feat: Automate reviewed SynapseML-to-Fabric releases

[Rana Singh (ranadeepsingh)]

What

Automates the deterministic parts of the SynapseML-to-Fabric release as a reviewed, fail-closed flow. A release engineer provides one OSS version; the tooling derives the Git tags, current SynapseML-Publish-Official parameters, public/internal artifact versions, and BBC-VHD values without retyping incompatible naming conventions.

This complements #2540: that PR owns derivative tags and Spark release-branch PRs; this PR owns the reviewed version bump, exact merged-commit tag, release matrix, artifact proof, GitHub Release, and BBC-VHD edit.

Release flow

1. Release Prepare runs only from master, validates X.Y.Z, applies the context-anchored bump, rebuilds/version-snapshots docs, opens the release PR, and explicitly dispatches branch validation (PRs opened with GITHUB_TOKEN do not recursively trigger workflows).
2. When that exact release PR merges, the workflow verifies its versioned docs, tags the recorded merged commit, and dispatches feat: automate release tag creation and spark branch rebase (Release Guide steps 1.4-1.5) #2540's derivative-tag/Spark-branch orchestrator.
3. release_matrix.py emits all OSS/Internal tags and artifact values plus a copy-paste az pipelines run command for live pipeline 35879. The live pipeline now accepts a base version, Internal patch, and target booleans; this supersedes the guide's older hand-entered-ref example.
4. verify_release.py verifies GitHub and Internal tags, public Maven CDN and PyPI publication, and every selected UPack/Synapse-Conda artifact. Network/auth/API-shape failures are errors, not missing-artifact lookalikes.
5. Release Notes is deliberately manual and artifact-gated. It publishes only the primary vX.Y.Z Release after every public target exists, and generates notes against the immutable tag rather than a moving master.
6. bump_bbcvhd.py updates the two package pins and component revision while preserving CRLF/LF, rejecting accidental reruns, and rolling both files back if either write or post-condition fails.

Guide mapping and human gates

Fabric release guide	Automated here	Intentionally human-gated
Step 1 - OSS	Version PR, docs snapshot, exact merge tag, derivative orchestration, public artifact proof, GitHub Release	ESRP approval and pipeline 17563 authorization
Step 2 - Internal	Matrix, Internal tag/artifact verification	Internal PR, tag/build authorization, ESRP approval
Step 3 - UPack	Live pipeline 35879 parameters and copy-paste queue command; post-publish proof	Authorized queue/approval decision
Step 4 - BBC-VHD	Deterministic setup.sh + version.txt update	BBC-VHD PR review, CI triage, White-Glove approval
Step 5 - Release train	Documented handoff	Train selection, rollout monitoring, Fabric confirmation

No ADO PAT or approval credential is stored in GitHub. The cross-system approval boundary remains explicit.

Evidence from shipped releases

• Live v1.1.3 replay: 33/33 GitHub, ADO, Maven, PyPI, UPack, and Synapse-Conda checks present.
• Live v1.1.1 Spark 4.0 replay reproduces the independent OSS rebuild counter (1.1.1-spark4-0-1) with all selected checks present.
• The matrix reproduces current pipeline 35879's Python 3.11/3.12/3.13 and Spark 3.5/4.0/4.1 contract.
• The BBC-VHD update matches the historical two-pin + component-revision pattern in PR 1805064 without line-ending damage.
• GitHub Release notes use the previous primary semantic tag, so the missing v1.1.1 Release object cannot make a later release span multiple versions.

Compatibility and failure contract

• No public JVM/Python API, serialized model, dependency, or package layout changes.
• Existing manual release commands remain possible; these workflows add a reviewed default path.
• Existing or conflicting tags, stale/off-mainline commits, missing docs snapshots, malformed versions, partial API responses, duplicate BBC-VHD assignments, and absent artifacts fail with actionable errors.
• Rebuild counters are explicit and independently validated for OSS and Internal packages.
• Credential-bearing Fabric E2E runs only on trusted branches and same-repository PRs; fork PRs skip the entire job before Key Vault access.

Validation

• 283 passed: complete bump-version and release-tool regression suite, including negative, pagination, auth-skip, rollback, CRLF, idempotency, workflow-contract, historical replay, and live-repo coverage tests.
• Pinned black==22.3.0: clean across the repository.
• actionlint 1.7.12: clean across all workflows.
• Previous-primary-tag replay: clean against the full live tag history.
• Next-version dry run (1.1.3 -> 1.1.4): 143 anchored replacements across 21 files, zero unanchored references, no writes.
• Rebased contract suite: 326 passed, 21 skipped, covering bump-version, release tooling, workflow contracts, and the Fabric fork guard.
• Rebase integrity: the complete PR patch hash remained 62faf4e5fa5e5f367a00e21a94496f958eb68fad after moving to master 57c799b834080681defec358925ef2a7d5d5eb95.

