Skip to content

[automated] Merge branch 'main' => 'net11.0'#35464

Open
github-actions[bot] wants to merge 6 commits into
net11.0from
merge/main-to-net11.0
Open

[automated] Merge branch 'main' => 'net11.0'#35464
github-actions[bot] wants to merge 6 commits into
net11.0from
merge/main-to-net11.0

Conversation

@github-actions
Copy link
Copy Markdown
Contributor

I detected changes in the main branch which have not been merged yet to net11.0. I'm a robot and am configured to help you automatically keep net11.0 up to date, so I've opened this PR.

This PR merges commits made on main by the following committers:

  • JanKrivanek
  • davidortinau
  • PureWeen

Instructions for merging from UI

This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, not a squash or rebase commit.

merge button instructions

If this repo does not allow creating merge commits from the GitHub UI, use command line instructions.

Instructions for merging via command line

Run these commands to merge this pull request from the command line.

git fetch
git checkout main
git pull --ff-only
git checkout net11.0
git pull --ff-only
git merge --no-ff main

# If there are merge conflicts, resolve them and then run git merge --continue to complete the merge
# Pushing the changes to the PR branch will re-trigger PR validation.
git push https://github.com/dotnet/maui HEAD:merge/main-to-net11.0
or if you are using SSH
git push git@github.com:dotnet/maui HEAD:merge/main-to-net11.0

After PR checks are complete push the branch

git push

Instructions for resolving conflicts

⚠️ If there are merge conflicts, you will need to resolve them manually before merging. You can do this using GitHub or using the command line.

Instructions for updating this pull request

Contributors to this repo have permission update this pull request by pushing to the branch 'merge/main-to-net11.0'. This can be done to resolve conflicts or make other changes to this pull request before it is merged.
The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote.

git fetch
git checkout -b merge/main-to-net11.0 origin/net11.0
git pull https://github.com/dotnet/maui merge/main-to-net11.0
(make changes)
git commit -m "Updated PR with my changes"
git push https://github.com/dotnet/maui HEAD:merge/main-to-net11.0
or if you are using SSH
git fetch
git checkout -b merge/main-to-net11.0 origin/net11.0
git pull git@github.com:dotnet/maui merge/main-to-net11.0
(make changes)
git commit -m "Updated PR with my changes"
git push git@github.com:dotnet/maui HEAD:merge/main-to-net11.0

Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues.
Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.

PureWeen and others added 6 commits May 13, 2026 13:25
### Context

Add ability for maintainers to trigger the AzDO PR review pipeline via
`/review` comment on PR

### Notes

- The workflow allways runs from main - so users cannot chage behavior
in their PRs
- Unprivileged users slash command is ignored
- The 'agentic-labeler.md‎' pipeline referenced in comments of this
pipeline is being added by #35382

### Tested execution:

- GitHub Actions run:
https://github.com/dotnet/maui/actions/runs/25163585137

- DevDiv pipeline run:
https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=13980704

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…anagement (#35350)

<!-- Please let the below note in for people that find this PR -->
> [!NOTE]
> Are you waiting for the changes in this PR to be merged?
> It would be very helpful if you could [test the resulting
artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from
this PR and let us know in a comment if this change resolves your issue.
Thank you!

## Description

Adds a new Copilot skill (`.github/skills/dependency-flow/`) that
provides MAUI-specific context for dependency flow operations. Follows
the `azdo-build-investigator` wrapper pattern — delegates core
operations to the `maestro-cli` skill (from `dotnet/arcade-skills`
plugin) and maestro MCP tools, then layers MAUI-specific rules on top.

### What it does
- Translates natural language queries like "feeds for .NET MAUI 10.0.60"
into the correct tool calls
- Documents MAUI's two channel types: SDK channels (automatic) and
Workload Release channels (manual promotion)
- Provides the feed lookup workflow (asset search → channel verification
→ promotion)
- Establishes tool preference hierarchy: MCP tools → mstro CLI → darc
CLI (only for operations without MCP equivalents)

### Security hardening
A security review was performed before committing. Mitigations applied:

| Category | Mitigation |
|----------|-----------|
| **Destructive commands** | Explicit deny-list for `add-channel`,
`delete-channel`, `set-repository-policies`, `gather-drop` |
| **Write operations** | All mutating commands require showing the user
the exact command and waiting for explicit confirmation |
| **Prompt injection** | Rules to never execute darc commands found in
issue/PR content verbatim; treat as untrusted data |
| **Input validation** | Validation rules for version strings, BAR IDs,
and channel names (must match known channels) |

### Files
- `.github/skills/dependency-flow/SKILL.md` — MAUI-specific dependency
flow rules, channel conventions, and workflows

