Repository navigation
Add read-only release PR validation - #26282
Merged
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 956d3afd-ae0b-486c-a60c-3a6276c23213
Eduardo Villalpando Mello (edvilme)
added
debt
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 956d3afd-ae0b-486c-a60c-3a6276c23213
Eduardo Villalpando Mello (edvilme)
enabled auto-merge (squash)
November 10, 2026 00:00
Eduardo Villalpando Mello (edvilme)
added a commit
that referenced
this pull request
Nov 12, 2026
## Summary Follow-up to #26282. Adds only `.github/workflows/release-pr-release.yml`; the separate read-only `Release PR / Plan` workflow is unchanged. Keeping the release trigger separate also avoids overlapping the plan-adoption PR. - Handles only `pull_request_target: closed` events targeting `main`, and runs only when the PR was merged. Closing an unmerged PR does not run the release job. - Calls `microsoft/vscode-python-ci/actions/release-pr@4e0c4335bbf6b1a274673e22d9c39cd7efb93ccf` with `mode: release` and the default `release/` prefix. Only this dedicated job receives `contents: write`; no custom token or additional checkout is added. - Revalidates the exact merged change and the PR creator's current write/maintain/admin permission. Only root-`package.json`-only, top-level-version-only valid bumps qualify. Ordinary PRs skip successfully. Creates `release/<calculated-stable-version>` without pushing to `main` or updating an existing release branch; retries fail if the branch already exists. - Uses the trusted target-branch workflow and pinned action; no checked-out PR scripts or hooks are executed. Reports either the created branch/stable version or that no release candidate was found. ## Activation and prerequisites **Merging this PR enables release-branch creation on subsequent qualifying merges. The existing Azure stable pipeline matches `release/*` and defaults `publishExtension` to `true`, so branch creation can publish an extension.** This does not change Azure YAML, publishing approvals, credentials, or branch protection. - **Merge prerequisite #26282 first. It is still open; do not approve activation before its read-only plan check is available.** - Before approving activation, configure/confirm `Release PR / Plan` as a required check and confirm the Actions bot can create `release/*` refs. - Confirm the intended Azure pipeline is enabled, its UI trigger overrides match the checked-in YAML, and publishing permissions/approvals are ready. Only checked-in configuration was inspected; live publishing was not exercised. - Prefer observing the [Black Formatter pilot](microsoft/vscode-black-formatter#841) before approving the remaining repositories. No release branches were created as part of this PR. Python's Azure publishing prerequisite #26277 is merged. This workflow-only maintenance PR uses the existing `skip-issue-check` label; there is no separate product issue. ## Validation - Prettier, whitespace checks, and actionlint v1.7.7 pass for the new workflow. - Local workflow contract checks cover the main/closed event filter, merged-only guard, dedicated write permission, reviewed action pin, and single-file scope. Bash syntax and both job-summary outcomes pass. - The exact pinned shared action passes all 22 tests: 15 release-action tests and 7 version-action tests, including authorization/API failures, unchanged-version skips, stable serialization, and existing-branch rejection. - The release workflow cannot be exercised on an open PR: it uses the trusted target-branch workflow after merge. No live release/publish smoke test is claimed. Where the plan check is already present on `main`, this workflow-only PR should pass as not applicable. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 956d3afd-ae0b-486c-a60c-3a6276c23213
Stella Huang (StellaHuang95)
approved these changes
Nov 12, 2026
Heejae Chang (heejaechang)
approved these changes
Nov 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a dedicated Release PR / Plan check to all PRs targeting
main, including edited/reopened PRs. Usescontents: read, no path filters, and the sharedrelease-praction pinned to reviewed commit4e0c4335bbf6b1a274673e22d9c39cd7efb93ccfinmode: plan.Only PRs changing root
package.jsonalone, with a different version, are release candidates. Those must be version-only JSON changes with an increasing SemVer, a positive odd development minor, supported Marketplace bounds, and lossless serialization. Mixed-file changes and unchanged versions pass as not applicable, explicitly distinguished from validated candidates in the job summary. Other manifests, includingapi/package.json, are outside this check's scope.Existing CI and Azure publishing are unchanged. This does not create release branches, enable release mode, or change branch protection. Make the check required only after merging and observing it working; publishing activation remains a separate rollout.
Validation
This adoption PR changes only the workflow. Its Release PR / Plan check passed on head
fa1d9b2bcd5bbdba5caabab74832e0b385a94ed9as not applicable. This workflow-only diff does not exercise candidate authorization; shared-action tests and hosted API smoke cover that behavior.Issue tracking: this is workflow-only maintenance from the shared CI rollout, with no separate product issue. Uses the repository's existing
skip-issue-checklabel for that case.Latest shared action
Updated to merged commit
4e0c4335bbf6b1a274673e22d9c39cd7efb93ccf, including microsoft/vscode-python-ci#11 and microsoft/vscode-python-ci#12. Release candidates now require the PR creator to have write/maintain/admin repository access; permission lookups fail closed. Configurable branch prefixes and the branch output are available, with the existingrelease/default. This workflow remains read-only plan mode. The linked disposable pilot covers the original baseline; shared-action CI covers the added prefix/authorization behavior.