Add branch guard to merge-net11-to-release workflow

[PureWeen]

Problem

The Merge net11.0 to next release workflow silently does nothing when triggered via workflow_dispatch or schedule because both run against main (the default branch). The arcade merge script uses GITHUB_REF_NAME as the config lookup key, finds no "main" entry in github-merge-flow-release-11.jsonc, and exits with "There was no configuration found for main" — but reports success.

Fix

Add if: github.ref_name == 'net11.0' guard to the job so it skips immediately when triggered from the wrong branch, instead of silently succeeding.

For workflow_dispatch: Select net11.0 from the branch dropdown in the GitHub UI before clicking Run.

For schedule: The cron trigger always runs on the default branch (main), so it will be skipped. The workflow on the net11.0 branch (triggered by push) handles the actual merges.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 34797

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 34797"

[Copilot]

Pull request overview

Updates the Merge net11.0 to next release GitHub Actions workflow to prevent it from running (and silently succeeding) when invoked from the default branch, aligning execution with how the arcade merge configuration is selected.

Changes:

• Add a job-level if: github.ref_name == 'net11.0' guard so the reusable merge job only runs when triggered from the net11.0 branch.
• Add inline workflow comments explaining why the workflow must be run from net11.0 and how to select the branch for workflow_dispatch.

[Copilot]

The note about schedule looks inaccurate: scheduled workflows always run using the workflow file from the repository’s default branch, not from net11.0. Consider rewording this comment to reflect that the schedule trigger will run on main and be skipped by the job-level if, while merges are expected to happen via the push trigger on net11.0 (or a workflow_dispatch explicitly run on net11.0).

Suggested change

	# The schedule trigger only works when this file exists on net11.0.
	# Scheduled workflows run from the repository's default branch, so schedule-based
	# runs will execute on main and be skipped by the job-level if below. Expected
	# merge executions come from the push trigger on net11.0 or a workflow_dispatch
	# explicitly run on net11.0.

[kubaflo]

/review -b feature/refactor-copilot-yml

[MauiBot]

Expert Review — 1 findings

See inline comments for details.

[MauiBot]

[major] Workflow behavior — This job-level if makes the scheduled trigger a no-op. GitHub scheduled workflows run from the repository default branch, so github.ref_name will not be net11.0; the daily merge automation will always skip. Either remove the schedule trigger, or implement a default-branch scheduled workflow that dispatches/runs the merge against net11.0 explicitly.

[kubaflo]

IS this PR ready?

[kubaflo]

/review -b feature/enhanced-reviewer -p android

[MauiBot]

Expert Review — 1 findings

See inline comments for details.

[MauiBot]

[major] Build & MSBuild — This job-level guard disables the scheduled merge. GitHub runs scheduled workflows from the repository default branch (main here), so github.ref_name is main on the cron trigger and the only job is skipped. The workflow no longer performs the scheduled net11.0 → release merge; keep the guard scoped to workflow_dispatch/push, or otherwise make the scheduled path invoke Arcade with the net11.0 merge-from branch/config key.

[MauiBot]

AI Review Summary

@PureWeen — new AI review results are available based on this last commit: b7a6a9e.
Add branch guard to merge-net11-to-release workflow To request a fresh review after new comments or commits, comment /review rerun.

Review Sessions — click to expand

Gate — Test Before & After Fix

Gate Result: ⚠️ SKIPPED

No tests were detected in this PR.

Recommendation: Add tests to verify the fix using the write-tests-agent.

---

Pre-Flight — Context & Validation

Issue: unavailable - GitHub CLI is not authenticated in this environment
PR: #34797 - local squashed review branch pr-review-34797
Platforms Affected: workflow/infrastructure (android requested for testing, but no Android code or tests changed)
Files Changed: 1 implementation, 0 test

Key Findings

• PR delta only changes .github/workflows/merge-net11-to-release.yml.
• The PR's current fix adds if: github.ref_name == 'net11.0' to protect the Arcade merge workflow from wrong-branch runs.
• The Arcade reusable workflow reads GITHUB_REF_NAME as the merge-from branch; github-merge-flow-release-11.jsonc only has a net11.0 configuration entry.
• GitHub schedule events run on the default branch, so the new branch guard skips the only job on cron runs.
• Gate was already skipped before this task because no tests were detected in the PR.

Code Review Summary

Verdict: NEEDS_CHANGES
Confidence: high
Errors: 1 | Warnings: 0 | Suggestions: 0

Key code review findings:

• ❌ .github/workflows/merge-net11-to-release.yml:26 — if: github.ref_name == 'net11.0' disables scheduled runs because the schedule event runs from the default branch (main), not net11.0.

