Repository navigation
Add read-only release PR validation - #2003
Merged
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 956d3afd-ae0b-486c-a60c-3a6276c23213
Contributor
|
🔒 Automated review in progress — Stella Huang (@StellaHuang95) is auto-reviewing this PR. |
Contributor
|
Reviewed commit: Result: 🔴 Verification detailsVerification: Automated verification is best effort. The PR author remains responsible for testing. Summary: [unavailable] Container verification could not start and local execution was not authorized for this PR HEAD: Podman CLI is not installed or is not on PATH. Test runs: none recorded. |
Stella Huang (StellaHuang95)
previously approved these changes
Nov 9, 2026
Stella Huang (StellaHuang95)
left a comment
Stella Huang (StellaHuang95)
left a comment
Contributor
There was a problem hiding this comment.
Approved via Review Center.
Stella Huang (StellaHuang95)
added
the
review-auto:approved
Rich Chiodo (rchiodo)
previously approved these changes
Nov 9, 2026
Rich Chiodo (rchiodo)
left a comment
Rich Chiodo (rchiodo)
left a comment
Contributor
There was a problem hiding this comment.
Approved via Review Center.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 956d3afd-ae0b-486c-a60c-3a6276c23213
Eduardo Villalpando Mello (edvilme)
dismissed stale reviews from Rich Chiodo (rchiodo) and Stella Huang (StellaHuang95)
via
November 9, 2026 23:53
7649eed
Eduardo Villalpando Mello (edvilme)
enabled auto-merge (squash)
November 10, 2026 00:00
Stella Huang (StellaHuang95)
approved these changes
Nov 10, 2026
Bill Schnurr (bschnurr)
approved these changes
Nov 10, 2026
Bill Schnurr (bschnurr)
left a comment
Bill Schnurr (bschnurr)
left a comment
Member
There was a problem hiding this comment.
Approved via Review Center.
Eduardo Villalpando Mello (edvilme)
added a commit
that referenced
this pull request
Nov 10, 2026
## Summary Follow-up to #2003. Adds only `.github/workflows/release-pr-release.yml`; the separate read-only `Release PR / Plan` workflow is unchanged. Keeping the release trigger separate also avoids overlapping the plan-adoption PR. - Handles only `pull_request_target: closed` events targeting `main`, and runs only when the PR was merged. Closing an unmerged PR does not run the release job. - Calls `microsoft/vscode-python-ci/actions/release-pr@4e0c4335bbf6b1a274673e22d9c39cd7efb93ccf` with `mode: release` and the default `release/` prefix. Only this dedicated job receives `contents: write`; no custom token or additional checkout is added. - Revalidates the exact merged change and the PR creator's current write/maintain/admin permission. Only root-`package.json`-only, top-level-version-only valid bumps qualify. Ordinary PRs skip successfully. Creates `release/<calculated-stable-version>` without pushing to `main` or updating an existing release branch; retries fail if the branch already exists. - Uses the trusted target-branch workflow and pinned action; no checked-out PR scripts or hooks are executed. Reports either the created branch/stable version or that no release candidate was found. ## Activation and prerequisites **Merging this PR enables release-branch creation on subsequent qualifying merges. The existing Azure stable pipeline matches `release/*` and defaults `publishExtension` to `true`, so branch creation can publish an extension.** This does not change Azure YAML, publishing approvals, credentials, or branch protection. - Plan prerequisite #2003 is merged. - Before approving activation, configure/confirm `Release PR / Plan` as a required check and confirm the Actions bot can create `release/*` refs. - Confirm the intended Azure pipeline is enabled, its UI trigger overrides match the checked-in YAML, and publishing permissions/approvals are ready. Only checked-in configuration was inspected; live publishing was not exercised. - Prefer observing the [Black Formatter pilot](microsoft/vscode-black-formatter#841) before approving the remaining repositories. No release branches were created as part of this PR. ## Validation - Prettier, whitespace checks, and actionlint v1.7.7 pass for the new workflow. - Local workflow contract checks cover the main/closed event filter, merged-only guard, dedicated write permission, reviewed action pin, and single-file scope. Bash syntax and both job-summary outcomes pass. - The exact pinned shared action passes all 22 tests: 15 release-action tests and 7 version-action tests, including authorization/API failures, unchanged-version skips, stable serialization, and existing-branch rejection. - The release workflow cannot be exercised on an open PR: it uses the trusted target-branch workflow after merge. No live release/publish smoke test is claimed. Where the plan check is already present on `main`, this workflow-only PR should pass as not applicable. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 956d3afd-ae0b-486c-a60c-3a6276c23213
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a dedicated Release PR / Plan check to all PRs targeting
main, including edited/reopened PRs. Usescontents: read, no path filters, and the sharedrelease-praction pinned to reviewed commit4e0c4335bbf6b1a274673e22d9c39cd7efb93ccfinmode: plan.Only PRs changing root
package.jsonalone, with a different version, are release candidates. Those must be version-only JSON changes with an increasing SemVer, a positive odd development minor, supported Marketplace bounds, and lossless serialization. Mixed-file changes and unchanged versions pass as not applicable, explicitly distinguished from validated candidates in the job summary. Other manifests, includingapi/package.json, are outside this check's scope.Existing CI and Azure publishing are unchanged. This does not create release branches, enable release mode, or change branch protection. Make the check required only after merging and observing it working; publishing activation remains a separate rollout.
Validation
This adoption PR changes only the workflow. Its Release PR / Plan check passed on head
7649eedcc247217d9835af154e5e3e106c081d3fas not applicable. This workflow-only diff does not exercise candidate authorization; shared-action tests and hosted API smoke cover that behavior.Latest shared action
Updated to merged commit
4e0c4335bbf6b1a274673e22d9c39cd7efb93ccf, including microsoft/vscode-python-ci#11 and microsoft/vscode-python-ci#12. Release candidates now require the PR creator to have write/maintain/admin repository access; permission lookups fail closed. Configurable branch prefixes and the branch output are available, with the existingrelease/default. This workflow remains read-only plan mode. The linked disposable pilot covers the original baseline; shared-action CI covers the added prefix/authorization behavior.