Python: resolve release tags against real package directories

[Giles Odigwe (giles17)]

Motivation & Context

python-release.yml builds the release assets for a release by deriving a package name
from the release tag. The extraction is a single sed that splits the tag on the first
hyphen:

PACKAGE=$(echo "$TAG" | sed 's/^python-\([^-]*\)-.*$/\1/')

That assumes package names never contain a hyphen and always match their directory name
exactly. Neither holds, so against the tags this repo actually produces:

Tag	Extracted	Result
python-devui-1.0.0b260414	devui	correct
python-hosting-a2a-1.0.0a260723	hosting	builds the wrong package — packages/hosting exists, so it succeeds silently
python-github-copilot-1.0.0	github	fails — the directory is github_copilot
python-1.14.0	python-1.14.0	fails — no match, the tag passes through unchanged

The hosting-a2a case is the concerning one: the job attaches artifacts for a different
package to the release without any error.

Separately, the tag value was templated directly into the run: script text rather than
passed through the step env: block. Every other workflow in this repo already uses the
env: block for github.event.* values, so this one was the odd one out.

Description & Review Guide

• What are the major changes?

  • Require the tag to end in a supported version before doing anything else. The pattern
    covers the lifecycle versions from the python-package-management skill plus the
    re-cut suffixes present in the tag history (1.0.0b251105.1, 1.0.0b251106.post1):
    ^[0-9]+\.[0-9]+\.[0-9]+([ab][0-9]+|rc[0-9]+)?(\.[0-9]+|\.post[0-9]+)?$.
    Tags matching neither shape are rejected instead of being guessed at.
  • Resolve the package name against the real packages/ listing instead of guessing the
    hyphen boundary. The trailing -<version> component is stripped, and the remainder is
    matched against each directory name both literally and with _ normalized to -,
    which covers hosting-a2a, azure-ai-search, github_copilot, and foundry_local.
  • Handle the python-<version> workspace tag explicitly. It now runs the root
    uv run poe build, which builds every workspace package plus the agent-framework
    meta package into python/dist/, instead of failing on a nonsensical package name.
  • Fail with an explicit error naming the derived package or version, and the available
    packages, rather than falling through to a confusing later failure.
  • Pass the tag via the step env: block as TAG_NAME and reference it as a quoted shell
    variable, matching the pattern used elsewhere in .github/workflows/.
  • Add set -euo pipefail to the scripted steps.

• What is the impact of these changes?
  Single-package release tags now resolve to the correct directory, including the ones that
  previously resolved to the wrong package or failed outright. Workspace-level
  python-X.Y.Z tags now build assets instead of erroring. Malformed tags fail with a clear
  message instead of producing an arbitrary build. Renamed the first step from
  "Set environment variables" to "Resolve the package to build" to reflect what it does.

• What do you want reviewers to focus on?
  The python-<version> branch: it now invokes the root poe build, which builds all
  packages plus the meta package. Please confirm that is the intended asset set for a
  workspace-level release tag — that is the one behavior here that is a deliberate choice
  rather than a straightforward correction.

Verified against all 62 existing python-* tags in the repo (all resolve as expected), a
synthetic tag for each of the 35 directories under python/packages/ (all round-trip to
the correct directory), and a set of malformed tags (python-devui, python-typo,
python-, python-hosting-a2a, python-devui-notaversion, python-1.0), which all
error out.

Related Issue

N/A — no tracking issue; found while reading the release workflow.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Pull request overview

Improves release-tag handling and package path quoting in the Python release workflow.

Changes:

• Passes release tags through step environment variables.
• Adds package-name validation.
• Quotes package directory paths.

Suppressed comments (1)

.github/workflows/python-release.yml:46

• This condition does not verify that the tag matched python-<package>-<version>. sed returns the original input on no match, and its .* also accepts an empty version; for example, python-core- yields core, passes this check, and builds the package despite having no version. Validate the full tag/extraction match (including a nonempty version) before checking the package identifier.

            echo "Error: could not derive a valid package name from tag '$TAG'"

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 1b8dff257ce7
Model: gpt-5.6-sol

Overview

The change removes direct release-tag interpolation from shell source, constrains the derived package identifier, and quotes the package path used by the build command. The environment handoff remains job-scoped, and the existing package-directory check prevents nonexistent targets from reaching the build. No publishable Critical, High, or Medium defect was introduced by this diff.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.

[Giles Odigwe (giles17)]

/review

[github-actions]

MAF Automated Review — Iteration 2

Result: Findings reported
Scope: 1 net-new commit(s): 654835742abc
Model: gpt-5.6-sol

Overview

The workflow now resolves package tags against real package directories, handles underscore-to-hyphen aliases, quotes tag-derived values, and fails when a package name cannot be resolved. The full-workspace build is also wired through the repository's existing root build task. One input-validation gap remains: any single-component suffix is accepted as a workspace version, allowing malformed package tags to attach the full artifact set.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: .github/workflows/python-release.yml