You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Automates Azure DevOps validation for the repository's generated CI-fix pull requests.
Adds strict same-repository gating for the automated fingerprint: github-actions[bot], ci-fix/** head, agentic-workflows label, and the correct title/base pairing for main and net11.0.
Uses trusted pull_request_target execution plus trusted-main workflow_run reconciliation for both fixer workflows, including cases where GitHub-token-created PR events are suppressed or approval-gated. Every configured PR event reconciles live eligible open PR heads rather than relying on stale webhook identities.
Refreshes nominated PRs individually and verifies each test-merge commit contains the refreshed source head as its second parent before queueing or deduplication. Missing, stale, or conflicting merge pairs produce explicit per-PR failures without blocking other verified heads; the overall run remains non-success when eligible work cannot be dispatched. Live eligibility and the head/merge pair are revalidated for each pipeline under the same partial-failure boundary as dedupe and queue operations.
Queues MAUI validation definitions 302 (maui-pr), 313 (maui-pr-uitests), and 314 (maui-pr-devicetests) with the verified PR merge ref/SHA, provider triggerInfo, and serialized system.pullRequest.* parameters matching observed normal Azure PR build payloads. The system parameters include the bare target branch used by pipeline conditions and the source head SHA. PR-head check association remains subject to live canary verification.
Adds per-pipeline/head-SHA deduplication, bounded retries, safe ambiguous-POST reconciliation, explicit partial-failure reporting, summaries, and build links. Nested PowerShell request timeouts enter reconciliation without repeating the POST; failed reconciliation preserves possible-acceptance uncertainty. Deduplication and both fixer instructions require the PR merge ref and exact source-head metadata when matching automatic builds.
Both fixer variants retain primary-pipeline whole-build validation for build-only fixes. When a build break originates in definition 313 or 314, merely observing its exact-head run is insufficient: all relevant originating platform build legs must be completed and successful before marking ready. Missing, unknown, pending, failed, or canceled relevant evidence stops readiness; unrelated test-leg flakes do not. Readiness audit comments identify the validated primary and originating pipeline/build evidence.
A shared seven-minute dispatch budget caps HTTP timeouts and backoff under the ten-minute job limit. Budget exhaustion, including during queue-time revalidation, preserves completed results and explicitly reports unprocessed work without implying those pipelines submitted a queue POST.
Never checks out or executes PR-controlled code; authentication uses the existing main-branch OIDC trust and no PAT.
Updates the CI-fixer descriptions, setup documentation, and compiled gh-aw lock files.
Validation
Completed locally:
73 focused Pester tests passed at d0cf55b, independently rerun, including offline full-script reconciliation, delayed-event regressions, behavioral queue-response coverage, shared-budget exhaustion, and accurate partial-result reporting across multiple PRs. Coverage includes nested timeout exceptions with real duplicate identity matching, outer/nested JSON contract assertions for main and net11.0, stale/malformed merge-parent rejection, refreshed eligibility revocation, actual entrypoint mixed/all-unverifiable failure routing, preservation of completed results after queue-time revalidation failures, and dedupe/fixer source-head contract alignment. The readiness additions assert prompt requirements in both sources; they do not simulate agent execution.
A local stalled-HTTP-server repro confirms actual PowerShell Invoke-RestMethod timeout exceptions are recognized as transient after the fix. No Azure request was made by this repro.
PowerShell parse validation passed.
actionlint passed for the new dispatcher workflow. Direct linting of the generated fixer locks reports the same six pre-existing findings before and after this readiness change; the gh-aw actionlint wrapper returned tooling exit 125, not a clean lint result.
Both gh-aw v0.86.2 strict compile/no-emit checks passed for the readiness follow-up, and both locks were regenerated with zero compiler warnings. This follow-up changes only their body hashes, not workflow configuration.
Dry-run payload validation passed for all three pipeline definitions.
git diff --check passed.
Rollout notes
Merging enables the automation. Only pipeline 302 OIDC queueing has live proof so far. Azure DevOps Basic access and Queue builds permission for all three definitions, plus exact PR-head check association, remain rollout/canary requirements and should be verified after merge. No live build was queued by this PR-creation or review-follow-up work.
Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.
The reason will be displayed to describe this comment to others. Learn more.