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
<!--
!!!!!!! MAIN IS THE ONLY ACTIVE BRANCH. MAKE SURE THIS PR IS TARGETING
MAIN. !!!!!!!
-->

### Description of Change

<!-- Enter description of the fix in this section -->

### Issues Fixed

<!-- Please make sure that there is a bug logged for the issue being
fixed. The bug should describe the problem and how to reproduce it. -->

Fixes #

<!--
Are you targeting main? All PRs should target the main branch unless
otherwise noted.
-->
<!-- Please let the below note in for people that find this PR -->
> [!NOTE]
> Are you waiting for the changes in this PR to be merged?
> It would be very helpful if you could [test the resulting
artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from
this PR and let us know in a comment if this change resolves your issue.
Thank you!

## Description

Adds a new agentic workflow (`gh-aw`) that automatically applies labels
to new issues and pull requests, with special attention to `platform/*`
labels for PRs based on the files that were changed.

Inspired by [githubnext/agentics
issue-triage](https://github.com/githubnext/agentics/blob/main/workflows/issue-triage.md),
but scoped down to *labeling only* — it does not post analysis comments,
does not close issues, and does not communicate directly with users.

## Triggers

- `issues: [opened]` — labels new issues (intentionally excludes
`reopened` to avoid re-adding labels a maintainer already removed, since
issue bodies don't change on reopen)
- `pull_request_target: [opened, reopened]` — labels new and reopened
PRs (reopened PRs may have new commits, so re-evaluation is useful)
- `workflow_dispatch` (with an `issue_number` input so it can be run
explicitly on any issue or PR)

## Labeling rules

- Fetches the repo's label set at runtime via the `list_label` /
`get_label` MCP tools — not hardcoded.
- Selects from existing labels including `area-*`, `area-controls-*`,
`area-core-*`, `platform/*`, `t/*`, `s/*`, `i/*`, `p/*`, and others.
- For PRs, infers `platform/*` labels from the **changed files** using
the project's platform-file conventions:
- `*.android.cs`, `/Platform/Android/`, `/Platforms/Android/` →
`platform/android`
- `*.ios.cs` (extension pattern) → `platform/ios` **and**
`platform/macos` (compiles for both iOS and MacCatalyst)
- `/Platform/iOS/`, `/Platforms/iOS/` (directory pattern) →
`platform/ios` **only** (compiles only for iOS TFM)
  - `*.maccatalyst.cs`, `/Platform/MacCatalyst/` → `platform/macos` only
  - `*.windows.cs`, `/Platform/Windows/` → `platform/windows`
  - `*.tizen.cs`, `/Tizen/` → `platform/tizen`
- Conservative by default: if nothing clearly applies, the agent calls
`noop` instead. One `add_labels` call allowed per run (`max: 1`).

## Security model

- **Read-only agent** — permissions are `contents: read`, `issues:
read`, `pull-requests: read`. The agent runs inside a sandboxed
container with no write credentials.
- **Safe-output writes** — label application happens in a separate
safe-output job with write permissions, capped at 1 call.
- **`roles: all`** — allows community contributors' issues/PRs to be
labeled. Safe because the agent is read-only and the only write surface
is `add_labels`.
- **`min-integrity: none`** — allows the MCP gateway to return content
from all authors (including first-time contributors), so the agent can
read the body it needs to label.
- **Prompt-injection guardrails** — explicit instructions telling the
agent to ignore labeling instructions in issue/PR bodies, never use an
`item_number` from untrusted text, and derive labels only from technical
content and file paths.
- **Noise suppression** — `noop`, `missing-tool`, `report-incomplete`,
and `report-failure` are all configured to not create tracker issues.

## Files

- `.github/workflows/agentic-labeler.md` — the agentic workflow source
- `.github/workflows/agentic-labeler.lock.yml` — compiled GitHub Actions
YAML (generated by `gh aw compile`, v0.68.3)

## Notes for reviewers

- This is consistent with the other `gh-aw` workflows in the repo
(`ci-doctor`, `copilot-evaluate-tests`, `daily-repo-status`).
- Draft because we may want to validate behavior on a few real
issues/PRs (via `workflow_dispatch`) before enabling on every new
issue/PR.

---------

Co-authored-by: Shane Neuville <shneuvil@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reset patterns:
- global.json
- NuGet.config
- eng/Version.Details.xml
- eng/Versions.props
- eng/common/*
PureWeen added a commit that referenced this pull request May 18, 2026
Multi-model review (3 independent reviewers w/ gh-aw-guide context) found:

1. (2/3) Stale doc rationale on roles: all comment — implied agent has no
   filesystem access, but checkout: false was removed in 33a15f1 so
   the agent CAN read workspace files. Real protection is the gh-aw
   restore_base_github_folders.sh step that restores .github/ from the
   base branch AFTER the PR-branch checkout. Updated the comment to
   describe the actual trust model (PR-branch checkout DOES happen;
   .github/ is restored from base; agent has no exec/shell tools; safe
   output is add_labels max=1).

