Automate stable release dependency finalization

.ci/scripts/wheel/test_clean_install.py

@@ -71,15 +71,29 @@ def test_release_pytorch_requirement() -> None:
         os.environ.get("GITHUB_BASE_REF", ""),
         os.environ.get("GITHUB_REF", ""),
     )
-    release_ci = any(
+    release_tag_ci = any(
+        re.fullmatch(r"refs/tags/v\d+\.\d+\.\d+", ref) for ref in ci_refs
+    )
+    release_ci = release_tag_ci or any(
         ref.startswith("release/")
-        or re.fullmatch(r"refs/tags/v\d+\.\d+\.\d+(?:-rc\d+)?", ref)
+        or re.fullmatch(r"refs/tags/v\d+\.\d+\.\d+-rc\d+", ref)
         for ref in ci_refs
     )
     assert not release_ci or config["RELEASE_WHEEL"], (
         "this wheel is being built from a release ref, but torch_pin.py does not enable "
         "release metadata; run scripts/release/apply-release-changes.sh"
     )
+    dependencies_finalized = config.get("RELEASE_DEPENDENCIES_FINALIZED") is True
+    assert not release_tag_ci or dependencies_finalized, (
+        "this wheel is being built from a release tag, but stable dependencies were not "
+        "finalized; run scripts/release/finalize_release.py before tagging"
+    )
+    assert not dependencies_finalized or re.fullmatch(
+        r"\d+\.\d+\.\d+", config["TORCH_VERSION"]
+    ), (
+        "release dependencies are marked finalized, but TORCH_VERSION is not a final "
+        f"PyTorch release: {config['TORCH_VERSION']}"
+    )
     torch_requirements = [
         Requirement(raw)
         for raw in metadata.requires("executorch") or []

.github/workflows/lint.yml

@@ -51,11 +51,12 @@ jobs:
           TORCH_VERSION=$(python -c "from torch_pin import TORCH_VERSION; print(TORCH_VERSION)")
           TORCHVISION_VERSION=$(python -c "from torch_pin import TORCHVISION_VERSION; print(TORCHVISION_VERSION)")
           TORCHAUDIO_VERSION=$(python -c "from torch_pin import TORCHAUDIO_VERSION; print(TORCHAUDIO_VERSION)")
+          TORCH_INDEX=$(python -c "from torch_pin import RELEASE_WHEEL, RELEASE_DEPENDENCIES_FINALIZED; print('https://download.pytorch.org/whl/test/cpu' if RELEASE_WHEEL and not RELEASE_DEPENDENCIES_FINALIZED else 'https://download.pytorch.org/whl/cpu')")
           pip install \
             "torch==${TORCH_VERSION}" \
             "torchvision==${TORCHVISION_VERSION}" \
             "torchaudio==${TORCHAUDIO_VERSION}" \
-            --index-url "https://download.pytorch.org/whl/test/cpu"
+            --index-url "${TORCH_INDEX}"
           pip install lintrunner==0.12.7 lintrunner-adapters==0.14.1
           pip install -r requirements-lintrunner.txt
           USE_CPP=0 pip install --no-build-isolation third-party/ao
@@ -108,7 +109,9 @@ jobs:
           lintrunner init
 
       - name: Test release preparation
-        run: python scripts/release/test_prepare_release.py
+        run: |
+          python scripts/release/test_prepare_release.py
+          python scripts/release/test_finalize_release.py
 
       - name: Validate release configuration
         if: startsWith(github.ref_name, 'release/') || startsWith(github.base_ref, 'release/')

scripts/release/apply-release-changes.sh

@@ -51,3 +51,5 @@ fi
 "${PYTHON_EXECUTABLE}" "${GIT_TOP_DIR}/scripts/release/prepare_release.py" "${PREPARE_ARGS[@]}"
 
 echo "Release changes are ready for review. This script does not commit or push them."
+echo "When stable dependency artifacts are published, run:"
+echo "   python scripts/release/finalize_release.py"