feat: publish telemetry reporter GitHub releases

[Tom Meschter (tmeschter)]

Add controlled GitHub release publishing for the telemetry reporter Native AOT packages.

Problem

The telemetry reporter pipeline produces verified packages for six runtime identifiers, but there was no manually controlled process to publish those packages as a GitHub release. Release artifacts also need to be guaranteed to come from the exact commit being released.

Solution

• Keep scheduled runs of telemetry-reporter - nightly focused on change detection, building, and verification.
• Add a Release stage to manually queued main runs of the same pipeline, following the Azure SDK release-pipeline pattern.
• Build and verify the full matrix in the manual run, then release artifacts produced earlier in that same run so the commit SHA and packages cannot drift across runs.
• Retain the release run, authenticate with the Azure SDK Automation GitHub App, and validate the manifest against the current build ID and source commit.
• Create the GitHub release as a draft, upload all six runtime ZIPs, and publish it as Latest only after every upload succeeds. Delete the draft and tag on failure so the run can be retried.
• Keep symbols, checksums, build information, and the manifest in the retained Azure DevOps run.

Validation

• PowerShell scripts and Azure DevOps YAML parse successfully.
• Synthetic artifacts verified manual-run manifest provenance and all six runtime assets.
• Scheduled manifests are rejected by the release publisher.
• Manual initialization builds the complete platform matrix.
• Mocked GitHub CLI tests verified draft creation, asset upload, publication, and cleanup after an upload failure.

Operational setup

The existing telemetry-reporter - nightly definition remains the only pipeline definition. It must be authorized to create retention leases and use AzureSDKEngKeyVault Secrets. The Azure SDK Automation GitHub App installation must include microsoft/GitHub-Copilot-for-Azure with Contents: write permission.

Fixes microsoft/GitHub-Copilot-for-Azure-pr#373

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical retention-token handling and additional authentication, retention, and release-upload defects must be fixed before approval.

Review effort: Lite
Findings: 1 · 2

Open (3)

• Token argument is passed literally instead of being expanded · New
• Lease list response is incorrectly treated as a value wrapper · New
• Release creation and asset upload lack failure recovery · New

What changed in this PR

Separates telemetry reporter nightly artifact verification from manually controlled GitHub release publishing.

Changes:

• Adds release-candidate tagging and a manual release pipeline.
• Adds artifact validation, retention leases, and GitHub App authentication.
• Publishes runtime ZIPs and updates pipeline documentation.
• Unresolved defects remain in retention handling, authentication, and release-upload recovery.

File	Description
telemetry-reporter/​README.md	Documents nightly and release workflows.
telemetry-reporter/​eng/​scripts/​Test-NightlyBuildArtifacts.ps1	Adds release metadata validation.
telemetry-reporter/​eng/​scripts/​Publish-NightlyRelease.ps1	Validates and publishes runtime archives.
telemetry-reporter/​eng/​scripts/​New-NightlyBuildInfo.ps1	Excludes release-only changes from nightly builds.
pipelines/​telemetry-reporter-release.yml	Defines the manual release pipeline.
pipelines/​telemetry-reporter-nightly.yml	Tags eligible nightly runs.
pipelines/​README.md	Documents pipeline setup and operation.
eng/​common/​scripts/​login-to-github.ps1	Mints GitHub App tokens.
eng/​common/​scripts/​Add-RetentionLease.ps1	Manages Azure DevOps retention leases.
eng/​common/​pipelines/​templates/​steps/​retain-run.yml	Provides retention pipeline steps.
eng/​common/​pipelines/​templates/​steps/​login-to-github.yml	Provides GitHub authentication steps.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.