chore: move master to v1.9 and shift release window to release/v1.8

[Behzad Mirkhanzadeh (behzad-mir)]

Reason for Change:

v1.8.13 was released from master on 2026-09-11, so master now opens the v1.9 line and release/v1.8 becomes the maintained N-1 branch.

• scheduled-release.yaml — next-version prefix v1.8 → v1.9. The 14:00 cron, workflow_dispatch default, concurrency group and RELEASE_BRANCH now target release/v1.8. release/v1.7 stays selectable for manual dispatch so it can still be patched on demand.
• dependabot.yaml — adds release/v1.8 entries (docker, gomod /, gomod /azure-ipam), mirroring the existing release/v1.7 blocks.
• go-version-check.yaml — Go upgrade backport target release/v1.7 → release/v1.8.

Why k8s.io/* is capped at <0.37.0 on release/v1.8

master is currently on k8s.io v0.36.4, and AKS 1.36 is the newest GA version (GA'd 2026-06-19, also LTS). Holding release/v1.8 at 0.36.x keeps it aligned with that GA line, exactly as release/v1.7 is held at 0.34.x for AKS 1.34. AKS 1.37 is public preview only (live in 2 of 77 regions as of 2026-09-14, GA planned Oct 2026), so it is not a supportable target for this branch yet. github.com/Azure/azure-container-networking is capped at <1.9.0 for azure-ipam on the same reasoning.

Issue Fixed:

N/A — release process maintenance.

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:

Important

This PR should not merge until release/v1.8 exists, otherwise the 14:00 Friday cron will target a missing branch.

Creating release/v1.8 currently requires an admin — it is blocked by a repository ruleset:

GH013: Repository rule violations found for refs/heads/release/v1.8
- This branch must not contain merge commits.
  Found 1 violation: 1eb5a8038bd0f35505e9af9213ef94d324d2b1a7

1eb5a8038 is a merge commit from 2021 (PR #1033). Ruleset require-pr (ID 1422884) applies required_linear_history to refs/heads/release/* with no bypass actors, and creating a new ref makes the entire history "new" to it, so the rule trips. release/v1.7 contains the same commit, so the rule postdates that branch. Both git push and the REST refs API are rejected.

Suggested sequence for an admin:

1. Set ruleset 1422884 enforcement to evaluate (or add a temporary bypass actor).
2. Create the branch at the v1.8.13 commit — which is also current master head:

   git push origin c25aba4e71e4d7b1e3f9143187e7d4f253220da2:refs/heads/release/v1.8
   

3. Restore ruleset 1422884 enforcement to active.
4. Add refs/heads/release/v1.8 to ruleset 1122967 (require-merge-queue), which currently lists only release/v1.5, release/v1.6, release/v1.7.

Because this will block every future release branch cut from master (v1.9, v2.0, …), consider removing required_linear_history from the release/* condition permanently.

Follow-up not included here: release/v1.6 is still in dependabot.yaml. Whether to drop it now that the window has shifted is a support-policy call, so this PR leaves v1.6 and v1.7 untouched.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The v1.9 release path lacks first-tag handling, and related dependency and backport configuration updates remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates release automation to open the v1.9 line on master and maintain release/v1.8.

Changes:

• Retargets scheduled releases to release/v1.8 with v1.9 versioning.
• Retargets Go upgrade backports to release/v1.8.
• Adds Dependabot policies for release/v1.8.

File summaries

File	Summary
.github/workflows/scheduled-release.yaml	Updates release schedules and version prefixes.
.github/workflows/go-version-check.yaml	Retargets Go backport automation.
.github/dependabot.yaml	Adds v1.8 dependency update rules.

Review details

Suppressed comments (1)

.github/workflows/scheduled-release.yaml:740

• The same no-seed-tag failure is duplicated in the actual tag-creation job: with no merged v1.9.x tag, this next-version --version-prefix v1.9 invocation errors before any tag is created (tools/release/internal/version/version.go:115-120,155-171). Please make the first v1.9 release resolvable before switching this job to the new prefix.

            VERSION_PREFIX="--version-prefix v1.9"

• Files reviewed: 3/3 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.