GPT-only empirical adversarial review of 820c6531907b - needs changes.
One additional P1 defect is documented inline: the workflow_run reconciliation path crashes before it can queue any validation. I reproduced it using actual public GitHub open-PR JSON and a real completed main-branch fixer payload, replaying only the HTTP response boundary locally with a noncredential placeholder. The full script's workflow_run -DryRun invocation throws Unexpected base repository ''. at line 106, reached through lines 232 and 553. Explicitly enumerating the same response changes one System.Object[] item into three PR objects and lets the scan complete.
Produced the expected merge-ref, merge-SHA and source-head payloads for definitions 302, 313 and 314; no builds queued
Full workflow_run -DryRun path
Reproduced the inline defect
CI evidence: required maui-pr is skipping, and there are no PR builds for definitions 302/313/314. PowerShell Script Tests has three failures, but all three are stale GPT-5.6 model assertions in unchanged base-branch inputs; I reproduced those same three failures locally and verified the relevant files are identical between this PR's base and head. This is not a clean-CI or live-rollout claim: OIDC queue permissions for all three definitions and actual PR-head check association still need a live canary.
The s/agent-review-in-progress label stays on this PR while the run is active. The final recommendation and outcome labels are posted only after Gate, expert review, and Deep UI tests finish.
The s/agent-review-in-progress label stays on this PR while the run is active. The final recommendation and outcome labels are posted only after Gate, expert review, and Deep UI tests finish.
Require originating pipeline run to pass before advancing to T3
.github/workflows/ci-status-fix-net11.md:1220
This gate only checks that the originating UI/device pipeline build exists, then proceeds to T3 even if that matching run is still pending or has failed. A build-only fix for a 313/314 failure can therefore be marked ready without showing that the originating build break is fixed. Require the matching run’s relevant legs to be fully green before proceeding.
Require originating pipeline run to pass before advancing to T3
.github/workflows/ci-status-fix.md:1204
This gate only checks that the originating UI/device pipeline build exists, then proceeds to T3 even if that matching run is still pending or has failed. A build-only fix for a 313/314 failure can therefore be marked ready without showing that the originating build break is fixed. Require the matching run’s relevant legs to be fully green before proceeding.
The s/agent-review-in-progress label stays on this PR while the run is active. The final recommendation and outcome labels are posted only after Gate, expert review, and Deep UI tests finish.
@PureWeen — new AI review results are available based on commit d0cf55b.
🗂️ Review Sessions — click to expand 🚦 Gate — Test Before & After Fix
Gate Result: ⚠️ SKIPPED
No tests were detected in this PR.
Recommendation: Add tests to verify the fix using the write-tests-agent.
📋 Pre-Flight — Context & Validation
⚠️Pre-Flight did not produce output on this run.
The Copilot expert-review task ended before this phase was persisted, usually because the review-stage time budget expired or the CI agent encountered a transient authentication/runtime problem. Earlier completed sections remain valid, but this review is incomplete without this phase.
Next step: re-comment /review to retry on a fresh agent. If this repeats across runs, a maintainer should inspect the reviewer token and Task 3 logs.
🔬 Code Review — Deep Analysis
⚠️Code Review did not produce output on this run.
The Copilot expert-review task ended before this phase was persisted, usually because the review-stage time budget expired or the CI agent encountered a transient authentication/runtime problem. Earlier completed sections remain valid, but this review is incomplete without this phase.
Next step: re-comment /review to retry on a fresh agent. If this repeats across runs, a maintainer should inspect the reviewer token and Task 3 logs.
🛠️ Try-Fix — Analysis & Comparison
⚠️Try-Fix did not produce output on this run.
The Copilot expert-review task ended before this phase was persisted, usually because the review-stage time budget expired or the CI agent encountered a transient authentication/runtime problem. Earlier completed sections remain valid, but this review is incomplete without this phase.
Next step: re-comment /review to retry on a fresh agent. If this repeats across runs, a maintainer should inspect the reviewer token and Task 3 logs.
🏁 Report — Final Recommendation
⚠️Report / Final Recommendation did not produce output on this run.
The Copilot expert-review task ended before this phase was persisted, usually because the review-stage time budget expired or the CI agent encountered a transient authentication/runtime problem. Earlier completed sections remain valid, but this review is incomplete without this phase.
