Replace PAT with WIF in publish step

.npmrc

@@ -1,7 +1,7 @@
-; We use Dependabot to update our packages, so we want to add without a prefix
-save-exact=true
-; We download from a private feed during the release process
+; We generally want to save install/update commands
+save=true
+; We use a public Azure Artifacts mirror
 registry=https://pkgs.dev.azure.com/powershell/PowerShell/_packaging/powershell/npm/registry/
 always-auth=true
-; We want the lockfile to reference the default registry
-replace-registry-host=npmjs
+; But we don't want references to it in the lockfile
+omit-lockfile-registry-resolved=true

.pipelines/vscode-powershell-Official.yml

@@ -190,21 +190,23 @@ extends:
         pool:
           type: windows
         variables:
-          - group: VSCodeMarketplace
-          - name: ob_outputDirectory
-            value: $(Build.SourcesDirectory)/out
+          ob_outputDirectory: $(Build.SourcesDirectory)/out
         steps:
         - download: current
           displayName: Download artifacts
         - pwsh: npm ci
           displayName: Install NPM packages (for vsce)
-        - pwsh: |
-            $publishArgs = @(
-              '--pat'
-              '$(token)'
-              '--packagePath'
-              '$(drop)/powershell-$(vsixVersion).vsix'
-              if ([bool]::Parse('$(prerelease)')) { '--pre-release' }
-            )
-            npm run publish -- @publishArgs
+        - task: AzureCLI@2
           displayName: Run vsce publish
+          inputs:
+            azureSubscription: vscode-marketplace
+            scriptType: pscore
+            scriptLocation: inlineScript
+            inlineScript: |
+              $publishArgs = @(
+                '--azure-credential'
+                '--packagePath'
+                '$(drop)/powershell-$(vsixVersion).vsix'
+                if ([bool]::Parse('$(prerelease)')) { '--pre-release' }
+              )
+              npm run publish -- @publishArgs