Add automated namespace approval workflow for spec PRs

.github/namespace-approvers.yml

@@ -0,0 +1,26 @@
+# cspell:words jsquire alzimmermsft xirzec kashifkhan maorleger jhendrixMSFT ArthurMa1978
+# Namespace Approvers Configuration
+# This file defines who can approve namespace changes per language.
+# To update, submit a PR to this file. In the future, this may be
+# synced automatically from ARCHITECTS files in each language repo.
+
+data-plane:
+  dotnet:
+    - jsquire
+    - m-nash
+  java:
+    - JonathanGiles
+    - alzimmermsft
+  python:
+    - xirzec
+    - kashifkhan
+  typescript:
+    - xirzec
+    - maorleger
+  go:
+    - jhendrixMSFT
+
+management-plane:
+  all:
+    - ArthurMa1978
+    - m-nash

.github/namespace-format-rules.yml

@@ -0,0 +1,31 @@
+# Namespace Format Rules
+# These regex patterns validate namespace/package naming conventions per language.
+# Namespaces that fail validation are flagged in the bot comment before manual review.
+#
+# To update: submit a PR modifying the patterns below.
+# Each language can have one rule or multiple rules (array).
+# Each rule has a `pattern` (regex) and optional `description`.
+#
+# Maintainer: @ArthurMa1978
+
+dotnet:
+  pattern: '^Azure\.ResourceManager\.(?:[A-Z][a-zA-Z0-9]*)(?:\.[A-Z][a-zA-Z0-9]*)?$'
+  description: "Azure.ResourceManager.{Name} or Azure.ResourceManager.{SuperService}.{Name} (PascalCase)"
+
+java:
+  - pattern: "^azure-resourcemanager-[a-z0-9]+(?:-[a-z0-9]+)?$"
+    description: "Maven artifact: azure-resourcemanager-{name} (lowercase)"
+  - pattern: '^com\.azure\.resourcemanager\.[a-z0-9]+(?:\.[a-z0-9]+)?$'
+    description: "Java package: com.azure.resourcemanager.{name} (lowercase)"
+
+go:
+  pattern: "^sdk/resourcemanager/(?:[a-z0-9]+)/(?:arm[a-z0-9]+)$"
+  description: "sdk/resourcemanager/{name}/arm{name} (lowercase)"
+
+typescript:
+  pattern: "^@azure/arm-[a-z0-9]+$"
+  description: "@azure/arm-{name} (lowercase)"
+
+python:
+  pattern: "^azure-mgmt-[a-z0-9]+$"
+  description: "azure-mgmt-{name} (lowercase)"

.github/shared/src/changed-files.js

@@ -1,3 +1,3 @@
 import debug from "debug";
 import { simpleGit } from "simple-git";
 import { KeyedCache } from "./cache.js";
@@ -281,6 +281,14 @@
   );
 }
 
+/**
+ * @param {string} file
+ * @returns {boolean}
+ */
+export function tspconfig(file) {
+  return typeof file === "string" && /specification\/.*\/tspconfig\.yaml$/.test(file);
+}
+
 /**
  * @param {string} [file]
  * @returns {boolean}

.github/workflows/namespace-approval-code.yaml

@@ -0,0 +1,41 @@
+name: "Namespace Approval - Analyze Code"
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+
+permissions:
+  contents: read
+
+jobs:
+  detect-namespaces:
+    name: Analyze Code
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
+
+      - name: Setup Node and install dependencies
+        uses: ./.github/actions/setup-node-install-deps
+
+      - name: Detect namespace changes
+        id: detect
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { default: detectNamespaces } =
+              await import('${{ github.workspace }}/.github/workflows/src/namespace-approval/detect-namespaces.js');
+            await detectNamespaces({ github, context, core });
+
+      - name: Upload namespace results
+        if: always() && steps.detect.outputs.results
+        uses: actions/upload-artifact@v7
+        with:
+          name: namespace-results
+          path: ${{ steps.detect.outputs.results_path }}
+          if-no-files-found: ignore

.github/workflows/namespace-approval-status.yaml

@@ -0,0 +1,41 @@
+name: "Namespace Approval - Set Status"
+
+on:
+  workflow_run:
+    workflows: ["Namespace Approval - Analyze Code"]
+    types: [completed]
+
+permissions:
+  actions: read
+  contents: read
+  pull-requests: write
+  statuses: write
+
+jobs:
+  post-results:
+    name: Post Namespace Results
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            .github/
+
+      - name: Install dependencies for github-script actions
+        uses: ./.github/actions/install-deps-github-script
+
+      - name: Post namespace review comment
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { default: postResults } =
+              await import('${{ github.workspace }}/.github/workflows/src/namespace-approval/post-results.js');
+            await postResults({ github, context, core });
+
+      - name: Set namespace approval status
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { default: statusCheck } =
+              await import('${{ github.workspace }}/.github/workflows/src/namespace-approval/status-check.js');
+            await statusCheck({ github, context, core });

