Add GitHub Action to enforce architect approval for strict version pins

[Copilot]

Implementation Complete ✅

• Analyze existing workflows and understand patterns used in the repository
• Create a GitHub Actions workflow that:
  • Triggers on pull_request events for paths matching /sdk/**/setup.py and /sdk/**/pyproject.toml
  • Detects newly introduced strict version pins (==) in main runtime dependencies
  • Ignores dev/test/extras dependencies and comments
  • Blocks merging unless approved by an architect (kashifkhan, annatisch, or johanste)
• Create Python script with logic to detect strict version pins
• Test the detection logic locally (all tests passing)
• Update CODEOWNERS file to require architect approval for setup.py and pyproject.toml files
• Add comprehensive documentation
• Validate workflow YAML structure and syntax
• Run integration tests
• Fix CI errors
• Remove codeowner names from README
• Add .github/scripts to cspell ignore list

Recent Changes:

Added .github/scripts/ to cspell ignorePaths** - Updated .vscode/cspell.json to ignore spelling checks in the .github/scripts/ directory to avoid false positives in the check_strict_pins.py script.

Original prompt

Implement a GitHub Action workflow that blocks merging a PR if it introduces a new strict version pin (e.g., package==version) in a main runtime dependency section (install_requires for setup.py, [project] dependencies for pyproject.toml) inside any file matching /sdk//setup.py or /sdk//pyproject.toml, unless an architect—a user in the set {kashifkhan, annatisch, johanste}—has approved the PR. The workflow should:

• Only consider main package dependencies and ignore new pins in dev/test/extras or comments
• Execute on pull requests touching the relevant files
• Analyze the diff to detect only newly introduced or modified pins (changes from broader constraints to strict == as well as additions)
• Block merging unless one of the specified architects leaves an approval review.

Also, update CODEOWNERS to require approval from kashifkhan, annatisch, or johanste for /sdk//setup.py and /sdk//pyproject.toml files.

All workflow and CODEOWNERS changes should be compatible with downstream branch protection rules to guarantee enforcement.

Provide a clear workflow file and CODEOWNERS proposal for review.

This pull request was created as a result of the following prompt from Copilot chat.

Implement a GitHub Action workflow that blocks merging a PR if it introduces a new strict version pin (e.g., package==version) in a main runtime dependency section (install_requires for setup.py, [project] dependencies for pyproject.toml) inside any file matching /sdk//setup.py or /sdk//pyproject.toml, unless an architect—a user in the set {kashifkhan, annatisch, johanste}—has approved the PR. The workflow should:

• Only consider main package dependencies and ignore new pins in dev/test/extras or comments
• Execute on pull requests touching the relevant files
• Analyze the diff to detect only newly introduced or modified pins (changes from broader constraints to strict == as well as additions)
• Block merging unless one of the specified architects leaves an approval review.

Also, update CODEOWNERS to require approval from kashifkhan, annatisch, or johanste for /sdk//setup.py and /sdk//pyproject.toml files.

All workflow and CODEOWNERS changes should be compatible with downstream branch protection rules to guarantee enforcement.

Provide a clear workflow file and CODEOWNERS proposal for review.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[l0lawrence]

@copilot help me fix the CI errors

[Copilot]

@copilot help me fix the CI errors

Fixed the CI errors in commit c2684be:

1. Added pull-requests: write permission - The workflow needs write access to post comments on PRs
2. Moved README file - Relocated README-strict-version-pins.md from .github/workflows/ to .github/ to avoid CI validation issues with non-workflow files

The workflow should now pass CI checks.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• scanning-api.github.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[l0lawrence]

@copilot remove the codeowner names from the readme

[Copilot]

@copilot remove the codeowner names from the readme

Removed the codeowner names from the README in commit 45517b7. The documentation now refers to "designated architects" instead of listing specific usernames.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• scanning-api.github.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[l0lawrence]

@copilot ignoring the spelling errors in the python file

[Copilot]

@copilot ignoring the spelling errors in the python file

Added .github/scripts/** to the cspell ignorePaths in commit 67cc772. The spell checker will now ignore files in the .github/scripts/ directory.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• scanning-api.github.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)