If we see a PR to the extension registry that ONLY introduces a new version with the same name, providers, capabilities, etc., then we should automatically approve it. Anything else should require approval from the azd team until we get more automatic guards in place.

Tasks:

• Create the workflow and get some basic checks - workflow runs in "information only" and doesn't block anything
  • Add "is approved or created by Azure SDK owners" as first step.
  • Add in the next phase - check that the extension update only does simple updates (ie, no provider changes, no capability changes).
  • You can see some of this workflow in action now:
    • The workflow itself: https://github.com/Azure/azure-dev/actions/workflows/ext-registry-check.yml
    • A failed run, because I modified an existing release: https://github.com/Azure/azure-dev/actions/runs/29129221900/job/86481139975#step:3:15
    • A successful run - I only added a new release, and didn't change any of the critical fields (https://github.com/Azure/azure-dev/actions/runs/29129306528/job/86481383373#step:3:1)
• Hook us up in the GitHub repo, so we're a required approval check
• Add more users to CODEOWNERS now that we're sure our check blocks things. This should let Foundry developers approve their own releases, provided they are within the guidelines stated above.