Next step: re-comment /review to retry on a fresh agent. If this repeats across runs, a maintainer should inspect the reviewer token and Task 3 logs.
🧭 Next Steps — review latest findings
No alternative fix was selected for this run. Review the session findings and CI results before merging.
…#39188)
<!-- Please let the below note in for people that find this PR -->
> [!NOTE]
> Are you waiting for the changes in this PR to be merged?
> It would be very helpful if you could [test the resulting
artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from
this PR and let us know in a comment if this change resolves your issue.
Thank you!
<!--
!!!!!!! MAIN IS THE ONLY ACTIVE BRANCH. MAKE SURE THIS PR IS TARGETING
MAIN. !!!!!!!
-->
### Description of Change
<!-- Enter description of the fix in this section -->
Fix a confirmed startup-deadline regression in the CI-fix Azure DevOps
dispatcher introduced by #39147, and correct a separate, pre-existing
producer prompt contradiction that blocks mandatory safe-output
registration.
**Production evidence:** [run
37477952193](https://github.com/dotnet/maui/actions/runs/37477952193)
spent approximately 533 seconds between starting the 420-second deadline
and completing trusted checkout; [run
37485076087](https://github.com/dotnet/maui/actions/runs/37485076087)
spent approximately 494 seconds. Both then failed with `The variable
cannot be validated because the value 0 is not a valid value for the
DispatcherBudgetSeconds variable.`
**Root cause:** The script parameter `[ValidateRange(1,
540)][int]$DispatcherBudgetSeconds` and top-level
`$script:DispatcherBudgetSeconds` are the same validated PowerShell
variable. Clamping valid caller input `420` against an already-expired
absolute deadline assigns `0` to that variable, triggering validation
before explicit budget-exhaustion reporting can run. Extracted helper
tests did not exercise this entrypoint initialization.
**Correction:**
- Store the clamped runtime allowance in the distinct
`EffectiveDispatcherBudgetSeconds` variable and update remaining-budget
helpers and their extracted-test state consistently. Caller budget `0`
remains invalid.
- Fail startup explicitly with `[dispatcher-budget-exhausted]` when
preparation has consumed the deadline, before PR discovery,
authentication, HTTP, or sleep. Write a failed preparation/deadline job
summary and state `No queue POST was attempted.` This also fails rather
than claiming successful no-work reconciliation when the deadline is
expired.
- Limit trusted checkout to the standalone
`/.github/scripts/Queue-CiFixAzdoValidation.ps1` using non-cone sparse
checkout. The existing SHA-pinned checkout v7.0.1 supports exact
patterns and automatically uses `blob:none` for sparse fetches. Preserve
`github.sha`, `fetch-depth: 1`, and `persist-credentials: false`; never
fetch or execute PR code.
- Document preparation behavior and limitations. Keep the absolute
pre-checkout 420-second deadline and ten-minute hard job timeout
unchanged; do not restart or extend either allowance.
**Validation:** Baseline dispatcher suite: 73 passed. Before the script
correction, the six new actual-entrypoint cases produced four expected
expired-deadline failures with the original validation exception and two
passing caller-validation/future-deadline cases. After correction, all
**79 tests passed**, including existing helper/queue regressions.
Expired cases assert the preparation summary, explicit prefix, no-POST
message, and zero HTTP/sleep calls; a native PowerShell process asserts
nonzero exit. The valid future deadline still produces the three
verified offline pipeline payloads.
Exact final commands and results:
```powershell
pwsh -NoProfile -Command '$env:PSModulePath = "/Users/shneuvil/.copilot/session-state/237fbb01-6532-4170-9f5e-6af14fa3a5e0/files/powershell-modules" + [IO.Path]::PathSeparator + $env:PSModulePath; Import-Module Pester -ErrorAction Stop; Invoke-Pester -Path .github/scripts/Queue-CiFixAzdoValidation.Tests.ps1 -Output Normal -CI'
# Passed: 79; failed/skipped: 0. Reused existing Pester; no dependency installation.
pwsh -NoProfile -Command '$files = @(".github/scripts/Queue-CiFixAzdoValidation.ps1", ".github/scripts/Queue-CiFixAzdoValidation.Tests.ps1"); foreach ($file in $files) { $tokens = $null; $errors = $null; [void][System.Management.Automation.Language.Parser]::ParseFile((Join-Path $PWD $file), [ref]$tokens, [ref]$errors); if ($errors.Count) { $errors | ForEach-Object { Write-Error $_ }; exit 1 }; Write-Output "Parse passed: $file" }'
