fix(python): derive __version__ from package metadata; align Node version sentinel

[stephentoub]

Summary

The Python SDK was baking in a stale, hardcoded version number. python/copilot/__init__.py had __version__ = "0.1.0" and python/pyproject.toml had version = "0.1.0". The publish workflow only rewrites pyproject.toml at release time (sed 's/^version = .*/...'), so the public runtime __version__ never got updated and permanently reported a stale value regardless of what was actually published.

This PR implements the correct fix and brings the Node SDK in line with the dev-sentinel convention already used by the .NET and Rust SDKs.

Changes

Python (the actual fix)

• __version__ is now derived from the installed package metadata via importlib.metadata.version("github-copilot-sdk"), so it always matches what was installed.
• The fallback (when no package metadata is present, e.g. a raw source checkout) is a 0.0.0.dev0 dev sentinel rather than a real-looking number that would silently go stale again.
• pyproject.toml version is now the 0.0.0.dev0 dev sentinel; CI injects the real version at publish time.

Node (consistency alignment)

• package.json version 0.1.8 → 0.0.0-dev, and the package script's trailing npm version 0.1.0 → 0.0.0-dev.
• scripts/set-version.js default fallback 0.1.0-dev → 0.0.0-dev.
• package-lock.json (root + packages[""]) and samples/package-lock.json (packages[".."]) synced to 0.0.0-dev to keep npm ci happy.

The publish flow is unchanged — CI still injects the real VERSION at publish time; only the committed defaults become unmistakable dev placeholders.

Audit of the other SDKs

No changes needed; they were already correct:

SDK	Version source	Status
.NET	<Version>0.0.0-dev</Version> (set via dotnet pack -p:Version=)	✅ already a dev sentinel
Rust	version = "0.0.0-dev" (set via sed)	✅ already a dev sentinel
Go	tag-based (go/v…), no embedded version	✅ n/a
Java	…-SNAPSHOT, managed by maven-release-plugin	✅ Maven dev convention

Only Python exposed a runtime __version__, and only Node committed a real-looking number — both addressed here.

Validation

• __version__ resolves from installed metadata; fallback returns the sentinel.
• 0.0.0.dev0 is valid PEP 440; 0.0.0-dev is valid semver.
• The publish workflow's sed '^version = .*' still matches exactly one line.
• package.json and all lockfiles agree on 0.0.0-dev; JSON validated.
• ruff check passes on the modified Python file (stdlib import correctly placed for isort).
• No code reads copilot.__version__ and no tests assert on it.

Reviewed by two independent code-review passes (GPT-5.5 and Opus 4.7); the one issue surfaced (stale samples/package-lock.json) is fixed here.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

This PR fixes Python SDK runtime version reporting by deriving copilot.__version__ from installed package metadata, and aligns committed Node SDK development versions with the repo’s dev-sentinel convention.

Changes:

• Python now uses importlib.metadata.version("github-copilot-sdk") with a 0.0.0.dev0 fallback.
• Python pyproject.toml uses a PEP 440 dev sentinel that publish CI can still replace.
• Node package metadata and lockfiles now use 0.0.0-dev consistently.

Show a summary per file

File	Description
python/pyproject.toml	Replaces stale hardcoded project version with Python dev sentinel and explanatory comment.
python/copilot/__init__.py	Derives __version__ from installed package metadata with source-checkout fallback.
nodejs/scripts/set-version.js	Updates default fallback version to Node dev sentinel.
nodejs/package.json	Updates committed package version and package script reset target.
nodejs/package-lock.json	Synchronizes root package lock version entries.
nodejs/samples/package-lock.json	Synchronizes sample lockfile’s parent package version entry.

Copilot's findings

Files not reviewed (2)

• nodejs/package-lock.json: Language not supported
• nodejs/samples/package-lock.json: Language not supported

• Files reviewed: 4/6 changed files
• Comments generated: 0

[github-actions]

Cross-SDK Consistency Review ✅

This PR makes no changes to public API surface — it only updates version sentinel strings in package.json, package-lock.json, pyproject.toml, and __init__.py.

The PR description already includes a thorough audit of all SDK version strategies:

SDK	Status
Python	✅ Fixed — now derives __version__ from installed package metadata
Node.js	✅ Fixed — sentinel aligned to 0.0.0-dev
.NET	✅ Already used 0.0.0-dev sentinel
Rust	✅ Already used 0.0.0-dev sentinel
Go	✅ Tag-based, no embedded version
Java	✅ Uses Maven -SNAPSHOT convention

No cross-SDK consistency concerns. The changes appropriately align Python and Node with the convention already established by the other SDKs.

Generated by SDK Consistency Review Agent for issue #1521 · ● 915.5K · ◷