a repository idle for 60 days.

The workflow has not run: a schedule only runs from the default branch.

Author: ndemianc

.github/workflows/openvsx-key.yml

@@ -0,0 +1,47 @@
+name: Open VSX signing key
+
+# LevelCode verifies every extension it installs or updates against Open VSX's signing key, and it
+# does not ask the registry for that key: the keys it trusts ship inside the app
+# (modules/extension-signature/keys.json). That is the point of pinning — and its price. The day
+# Open VSX signs with another key, every LevelCode already installed refuses what the new key
+# signs, until a release carries it.
+#
+# This asks the registry once a day, so that day is known the day it comes and not from a user's
+# bug report. It runs scripts/extension-signature.mjs registry: which key do the newest extensions
+# name, and do some of them really verify with the pinned keys?
+#
+# A failed run is the alarm. What to do then: docs/EXTENSION-SIGNATURES.md, "When Open VSX changes
+# its key". GitHub mails a failed scheduled run to whoever last edited this file's schedule, and
+# stops scheduling in a repository with no activity for 60 days.
+
+on:
+  schedule:
+    - cron: "17 6 * * *" # daily, off the hour: scheduled runs queue up at :00
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  registry:
+    name: Open VSX signs with a pinned key
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "24" # as test.yml
+      - name: Ask the registry
+        # Exit 1 is evidence — a key that is not pinned, or signatures that no longer verify — and
+        # fails at once. Exit 2 is "could not ask": an outage is not news, so it is asked again, and
+        # fails only if the registry cannot be asked three times in ten minutes. That matters too: if
+        # this check has gone blind, a changed key would pass unseen.
+        run: |
+          for attempt in 1 2 3; do
+            code=0
+            node scripts/extension-signature.mjs registry --strict || code=$?
+            if [ "$code" -ne 2 ]; then exit "$code"; fi
+            echo "Could not ask the registry (attempt $attempt of 3)."
+            if [ "$attempt" -lt 3 ]; then sleep 300; fi
+          done
+          exit 2

CLAUDE.md

@@ -102,7 +102,7 @@ module for that slot. Full account + runbooks: `docs/EXTENSION-SIGNATURES.md`.
   the editor imports it — accepts a real package and refuses a changed one.
 - **`smoke <LevelCode.app>`** asks the app itself (its command line installs one tiny extension into
   temp folders). It is the check that would have caught the original bug; CI runs it after each build.
-- **`registry`** watches for Open VSX changing its key (the release gate runs it). Exit 1 means
+- **`registry`** watches for Open VSX changing its key (daily workflow + release gate). Exit 1 means
   evidence, and every shipped build is refusing extensions until a release carries the new key.
 - **Do not "fix" a refusal by turning verification off** (`extensions.verifySignature`, a patch like
   VSCodium's). And a run from source proves nothing here: the editor only enforces on a built app.

docs/EXTENSION-SIGNATURES.md

@@ -74,6 +74,7 @@ something in the path.
 | `release.yml`, after the build | `smoke` on the built app | The job fails; a registry that cannot be reached is a warning |
 | `release.yml`, in the test gate | `registry` | The release stops before the hour-long build; unreachable is a warning |
 | `make-dmg.sh` step 0, before signing | `install`, then `check` | The app is not signed |
+| `openvsx-key.yml`, daily | `registry --strict` | The run fails — that is the alarm |
 | Every pull request | The suite, via `test-extensions.sh` | The gate is red |
 
 All four commands are `node scripts/extension-signature.mjs <command>`.
@@ -160,8 +161,8 @@ automatic update of extensions fails without a dialog. Nothing already installed
 Users can still click *Install Anyway*, which is exactly the habit this feature exists to end, so
 the gap should be short. After `delete`, every install is refused with `NotSigned`.
 
-**How you find out.** The release gate's `registry` step fails, or a user reports `Untrusted`.
-To ask by hand:
+**How you find out.** In order of likelihood: the daily *Open VSX signing key* workflow fails;
+the release gate's `registry` step fails; a user reports `Untrusted`. To ask by hand:
 
 ```bash
 node scripts/extension-signature.mjs registry

modules/extension-signature/test/extensionSignature.test.js

@@ -980,6 +980,7 @@ function moduleTrusting(keys) {
 		const smoked = position(release, 'run: node scripts/extension-signature.mjs smoke "VSCode-darwin-${{ matrix.arch }}/LevelCode.app"', 'release.yml');
 		const zipped = position(release, 'ditto -c -k --sequesterRsrc --keepParent', 'release.yml');
 		assert.deepStrictEqual([gate, asked, built, smoked, zipped], [gate, asked, built, smoked, zipped].sort((a, b) => a - b));
+		assert.match(read('.github', 'workflows', 'openvsx-key.yml'), /node scripts\/extension-signature\.mjs registry --strict/);
 	});
 
 	console.log('\nextensionSignature: ' + n + ' tests passed.');