Sources

• SynapseML Fabric Release Guide v2
• SynapseML-Publish-Official pipeline 35879
• Historical BBC-VHD release PR 1805064
• Derivative-tag automation #2540

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

Hey Rana Singh (@ranadeepsingh) 👋!
Thank you so much for contributing to our repository 🙌.
Someone from SynapseML Team will be reviewing this pull request soon.

We use semantic commit messages to streamline the release process.
Before your pull request can be merged, you should make sure your first commit and PR title start with a semantic prefix.
This helps us to create release messages and credit you for your hard work!

Examples of commit messages with semantic prefixes:

• fix: Fix LightGBM crashes with empty partitions
• feat: Make HTTP on Spark back-offs configurable
• docs: Update Spark Serving usage
• build: Add codecov support
• perf: improve LightGBM memory usage
• refactor: make python code generation rely on classes
• style: Remove nulls from CNTKModel
• test: Add test coverage for CNTKModel

To test your commit locally, please follow our guild on building from source.
Check out the developer guide for additional guidance on testing your change.

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

This PR adds release-engineering automation to make SynapseML-to-Fabric releases more deterministic and reviewable, including a GitHub Actions “prepare → tag merged commit → publish notes” flow plus supporting Python tooling to derive/verify release identifiers and safely bump BBC-VHD pins.

Changes:

• Introduces a release matrix generator (release_matrix.py) and an end-to-end verifier (verify_release.py) with accompanying tests.
• Adds bump_bbcvhd.py (plus tests) to safely update BBC-VHD component pins while preserving line endings and rolling back on failure.
• Adds/updates GitHub workflows for release prepare/tagging and manual, artifact-gated release notes; enables workflow_dispatch for PR validation so release PRs created via GITHUB_TOKEN can be validated.

Show a summary per file

File	Description
scripts/test_bump_version.py	Extends bump-version tests for denylisted repo-relative paths; normalizes path keys to POSIX.
scripts/bump-version.py	Improves Windows console encoding robustness; adds path-based denylist support; normalizes path handling via as_posix().
scripts/release/release_matrix.py	Adds a single-source-of-truth release matrix for tags and artifact versions + CLI rendering.
scripts/release/verify_release.py	Adds live verification of GitHub/ADO tags and Maven/PyPI/UPack/Azure Artifacts presence.
scripts/release/bump_bbcvhd.py	Adds deterministic, rollback-safe BBC-VHD component pin updater with CRLF/LF preservation.
scripts/release/README.md	Documents how to use the new release tooling and where it fits in the guide.
scripts/release/test_release_matrix.py	Adds regression/contract tests for the release matrix derivations and CLI validation.
scripts/release/test_verify_release.py	Adds unit tests for verifier networking/error handling and run plan behavior.
scripts/release/test_bump_bbcvhd.py	Adds tests for BBC-VHD bump idempotency, rollback, and newline preservation.
scripts/release/test_release_workflows.py	Adds tests asserting key workflow contract properties (manual gating, dispatch behavior).
scripts/release/test_prev_tag.sh	Adds a repo-taglist regression script for “previous primary tag” selection logic.
.github/workflows/release-prepare.yml	Adds a reviewed release PR generator and a merged-commit tagger that dispatches downstream orchestration.
.github/workflows/release-notes.yml	Adds a manual, artifact-gated GitHub Release publisher with explicit previous-tag selection.
.github/workflows/pr-validation.yml	Enables workflow_dispatch so validations can be dispatched for bot-opened release PR branches.

