Python: Improve python package management operations

[moonbox3]

Motivation & Context

Speed up the Python package management/release skill by validating only changed packages and running lock-independent lower/upper-bound import probes in parallel. Previously, all 37 packages ran four serial checks each (148 isolated validation commands) which made release validation take about an hour in practice.

The new approach reduced single-package validation from ~294 seconds to ~40 seconds (~7× faster), while a realistic six-package release completed in ~39 seconds total. The exhaustive test/Pyright matrix remains available for CI and dependency-range audits.

Description & Review Guide

• What are the major changes?
• What is the impact of these changes?
• What do you want reviewers to focus on?

Related Issue

Fixes #

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Pull request overview

This PR adds a faster “release” dependency-bound validation path for the Python workspace by probing only changed release packages and running lock-independent lower/upper import checks concurrently, while keeping the existing exhaustive test/typing matrix available for CI and audits.

Changes:

• Add a new --mode release to validate_dependency_bounds and route it through a dedicated implementation module.
• Implement concurrent lock-independent lowest-direct/highest import probes for changed package metadata, with JSON reporting.
• Add tests and update developer documentation/skills plus a new Poe task (validate-python-release) for release validation.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
python/scripts/dependencies/validate_dependency_bounds.py	Adds release mode CLI wiring and new release-mode arguments.
python/scripts/dependencies/_dependency_bounds_release_impl.py	Implements changed-package discovery, probe planning, concurrent probing, and report writing.
python/scripts/dependencies/tests/test_dependency_bounds_release.py	Adds unit tests for probe planning, command generation, and change detection.
python/scripts/dependencies/README.md	Documents release mode, its behavior, and the new report output.
python/pyproject.toml	Adds validate-python-release Poe task and updates test-task description.
python/packages/foundry_hosting/pyproject.toml	Formatting-only adjustment in build-system section.
python/.github/skills/python-package-management/SKILL.md	Updates guidance to use the new bounded release validation path.
python/.github/skills/agent-framework-py-release/SKILL.md	Updates release workflow guidance to use a consistent main ref and the new release validation task.

Comments suppressed due to low confidence (1)

python/scripts/dependencies/_dependency_bounds_release_impl.py:415

• The failure message hard-codes a “five-minute” deadline, but the release deadline is configurable via deadline_seconds. This can be misleading when --release-timeout-seconds is changed.

    started = time.monotonic()
    remaining_seconds = deadline - started
    if remaining_seconds <= 0:
        return {
            "status": "failed",
            "duration_seconds": 0.0,
            "error": "The five-minute release-validation deadline elapsed before uv.lock refresh started.",
        }

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	45259	4451	90%

report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9368	33 💤	0 ❌	0 🔥	2m 31s ⏱️

[github-actions]

Automated Code Review

Reviewers: 2 | Confidence: 92%

✓ Test Coverage

The test file covers the core planning logic (_build_release_project_map, _build_release_probe_plan, _build_release_probe_command, _changed_release_project_paths) but leaves the probe execution and result-parsing paths entirely untested. _parse_probe_payload is a pure function critical to determining probe success/failure and is trivial to unit test. The top-level run_release_mode orchestrator also has no coverage, though a dry-run-based test would be lightweight and would catch wiring issues.

✗ Design Approach

I found one blocking design issue: the new release-validation path is hard-wired to Python 3.10, which makes it fail by construction for releasable packages in this repo that require a newer interpreter.

Flagged Issues

• The new validate-python-release flow always defaults to Python 3.10, but python/packages/azure-cosmos-memory/pyproject.toml:6 declares requires-python = ">=3.11". Releasing that package through the new default path would fail before validation can happen, so the design does not cover all valid package releases.

---

Automated review by moonbox3's agents

[github-actions]

Flagged issue

The new validate-python-release flow always defaults to Python 3.10, but python/packages/azure-cosmos-memory/pyproject.toml:6 declares requires-python = ">=3.11". Releasing that package through the new default path would fail before validation can happen, so the design does not cover all valid package releases.

---

Source: automated DevFlow PR review

[moonbox3]

Addressed the review summary and flagged issue in 388b2dd. Release probes now derive Python from each package closure, blank base refs are rejected, configurable deadline messages are accurate, and coverage now includes payload parsing plus dry-run orchestration. Focused tests, Ruff, source/test Pyright, the release Poe task, and real lower/upper azure-cosmos-memory probes all pass.