# Passed: both PowerShell files parsed without errors.
```
```bash
actionlint .github/workflows/ci-fix-azdo-validation.yml
# Passed.
git diff --check
# Passed.
```
**Limits:** The sparse-checkout assertion is a static
configuration/trust regression, not a hosted checkout timing
measurement. Production checkout performance remains unproven; checkout
or PowerShell startup exceeding the ten-minute hard guard can still
cancel the job before a summary is written. No live Azure queue
requests, manual workflow dispatches/reruns, `/azp` requests, or
credential/permission/model-policy changes were performed. There is
still no successful eligible-PR Azure canary evidence here; this PR does
not establish Azure permissions or exact-head check linkage for any of
the three pipelines.
**Related producer blocker (pre-existing, not introduced by #39147):**
[main producer run
37464881821](https://github.com/dotnet/maui/actions/runs/37464881821)
and [net11 producer run
37465231994](https://github.com/dotnet/maui/actions/runs/37465231994)
concluded success but emitted `missing_tool` / `report_incomplete`. The
net11 diagnostic explicitly says mandatory expectation registration
requires PowerShell but the run instructions exclude it. The main
diagnostic likewise reports the prompt-specific `no-pwsh` restriction,
alongside separate unavailable cited Azure timeline evidence. This is an
upstream producer blocker: a compliant PR cannot reach dispatcher
validation if required registration is prohibited by its own prompt.
Both producers already allow `pwsh` in `tools.bash`, and Hard Rule 11
requires `Register-CiFixSafeOutputExpectation.ps1` or atomic
validation/registration via `Test-CiFixTransport.ps1`. Their bottom
Environment constraints sections nevertheless said `no pwsh`. The
mirrored correction changes only that prose: explicitly identify `pwsh`
availability for those deterministic helpers, retain `no gh` / `no
python` and `curl` + `jq` API guidance, and reiterate existing
fail-closed registration/transport requirements. No tool allowlists,
network, permissions, credentials, trust, model policy, or output gates
change.
Added two assertions in the existing registration test suite protecting
both producer twins. Both failed on the old contradictory guidance and
pass after correction. Regenerated both locks with retained **gh-aw
v0.86.2**, without manual edits or compiler upgrade; **only `body_hash`
changes**. Frontmatter and all generated lock runtime content remain
identical.
Additional exact validation commands and results:
```powershell
pwsh -NoProfile -Command '$env:PSModulePath = "/Users/shneuvil/.copilot/session-state/237fbb01-6532-4170-9f5e-6af14fa3a5e0/files/powershell-modules" + [IO.Path]::PathSeparator + $env:PSModulePath; Import-Module Pester -ErrorAction Stop; $config = New-PesterConfiguration; $config.Run.Path = @(".github/scripts/Register-CiFixSafeOutputExpectation.Tests.ps1", ".github/scripts/Test-CiFixTransport.Tests.ps1", ".github/scripts/Queue-CiFixAzdoValidation.Tests.ps1"); $config.Run.Exit = $true; $config.Output.Verbosity = "Normal"; $config.TestResult.Enabled = $true; $config.TestResult.OutputPath = "/Users/shneuvil/.copilot/session-state/1e0cc90a-a521-4055-9e7a-9565cdaf5504/files/producer-and-dispatcher-pester-results.xml"; Invoke-Pester -Configuration $config'
# Passed after lock regeneration: 116 tests (6 registration, 31 transport, 79 dispatcher); 0 failed/skipped.
pwsh -NoProfile -Command '$file = Join-Path $PWD ".github/scripts/Register-CiFixSafeOutputExpectation.Tests.ps1"; $tokens = $null; $errors = $null; [void][System.Management.Automation.Language.Parser]::ParseFile($file, [ref]$tokens, [ref]$errors); if ($errors.Count) { $errors | ForEach-Object { Write-Error $_ }; exit 1 }; Write-Output "PowerShell parse passed"'
