🌟 [Major]: Release decisions use owned labels

[Marius Storhaug (MariusStorhaug)]

Release decisions now use an owned release: label set, preventing dependency metadata and legacy bare labels from choosing a repository version.

Breaking Changes

Release-GHRepository@v3 removes AutoPatching, IgnoreLabels, MajorLabels, MinorLabels, and PatchLabels. Consumers must grant issues: write, subscribe to unlabeled, remove release-workflow path filters, and replace legacy decisions before moving from v2.

Existing v2 tags remain unchanged. The v3 tags are created only after this pull request is reviewed and merged.

New: Canonical release labels

Label	Instruction
release:patch	Publish a patch release.
release:minor	Publish a minor release.
release:major	Publish a major release.
release:pre-release	Publish an open pull request as a prerelease when combined with one bump label.
release:skip	Validate without publishing.

The action provisions and reconciles these labels while leaving all unrelated labels unchanged. Dry runs report the label changes without mutating repository state.

Changed: Release decisions fail closed

Exactly one bump label or release:skip is required. Missing decisions, multiple bumps, release:skip combined with another owned label, and release:pre-release without one bump stop the action. Bare and legacy labels are ignored as release inputs.

Prereleases are restricted to open pull requests. Stable releases and closed-pull-request cleanup preserve the existing v2 release lifecycle.

---

Technical details

• Added a pure decision resolver, canonical label definitions, and an open-pull-request prerelease predicate in src/Release-GHRepository.Helpers.psm1.
• Added Pester 6.1 coverage for every one of the 32 owned-label subsets plus event-state behavior.
• The trusted write workflow uses pull_request_target without checking out an untrusted head; concurrency remains cancel-in-progress but is scoped per pull request.
• Prerelease remains an action input only for selecting a prerelease GitHub module dependency; it does not control repository release behavior.
• Implementation plan progress: all local implementation, test, workflow, documentation, and review-loop steps are complete. Cross-repository rollout remains ordered after v3 publication.
• Copilot review loop: four actionable threads were fixed, replied to, and resolved; the current-head review reports no new comments.
• Issue convergence sweep: open Release-GHRepository issues 105 and 108 were checked. Neither is fully satisfied by this scoped change; runner pinning and push-authoritative releases remain separate work.

Changed surface	Standards checked	Framework docs checked	Result
src/**, tests/**	PowerShell, Functions, Scripts, Testing	Release Management	Aligned
action.yml, .github/workflows/**	GitHub Actions, YAML, Security	Release Management, Automation Labels	Aligned
README.md	Natural Language, Markdown	Release Management, Automation Labels	Aligned

Relevant issues (or links)

Related work

• Depends on 📖 [Docs]: Release decisions no longer collide with Dependabot labels MSXOrg/docs#188
• References Default module release decisions to namespaced labels Process-PSModule#359
• References Bring the action into compliance with the GitHub Actions standard #105
• References 🌟 [Major]: Support push-authoritative releases and moving workflow tags #108

[Copilot]

Pull request overview

This PR introduces a strict, “fail-closed” release-decision model based on a canonical, action-owned release: label set, removing legacy/bare label influence and eliminating default/automatic patching behavior.

Changes:

• Adds a PowerShell helper module to define canonical release labels and to resolve/validate release decisions from PR labels.
• Updates the main action logic to (a) provision canonical labels each run and (b) drive release/prerelease/skip decisions exclusively via the resolver.
• Updates documentation, action inputs, and workflows to reflect the new owned-label contract and required events/permissions; adds unit tests for the resolver.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/Release-GHRepository.Helpers.Tests.ps1	Adds Pester coverage for canonical label definitions and release-decision resolution/rejection rules.
src/Release-GHRepository.Helpers.psm1	Introduces canonical label definitions and the strict Resolve-ReleaseDecision validator.
src/main.ps1	Provisions canonical labels and replaces legacy label/auto-patching logic with the resolver output.
README.md	Documents the owned-label contract, workflow requirements, and v2→v3 migration steps.
action.yml	Removes legacy label/auto-patching inputs and clarifies Prerelease input semantics.
.github/workflows/Release.yml	Ensures label transitions are evaluated (unlabeled) and grants issues: write for label provisioning.
.github/workflows/Action-Test.yml	Adds Pester unit tests and expands PR event types to include unlabeled.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

src/main.ps1:154

• $createPrerelease can become true for merged/closed pull requests when the PR targets a non-default branch (because $closedPullRequest only covers closed-but-not-merged). That would create prereleases from closed PRs, conflicting with the intended “open pull request prerelease” behavior.

$createPrerelease = $releaseDecision.Prerelease -and -not $createRelease -and -not $closedPullRequest

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/Release.yml:19

• pull_request_target sets github.ref to the base/default branch (e.g. refs/heads/main), so using ${{ github.workflow }}-${{ github.ref }} collapses all PR runs into the same concurrency group. With cancel-in-progress: true, activity on one PR can cancel an in-progress run for a different PR, which can interrupt release/prerelease creation or cleanup. Use a PR-scoped key (e.g. PR number) to isolate runs per PR (matching the README guidance).

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.