Localize ADMX Group Policy strings via Touchdown

[benhillis]

Adds the WSL ADMX policy strings to the nightly Touchdown localization pipeline so translated .adml files are produced for every locale already covered by Resources.resw. Translated files land at intune/<locale>/WSL.adml, matching the Group Policy on-disk layout (the language-neutral WSL.admx stays at intune/WSL.admx).

Changes

• intune/en-US/WSL.adml — new baseline ADML file. Each translatable string is annotated with {Locked="..."} XML comments so translators preserve product names (Windows Subsystem for Linux, WSL, WSL1, WSL2, Store WSL), .wslconfig keys (wsl2.kernel, wsl2.systemDistro, wsl2.kernelCommandLine, wsl2.nestedVirtualization, wsl2.kernelDebugPort, wsl2.networkingMode, wsl2.firewall), command names (wsl.exe, debug-shell, mount), networking-mode enum values (None, NAT, Mirrored, VirtioProxy), and the policy state literal Disabled.
• .pipelines/wsl-build-nightly-localization.yml — adds intune/en-US/WSL.adml to the trigger paths and to the TouchdownBuildTask resourceFilePath block. The combined ;O:intune\ mapping puts translated files at intune/<locale>/WSL.adml.
• tools/devops/validate-localization.py — adds validate_adml() enforcing the same locked-token invariant as .resw (every {Locked="X"} token must appear verbatim in its target string value), id parity for both <stringTable> and <presentationTable> between baseline and translated files, and a <!-- ... --> based comment scan for locked tokens (since ElementTree drops comments). All CLI args are now --option form with module-level defaults (RESOURCE_FOLDER, BASELINE_LANGUAGE='en-US', ADML_FOLDER='intune'); the CI fast path runs zero-arg with no pip install click dependency. Local overrides use the click flag form.
• .pipelines/build-stage.yml — invokes the validator with no args (was localization/strings en-US); the script now sources both folders and the baseline language from its module-level defaults.
• tools/devops/create-change.py — includes untracked files in the Changed files: report and stages them with git add -A (via repo.git.add(A=True)) before commit. Without this, Touchdown's first-time ADML outputs would land as untracked files in newly created intune/<locale>/ directories and be silently dropped by git commit -a, which only stages modifications and deletions of already-tracked files.

Verification

Manually queued wsl-github-localization against this branch (ADO build 146781281). Touchdown returned WSL.adml translations for 20 locales (cs-CZ, da-DK, de-DE, en-GB, es-ES, fi-FI, fr-FR, hu-HU, it-IT, ja-JP, ko-KR, nb-NO, nl-NL, pl-PL, pt-BR, pt-PT, ru-RU, sv-SE, tr-TR, zh-CN, zh-TW) and saved them to disk at intune/<locale>/WSL.adml. A subsequent run with the create-change.py fix in this branch will produce a follow-up auto-PR containing those .adml files alongside the usual .resw updates. Validator was sanity-tested zero-arg under both Windows and WSL Linux (case-sensitive FS): 22 resw locales + ADML baseline pass; injecting bogus locked tokens or removing strings/presentations from a fake locale correctly fails with exit 1.

Note: depends on no other PR. The unrelated nightly-pipeline target-branch fix that surfaced during this debugging is in #40510.

[Copilot]

Pull request overview

Integrates WSL’s ADMX/ADML Group Policy strings into the Touchdown localization pipeline so that translated .adml files are generated nightly and validated alongside existing .resw localization assets.

Changes:

• Adds an en-US ADML baseline and wires it into the nightly Touchdown localization pipeline output mapping.
• Extends validate-localization.py to validate ADML locked-token invariants and string-id parity across locales, and updates CI invocation accordingly.
• Updates the auto-PR creation script to stage newly created files (e.g., first-time intune/<locale>/WSL.adml outputs) before committing.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/devops/validate-localization.py	Adds ADML parsing + validation and updates CLI/argv handling to accept an ADML folder parameter.
tools/devops/create-change.py	Stages all changes (including untracked files) before committing so new localized outputs aren’t dropped.
intune/en-US/WSL.adml	Introduces the en-US ADML baseline with {Locked="..."} annotations for translators.
.pipelines/wsl-build-nightly-localization.yml	Adds the ADML baseline to Touchdown inputs and output mapping into intune/<locale>/.
.pipelines/build-stage.yml	Passes the ADML folder to localization validation in CI.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[JohnMcPMS]

My python isn't great but it seems like it should work generally if it is running now.