Fix Candidates

#	Source	Approach	Test Result	Files Changed	Notes
PR	PR #34797	Add a job-level guard so Arcade only runs when github.ref_name == 'net11.0'	⚠️ Gate skipped; static YAML valid	.github/workflows/merge-net11-to-release.yml	Protects push/manual path but skips scheduled runs

---

Code Review — Deep Analysis

Code Review — PR #34797

Independent Assessment

What this changes: The PR adds documentation and a job-level branch guard to .github/workflows/merge-net11-to-release.yml, allowing the Arcade inter-branch merge reusable workflow to run only when github.ref_name == 'net11.0'.
Inferred motivation: The Arcade reusable workflow reads GITHUB_REF_NAME as the merge-from branch and the repository config only contains a net11.0 merge-flow entry, so runs from other refs cannot find the intended configuration.

Reconciliation with PR Narrative

Author claims: Live PR metadata was unavailable because gh is not authenticated in this environment. Local comments added by the PR claim the workflow must be triggered from net11.0.
Agreement/disagreement: The branch constraint is correct for push and manual dispatch paths, but the same guard disables the scheduled path because GitHub schedule events run on the default branch.

Findings

❌ Error — Scheduled merge is skipped

.github/workflows/merge-net11-to-release.yml:26 adds if: github.ref_name == 'net11.0'. Scheduled GitHub Actions workflows run on the repository default branch (origin/HEAD is origin/main locally), so the 04:00 cron fires with github.ref_name == 'main' and skips the only job. The daily safety-net merge therefore never creates or updates the net11.0 to release merge PR.

Devil's Advocate

If this workflow file is intentionally only expected to run from the net11.0 branch, the guard prevents incorrect manual invocations. However, the workflow still declares a schedule trigger and the comment says schedule exists, so silently skipping scheduled runs is a real behavioral regression unless the schedule trigger is removed or handled separately.

Verdict: NEEDS_CHANGES

Confidence: high
Summary: The PR fixes accidental wrong-branch execution for push/manual runs, but breaks the scheduled safety-net path. A better fix should either remove the nonfunctional schedule explicitly or preserve scheduled runs by invoking Arcade with net11.0 as the merge-from branch.

---

Fix — Analysis & Comparison

Fix Candidates

#	Source	Approach	Test Result	Files Changed	Notes
1	try-fix	Remove the schedule trigger and document push/manual-only behavior	❌ YAML passed, selection failed	1 file	Clearer than a skipped schedule, but loses the daily safety net
2	try-fix	Split scheduled runs into an explicit job that passes net11.0 to Arcade scripts	✅ Static YAML + expert review passed	1 file	Preserves push/manual branch safety and restores scheduled merge behavior
PR	PR #34797	Guard the reusable Arcade job with if: github.ref_name == 'net11.0'	⚠️ Gate skipped; YAML valid; expert review found issue	1 file	Skips scheduled runs from default branch

Cross-Pollination

Model	Round	New Ideas?	Details
maui-expert-reviewer	1	Yes	Found the PR guard disables scheduled runs because schedule events run on the default branch
maui-expert-reviewer	2	No blocking findings	Candidate 2 produced [] reviewer findings

Exhausted: No
Selected Fix: Candidate #2 — It is the first candidate that passes the available validation and is demonstrably better than the PR's current fix because it preserves scheduled net11.0→release merges instead of silently skipping them.

Validation Notes

• Gate verification was not re-run per instruction; prior gate result was skipped because no tests were detected.
• Available local validation: Ruby YAML parse of .github/workflows/merge-net11-to-release.yml.
• Live PR metadata and GitHub Actions execution were unavailable because gh is not authenticated in this environment.
• EstablishBrokenBaseline.ps1 could not be used for this workflow-only PR because it excludes .github/* from fix-file detection; each candidate was restored manually after capture.

---

Report — Final Recommendation

Comparative Report — PR #34797

Candidates compared

Rank	Candidate	Result	Rationale
1	pr-plus-reviewer	✅ Winner	Applies the expert reviewer's actionable feedback to the PR approach: push/manual runs remain guarded to net11.0, while scheduled runs use an explicit job that passes net11.0 to Arcade. This preserves the daily merge safety net and matches the successful STEP 5a try-fix-2 behavior.
2	try-fix-2	✅ Passed available validation	Functionally equivalent to pr-plus-reviewer: static YAML passed and expert review produced []. Ranked just below pr-plus-reviewer because the latter is the same fix framed as direct reviewer feedback on the PR candidate.
3	try-fix-1	❌ Failed selection criteria	Removes the schedule trigger entirely. This is clearer than a scheduled run that silently skips, but it loses the daily merge safety net and was marked failed in STEP 5a.
4	pr	❌ Expert review failed	The raw PR adds if: github.ref_name == 'net11.0' to the only job. That protects wrong-branch push/manual runs, but scheduled GitHub Actions runs execute from the default branch, so the cron path skips the only job and no scheduled merge occurs.

