Adopt vscode-common-python-lsp as a git submodule, synced via repository_dispatch, and stop Dependabot duplicates

.github/dependabot.yml

@@ -13,14 +13,14 @@ updates:
       npm-minor-patch:
         patterns:
           - '*'
-        # Exclude @vscode/common-python-lsp so it gets its own standalone PR (weekly).
-        exclude-patterns:
-          - '@vscode/common-python-lsp'
         update-types:
           - 'minor'
           - 'patch'
     open-pull-requests-limit: 10
     ignore:
+      # @vscode/common-python-lsp is handled by the shared-package-release
+      # dispatch workflow, so ignore it here to avoid duplicate PRs.
+      - dependency-name: '@vscode/common-python-lsp'
       - dependency-name: '@types/vscode'
       - dependency-name: '@types/node'
       - dependency-name: 'vscode-languageclient'
@@ -39,12 +39,13 @@ updates:
       pip-minor-patch:
         patterns:
           - '*'
-        # Exclude vscode-common-python-lsp so it gets its own standalone PR (weekly).
-        exclude-patterns:
-          - 'vscode-common-python-lsp'
         update-types:
           - 'minor'
           - 'patch'
+    ignore:
+      # vscode-common-python-lsp is handled by the shared-package-release
+      # dispatch workflow, so ignore it here to avoid duplicate PRs.
+      - dependency-name: 'vscode-common-python-lsp'
 
   # Python test dependencies are updated weekly, minor updates are grouped (1 PR "pip-test-minor-patch").
   - package-ecosystem: 'pip'

