Use shared localization submission and pull-only release imports

.github/workflows/localization.yml

@@ -0,0 +1,36 @@
+name: Localization
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - package.json
+      - package.nls.json
+      - src/**/*.ts
+      - external/vscode-common-python-lsp
+      - .gitmodules
+      - .nvmrc
+      - .github/workflows/localization.yml
+
+permissions:
+  contents: read
+
+concurrency:
+  group: localization-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  localization:
+    if: github.repository == 'microsoft/vscode-flake8'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: microsoft/vscode-common-python-lsp/.github/actions/localization@d1877b84bb10ff7caa6bd12ab4e75498ba760790
+        with:
+          app-id: ${{ vars.PYTHON_LOCALIZATION_APP_ID }}
+          private-key: ${{ secrets.PYTHON_LOCALIZATION_PRIVATE_KEY }}
+          submodules: recursive
+          source-paths: '["src", "external/vscode-common-python-lsp/typescript/src"]'
+          node-version: '24.17.0'

.gitignore

@@ -10,3 +10,7 @@ bundled/libs/
 **/.pytest_cache
 **/.vs
 **/.DS_Store
+
+# Localization is generated from the dev handback during releases.
+/package.nls.*.json
+/l10n/

README.md

@@ -140,3 +140,15 @@ Then install dependencies:
 ```bash
 npm install
 ```
+
+### Localization
+
+The **Localization** GitHub workflow submits English strings using the [shared composite action and Python tooling](https://github.com/microsoft/vscode-common-python-lsp#shared-localization-automation). Stable and pre-release DevDiv pipelines independently retrieve translations through Pylance-Eng's `pullLocalization: true`; releases never submit English or create translation-update PRs.
+
+Both paths use `microsoft/vscode-python-extensions-loc`, branch **`dev`**, with canonical extension ID **`ms-python.flake8`**. English XLF is stored in `src/en/ms-python.flake8` and handbacks in `out/ms-python.flake8`. The action and Azure tooling checkout are pinned to the same reviewed revision.
+
+Configure the `PYTHON_LOCALIZATION_APP_ID` Actions variable and `PYTHON_LOCALIZATION_PRIVATE_KEY` secret here, or grant access to organization-level credentials. The app needs Contents write access only to the localization drop; the caller's repository token stays read-only. The shared action uses the Microsoft npm proxy and pinned localization CLI. Authorize the literal `Github-Pylance` service connection for both Azure repository resources and release pipelines.
+
+Keep English `package.nls.json` tracked. Root `package.nls.<locale>.json` and `l10n/` runtime files are generated, git-ignored release outputs. VSCE must include generated locale files despite Git ignores. Local builds are English-only unless translations are imported explicitly.
+
+Translation is asynchronous. All 14 supported locales must be present, and every required real-language table must contain translation evidence. Individual untranslated strings are allowed. Missing, incomplete, or wholly untranslated handbacks fail before packaging, without falling back to stale translations. Do not publish while onboarding or real translated output is pending.

build/azure-devdiv-pipeline.pre-release.yml

@@ -12,15 +12,21 @@ schedules:
 
 resources:
   repositories:
-    - repository: MicroBuildTemplate
-      type: git
-      name: 1ESPipelineTemplates/MicroBuildTemplate
-      ref: refs/tags/release
-
     - repository: templates
       type: git
       name: DevDiv/Pylance-Eng
       ref: refs/heads/main
+    - repository: translations
+      type: github
+      name: microsoft/vscode-python-extensions-loc
+      # Temporarily use dev while the localization force-push issue is resolved.
+      ref: refs/heads/dev
+      endpoint: Github-Pylance
+    - repository: localizationTools
+      type: github
+      name: microsoft/vscode-common-python-lsp
+      ref: d1877b84bb10ff7caa6bd12ab4e75498ba760790
+      endpoint: Github-Pylance
 variables:
   - name: TeamName
     value: VSCode-flake8
@@ -62,41 +68,15 @@ parameters:
         displayName: Build extension
 
