Pull Request

IMPORTANT: Before submitting, please remove all sensitive data, secrets, tokens, or confidential information. Ensure you've redacted any NDA-covered information, IP addresses, resource names, or security-related details that shouldn't be publicly disclosed.

Description

Migrate GitHub-side release management from GitVersion + the custom create-release workflow to release-please-action v4.4.1 using the simple release type with a manifest-driven configuration. The new workflow is workflow_dispatch only (no auto-trigger on push) so releases remain explicitly gated.

This PR also removes the parallel Azure DevOps release-branch automation that was tightly coupled to GitVersion, since release management now runs from GitHub. The Azure DevOps github-push mirror pipeline is retained but trimmed of GitVersion references.

Net change: 17 files, +148 / -1364.

Related Issue

Relates to WI-01 (replace GitVersion with release-please on GitHub side).

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Blueprint modification or addition
• Component modification or addition
• Documentation update
• CI/CD pipeline change
• Other (please describe):

Implementation Details

Added

• .github/workflows/release-please.yml — workflow_dispatch-only workflow invoking googleapis/release-please-action@v4.4.1 (pinned).
• release-please-config.json — simple release type, single root package.
• .release-please-manifest.json — pinned to current version 2.8.0.

Disabled (kept on disk, renamed so GitHub no longer schedules it)

• .github/workflows/create-release.yml → .github/workflows/create-release.yml.disabled

Deleted

• GitVersion.yml (root)
• .azuredevops/pipelines/release-branch-create.yml
• .azuredevops/docs/release-branch-create.md
• .azdo/pipelines/github-push.yml (superseded by .azuredevops/pipelines/github-push.yml)

Modified (docs + ADO mirror)

• docs/build-cicd/release-workflow.md — describes release-please trigger, manifest, and version bump flow.
• docs/build-cicd/configuration-reference.md — replaces GitVersion config reference with release-please config reference.
• .azuredevops/docs/github-push.md — removes GitVersion language.
• .azuredevops/pipelines/github-push.yml — removes GitVersion variable group and step.
• .azuredevops/README.md — drops the release-branch-create entry.
• .github/copilot-instructions.md — points contributors at release-please instead of GitVersion.

Testing Performed

• Terraform plan/apply
• Blueprint deployment test
• Unit tests
• Integration tests
• Bug fix includes regression test (see Test Policy)
• Manual validation
• Other: actionlint, yamllint, prettier --check, markdownlint-cli2 all pass on the changed files.

Validation Steps

# YAML / Actions
actionlint .github/workflows/release-please.yml
yamllint .github/workflows/release-please.yml release-please-config.json .release-please-manifest.json

# Formatting
npx prettier --check release-please-config.json .release-please-manifest.json .github/workflows/release-please.yml

# Markdown
npx markdownlint-cli2 \
  docs/build-cicd/release-workflow.md \
  docs/build-cicd/configuration-reference.md \
  .azuredevops/docs/github-push.md \
  .azuredevops/README.md \
  .github/copilot-instructions.md

All validators reported no errors at HEAD 6427d727.

Checklist

• I have updated the documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have run terraform fmt on all Terraform code
• I have run terraform validate on all Terraform code
• I have run az bicep format on all Bicep code
• I have run az bicep build to validate all Bicep code
• I have checked for any sensitive data/tokens that should not be committed
• Lint checks pass (run applicable linters for changed file types)

Terraform / Bicep / test items are N/A — this PR is JSON + YAML + Markdown only.

Security Review

• No credentials, secrets, or tokens are hardcoded or logged
• RBAC and identity changes follow least-privilege principles
• No new network exposure or public endpoints introduced without justification
• Dependency additions or updates have been reviewed for known vulnerabilities
• Container image changes use pinned digests or SHA references

The diff touches only release tooling configuration and docs. The release-please action is pinned to v4.4.1. No code paths, identity boundaries, or network resources are changed.

Note: a Grype scan of the repo (unrelated to files modified by this PR) reports 4 pre-existing CVEs in dependencies (go.opentelemetry.io/otel, postcss, uuid, github.com/jackc/pgx/v5). These should be addressed in a separate dependency-bump PR per precedent (#427, #444).

Additional Notes

• HEAD: 6427d727 (up to date with main at c01b934f).
• The new workflow is intentionally workflow_dispatch-only for this rollout; once verified, a follow-up PR can enable the standard push: branches: [main] trigger.
• The ADO release-branch-create pipeline is removed because release-branch creation is now handled by release-please's release PR. The ADO github-push mirror remains.

Screenshots (if applicable)

N/A — no UI changes.