ci(scripts): move shared azldev helpers to scripts/components/

The 'compute_changed.sh' and 'compute_render_set.py' helpers are about
to be reused by the GH Actions Check Rendered Specs gate. Move them
out of the CT-only directory and trim CT-specific behavior:

- Drop --publish-dir + trap (callers handle artifact publication).
- Drop ADO ##[group] log markers (callers add their own per-pipeline).
- Drop baked-in AZLDEV_ALLOW_ROOT step-env. azldev calls inside the
  helper retain an inline 'AZLDEV_ALLOW_ROOT=1' prefix per
  .github/instructions/ado-pipeline.instructions.md, so callers do
  not need to lift the restriction at step scope.
- Drop the 'Upload set' jq report (CT-flow specific; moved inline to
  the CT pipeline YAML alongside the artifact-publish wrapper).

CT pipeline call sites are updated to point at the new paths and to
re-wrap the call with the log groups and publish-dir cp that used to
live in the script.

Author: dmcilvaney

.github/workflows/ado/templates/sources-upload-stages.yml

@@ -138,12 +138,34 @@ stages:
           - script: |
               set -euo pipefail
               json_file="$(Build.ArtifactStagingDirectory)/changed-components/changed-components.json"
-              .github/workflows/scripts/control-tower/compute_changed.sh \
+              # Publish the changed-components JSON for post-mortem triage on
+              # EVERY exit path, not just success -- if azldev hard-fails on a
+              # consistency tripwire the partial JSON is exactly what an
+              # operator needs to investigate.
+              publish_artifact() {
+                if [[ -s "$json_file" ]]; then
+                  mkdir -p "$(ob_outputDirectory)/changed-components"
+                  cp "$json_file" "$(ob_outputDirectory)/changed-components/" || true
+                fi
+              }
+              trap publish_artifact EXIT
+
+              echo "##[group]Computing changed components"
+              .github/workflows/scripts/components/compute_changed.sh \
                 --output-file "$json_file" \
-                --publish-dir "$(ob_outputDirectory)" \
                 --source-commit "$(sourceCommit)" \
                 --target-commit "$(targetCommit)"
+              echo "##[endgroup]"
+
+              echo "##[group]Upload set (sourcesChange == true, changeType in {added, changed})"
+              upload_count=$(jq -r '[.[] | select(.sourcesChange == true and (.changeType | IN("added", "changed")))] | length' "$json_file")
+              jq -r '.[] | select(.sourcesChange == true and (.changeType | IN("added", "changed"))) | .component' "$json_file" | sort
+              echo "Total: $upload_count component(s) to upload."
+              echo "##[endgroup]"
+
               echo "##vso[task.setvariable variable=changedComponentsFile;isreadonly=true]$json_file"
+            env:
+              AZLDEV_ALLOW_ROOT: "1"
             displayName: "Compute changed components"
 
           # Render the components that need re-rendering (azldev-flagged plus

.github/workflows/scripts/components/compute_changed.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Compute the set of changed components between source and target commits.
+#
+# Writes one JSON entry per component to <output-file>, with fields:
+#   - component:     name
+#   - changeType:    'added' | 'changed' | 'unchanged' | 'deleted'
+#   - sourcesChange: bool (rendered 'sources' file differs across commits)
+#
+# azldev hard-fails if any component has sourcesChange == true without a
+# corresponding identity change (added/changed/deleted) -- supply-chain
+# drift protection.
+#
+# Callers are responsible for log grouping and artifact publication. If the
+# host runs azldev as root (CI containers), set AZLDEV_ALLOW_ROOT=1 in the
+# environment.
+
+set -euo pipefail
+
+usage() { echo "Usage: $0 --output-file FILE --source-commit SHA --target-commit SHA" >&2; exit 1; }
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --output-file)    output_file="$2"; shift 2 ;;
+    --source-commit)  source_commit="$2"; shift 2 ;;
+    --target-commit)  target_commit="$2"; shift 2 ;;
+    *) usage ;;
+  esac
+done
+[[ -z "${output_file:-}" || -z "${source_commit:-}" || -z "${target_commit:-}" ]] && usage
+
+mkdir -p "$(dirname "$output_file")"
+
+azldev component changed --from "$target_commit" --to "$source_commit" -a --include-unchanged -O json > "$output_file"
+
+echo "Changed components (non-unchanged):"
+jq -r '.[] | select(.changeType != "unchanged") | "  \(.changeType)\t\(.component)"' "$output_file" | sort

…ipts/control-tower/compute_render_set.py …scripts/components/compute_render_set.py.github/workflows/scripts/control-tower/compute_render_set.py renamed to .github/workflows/scripts/components/compute_render_set.py .github/workflows/scripts/control-tower/compute_render_set.py renamed to .github/workflows/scripts/components/compute_render_set.py

@@ -36,7 +36,7 @@ git diff --no-renames --name-only "$target_commit" "$source_commit" -- "$specs_d
 # Render set is the union of:
 #   - components flagged by 'azldev component changed' (inputs differ)
 #   - components whose spec tree was touched directly in the PR
-changed=$(python3 .github/workflows/scripts/control-tower/compute_render_set.py \
+changed=$(python3 .github/workflows/scripts/components/compute_render_set.py \
   --changed-components-file "$changed_components_file" \
   --specs-diff-file "$specs_diff_file" \
   --specs-dir "$specs_dir")