[Eduardo Villalpando Mello (edvilme)]

Summary

Follow-up to #2003. Adds only .github/workflows/release-pr-release.yml; the separate read-only Release PR / Plan workflow is unchanged. Keeping the release trigger separate also avoids overlapping the plan-adoption PR.

• Handles only pull_request_target: closed events targeting main, and runs only when the PR was merged. Closing an unmerged PR does not run the release job.
• Calls microsoft/vscode-python-ci/actions/release-pr@4e0c4335bbf6b1a274673e22d9c39cd7efb93ccf with mode: release and the default release/ prefix. Only this dedicated job receives contents: write; no custom token or additional checkout is added.
• Revalidates the exact merged change and the PR creator's current write/maintain/admin permission. Only root-package.json-only, top-level-version-only valid bumps qualify. Ordinary PRs skip successfully. Creates release/<calculated-stable-version> without pushing to main or updating an existing release branch; retries fail if the branch already exists.
• Uses the trusted target-branch workflow and pinned action; no checked-out PR scripts or hooks are executed. Reports either the created branch/stable version or that no release candidate was found.

Activation and prerequisites

Merging this PR enables release-branch creation on subsequent qualifying merges. The existing Azure stable pipeline matches release/* and defaults publishExtension to true, so branch creation can publish an extension. This does not change Azure YAML, publishing approvals, credentials, or branch protection.

• Plan prerequisite Add read-only release PR validation #2003 is merged.
• Before approving activation, configure/confirm Release PR / Plan as a required check and confirm the Actions bot can create release/* refs.
• Confirm the intended Azure pipeline is enabled, its UI trigger overrides match the checked-in YAML, and publishing permissions/approvals are ready. Only checked-in configuration was inspected; live publishing was not exercised.
• Prefer observing the Black Formatter pilot before approving the remaining repositories. No release branches were created as part of this PR.

Validation

• Prettier, whitespace checks, and actionlint v1.7.7 pass for the new workflow.
• Local workflow contract checks cover the main/closed event filter, merged-only guard, dedicated write permission, reviewed action pin, and single-file scope. Bash syntax and both job-summary outcomes pass.
• The exact pinned shared action passes all 22 tests: 15 release-action tests and 7 version-action tests, including authorization/API failures, unchanged-version skips, stable serialization, and existing-branch rejection.
• The release workflow cannot be exercised on an open PR: it uses the trusted target-branch workflow after merge. No live release/publish smoke test is claimed. Where the plan check is already present on main, this workflow-only PR should pass as not applicable.

[Stella Huang (StellaHuang95)]

🔒 Automated review in progress — Stella Huang (@StellaHuang95) is auto-reviewing this PR.

[Stella Huang (StellaHuang95)]

Reviewed commit: b7e0bf1f86385f68e0863b477a4ef3e47f249ad1

Result: 🔴 could-not-verify

Verification details

Verification: Automated verification is best effort. The PR author remains responsible for testing.

Summary: [unavailable] Container verification could not start and local execution was not authorized for this PR HEAD: Podman CLI is not installed or is not on PATH.

Test runs: none recorded.

[Stella Huang (StellaHuang95)]

Approved via Review Center.

[Rich Chiodo (rchiodo)]

Approved via Review Center.

[Bill Schnurr (bschnurr)]

Approved via Review Center.