CI: Creating release tag should trigger stable pipeline

Author: edvilme

azure-pipelines/README.md

@@ -1,5 +1,5 @@
 pre-release.yml: This should build from the `main` branch and publish to the Azure Pipeline feed. This will be consumed by extensions that are also doing pre-release builds. Signing is required on this build.
 
-stable.yml: This should build from the `release/*` branch and publish to the Azure Pipeline feed. This will be consumed by extensions when publishing stable builds. Signing is required on this build.
+stable.yml: This builds tags matching `release/<year>.<build>`, where `<year>` is four digits and `<build>` is numeric, and publishes to the Azure Pipeline feed. The pipeline is triggered when a matching tag is pushed to GitHub. This will be consumed by extensions when publishing stable builds. Signing is required on this build.
 
 playground.yml: This pipeline is for engineering/testing purposes so we can do fixes and tests without affecting the pipeline feeds. This will not publish to the Azure Pipeline feed. Signing is not required on this build.

azure-pipelines/stable.yml

@@ -1,6 +1,11 @@
-trigger: none
+trigger:
+  branches:
+    exclude:
+      - "*"
+  tags:
+    include:
+      - "release/*"
 pr: none
-# Should only ever be manually run.
 
 resources:
   repositories:
@@ -45,5 +50,11 @@ extends:
         target: x86_64-pc-windows-msvc
 
     preBuildSteps:
+      - pwsh: |
+          if ("$(Build.SourceBranch)" -notmatch '^refs/tags/release/\d{4}\.\d+$') {
+            Write-Error "Stable release tag must match release/<year>.<build>, where <year> is four digits and <build> is numeric."
+            exit 1
+          }
+        displayName: "Validate stable release tag"
       - pwsh: Rename-Item -Path "./.cargo/config.toml.disabled" -NewName "config.toml"
         displayName: "Enable Azure Build config for Rust"