chore: import upstream snapshot with attribution

.github/workflows/release-finalize.yml

@@ -0,0 +1,122 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Triggers automatically when the changelog PR is merged to a candidate branch.
+# Records the last-release-sha for Release Please and renames the branch to release/v{version}.
+name: "Release: Finalize"
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - release/candidate
+      - release/v1-candidate
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  finalize:
+    if: github.event.pull_request.merged == true && github.repository == 'google/adk-python'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for release-please PR
+        id: check
+        env:
+          LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }}
+        run: |
+          if echo "$LABELS" | grep -q "autorelease: pending"; then
+            echo "is_release_pr=true" >> $GITHUB_OUTPUT
+          else
+            echo "Not a release-please PR, skipping"
+            echo "is_release_pr=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Determine Branch Configurations
+        if: steps.check.outputs.is_release_pr == 'true'
+        id: config
+        run: |
+          CANDIDATE_BRANCH="${{ github.event.pull_request.base.ref }}"
+          if [ "$CANDIDATE_BRANCH" = "release/v1-candidate" ]; then
+            echo "base_branch=v1" >> $GITHUB_OUTPUT
+            echo "config_file=.github/release-please-config-v1.json" >> $GITHUB_OUTPUT
+            echo "manifest_file=.github/.release-please-manifest-v1.json" >> $GITHUB_OUTPUT
+          else
+            echo "base_branch=main" >> $GITHUB_OUTPUT
+            echo "config_file=.github/release-please-config.json" >> $GITHUB_OUTPUT
+            echo "manifest_file=.github/.release-please-manifest.json" >> $GITHUB_OUTPUT
+          fi
+
+      - uses: actions/checkout@v6
+        if: steps.check.outputs.is_release_pr == 'true'
+        with:
+          ref: ${{ github.event.pull_request.base.ref }}
+          token: ${{ secrets.RELEASE_PAT }}
+          fetch-depth: 0
+
+      - name: Extract version from manifest
+        if: steps.check.outputs.is_release_pr == 'true'
+        id: version
+        run: |
+          VERSION=$(jq -r '.["."]' "${{ steps.config.outputs.manifest_file }}")
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Extracted version: $VERSION"
+
+      - name: Configure git identity from RELEASE_PAT
+        if: steps.check.outputs.is_release_pr == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
+        run: |
+          USER_JSON=$(gh api user)
+          git config user.name "$(echo "$USER_JSON" | jq -r '.login')"
+          git config user.email "$(echo "$USER_JSON" | jq -r '.id')+$(echo "$USER_JSON" | jq -r '.login')@users.noreply.github.com"
+
+      - name: Record last-release-sha for release-please
+        if: steps.check.outputs.is_release_pr == 'true'
+        run: |
+          BASE_BRANCH="${{ steps.config.outputs.base_branch }}"
+          CONFIG_FILE="${{ steps.config.outputs.config_file }}"
+          CANDIDATE_BRANCH="${{ github.event.pull_request.base.ref }}"
+
+          git fetch origin "$BASE_BRANCH"
+          CUT_SHA=$(git merge-base "origin/$BASE_BRANCH" HEAD)
+          echo "Release was cut from $BASE_BRANCH at: $CUT_SHA"
+
+          jq --arg sha "$CUT_SHA" '. + {"last-release-sha": $sha}' \
+            "$CONFIG_FILE" > tmp.json && mv tmp.json "$CONFIG_FILE"
+
+          git add "$CONFIG_FILE"
+          git commit -m "chore: update last-release-sha for next $BASE_BRANCH release"
+          git push origin "$CANDIDATE_BRANCH"
+
+      - name: Rename candidate to release/v{version}
+        if: steps.check.outputs.is_release_pr == 'true'
+        run: |
+          VERSION="v${STEPS_VERSION_OUTPUTS_VERSION}"
+          CANDIDATE_BRANCH="${{ github.event.pull_request.base.ref }}"
+          git push origin "$CANDIDATE_BRANCH:refs/heads/release/$VERSION" ":$CANDIDATE_BRANCH"
+          echo "Renamed $CANDIDATE_BRANCH to release/$VERSION"
+        env:
+          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
+
+      - name: Update PR label to tagged
+        if: steps.check.outputs.is_release_pr == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh pr edit ${{ github.event.pull_request.number }} \
+            --remove-label "autorelease: pending" \
+            --add-label "autorelease: tagged"
+          echo "Updated PR label to autorelease: tagged"