 extends:
-  template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
+  template: azure-pipelines/extension/pre-release.yml@templates
   parameters:
-    sdl:
-      sourceAnalysisPool: VSEng-MicroBuildVSStable
-      codeSignValidation:
-        enabled: true
-      sbom:
-        enabled: false # Disable global SBOM generation; we'll enable selectively per artifact output
-    pool:
-      name: AzurePipelines-EO
-      os: windows
-
-    customBuildTags:
-      - ES365AIMigrationTooling
-    stages:
-      - stage: Build
-        displayName: Build & Package Extension
-        jobs:
-          - template: azure-pipelines/extension/templates/jobs/package.yml@templates
-            parameters:
-              buildSteps: ${{ parameters.buildSteps }}
-              isPreRelease: true
-              standardizedVersioning: true
-              customNPMRegistry: $(AZURE_ARTIFACTS_FEED)
-
-      - stage: Publish
-        displayName: Publish Extension
-        dependsOn: Build
-        jobs:
-          - template: azure-pipelines/extension/templates/jobs/publish-extension.yml@templates
-            parameters:
-              publishExtension: ${{ parameters.publishExtension }}
-              preRelease: true
-              teamName: $(TeamName)
-              ghCreateTag: true
-              ghCreateRelease: true
-              ghReleaseAddChangeLog: true
-              customNPMRegistry: $(AZURE_ARTIFACTS_FEED)
+    buildSteps: ${{ parameters.buildSteps }}
+    standardizedVersioning: true
+    customNPMRegistry: $(AZURE_ARTIFACTS_FEED)
+    publishExtension: ${{ parameters.publishExtension }}
+    teamName: $(TeamName)
+    ghCreateTag: true
+    ghCreateRelease: true
+    ghReleaseAddChangeLog: true
+    sourceAnalysisPool: VSEng-MicroBuildVSStable
+    pullLocalization: true

build/azure-devdiv-pipeline.stable.yml

@@ -7,15 +7,21 @@ pr: none
 
 resources:
   repositories:
-    - repository: MicroBuildTemplate
-      type: git
-      name: 1ESPipelineTemplates/MicroBuildTemplate
-      ref: refs/tags/release
-
     - repository: templates
       type: git
       name: DevDiv/Pylance-Eng
       ref: refs/heads/main
+    - repository: translations
+      type: github
+      name: microsoft/vscode-python-extensions-loc
+      # Temporarily use dev while the localization force-push issue is resolved.
+      ref: refs/heads/dev
+      endpoint: Github-Pylance
+    - repository: localizationTools
+      type: github
+      name: microsoft/vscode-common-python-lsp
+      ref: d1877b84bb10ff7caa6bd12ab4e75498ba760790
+      endpoint: Github-Pylance
 variables:
   - name: TeamName
     value: VSCode-flake8
@@ -57,55 +63,16 @@ parameters:
         displayName: Build extension
 
 extends:
-  template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
+  template: azure-pipelines/extension/stable.yml@templates
   parameters:
-    sdl:
-      sourceAnalysisPool: VSEng-MicroBuildVSStable
-      codeSignValidation:
-        enabled: true
-      sbom:
-        enabled: false # Disable global SBOM generation; we'll enable selectively per artifact output
-    pool:
-      name: AzurePipelines-EO
-      os: windows
-
-    customBuildTags:
-      - ES365AIMigrationTooling
-    stages:
-      - stage: Build
-        displayName: Build & Package Extension
-        jobs:
-          - template: azure-pipelines/extension/templates/jobs/package.yml@templates
-            parameters:
-              buildSteps: ${{ parameters.buildSteps }}
-              isPreRelease: false
-              standardizedVersioning: true
-              customNPMRegistry: $(AZURE_ARTIFACTS_FEED)
-
-      - stage: WaitForValidation
-        displayName: Wait for Validation
-        dependsOn: Build
-        jobs:
-          - job: wait_for_validation
-            displayName: Wait for manual validation
-            pool: server
-            steps:
-              - task: ManualValidation@0
-                timeoutInMinutes: 1440 # task times out in 1 day
-                inputs:
-                  notifyUsers: 'plseng@microsoft.com'
-                  instructions: 'please test the latest draft release then publish it.'
-                  onTimeout: 'reject'
-      - stage: Publish
-        displayName: Publish Extension
-        dependsOn: WaitForValidation
-        jobs:
-          - template: azure-pipelines/extension/templates/jobs/publish-extension.yml@templates
-            parameters:
-              publishExtension: ${{ parameters.publishExtension }}
-              preRelease: false
-              teamName: $(TeamName)
-              ghCreateTag: true
-              ghCreateRelease: true
-              ghReleaseAddChangeLog: true
-              customNPMRegistry: $(AZURE_ARTIFACTS_FEED)
+    buildSteps: ${{ parameters.buildSteps }}
+    standardizedVersioning: true
+    customNPMRegistry: $(AZURE_ARTIFACTS_FEED)
+    publishExtension: ${{ parameters.publishExtension }}
+    teamName: $(TeamName)
+    ghCreateTag: true
+    ghCreateRelease: true
+    ghReleaseAddChangeLog: true
+    validationNotifyUsers: plseng@microsoft.com
+    sourceAnalysisPool: VSEng-MicroBuildVSStable
+    pullLocalization: true