chore(deps): pin Azure SDK majors and stamp AgentOps version into generated workflows

[placerda]

Problem

Two layers of version fragility just bit us live during PO's tutorial recording:

1. pyproject.toml declares every Azure SDK with only a lower bound (e.g. azure-ai-projects>=2.0.1). When azure-ai-projects major-bumped to 2.x, the agent-definition serialization shape changed (_copy_definition started returning {"_data": {...}} instead of a flat dict), which produced invalid_payload — Required properties ["kind"] are not present in the middle of PO's video recording. The runtime fix shipped in v0.3.2 (fix(prompt_deploy): normalize Foundry definition to dict for SDK 2.x compatibility #216), but the underlying dependency-pinning gap remains: nothing stops azure-ai-projects 3.x from doing the exact same thing tomorrow.

2. Generated CI/CD templates install agentops-accelerator[...] @ git+https://github.com/Azure/agentops.git@main with no version pin. Two users who run agentops workflow generate six months apart get workflow files that pull different agentops snapshots on every CI run — non-reproducible by construction. The templates even carry stale # NOTE: pinned to GitHub main until the next package release comments from when the feature first landed.

Solution

pyproject.toml — pin runtime dependencies to current major

Every Azure SDK dependency now caps at the next major. Same for the other ecosystem deps that have a history of breaking changes (pandas, fastapi, uvicorn, httpx, markdown). cryptography is intentionally left unbounded so security patches flow through without an AgentOps release.

-  "azure-ai-projects>=2.0.1",
+  "azure-ai-projects>=2.0.1,<3.0",
   ...
-  "azure-ai-evaluation>=1.0",
+  "azure-ai-evaluation>=1.0,<2.0",
   ...

The dev dependency-group declaration of azure-ai-evaluation was bumped to match.

agentops workflow generate — pin generated workflows to the installed agentops version

New helper in services/cicd.py:

def _agentops_install_spec(version: str | None = None) -> str:
    """Return the pip version-spec suffix used in generated workflows."""
    if version is None:
        from agentops import __version__ as version
    from packaging.version import InvalidVersion, Version
    try:
        parsed = Version(version)
    except InvalidVersion:
        return AGENTOPS_DEV_INSTALL_SPEC  # " @ git+...@main"
    if parsed.local is not None or parsed.is_devrelease:
        return AGENTOPS_DEV_INSTALL_SPEC
    return f"=={version}"

A new template substitution __AGENTOPS_INSTALL_SPEC__ is wired into generate_cicd_workflows and applied to every GitHub Actions + Azure DevOps template install line (26 install lines across 20 template files). Per the rubber-duck pass, this uses PEP 440 parsing via packaging.version.Version (transitive of pip), not a hand-rolled \d+\.\d+\.\d+ regex — so legitimate .postN / rcN releases also pin correctly.

End-to-end effect:

Install context	What ends up in generated workflows
AgentOps installed from PyPI (0.3.3)	pip install "agentops-accelerator[...]==0.3.3"
Editable install (0.3.4.dev1+gabcdef)	pip install "agentops-accelerator[...] @ git+...@main" (unchanged dev fallback)

Stale # NOTE: pinned to GitHub main until the next package release comments were removed from 5 templates — they no longer apply.

Scope of changes

• pyproject.toml — upper bounds.
• src/agentops/services/cicd.py — helper + substitution wiring.
• 10 × src/agentops/templates/workflows/*.yml.
• 10 × src/agentops/templates/pipelines/azuredevops/*.yml.
• tests/unit/test_cicd.py — 5 new regression tests.
• CHANGELOG.md — [Unreleased] → Changed.

Skill files / agent.yaml / Dockerfile / agent-server README are not touched — they are human-facing install guidance (not generated workflow files), and @main is intentional for "install latest dev" guidance there.

Tests

$ python -m pytest tests/ -x -q
813 passed, 1 skipped in 50.52s

Net delta: +5 tests vs the v0.3.2 baseline (808).

New tests:

• test_agentops_install_spec_pins_clean_release — 0.3.2 → ==0.3.2.
• test_agentops_install_spec_pins_post_and_rc_releases — 0.3.2.post1, 0.4.0rc1 → pin.
• test_agentops_install_spec_falls_back_for_dev_or_local_installs — 0.3.3.dev1, 0.3.2+gabcdef, 0.0.0-dev → @main.
• test_workflow_install_lines_pin_to_release_version — end-to-end render under a forced clean version asserts no git+...@main and no orphan __AGENTOPS_INSTALL_SPEC__ in any of 8 generated files (GitHub + Azure DevOps).
• test_workflow_install_lines_fall_back_to_main_for_dev_installs — end-to-end render under the dev fallback asserts the @main install spec is present.

Migration notes

Existing user workflows (already-generated files in user repos like placerda/agentops-prompt-quickstart) are not retroactively rewritten by this PR. Users opt in by re-running agentops workflow generate --force against any AgentOps release ≥ this one. Per rubber-duck guidance, no agentops workflow update-pins CLI command is added — the manual re-run is enough for now.

Not in scope

Set aside per rubber-duck (revisit if real demand emerges):

• Full generated constraints.txt for transitive-dep reproducibility.
• New agentops workflow update-pins CLI command.
• Full toolchain reproducibility (pinned uv / Python patch / action SHAs).
• Dependabot configuration for routine upper-bound lifts — should be a separate ops change.

Rubber-duck

Plan critiqued before implementation. All blocking findings adopted:

• ✅ Apply substitution to Azure DevOps pipelines as well (not just GitHub workflows).
• ✅ Fix the f"=={version}" typo from the original sketch → f"=={version}".
• ✅ Use packaging.version.Version instead of a \d+\.\d+\.\d+ regex so .postN / rcN releases pin.
• ✅ Update all 5 stale NOTE comments.
• ✅ cryptography left unbounded (security-patch sensitive).