Ensure release automation for security-partners works in .NET 8.0/VMR

[MichaelSimons]

The recent change to introduce CI recent pipeline added to mirror changes to the security partners repo needs to be updates to work in the VMR. There may be other changes needed with release automation - e.g. https://github.com/dotnet/source-build/blob/main/eng/source-build-pre-release.yml

[premun]

I saw the triage recording but I don't quite understand this task. The linked pipeline seems to only build the tarball and I thought we have agreed that we don't need that as the VMR is validated in different places.

Or maybe I misunderstand what "release automation" means? Is this issue about mirroring the VMR too?

[premun]

Or is this about making sure the whole release checklist is applicable for the new VMR?

[MichaelSimons]

@premun - I link the wrong PR in the original description. I updated the description. I mean to link to the mirror pipeline.

[premun]

I think I have the code ready but to run it, I'd need to wait for the branch snap and some release/8.0 build

https://github.com/dotnet/source-build/compare/prvysoky/net-8.0?expand=1

[premun]

I opened a PR to bring 8.0 up to par with 6.0/7.0

Next steps

We could make the pipeline multi-stage and compose it of the various pipelines that need to be invoked separately. The stages could be divided by approval gates. So something like:

• Get info stage - Current pre-release pipeline
• Approval gate - Confirmation that smoke test prereqs are in place
• Mirror stage - Current mirroring pipeline
• Approval gate - Wait for .NET 8.0 release
• Release stage - Current release pipeline
  • Possibly another stage for sending out comms, or could be part of this one

Further ideas:

• We could then have 1 pipeline run for each release of each version (so a 6.0 run, 7.0 run, 8.0 run).
• We could have instructions directly in the PR gates (or in the release notes).