[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Dependency-floor, packaging, and isolated-environment typing regressions can reach a release because the existing dependency-bounds test matrix runs only in non-blocking maintenance automation. This adds a blocking CI check for version-bump and new-workspace-package PRs without running the exhaustive matrix on ordinary Python PRs.

Description & Review Guide

• What are the major changes? Add a dedicated dependency-bounds workflow and a dependency-free Git/TOML selector. Compare committed package versions against the immutable PR or merge-group base SHA. Run the existing full lower/upper test-and-typing matrix when a workspace package is added or an existing package version changes; manual dispatch also runs the matrix. Include a 60-minute job timeout, report upload on failure, 20 offline selector regression tests, and updated contributor/release documentation.
• What is the impact of these changes? Ordinary PRs receive a successful lightweight no-op check without workspace installation. Other metadata edits, deleted packages, and excluded standalone projects such as Lab do not trigger the matrix. Detection, setup, and validation errors fail the check. The workflow intentionally has no PR path filter so non-Python PRs are not left waiting for a missing required check. Existing code-quality and maintenance workflows, the validator, and the bounded local release import probes remain unchanged. After merging, repository rules must require Dependency Bounds Validation to enforce the gate at merge time; this PR does not change repository rules.
• What do you want reviewers to focus on? Confirm the new-package/version-change boundary, immutable base handling for PRs and merge groups, successful no-op behavior, and use of the full test-and-typing matrix rather than import-only release probes.

Focused checks completed:

• cd python && uv run --no-project --python 3.13 python -m unittest discover -s scripts/dependencies/tests -p test_detect_version_bumps.py — passed, 20 tests.
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 -shellcheck= .github/workflows/python-dependency-bounds.yml — passed; ShellCheck was not run.
• git diff --check and git diff --cached --check — passed before commit.
• Exercised the workflow selector for PR/merge-group no-ops, manual dispatch, and missing/invalid bases — passed. The full dependency matrix, package builds, and full workspace unit suite were not run locally.

Related Issue

Fixes #6582

Follows the maintainer's version-bump-only direction. The maintainer confirmed the full test-and-typing coverage and inclusion of new packages during implementation. No competing open PR for this issue was found before opening.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: GitHub Copilot assisted with the workflow, version-change selector, regression tests, documentation, focused validation, and this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 5230237daea8
Model: gpt-5.6-sol

Overview

The PR adds a lightweight, fail-closed selector in front of the existing exhaustive dependency-bounds matrix, with immutable-base comparison, offline regression tests, isolated validation environments, explicit timeouts, and failure-report upload. Those guards cover manifest additions and direct version changes well. However, the selector does not recognize an existing package that becomes a workspace member through a root workspace configuration change, allowing that newly included package to skip the intended validation gate.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/scripts/dependencies/detect_version_bumps.py

[Copilot]

🟡 Changes recommended

The selector skips validation for newly included workspace members when their manifests and the root version are unchanged, requiring a membership-aware fix and regression test.

1 open issue

• Validate packages newly included by workspace membership changes · New

What changed in this PR

Adds dependency-bounds validation to Python CI for version changes and new workspace packages, addressing the release coverage gap described in #6582. Merge-time enforcement still requires repository rules to require the check.

Changes:

• Adds a workflow that runs the full lower/upper test-and-typing matrix when selected, with a lightweight no-op for ordinary PRs.
• Adds a dependency-free selector using immutable base commits and 20 offline regression tests.
• Documents the CI gate and its separation from bounded local release probes.

File	Description
python/​scripts/​dependencies/​tests/​test_detect_version_bumps.py	Adds regression tests for selection and failure behavior.
python/​scripts/​dependencies/​README.md	Documents the selector, workflow, and enforcement requirements.
python/​scripts/​dependencies/​detect_version_bumps.py	Detects added manifests and committed package version changes.
python/​DEV_SETUP.md	Explains when the full dependency matrix runs in CI.
python/​.github/​skills/​agent-framework-py-release/​SKILL.md	Distinguishes CI matrix coverage from local release probes.
.github/​workflows/​python-dependency-bounds.yml	Adds conditional validation, timeout, and report upload.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 2

Result: No findings
Scope: 1 net-new commit(s): 4546c3dacce9
Model: gpt-5.6-sol

Overview

This incremental patch closes the previously reported workspace-membership gap by comparing base and HEAD membership sets and treating newly included manifests as validation candidates. The implementation fails closed on invalid Git or manifest data, and focused tests cover additions through both members and exclude changes as well as intentional removal and exclusion no-ops. No Critical, High, or Medium defect was established on a changed line in the authoritative review range.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.