# Passed.
```
```bash
/Users/shneuvil/.copilot/session-state/237fbb01-6532-4170-9f5e-6af14fa3a5e0/files/tools/gh-aw-0.86.2/darwin-arm64 compile ci-status-fix ci-status-fix-net11 --strict --no-emit --no-check-update
# Passed: 2 workflows, 0 warnings.
/Users/shneuvil/.copilot/session-state/237fbb01-6532-4170-9f5e-6af14fa3a5e0/files/tools/gh-aw-0.86.2/darwin-arm64 compile ci-status-fix ci-status-fix-net11 --strict --no-check-update
# Passed: 2 workflows, 0 warnings; emitted body-hash-only changes.
actionlint .github/workflows/ci-status-fix.lock.yml .github/workflows/ci-status-fix-net11.lock.yml
# Nonzero both before and after regeneration: identical six baseline diagnostics.
# Each twin: concurrency.queue not recognized, ShellCheck SC2129 style, github.aw expression not recognized.
# No new lint findings; baseline/after outputs compared byte-identical.
```
**Producer limits:** These are static prompt/configuration assertions
and offline helper tests, not a hosted agent behavior evaluation.
Removing the contradiction does not guarantee that an agent will
register correctly, find a viable product fix, create a PR, or attach
Azure checks. Separate cited-timeline failures and other producer
blockers are not fixed here. No live workflow or network validation
tests were run.
### Issues Fixed
<!-- Please make sure that there is a bug logged for the issue being
fixed. The bug should describe the problem and how to reproduce it. -->
Follow-up to #39147 for the production startup regression evidenced by
the two linked dispatcher runs, plus the separate pre-existing producer
helper-guidance contradiction evidenced by the two producer runs. No
separate tracking issue is closed by this PR.
<!--
Are you targeting main? All PRs should target the main branch unless
otherwise noted.
-->
---------
Co-authored-by: PureWeen <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 1e0cc90a-a521-4055-9e7a-9565cdaf5504
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
kubaflo
left a comment
github-actions
Bot
added
the
s/agent-review-in-progress
MauiBot
added
s/agent-review-incomplete
Summary
Automates Azure DevOps validation for the repository's generated CI-fix pull requests.
github-actions[bot],ci-fix/**head,agentic-workflowslabel, and the correct title/base pairing formainandnet11.0.pull_request_targetexecution plus trusted-mainworkflow_runreconciliation for both fixer workflows, including cases where GitHub-token-created PR events are suppressed or approval-gated. Every configured PR event reconciles live eligible open PR heads rather than relying on stale webhook identities.maui-pr), 313 (maui-pr-uitests), and 314 (maui-pr-devicetests) with the verified PR merge ref/SHA, providertriggerInfo, and serializedsystem.pullRequest.*parameters matching observed normal Azure PR build payloads. The system parameters include the bare target branch used by pipeline conditions and the source head SHA. PR-head check association remains subject to live canary verification.Validation
Completed locally:
d0cf55b, independently rerun, including offline full-script reconciliation, delayed-event regressions, behavioral queue-response coverage, shared-budget exhaustion, and accurate partial-result reporting across multiple PRs. Coverage includes nested timeout exceptions with real duplicate identity matching, outer/nested JSON contract assertions for main and net11.0, stale/malformed merge-parent rejection, refreshed eligibility revocation, actual entrypoint mixed/all-unverifiable failure routing, preservation of completed results after queue-time revalidation failures, and dedupe/fixer source-head contract alignment. The readiness additions assert prompt requirements in both sources; they do not simulate agent execution.Invoke-RestMethodtimeout exceptions are recognized as transient after the fix. No Azure request was made by this repro.actionlintpassed for the new dispatcher workflow. Direct linting of the generated fixer locks reports the same six pre-existing findings before and after this readiness change; the gh-aw actionlint wrapper returned tooling exit 125, not a clean lint result.git diff --checkpassed.Rollout notes
Merging enables the automation. Only pipeline 302 OIDC queueing has live proof so far. Azure DevOps Basic access and Queue builds permission for all three definitions, plus exact PR-head check association, remain rollout/canary requirements and should be verified after merge. No live build was queued by this PR-creation or review-follow-up work.