feat(outdated): support monorepo tag nameing convention

[kevinbeier-enbw]

What

apm outdated and apm marketplace outdated now understand monorepo-style git tags like my-package_v1.0.1, not only v1.0.0.

Why

Repos that tag per package often use package_v1.0.0. Before this change, APM treated those refs as branch names, so outdated showed unknown instead of a real Latest / Status.

Idea is when you have a monorepo with multiple apm's

examples/monorepo-multi-apm/
├── README.md
├── TAGGING.md
├── apm.yml                      # marketplace index (apm1 + apm2)
└── packages/
    ├── apm1/
    │   ├── apm.yml
    │   └── .apm/skills/hello/SKILL.md
    └── apm2/
        ├── apm.yml
        └── .apm/skills/hello/SKILL.md

Note

We use _v (e.g. api-governance_v1.0.2), not @, because @ is already used for marketplace installs (apm install pkg@my-marketplace). If any other prefered standard is wanted, this can be changed.

[kevinbeier-enbw]

@microsoft-github-policy-service agree company="EnBW"

[Copilot]

Copilot wasn't able to review any files in this pull request.

[danielmeppiel]

APM Review Panel: ship_now

Monorepo tag support for outdated commands ships clean after the shepherd fold.

cc @kevinbeier-enbw @danielmeppiel @sergio-sisternes-epam -- a fresh advisory pass is ready for your review.

All active panelists returned zero findings after the shepherd fold in acf9306d. The change is bounded, tested with an integration path for marketplace monorepo tag inference, and documented in both the public CLI reference and the shipped apm-guide command resource. No specialist disagreements remain. Strategically this strengthens APM's monorepo story: per-package version tags now participate in stale-dependency reporting without creating a new command surface.

Dissent. No dissent. Auth panel inactive as expected because no auth surface was touched.

Aligned with: portability by manifest: monorepo users get accurate staleness detection per package without special configuration; pragmatic as npm: the existing outdated workflow learns the common tag layouts instead of adding a new command.

Growth signal. This is a useful release-note hook: apm outdated now understands common monorepo per-package tags.

Panel summary

Persona	B	R	N	Takeaway
Python Architect	0	0	0	Clean extraction of monorepo tag logic into tag_pattern module; fallback diagnostics and docs/tests are folded.
CLI Logging Expert	0	0	0	No user-facing output regressions; fallback inference now has debug breadcrumbs.
DevX UX Expert	0	0	0	Monorepo tag support is well-motivated; the shipped command guide and docs are now in sync.
Supply Chain Security Expert	0	0	0	No security-relevant surface touched; tag inference remains informational.
OSS Growth Hacker	0	0	0	Monorepo tag support removes an adoption blocker and is now visible in reference docs.
Doc Writer	0	0	0	Outdated and marketplace docs now accurately describe patterned-tag detection.
Test Coverage Expert	0	0	0	Unit coverage is thorough; integration coverage now exercises marketplace outdated monorepo tag inference.

B = blocking-severity findings, R = recommended, N = nits.
Counts are signal strength, not gates. The maintainer ships.

Reservations carried from strategic-alignment

• PR changes CLI behavior for apm outdated name/version/tag support -- addressed by folded docs in packages/apm-guide/.apm/skills/apm-usage/commands.md and public reference docs.
• Ensure required CI checks run green on the merge commit -- local validation is green; GitHub Actions workflows are awaiting maintainer approval to run on the fork.

Folded in this run

• (panel) Synced apm-guide command docs for apm outdated and apm marketplace outdated -- resolved in acf9306d.
• (panel) Added marketplace outdated integration coverage for {name}_v{version} monorepo tags -- resolved in acf9306d.
• (panel) Aligned default outdated tag detection with documented {name}--v{version} layout -- resolved in acf9306d.
• (panel) Added fallback inference diagnostics and clarified public docs -- resolved in acf9306d.

Copilot signals reviewed

• Copilot review 4372079457 -- NOT-LEGIT: bot reported it could not review any files and provided no actionable inline finding.

Regression-trap evidence (mutation-break gate)

• tests/integration/marketplace/test_outdated_integration.py::TestOutdatedVersionRanges::test_name_underscore_tags_are_inferred_end_to_end -- deleted _collect(inferred) fallback; test FAILED as expected; guard restored.

Lint contract

uv run --extra dev ruff check src/ tests/ and
uv run --extra dev ruff format --check src/ tests/ both passed after rebase onto origin/main.

CI

Local targeted tests passed: 85 passed. GitHub check rollup currently reports license/cla success; CI, Merge Gate, CodeQL, Deploy Docs, Spec conformance, and NOTICE Drift Check are action_required because the fork workflow runs need maintainer approval.

Mergeability status

Captured from gh pr view 1504 --json mergeable,mergeStateStatus,statusCheckRollup after the last push of this run.

PR	head SHA	CEO stance	iters	folds	defers	Copilot rounds	CI	mergeable	mergeStateStatus	notes
#1504	acf9306	ship_now	1	4	0	1	red	MERGEABLE	BLOCKED	awaiting workflow approval

Recommendation

Advisory panel recommends ship after maintainer approval runs the pending workflows and the protected checks report green.

---

_{This panel is advisory. It does not block merge. Re-apply the panel-review label after addressing feedback to re-run.}