.github/workflows/namespace-approval-validation.yaml

@@ -0,0 +1,43 @@
+name: "Namespace Approval - Validate Labels"
+
+on:
+  pull_request_target:
+    types:
+      - labeled
+      - unlabeled
+
+permissions:
+  contents: read
+  pull-requests: write
+  statuses: write
+
+jobs:
+  validate-approval:
+    name: Validate Namespace Approval
+    runs-on: ubuntu-24.04
+    steps:
+      # IMPORTANT: This workflow uses pull_request_target, which runs with repo write permissions.
+      # Only base-branch code is checked out below. Do NOT checkout or run code from the PR head.
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            .github/
+
+      - name: Install dependencies for github-script actions
+        uses: ./.github/actions/install-deps-github-script
+
+      - name: Validate namespace approval label
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { default: validateApproval } =
+              await import('${{ github.workspace }}/.github/workflows/src/namespace-approval/validate-approval.js');
+            await validateApproval({ github, context, core });
+
+      - name: Update namespace approval status
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { default: statusCheck } =
+              await import('${{ github.workspace }}/.github/workflows/src/namespace-approval/status-check.js');
+            await statusCheck({ github, context, core });

.github/workflows/src/namespace-approval/NAMESPACE-REVIEW-PROCESS.md

@@ -0,0 +1,105 @@
+# Namespace Approval Process
+
+## Overview
+
+When a service team adds or modifies SDK namespace configuration in their `tspconfig.yaml`, the namespace must be approved by authorized architects before the spec PR can merge.
+
+This process is automated via GitHub Actions on this repository.
+
+## How It Works
+
+### Detection
+
+When a PR modifies any `tspconfig.yaml` file, the analyze-code workflow:
+
+1. Identifies which languages have namespace/package-name configuration
+2. Extracts namespaces by parsing `tspconfig.yaml` emitter options directly
+3. Determines if the service is data-plane or management-plane (via path and linter config)
+4. For management-plane PRs, validates namespace format against language-specific naming rules (defined in `.github/namespace-format-rules.yml`)
+5. Uploads namespace results for the status workflow
+
+### Status + Approval
+
+The status workflow posts the namespace review comment, applies `<lang>-namespace-pending` labels, and validates architect approval labels.
+
+- **Data plane:** Each language architect approves their language by applying `<lang>-namespace-approved`
+- **Management plane:** ArthurMa1978 or m-nash can apply `namespace-approved-all` to approve all languages at once
+
+### Status Check
+
+A required status check (`Namespace Approval`) blocks merge until all pending namespaces are approved. The check:
+
+- ✅ Passes when all `*-namespace-pending` labels have corresponding `*-namespace-approved` labels
+- ❌ Fails when any pending namespace lacks approval
+- ⏭️ Skipped when the PR doesn't modify tspconfig.yaml (no namespace changes)
+
+### Reset on Change
+
+If a service team pushes a commit that changes namespace configuration, only the **affected languages** are reset:
+
+- Only languages whose namespace actually changed have their `<lang>-namespace-approved` label removed
+- Languages with unchanged namespaces keep their approval
+- The `<lang>-namespace-pending` label is re-applied for reset languages
+- The status check fails again until re-approved
+- The bot comment names which specific languages were reset
+
+## Labels
+
+| Label                       | Applied by       | Meaning                                        |
+| --------------------------- | ---------------- | ---------------------------------------------- |
+| `namespace-review-required` | Bot              | PR has namespaces that need architect approval |
+| `<lang>-namespace-pending`  | Bot              | Namespace detected, awaiting approval          |
+| `<lang>-namespace-approved` | Architect        | Namespace approved for this language           |
+| `namespace-approved-all`    | Architect (mgmt) | Shortcut: approves all pending languages       |
+| `namespace-approved`        | Bot              | All languages approved                         |
+| `Mgmt`                      | Bot              | PR is management plane                         |
+| `data-plane`                | Bot              | PR is data plane                               |
+
+Where `<lang>` is one of: `dotnet`, `java`, `python`, `typescript`, `go`, `rust`
+
+## Authorized Approvers
+
+Defined in [`.github/namespace-approvers.yml`](../../../namespace-approvers.yml):
+
+<!-- cspell:disable -->
+
+| Scope                | Approvers                     |
+| -------------------- | ----------------------------- |
+| .NET                 | @jsquire, @m-nash             |
+| Java                 | @JonathanGiles, @alzimmermsft |
+| Python               | @xirzec, @kashifkhan          |
+| TypeScript           | @xirzec, @maorleger           |
+| Go                   | @jhendrixMSFT                 |
+| Mgmt (all languages) | @ArthurMa1978, @m-nash        |
+
+<!-- cspell:enable -->
+
+## For Service Teams
+
+No action needed beyond your normal workflow:
+
+1. Add or modify namespace in your `tspconfig.yaml`
+2. Open a PR as usual
+3. The bot posts a status table and applies pending labels
+4. Wait for architects to approve
+5. Once approved, the status check passes and the PR can merge
+
+## For Architects
+
+1. Watch for PRs with `<lang>-namespace-pending` labels
+2. Review the proposed namespace in the PR diff
+3. If acceptable, apply `<lang>-namespace-approved` label
+4. For management plane PRs, you can use `namespace-approved-all` to approve all at once
+
+## Configuration
+
+To update approvers, submit a PR modifying `.github/namespace-approvers.yml`. Changes take effect immediately on merge.
+
+## Relationship to API Review
+
+Namespace approval is **separate from API review**:
+
+- **Namespace approval** (this repo): gates spec PR merge, ensures library naming is correct
+- **API review** (azure-sdk repo): reviews API surface design (methods, models, parameters)
+
+A new service typically needs namespace approval first (on their spec PR), then API review later (when SDK is built).