[automated] Open a dedicated Nix manifest PR after stable releases

[radical]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

The stable release pipeline already verifies and publishes the Aspire CLI archives and generates eng/nix/versions.json, but it commits the manifest into the same PR as PackageValidationBaselineVersion. That broad baseline PR can be delayed by unrelated package-validation and full-matrix failures, leaving main's public Nix flake pinned to an older stable CLI.

For 13.5.2, the release assets and Nix-generation workflow completed successfully, but the generated manifest remained in #19589 while main continued serving 13.4.6 through nix run github:microsoft/aspire#aspire-cli.

Describe the solution you'd like

When a non-prerelease GitHub release is published, automatically generate eng/nix/versions.json from the published .sha512 assets and open or update a dedicated, narrow Nix manifest PR.

The workflow should:

• Run only for stable x.y.z releases after the release assets are publicly available.
• Generate the concrete versioned URLs and SRI hashes with eng/nix/update-versions.sh.
• Change only the Nix manifest and any directly related generated metadata.
• Be idempotent when the manifest already points to that release.
• Keep the Nix package version independent of PackageValidationBaselineVersion.
• Update the release-process and Nix packaging documentation to describe the independent PR flow.

Additional context

The 13.5.2 internal release build uploaded and verified the CLI assets, then successfully dispatched the Nix update workflow: https://github.com/microsoft/aspire/actions/runs/32536914649.

PR #19642 is the manual catch-up for the Nix manifest. The follow-up automation should prevent future stable releases from requiring a manual bump.

[joperezr]

🤖 Aspire triage pass — 2026-08-25 03:54 UTC

Area: area-engineering-systems
Kind: feature-request
Repro: none — infrastructure/automation request (no runtime repro applicable)
Affected version(s): release process for stable x.y.z builds (referenced: 13.5.2 shipped while main Nix flake served 13.4.6; latest line: 13.5.x)
Severity: S3 — release-hygiene gap with a manual workaround (dedicated manual manifest-bump PR, e.g. #19642)

Urgency: ⚪ backlog — no milestone
Reason: feature request to add release-pipeline automation; a manual catch-up path already exists, so it does not clear the 13.5.x servicing or 13.6 vNext bar.

Suggested owner(s): Jose Perez Rodriguez (@joperezr) (score 9), backup David Fowler (@davidfowl) (score 6)
Evidence:

• joperezr merged Switch release flow to draft-then-publish for immutable releases #18068 (release flow: draft-then-publish) which last modified eng/nix/update-versions.sh — the exact script this request extends
• davidfowl merged Add first-party Nix package for Aspire CLI #18410 (added the first-party Nix package + eng/nix/versions.json + update-versions.sh)
• Update Nix flake manifest to v13.5.2 #19642 (manual Nix manifest bump to 13.5.2) is the manual process this automation would replace; labeled area-engineering-systems
• CODEOWNERS has no entry for eng/nix/**, so owner is inferred from merged-PR file history only

Confidence: medium
Needs human?: no