[Tomasz Naumowicz (tnaum-ms)]

Summary

Keep post-release version preparation automatic even when GitHub Actions is not allowed to create pull requests: prepare the branch, then create an assigned reminder issue with a prefilled Create version-bump PR link.

This follows #1042. Its first live run successfully prepared the version bump but failed to create the PR because the repository's bot-PR setting is locked by policy. Switching the PR action would not change that restriction; this approach needs no additional credential or policy exception.

New workflow

1. A stable release or manual run performs the existing guarded, root-only bump, for example 1.0.1 → 1.0.2-alpha.0.
2. Git pushes bot/bump-<version>, touching only the manifest and root lockfile.
3. GitHub CLI creates or updates a version-specific reminder issue assigned to Tomasz Naumowicz (@tnaum-ms), with:
   • A formatted old/new version table for both files.
   • An explanation of why the change is needed and what alpha.0 means.
   • A prefilled PR link, including the branch, title and description.
   • The release/manual-run context and workflow link.
4. A maintainer submits the PR under their own identity, normal PR CI runs, and the reminder is closed after merge.

Safety and reruns

• Preserve stable-release filtering, main-only checkout, lockfile synchronization and existing-alpha no-op behavior.
• Reuse matching remote branches without force pushes or additional commits; support a matching branch left behind by the earlier workflow.
• Refuse to overwrite conflicting version content or unrelated branch changes.
• Reuse/reopen the same issue by an exact version marker, using paginated REST enumeration instead of eventually consistent search.
• Validate that the reminder was actually assigned. Permission, assignment and network failures remain explicit failures.
• Write the branch and prefilled link to the workflow summary before issue creation, so the prepared work remains accessible if issue creation fails.

Permissions and scope

Remove peter-evans/create-pull-request, bot PR creation, automatic full-CI dispatch, and actions/PR write permissions. Use only pinned first-party setup actions, Git, the runner's preinstalled GitHub CLI, and contents + issues write permissions.

This PR does not change the current package version, create a live reminder, publish anything, modify repository policies, or introduce a token secret. Actual issue creation with GITHUB_TOKEN still needs verification on the first intended run after merge.

Updated release instructions, the feature overview, design, pipeline inventory, and operator-approved decision 0016.

Validation

Case 1 — opening a draft PR:

• npm run build — passed.
• node --test .github/scripts/*.test.cjs — 27/27 passed (13 existing bump tests and 14 new reminder tests).
• New tests use real isolated Git repositories and a fake GitHub API: no live issues/PRs or credentials are used. They cover exact prefilled URL/body, version-only commits, retries, existing/advanced branches, pagination, closed reminders, conflicts, and explicit permission/assignment/network failures.
• Parsed workflow YAML verified for triggers, guards, main checkout, minimal permissions, assignee, and the existing CI test glob.
• git diff --check — passed; root package manifests are unchanged.

Full Case 2 checks, including repository-wide prettier-fix, and the AI pre-review are deferred until ready for review. No live workflow run was performed; the workflow deliberately checks out main, so the new implementation becomes available after merge.

[github-actions]

✅ CI passed: standard tier (ready PR)

Commit 878b0fe, workflow run.

Layer	Result	Ran or skipped because
Static checks	✅ passed	every push
Unit tests	✅ passed	every push
npm packages: verify tarballs	⏭️ skipped	no change to packages/**, package-lock.json or the CI workflow
VSIX: inspect contents	✅ passed	ready PR
VSIX: self-test of the checks	⏭️ skipped	no change to build/verification/**, build/vite/**, the Vite configs, package-lock.json or the CI workflow
VSIX: activate in VS Code	✅ passed	ready PR
VSIX: self-test of the activation check	⏭️ skipped	no change to build/verification/**, build/vite/**, the Vite configs, package-lock.json or the CI workflow
Webview host in unbundled extensions	⏭️ skipped	no change to packages/vscode-ext-webview/**, package-lock.json or the CI workflow
E2E	⏭️ not available yet	arrives with the E2E iteration (full tier)

Full run: add the ci:full-requested label to run every layer once on the current commit.
No full run yet.

Code quality

Check	Status	How to fix
Localization (l10n)	✅ Passed	Nothing to fix
ESLint	✅ Passed	Nothing to fix
Prettier formatting	✅ Passed	Nothing to fix

Build size

No page, activation, VSIX or other bundle size changed by 5% or 50 KiB or more against main. VSIX: 8.5 MiB.

Artifacts: VSIX | Bundle-reports-39678429572 | L1-manifest-report-39678429572

All graphs (exact bytes)

Graph	PR bytes	Base bytes	Delta bytes	Delta %
Collection View page (collectionView)	6,036,286	6,036,286	✅ 0	0.0%
Document View page (documentView)	4,808,762	4,808,762	✅ 0	0.0%
Local Quick Start page (localQuickStart)	1,551,408	1,551,408	✅ 0	0.0%
Atlas Credentials page (atlasCredentials)	1,504,612	1,504,612	✅ 0	0.0%
Cluster Dashboard page (clusterDashboard)	1,550,863	1,550,863	✅ 0	0.0%
Activation (mainStartup)	3,448,763	3,448,763	✅ 0	0.0%
Extension host (main)	9,975,455	9,975,455	✅ 0	0.0%
Playground worker (playgroundWorker)	5,384,556	5,384,556	✅ 0	0.0%
VSIX (vsix)	8,941,525	8,941,525	✅ 0	0.0%
playgroundTsPlugin	6,175	6,175	✅ 0	0.0%
viewsEntry	1,456,593	1,456,593	✅ 0	0.0%
viewsAssets	80,340	80,340	✅ 0	0.0%
editorWorker	259,528	259,528	✅ 0	0.0%
jsonWorker	389,389	389,389	✅ 0	0.0%

Packaged bytes. Shared chunks count in every graph that loads them, so rows do not add up.

Updated in place on every run.

[Tomasz Naumowicz (tnaum-ms)]

Implementation and draft CI are verified on d05b5899.

• Local npm run build passed.
• All 27 release-automation integration tests passed locally and in CI.
• Final draft CI run passed static checks, unit tests and the required Merge gate. CodeQL, API extraction and CLA checks also passed.
• Fixed the initial CodeQL diagnostic by asserting exact reminder URLs in tests (2880c924), and formatted only the two Markdown tables flagged by CI (d05b5899). No workflow behavior was weakened.

This remains Case 1: a draft PR. Full local Case 2 checks, including repository-wide prettier-fix, and the AI pre-review remain deferred until ready for review. No live reminder issue was created; actual GITHUB_TOKEN issue creation will be verified on the first intended workflow run after merge.