.github/workflows/shared-package-release.yml

@@ -0,0 +1,161 @@
+name: Shared Package Release Handler
+
+on:
+  repository_dispatch:
+    types: [shared-package-release]
+
+permissions:
+  contents: write
+  issues: write
+
+concurrency:
+  group: 'shared-package-release-${{ github.event.client_payload.release_tag }}'
+  cancel-in-progress: false
+
+env:
+  NODE_VERSION: 24.17.0
+  # Match the Python version documented in requirements.in so the regenerated
+  # lockfile stays valid across the supported Python range.
+  PYTHON_VERSION: '3.10'
+
+jobs:
+  update-shared-packages:
+    name: Update shared packages
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Validate dispatch payload
+        env:
+          RELEASE_TAG: ${{ github.event.client_payload.release_tag }}
+        run: |
+          set -euo pipefail
+          if [ -z "${RELEASE_TAG}" ]; then
+            echo 'release_tag is missing from the dispatch payload.' >&2
+            exit 1
+          fi
+          if ! printf '%s' "${RELEASE_TAG}" | grep -Eq '^v?[0-9A-Za-z][0-9A-Za-z.+-]*$'; then
+            echo "release_tag '${RELEASE_TAG}' is not a valid version/ref." >&2
+            exit 1
+          fi
+
+      - name: Normalize release tag
+        id: release_version
+        env:
+          RELEASE_TAG: ${{ github.event.client_payload.release_tag }}
+        run: |
+          set -euo pipefail
+          VERSION="${RELEASE_TAG#v}"
+          echo "value=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Create branch for this release
+        env:
+          RELEASE_TAG: ${{ github.event.client_payload.release_tag }}
+        run: |
+          set -euo pipefail
+          BRANCH="shared-package-v${RELEASE_TAG#v}"
+          git fetch origin main
+          # Fetch any pre-existing remote branch so --force-with-lease has a ref.
+          git fetch origin "+refs/heads/${BRANCH}:refs/remotes/origin/${BRANCH}" 2>/dev/null || true
+          git checkout -B "$BRANCH" origin/main
+
+      - name: Update npm dependency
+        env:
+          NPM_DEP: ${{ github.event.client_payload.npm_dependency }}
+          RELEASE_VERSION: ${{ steps.release_version.outputs.value }}
+        run: |
+          set -euo pipefail
+          if [ -z "${NPM_DEP}" ]; then
+            echo 'No npm dependency in payload; skipping.'
+            exit 0
+          fi
+          npm install "${NPM_DEP}@${RELEASE_VERSION}"
+
+      - name: Update pip dependency
+        env:
+          PIP_DEP: ${{ github.event.client_payload.pip_dependency }}
+          RELEASE_VERSION: ${{ steps.release_version.outputs.value }}
+        run: |
+          set -euo pipefail
+          if [ -z "${PIP_DEP}" ]; then
+            echo 'No pip dependency in payload; skipping.'
+            exit 0
+          fi
+          if [ ! -f requirements.in ]; then
+            echo 'No requirements.in found; skipping.'
+            exit 0
+          fi
+          python -m pip install --upgrade uv
+          # Rewrite the pin (case-insensitive) for the shared package only.
+          sed -i -E "s/^${PIP_DEP}([<>=!~].*)?\$/${PIP_DEP}==${RELEASE_VERSION}/I" requirements.in
+          if ! grep -iEq "^${PIP_DEP}==${RELEASE_VERSION}([[:space:];].*)?\$" requirements.in; then
+            echo "Failed to pin ${PIP_DEP}==${RELEASE_VERSION} in requirements.in." >&2
+            exit 1
+          fi
+          # Scope the re-resolve to the shared package and pin to the documented
+          # Python version so unrelated deps and version markers are preserved.
+          uv pip compile --generate-hashes \
+            --upgrade-package "${PIP_DEP}" \
+            --python-version "${PYTHON_VERSION}" \
+            -o requirements.txt requirements.in
+
+      - name: Push branch and open tracking issue if changed
+        env:
+          RELEASE_TAG: ${{ github.event.client_payload.release_tag }}
+          RELEASE_URL: ${{ github.event.client_payload.release_url }}
+          REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          git config user.name 'github-actions[bot]'
+          git config user.email 'github-actions[bot]@users.noreply.github.com'
+          if git diff --quiet; then
+            echo 'No changes detected.'
+            exit 0
+          fi
+          BRANCH="shared-package-v${RELEASE_TAG#v}"
+          git add -A
+          git commit -m "Upgrade shared package to ${RELEASE_TAG}"
+          git push --force-with-lease --set-upstream origin "$BRANCH"
+          COMPARE_URL="https://github.com/${REPO}/compare/main...${BRANCH}?expand=1"
+          TITLE="[Shared Package] Open PR to upgrade to ${RELEASE_TAG}"
+          {
+            echo "### Shared package upgrade ready"
+            echo ''
+            echo "Branch \`${BRANCH}\` has been pushed."
+            echo ''
+            echo "[Open the pull request](${COMPARE_URL})"
+            echo ''
+            echo "Source release: ${RELEASE_URL}"
+          } >> "$GITHUB_STEP_SUMMARY"
+          BODY_FILE="$(mktemp)"
+          cat > "$BODY_FILE" <<EOF
+          Branch \`${BRANCH}\` has been pushed with the shared package upgrade to ${RELEASE_TAG}.
+
+          Organization settings prevent this workflow from opening pull requests automatically. Please open the PR manually:
+
+          ${COMPARE_URL}
+
+          Source release: ${RELEASE_URL}
+          EOF
+          # Reuse an existing open tracking issue for this release if present.
+          EXISTING="$(gh issue list --repo "$REPO" --state open --search "in:title ${TITLE}" --json number,title --jq "map(select(.title == \"${TITLE}\")) | .[0].number // empty" 2>/dev/null || true)"
+          if [ -n "${EXISTING}" ]; then
+            echo "Reusing existing tracking issue #${EXISTING}."
+            gh issue comment "${EXISTING}" --repo "$REPO" --body-file "$BODY_FILE" \
+              || echo 'Could not comment on issue; compare URL is in the job summary.'
+          else
+            gh issue create --repo "$REPO" --title "${TITLE}" --body-file "$BODY_FILE" \
+              || echo 'Could not create issue (Issues may be disabled); compare URL is in the job summary.'
+          fi