Use shared localization submission and pull-only release imports

.github/workflows/localization.yml

@@ -0,0 +1,30 @@
+name: Localization
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - package.json
+      - package.nls.json
+      - src/**/*.ts
+      - .github/workflows/localization.yml
+
+permissions:
+  contents: read
+
+concurrency:
+  group: localization-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  localization:
+    if: github.repository == 'microsoft/vscode-python-debugger'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: microsoft/vscode-common-python-lsp/.github/actions/localization@d1877b84bb10ff7caa6bd12ab4e75498ba760790
+        with:
+          app-id: ${{ vars.PYTHON_LOCALIZATION_APP_ID }}
+          private-key: ${{ secrets.PYTHON_LOCALIZATION_PRIVATE_KEY }}

.gitignore

@@ -13,4 +13,8 @@ bundled/libs/
 # Generated files (sources live in pre-built/)
 l10n/bundle.l10n.*.json
 package.nls.*.json
-telemetry.json
+telemetry.json
+
+# Localization is generated from the dev handback during releases.
+/package.nls.*.json
+/l10n/

README.md

@@ -132,3 +132,15 @@ The DevDiv Azure stable/prerelease pipelines pass the npm proxy to their build/p
 Each Python bootstrap and bundled-library install step explicitly sets `PIP_INDEX_URL` from `PIP_PROXY_INDEX_URL`, selecting the pip proxy even when a template's authentication setup changes the job-level index. Release triggers, approval gates, signing, and publishing behavior are unchanged.
 
 Dependabot continues to use public registries and its existing update settings. Legacy Azure stable, prerelease, and validation definitions are unchanged.
+
+### Localization
+
+The **Localization** GitHub workflow submits English strings using the [shared composite action and Python tooling](https://github.com/microsoft/vscode-common-python-lsp#shared-localization-automation). Stable and pre-release DevDiv pipelines independently retrieve translations through Pylance-Eng's `pullLocalization: true`; releases never submit English or create translation-update PRs.
+
+Both paths use `microsoft/vscode-python-extensions-loc`, branch **`dev`**, with canonical extension ID **`ms-python.debugpy`**. English XLF is stored in `src/en/ms-python.debugpy` and handbacks in `out/ms-python.debugpy`. The action and Azure tooling checkout are pinned to the same reviewed revision.
+
+Configure the `PYTHON_LOCALIZATION_APP_ID` Actions variable and `PYTHON_LOCALIZATION_PRIVATE_KEY` secret here, or grant access to organization-level credentials. The app needs Contents write access only to the localization drop; the caller's repository token stays read-only. The shared action uses the Microsoft npm proxy and pinned localization CLI. Authorize the literal `Github-Pylance` service connection for both Azure repository resources and release pipelines.
+
+Keep English `package.nls.json` tracked. Root `package.nls.<locale>.json` and `l10n/` runtime files are generated, git-ignored release outputs. VSCE must include generated locale files despite Git ignores. Local builds are English-only unless translations are imported explicitly (debugger pre-built assets remain available, but the release import runs after their overlay and is authoritative).
+
+Translation is asynchronous. All 14 supported locales must be present, and every required real-language table must contain translation evidence. Individual untranslated strings are allowed. Missing, incomplete, or wholly untranslated handbacks fail before packaging, without falling back to stale translations. Do not publish while onboarding or real translated output is pending.

build/azure-devdiv-pipeline.pre-release.yml

@@ -12,15 +12,20 @@ schedules:
 
 resources:
   repositories:
-    - repository: MicroBuildTemplate
-      type: git
-      name: 1ESPipelineTemplates/MicroBuildTemplate
-      ref: refs/tags/release
-
     - repository: templates
       type: git
       name: DevDiv/Pylance-Eng
-      ref: refs/heads/main
+      ref: refs/heads/users/bschnurr/localization-wrapper
+    - repository: translations
+      type: github
+      name: microsoft/vscode-python-extensions-loc
+      ref: refs/heads/dev
+      endpoint: Github-Pylance
+    - repository: localizationTools
+      type: github
+      name: microsoft/vscode-common-python-lsp
+      ref: d1877b84bb10ff7caa6bd12ab4e75498ba760790
+      endpoint: Github-Pylance
 variables:
   - name: TeamName
     value: VSCode-python-debugger
@@ -33,7 +38,7 @@ variables:
 
 parameters:
   - name: publishExtension
-    displayName: 🚀 Publish Extension
+    displayName: 🚀 Publish Extension
     type: boolean
     default: true
 
