5 Commits

Author SHA1 Message Date
Stefan Broenner 5eafcbfc8f Keep npm lockfiles portable and preserve inherited package sources (#871)
Co-authored-by: Stefan Broenner <stbrnner@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-09-11 09:07:01 -07:00
Stefan Broenner a67212a278 Update all dependencies and GitHub Actions (#758)
* chore(deps): update all dependencies

Updates NuGet, npm, Python, the .NET SDK, VS Code tooling, and GitHub Actions.

Tests: Release build; MCP protocol and transport tests; extension compile and lint; documentation build; package vulnerability audits.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 5e3452df-35bd-418d-b1f4-8b6903f8df24

* ci: allow verified Python package licenses

Allows MIT-0 and PSF-2.0 dependencies and scopes the typing-extensions metadata exception to that package.

Tests: dependency workflow YAML parse; full pre-commit gates.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 5e3452df-35bd-418d-b1f4-8b6903f8df24

---------

Copilot-Session: 5e3452df-35bd-418d-b1f4-8b6903f8df24
2026-08-06 16:54:31 +02:00
github-actions[bot] 352b1da895 Revert: remove RELEASE_PAT verification scratch file [skip ci]
Reverts the scratch verification commit; confirms PAT push authentication
and ruleset bypass work end-to-end for the release-automation fix.
2026-07-23 09:40:03 +02:00
github-actions[bot] f1d85698f3 test: verify RELEASE_PAT can push directly to protected main [skip ci]
This is a scratch verification commit for the release-automation fix in
PR #739 (direct changelog push using RELEASE_PAT as a ruleset bypass
actor). It will be reverted immediately by a follow-up commit.
2026-07-23 09:39:47 +02:00
Stefan Broenner 760a352a18 Re-architect changelog generation and release notes (#698)
* Re-architect changelog generation and release notes

Replace manual CHANGELOG.md editing and fragile awk/sed extraction with
changesets (@changesets/cli), following the industry-standard pattern used
by many open source JS/TS projects for human-curated, end-user-facing
changelogs.

- Add changesets tooling (package.json, .changeset/config.json,
  .changeset/README.md) using @changesets/changelog-github for PR-linked
  entries
- Add changeset-check.yml CI workflow: fails a PR if no changeset fragment
  was added, unless labeled skip-changelog
- Add scripts/Build-Changelog.ps1: compiles pending changesets into
  CHANGELOG.md and a release-notes body, replacing the old awk-based
  Unreleased extraction and sed-based rename step in release.yml
- Extract the GitHub Release body into a template file
  (.github/release-notes-template.md) with {{VERSION}}/{{CHANGELOG}}
  placeholders, rendered via PowerShell instead of an inline bash heredoc
  mixed with GitHub Actions expression syntax
- Clean up CHANGELOG.md: collapse several releases' worth of content that
  had been mislabeled as Unreleased (root cause: the old auto-PR-rename
  step silently failed to merge for months) into a single accurate
  released version entry, and condense verbose engineering prose into
  concise end-user-facing bullets
- Delete orphaned chore/changelog-v* branches left over from the broken
  automation
- Update Rule 27 and related instructions/docs (development-workflow,
  readme-management, RELEASE-STRATEGY, PR template) to describe the new
  changeset-based workflow

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Allow Python-2.0 license for argparse (transitive changesets dep)

The argparse npm package (transitive dependency of @changesets/cli via
js-yaml) declares its license as Python-2.0, an OSI-approved permissive
license, which was blocking the Dependency Review check.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Stefan Broenner <stbrnner@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-07-09 06:49:50 +02:00