Review details

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Suppressed comments (1)

scripts/release/verify_release.py:260

• --skip internal does not currently skip the internal PyPI feed checks (the synapseml_internal package); it only skips internal git tag checks. This makes --skip internal behave inconsistently compared with --skip public.

    def pip(self, package: str, version: str) -> str:
        if "pip" in self.skip or "ado" in self.skip:
            return SKIPPED
        # Azure Artifacts normalises pypi names: synapseml_internal -> synapseml-internal
        return (
            OK
            if version
            in self._feed_versions("Synapse-Conda", "pypi", package.replace("_", "-"))
            else MISSING
        )

• Files reviewed: 14/14 changed files
• Comments generated: 2
• Review effort level: Lite

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

scripts/release/verify_release.py:75

• On Windows, subprocess.run(..., shell=True) expects a command string, but this code passes a list. That combination can fail (or behave differently) on win32, which would break the fallback ADO auth path even when az is installed. Build a platform-appropriate command (string for shell=True, list otherwise).

    out = subprocess.run(
        [
            "az",
            "account",
            "get-access-token",
            "--resource",
            ADO_RESOURCE,
            "--query",
            "accessToken",
            "-o",
            "tsv",
        ],
        capture_output=True,
        text=True,
        shell=(sys.platform == "win32"),
    )

• Files reviewed: 14/14 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Rana Singh (ranadeepsingh)]

Addressed the current-head suppressed Windows auth finding in 6e80f27.

• Windows now gives subprocess.run(..., shell=True) a command string; non-Windows retains an argument list with shell=False.
• Parameterized regression coverage locks both command shapes.
• A token-less Windows fallback replay authenticated through �z and found all 12 selected v1.1.3 master artifacts; the complete release-tooling suite is 279 passed.

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

scripts/release/verify_release.py:313

• The Maven publication gate here verifies only synapseml-core_{scala} (via public_maven()), but the workflow-generated release notes advertise com.microsoft.azure:synapseml_2.12:${VERSION} (see .github/workflows/release-notes.yml:137) and the docs use the synapseml_2.12 coordinate (website/doctest.py:25). This can let verify_release.py report COMPLETE even if the primary install coordinate is missing (or vice versa). Consider aligning the verification to check the same Maven artifact(s) that users are instructed to consume (e.g., verify both synapseml_{scala} and synapseml-core_{scala}, or switch to the canonical one).

            "maven",
            tp.key,
            f"synapseml-core_{tp.scala}",
            tp.oss_maven_version,
            c.public_maven(tp.scala, tp.oss_maven_version),

• Files reviewed: 14/14 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Rana Singh (ranadeepsingh)]

Addressed the current-head suppressed tag-sort portability finding in c511a98.

• The contributor-side history helper no longer uses GNU sort -V; Python 3 sorts primary tags by numeric version tuple.
• It supports both python3 and python executable names while rejecting non-Python-3 interpreters.
• The helper still passes every full-history predecessor assertion, including numeric v1.0.9 -> v1.0.10, the dynamic oldest tag, and suffixed-tag exclusion.

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Review details

• Files reviewed: 14/14 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Rana Singh (ranadeepsingh)]

Azure build 232335424 failed only in Fabric E2E; the other 65 jobs succeeded. The failing FabricTestCleanup suite ran zero tests and aborted during environment discovery because GET https://api.fabric.microsoft.com/v1/workspaces returned HTTP 500 through all retries. This is a proven external-service failure before the PR's release automation was exercised, so I am re-running the exact current-head PR validation.

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.26%. Comparing base (3fac9b2) to head (c511a98).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2628      +/-   ##
==========================================
+ Coverage   87.24%   87.26%   +0.02%     
==========================================
  Files         338      338              
  Lines       20055    20055              
  Branches     2044     2044              
==========================================
+ Hits        17496    17501       +5     
+ Misses       2559     2554       -5     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Rana Singh (ranadeepsingh)]

Final current-head CI triage for c511a9881615bb72ec04d3e8a80511456fbde5c8:

• Azure PR builds 232335424 and 232344356 both validated merge commit 850bf9fb136449c1e0fa6cea257e9bdcc40b7afe (parents: current master and this exact head). In each full run, 65/66 jobs succeeded.
• Fabric E2E aborted before running any tests because GET https://api.fabric.microsoft.com/v1/workspaces returned HTTP 500 through every retry. Retrying only the failed Fabric job produced the same external 500 and again ran zero tests.
• This is the repository baseline, not a PR regression: current-master builds 232301239 and 232305251 and concurrent PR builds 232324496, 232331735, 232332516, 232338824, 232346646, 232347271, and 232352794 all failed the same Fabric job; master build 232305251 shows the identical workspace-list HTTP 500 with zero tests run.
• All GitHub checks are green, all current-head automated review findings are exhausted, no checks remain pending, and the expected private Internal compatibility phase is skipped because this is a fork PR.

The exact remaining engineering blocker is the shared Fabric test service/account outage; required maintainer approval is also still outstanding.

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Review details

• Files reviewed: 16/16 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Review details

• Files reviewed: 16/16 changed files
• Comments generated: 2
• Review effort level: Lite