chore(azldev): move azldev to a proper go module tool

[dmcilvaney]

Move azldev version management into a conventional nested Go module so Dependabot can update the direct azldev dependency. Dependabot does not yet support dependencies declared solely by Go tool directives.

• Refactor version resolution to read tools/azldev/go.mod and resolve it to a validated immutable Git hash at the GitHub Actions, Docker, and ADO installation boundaries.
• Retain .azldev-version temporarily for compatibility with the currently deployed trusted rendered-spec workflow.
• After this merges, existing 4.0 PRs must rebase so their raw heads include tools/azldev/go.mod.
• ADO runs are reviewer-gated; a target ADO run will validate the internal Go proxy path before merge.

[Copilot]

Pull request overview

Moves azldev version management into Go modules and updates CI to resolve and validate immutable tool hashes.

Changes:

• Adds the azldev Go tool dependency and supporting documentation.
• Refactors GitHub and ADO workflows to resolve the post-merge azldev hash.
• Adds resolver tests and dependency-smoke coverage.

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
go.mod	Declares the azldev tool and dependencies.
go.sum	Locks Go dependency checksums.
DEVELOPING.md	Documents Go-based installation and usage.
.github/workflows/lint.yaml	Runs azldev through go tool.
.github/workflows/dependency-smoke.yml	Adds resolver test execution.
.github/workflows/azldev-smoke.yml	Builds the runner from a resolved hash.
.github/workflows/check-rendered-specs.yml	Resolves the post-merge tool and render scope.
.github/workflows/containers/azldev-runner.Dockerfile	Installs azldev using an immutable hash.
.github/workflows/ado/templates/steps/install-deps.yml	Resolves azldev from go.mod.
.github/workflows/ado/templates/steps/get-changes-info.yml	Validates PR commit state before installation.
.github/instructions/pr-check-workflows.instructions.md	Updates runner-build guidance.
scripts/ci/render-specs-check/resolve_azldev_version.py	Implements secure version/hash resolution.
scripts/ci/render-specs-check/tests/conftest.py	Configures resolver test imports.
scripts/ci/render-specs-check/tests/requirements.txt	Pins pytest.
scripts/ci/render-specs-check/tests/test_resolve_azldev_version.py	Tests resolver behavior and validation.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

go.mod:5

• The stated Dependabot migration is incomplete: .github/dependabot.yml currently configures only pip and github-actions, so Dependabot will not scan this root Go module or propose azldev updates. Add a root gomod update entry (preferably scoped to github.com/microsoft/azure-linux-dev-tools) so this tool declaration is actually managed as intended.

tool github.com/microsoft/azure-linux-dev-tools/cmd/azldev

[Copilot]

Pull request overview

Copilot reviewed 15 out of 16 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

scripts/ci/render-specs-check/resolve_azldev_version.py:125

• Resolving only the azldev module to a commit hash does not reproduce the tool selected by this repository's module graph. go tool azldev and the documented unversioned go install honor root go.mod transitive versions/replacements, while every Docker/ADO install uses go install ...@<hash>, which ignores root go.mod. Consequently, a Dependabot transitive update (explicitly enabled here) can change the developer/lint binary without changing this hash or setting render-all, so the render gates test a different binary. Build CI from a validated post-merge module graph, or restrict and validate the graph so only the top-level azldev pin can vary.

        module = json.loads(_run_go("mod", "download", "-json", f"{AZLDEV_MODULE}@{version}"))

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 8 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

scripts/ci/render-specs-check/resolve_azldev_version.py:154

• go mod download honors GOPROXY, but standard proxy .info responses contain only fields such as Version and Time; they do not provide the VCS Origin URL/full hash. Consequently Origin is empty on fresh GitHub-hosted runners using proxy.golang.org and on the required ADO internal-proxy path, so every new resolver caller fails here before installing azldev. Resolve the immutable revision through a trusted mechanism that works with proxy-only environments (or carry a separately validated full hash); the mocked Origin in the unit test does not represent proxy behavior.

        module = json.loads(_run_go("mod", "download", "-json", f"{AZLDEV_MODULE}@{version}"))
    except json.JSONDecodeError as error:
        message = f"go returned invalid JSON while resolving {AZLDEV_MODULE}@{version}"
        raise ResolutionError(message) from error
    origin = module.get("Origin", {}) if isinstance(module, dict) else {}
    if not isinstance(origin, dict) or origin.get("VCS") != "git" or origin.get("URL") != AZLDEV_REPOSITORY:
        message = f"Go resolved {AZLDEV_MODULE}@{version} from an unexpected source"
        raise ResolutionError(message)

.github/workflows/check-rendered-specs.yml:88

• This reusable workflow is branch-pinned by the stub, so this new revision will only execute after it has merged into 4.0; at that point the trusted checkout does contain the module file. Keeping 1.25.6 hardcoded creates a second toolchain pin that Dependabot will not update, and a future azldev bump requiring newer Go will fail because the resolver sets GOTOOLCHAIN=local. Use the module's Go version here, as the lint and smoke workflows do.

          # The trusted 4.0 checkout does not contain the nested module until
          # this change merges, so it cannot use go-version-file yet.
          go-version: "1.25.6"

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated no new comments.