[DariuszPorowski]

Summary

Remove the unused Python SemVer validator and replace the straightforward Terraform test-recipe publisher with Bash, zip, and kubectl. Update the callers, prerequisites, and regression coverage without changing the public Make target.

Keep the XML result transformer and authorization-log collector, including its tests, in Python: replacing those would require an XML dependency or a substantial process-management rewrite.

Validation evidence

• make -f build/test.mk test-publish-recipes test-local-functional-runner — passed in WSL; both recipe publishers and the local runner passed.
• PYTHON=python-must-not-be-used bash .github/scripts/release-version-format_test.sh — passed on byte-identical files in an isolated WSL Git fixture. The Windows host lacks Make, and native WSL Git cannot resolve the Windows worktree metadata.
• fnm exec --using 24 -- node --test --test-name-pattern=Lint .github\scripts\changes_test.mjs — passed, 8 tests.
• shellcheck --external-sources --rcfile .github\linters\.shellcheckrc .github\scripts\publish-test-terraform-recipes.sh .github\scripts\publish-test-terraform-recipes_test.sh .github\scripts\release-version-format_test.sh build\scripts\local-functional.sh build\scripts\local-functional_test.sh — passed.
• A temporary migration comparison confirmed matching archive paths, contents, and file modes for all 12 checked-in Terraform recipes plus 3 fixtures covering hidden files, empty directories, spaces, and executable permissions.
• pnpm exec markdownlint-cli2 docs\contributing\contributing-code\contributing-code-github-workflows\README.md --config .github\linters\.markdownlint-cli2.yaml — blocked before lint execution: pnpm's dependency policy could not validate the pinned markdownlint-cli2@0.24.0 against the registry manifest. Dependency versions and policies were not changed; Markdown tooling remains unavailable for the documentation edits.

The full Go build, full test suite, and live-cluster functional tests were not run; the changes are scoped to development and CI scripts.

Reason for change

validate_semver.py was referenced only by its own obsolete test helpers; release validation already uses the shared Bash policy. Terraform recipe publishing is simple shell orchestration and does not need a separate Python implementation. This removes those unnecessary Python requirements while leaving the more complex, actively used Python scripts alone.

Related issue: N/A.

How to test

Use a normal Git checkout on Linux/WSL or macOS with Bash, GNU Make, Git, zip, unzip, Node.js 24, and ShellCheck available. No cluster, registry, or cloud credentials are needed for these checks.

make -f build/test.mk test-release-version-format test-publish-recipes test-local-functional-runner
node --test --test-name-pattern=Lint .github/scripts/changes_test.mjs
shellcheck --external-sources --rcfile .github/linters/.shellcheckrc \
  .github/scripts/publish-test-terraform-recipes.sh \
  .github/scripts/publish-test-terraform-recipes_test.sh \
  .github/scripts/release-version-format_test.sh \
  build/scripts/local-functional.sh \
  build/scripts/local-functional_test.sh

Expect the release-version, Bicep publisher, Terraform publisher, and local-runner success messages; 8 passing Node tests; and no ShellCheck diagnostics. The publisher tests use a mocked kubectl and real ZIP tools to cover archive contents, hidden and empty recipes, relative paths and spaces, summary output, missing inputs/tools, failure propagation, and temporary-file cleanup.

File change summary

File	Summary of change
.github/scripts/validate_semver.py	Remove the obsolete, test-only Python validator.
.github/scripts/release-version-format_test.sh	Remove Python-only helpers and retain malformed-version coverage against the active Bash policy.
.github/workflows/lint.yaml	Remove Python setup from the release-metadata validation path.
.github/scripts/publish-test-terraform-recipes.py	Remove the replaced Python publisher.
.github/scripts/publish-test-terraform-recipes.sh	Publish recipe ZIPs through Bash with explicit dependency checks, cleanup, and failure propagation.
.github/scripts/publish-test-terraform-recipes_test.sh	Add focused publisher regressions without a live cluster.
build/recipes.mk	Invoke the Bash Terraform publisher through the existing target.
build/test.mk	Include Terraform publisher coverage in test-publish-recipes.
build/scripts/local-functional.sh	Replace the publisher-only Python prerequisite with zip.
build/scripts/local-functional_test.sh	Update tool mocks and cover missing zip.
docs/contributing/contributing-code/contributing-code-github-workflows/README.md	Remove the obsolete Python prerequisite for release-metadata checks.
docs/contributing/contributing-code/contributing-code-tests/running-functional-tests.md	Document the ZIP-tool prerequisite and publisher verification command.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

• .github/workflows/lint.yaml

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	add5ea8
Unique ID	func5165d4e74e
Image tag	test-func5165d4e74e-40595436156-1

• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:test-func5165d4e74e-40595436156-1
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:test-func5165d4e74e-40595436156-1
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:test-func5165d4e74e-40595436156-1
• controller test image location: ghcr.io/radius-project/dev/controller:test-func5165d4e74e-40595436156-1
• ucp test image location: ghcr.io/radius-project/dev/ucpd:test-func5165d4e74e-40595436156-1
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting ucp-cloud functional tests...
⌛ Starting corerp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded

[Copilot]

🟢 Approval recommended

The scoped migration preserves the publishing interface, updates prerequisites consistently, and includes focused regression coverage with no identified blocking defects.

No open issues 🎉

What changed in this PR

This PR reduces Python dependencies in Radius development and CI tooling while preserving the public Terraform recipe publishing Make target. The XML transformer and authorization-log collector remain in Python.

Changes:

• Replace the Python Terraform recipe publisher with Bash, zip, and kubectl, with focused regression coverage.
• Remove the obsolete Python SemVer validator and retain malformed-version checks against the active Bash policy.
• Update callers, tool prerequisites, and contributor documentation.

File	Description
docs/​contributing/​contributing-code/​contributing-code-tests/​running-functional-tests.md	Document ZIP prerequisites and publisher verification.
docs/​contributing/​contributing-code/​contributing-code-github-workflows/​README.md	Remove Python from release-metadata prerequisites.
build/​test.mk	Include Terraform publisher regression tests.
build/​scripts/​local-functional.sh	Replace the Python prerequisite with zip.
build/​scripts/​local-functional_test.sh	Update mocks and check missing zip handling.
build/​recipes.mk	Invoke Bash through the existing publishing target.
.github/​workflows/​lint.yaml	Remove release-metadata Python setup.
.github/​scripts/​validate_semver.py	Delete the obsolete validator.
.github/​scripts/​release-version-format_test.sh	Remove Python helpers and extend Bash policy checks.
.github/​scripts/​publish-test-terraform-recipes.sh	Add Bash publishing with cleanup and failure propagation.
.github/​scripts/​publish-test-terraform-recipes.py	Delete the replaced Python publisher.
.github/​scripts/​publish-test-terraform-recipes_test.sh	Cover archives, inputs, failures, summaries, and cleanup.

_{Review effort: Balanced}

[github-actions]

Unit Tests

    2 files  ±0    420 suites  ±0   19m 59s ⏱️ -19s
7 795 tests ±0  7 793 ✅ ±0  2 💤 ±0  0 ❌ ±0 
8 965 runs  ±0  8 963 ✅ ±0  2 💤 ±0  0 ❌ ±0 

Results for commit add5ea8. ± Comparison against base commit 8ca2ce3.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.03%. Comparing base (b589a61) to head (add5ea8).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #13527   +/-   ##
=======================================
  Coverage   69.03%   69.03%           
=======================================
  Files         733      733           
  Lines       40185    40187    +2     
=======================================
+ Hits        27740    27745    +5     
+ Misses      12445    12442    -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.