@@ -100,43 +105,16 @@ parameters:
         displayName: Build extension
 
 extends:
-  template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
+  template: azure-pipelines/extension/pre-release.yml@templates
   parameters:
-    sdl:
-      sourceAnalysisPool: VSEng-MicroBuildVSStable
-      codeSignValidation:
-        enabled: true
-      sbom:
-        enabled: false # Disable global SBOM generation; we'll enable selectively per artifact output
-    pool:
-      name: AzurePipelines-EO
-      os: windows
-
-    customBuildTags:
-      - ES365AIMigrationTooling
-    stages:
-      - stage: Build
-        displayName: Build & Package Extension
-        jobs:
-          - template: azure-pipelines/extension/templates/jobs/package.yml@templates
-            parameters:
-              buildPlatforms: ${{ parameters.buildPlatforms }}
-              buildSteps: ${{ parameters.buildSteps }}
-              isPreRelease: true
-              standardizedVersioning: true
-              customNPMRegistry: $(NPM_CONFIG_REGISTRY)
-
-      - stage: Publish
-        displayName: Publish Extension
-        dependsOn: Build
-        jobs:
-          - template: azure-pipelines/extension/templates/jobs/publish-extension.yml@templates
-            parameters:
-              buildPlatforms: ${{ parameters.buildPlatforms }}
-              publishExtension: ${{ parameters.publishExtension }}
-              preRelease: true
-              teamName: $(TeamName)
-              ghCreateTag: true
-              ghCreateRelease: true
-              ghReleaseAddChangeLog: true
-              customNPMRegistry: $(NPM_CONFIG_REGISTRY)
+    buildPlatforms: ${{ parameters.buildPlatforms }}
+    buildSteps: ${{ parameters.buildSteps }}
+    standardizedVersioning: true
+    customNPMRegistry: $(NPM_CONFIG_REGISTRY)
+    publishExtension: ${{ parameters.publishExtension }}
+    teamName: $(TeamName)
+    ghCreateTag: true
+    ghCreateRelease: true
+    ghReleaseAddChangeLog: true
+    sourceAnalysisPool: VSEng-MicroBuildVSStable
+    pullLocalization: true

build/azure-devdiv-pipeline.stable.yml

@@ -7,15 +7,20 @@ pr: none
 
 resources:
   repositories:
-    - repository: MicroBuildTemplate
-      type: git
-      name: 1ESPipelineTemplates/MicroBuildTemplate
-      ref: refs/tags/release
-
     - repository: templates
       type: git
       name: DevDiv/Pylance-Eng
-      ref: refs/heads/main
+      ref: refs/heads/users/bschnurr/localization-wrapper
+    - repository: translations
+      type: github
+      name: microsoft/vscode-python-extensions-loc
+      ref: refs/heads/dev
+      endpoint: Github-Pylance
+    - repository: localizationTools
+      type: github
+      name: microsoft/vscode-common-python-lsp
+      ref: d1877b84bb10ff7caa6bd12ab4e75498ba760790
+      endpoint: Github-Pylance
 variables:
   - name: TeamName
     value: VSCode-python-debugger
@@ -28,7 +33,7 @@ variables:
 
 parameters:
   - name: publishExtension
-    displayName: 🚀 Publish Extension
+    displayName: 🚀 Publish Extension
     type: boolean
     default: true
 
@@ -95,58 +100,17 @@ parameters:
         displayName: Build extension
 
 extends:
-  template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
+  template: azure-pipelines/extension/stable.yml@templates
   parameters:
-    sdl:
-      sourceAnalysisPool: VSEng-MicroBuildVSStable
-      codeSignValidation:
-        enabled: true
-      sbom:
-        enabled: false # Disable global SBOM generation; we'll enable selectively per artifact output
-    pool:
-      name: AzurePipelines-EO
-      os: windows
-
-    customBuildTags:
-      - ES365AIMigrationTooling
-    stages:
-      - stage: Build
-        displayName: Build & Package Extension
-        jobs:
-          - template: azure-pipelines/extension/templates/jobs/package.yml@templates
-            parameters:
-              buildPlatforms: ${{ parameters.buildPlatforms }}
-              buildSteps: ${{ parameters.buildSteps }}
-              isPreRelease: false
-              standardizedVersioning: true
-              customNPMRegistry: $(NPM_CONFIG_REGISTRY)
-
-      - stage: WaitForValidation
-        displayName: Wait for Validation
-        dependsOn: Build
-        jobs:
-          - job: wait_for_validation
-            displayName: Wait for manual validation
-            pool: server
-            steps:
-              - task: ManualValidation@0
-                timeoutInMinutes: 1440 # task times out in 1 day
-                inputs:
-                  notifyUsers: 'plseng@microsoft.com'
-                  instructions: 'please test the latest draft release then publish it.'
-                  onTimeout: 'reject'
-
-      - stage: Publish
-        displayName: Publish Extension
-        dependsOn: WaitForValidation
-        jobs:
-          - template: azure-pipelines/extension/templates/jobs/publish-extension.yml@templates
-            parameters:
-              buildPlatforms: ${{ parameters.buildPlatforms }}
-              publishExtension: ${{ parameters.publishExtension }}
-              preRelease: false
-              teamName: $(TeamName)
-              ghCreateTag: true
-              ghCreateRelease: true
-              ghReleaseAddChangeLog: true
-              customNPMRegistry: $(NPM_CONFIG_REGISTRY)
+    buildPlatforms: ${{ parameters.buildPlatforms }}
+    buildSteps: ${{ parameters.buildSteps }}
+    standardizedVersioning: true
+    customNPMRegistry: $(NPM_CONFIG_REGISTRY)
+    publishExtension: ${{ parameters.publishExtension }}
+    teamName: $(TeamName)
+    ghCreateTag: true
+    ghCreateRelease: true
+    ghReleaseAddChangeLog: true
+    validationNotifyUsers: plseng@microsoft.com
+    sourceAnalysisPool: VSEng-MicroBuildVSStable
+    pullLocalization: true