Regression-test ordering

No regression tests were detected for this workflow-only PR, and the gate was skipped by instruction. STEP 5a's available validation still matters: try-fix-2 passed static YAML and expert review, while try-fix-1 failed selection criteria and the raw pr candidate failed expert review. No candidate that failed validation is ranked above a passing candidate.

Winner

pr-plus-reviewer is the single winning candidate. It keeps the useful part of the PR fix, addresses the expert reviewer's major finding, and preserves scheduled net11.0 to release merges by avoiding Arcade's GITHUB_REF_NAME dependency on schedule events.

---

Future Action — review latest findings

No alternative fix was selected for this run. Review the session findings and CI results before merging.

[kubaflo]

🤖 Multi-model code review — Request changes

Three models reviewed this PR independently (Claude Opus 4.8, GPT-5.5, Gemini 3.1 Pro), then reconciled in a cross-pollination round. This is an automated review summary; treat it as input, not a gate.

Verdict: ❌ Request changes — the change is safe and an improvement, but it introduces one factually incorrect comment that should be fixed.

What's good

The if: github.ref_name == 'net11.0' guard is a net safety improvement: it replaces Arcade's prior silent no-op on main (the merge script found no main entry in github-merge-flow-release-11.jsonc and exited "successfully" without merging) with an explicit, visible skip, while still allowing the intended paths — push to net11.0 and workflow_dispatch from net11.0. CI is clean.

Required change — the line-7 comment is incorrect

# The schedule trigger only works when this file exists on net11.0.

This is wrong and contradicts the PR description. GitHub Actions runs schedule events only from the repository's default branch (main); the file existing on net11.0 is irrelevant. The cron fires from main (github.ref_name == 'main') and is skipped by the new guard — exactly as your PR description correctly states. Please align the in-file comment with the (accurate) PR body. See inline on line 7.

Suggestion (non-blocking) — the now-inert schedule: trigger

With the guard in place, the daily cron is provably inert (always runs as main → skipped), surfacing as a perpetual green "skipped" run that reads like active automation. Consider removing the schedule: trigger, or — if periodic merges are actually desired — adding a small default-branch trampoline that workflow_dispatches with ref: net11.0. See inline on line 26.

_{Independent verdicts: Opus 4.8 — NEEDS_CHANGES (high) · GPT-5.5 — NEEDS_CHANGES (high) · Gemini 3.1 Pro — NEEDS_DISCUSSION (high). After cross-pollination: see consensus above.}

[kubaflo]

⚠️ This new comment is factually incorrect and contradicts this PR's own description. GitHub Actions runs schedule events only from the repository's default branch (main) — the workflow existing on net11.0 is irrelevant to whether the cron fires. What actually happens: the cron fires from main with github.ref_name == 'main', so the new guard skips it. The PR description states this correctly ("The cron trigger always runs on the default branch (main), so it will be skipped"). Please align this comment with that, e.g. "The schedule fires from the default branch (main) and is intentionally skipped by the guard; real merges run via the push trigger on the net11.0 copy of this workflow."

[kubaflo]

💡 Net positive: this guard replaces Arcade's prior silent no-op on main with an explicit skip, and correctly allows the intended paths (push to net11.0, workflow_dispatch from net11.0). One follow-up: with the guard in place the daily schedule: cron is now provably inert (it always runs as main and skips), which shows up as a perpetual green "skipped" run that looks like active automation. Consider either removing the schedule: trigger, or — if periodic merges are actually wanted — adding a tiny default-branch trampoline job that workflow_dispatches this workflow with ref: net11.0. Not blocking.

[kubaflo]

🔍 AI-generated — automated review by GitHub Copilot CLI, on behalf of @kubaflo.

Review: looks good ●

No conflicts. The branch guard is correct: if: github.ref_name == 'net11.0' ensures the arcade inter‑branch‑merge job only runs when triggered from net11.0, which matches how GITHUB_REF_NAME is used as the config lookup key. The added comments clearly document the workflow_dispatch branch‑selection requirement.

Mergeable; just pending checks/approval. No issues found.