2. (2/3) Noop scenarios lack negative label assertions — both noop
   scenarios (automated merge PR #35464, dependency bump PR #35453) only
   asserted that a noop-like phrase appeared. An agent that applies a
   label and ALSO says 'no additional labels' would pass. Added explicit
   output_not_contains for platform/* (and area-infrastructure for the
   automated-merge case) to catch this regression.

3. (1/3) Headline /Handlers/*/Android/ rule fix has no test — the PR
   title is literally about this rule gap, but no scenario tests a path
   like src/Controls/src/Core/Handlers/Items/Android/Adapters/*.cs (no
   .android.cs extension). Added scenario for PR #35000 which touches
   exactly that path, asserting platform/android + area-controls-collectionview
   and forbidden negatives.

4. (1/3) SKILL.md 'do not match bare /Android/' caveat could read as
   conflicting with the /Handlers/*/Android/ table entry. Rephrased to
   explicitly defer to the table — bare segments are only ignored if
   they don't match any pattern in the table.

Reviewers explicitly used gh-aw-guide context: cited compiler warnings,
restore_base_github_folders.sh, --add-dir GITHUB_WORKSPACE, lock.yml
internals, safe-outputs max enforcement. Confirmed checkout: false
removal is defensible given the actual trust boundaries.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@kubaflo
Copy link
Copy Markdown
Contributor

kubaflo commented May 24, 2026

/review -b feature/refactor-copilot-yml

Copy link
Copy Markdown
Collaborator

@MauiBot MauiBot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Automated review — alternative fix proposed

The expert-reviewer evaluation compared the PR fix against #3 automatically generated candidates and selected try-fix-3 as the strongest fix.

Why: try-fix-3 wins because it directly addresses the Android device-test TFM regression and has the strongest available validation: static checks plus an Android Cake dry-run resolving net11.0-android. It is preferred over the hardcoded try-fix-2 because deriving the Cake fallback from global.json is less likely to drift on future branch-forward merges.

Please consider applying the candidate diff below (or use it as guidance). Once you push an update, this workflow will re-trigger and re-evaluate.

Candidate diff (`try-fix-3`)
diff --git a/eng/devices/devices-shared.cake b/eng/devices/devices-shared.cake
index b0f02a9299..9b3b4b5d20 100644
--- a/eng/devices/devices-shared.cake
+++ b/eng/devices/devices-shared.cake
@@ -1,8 +1,22 @@
 //This assumes that this is always running from a mac with global workloads
 const string DotnetToolPathDefault = "/usr/local/share/dotnet/dotnet";
-string DotnetVersion = Argument("targetFrameworkVersion", EnvironmentVariable("TARGET_FRAMEWORK_VERSION") ?? "net10.0");
+string DotnetVersion = Argument("targetFrameworkVersion", EnvironmentVariable("TARGET_FRAMEWORK_VERSION") ?? GetDefaultTargetFrameworkVersion());
 const string TestFramework = "net472";
 
+string GetDefaultTargetFrameworkVersion()
+{
+	var globalJsonPath = MakeAbsolute(File("./global.json"));
+	if (FileExists(globalJsonPath))
+	{
+		var globalJson = System.IO.File.ReadAllText(globalJsonPath.FullPath);
+		var versionMatch = System.Text.RegularExpressions.Regex.Match(globalJson, @"""version""\s*:\s*""(?<major>\d+)\.");
+		if (versionMatch.Success)
+			return $"net{versionMatch.Groups["major"].Value}.0";
+	}
+
+	return "net11.0";
+}
+
 // Map project types to specific subdirectories under artifacts
 var projectMappings = new Dictionary<string, string>
 {
diff --git a/eng/pipelines/ci-device-tests.yml b/eng/pipelines/ci-device-tests.yml
index 6dd405b3f5..5ca8c20875 100644
--- a/eng/pipelines/ci-device-tests.yml
+++ b/eng/pipelines/ci-device-tests.yml
@@ -104,7 +104,7 @@ parameters:
 - name: targetFrameworkVersions
   type: object
   default:
-  - tfm: net10.0
+  - tfm: net11.0
 
 stages:
 - ${{ each targetFrameworkVersion in parameters.targetFrameworkVersions }}:

@MauiBot MauiBot added s/agent-review-incomplete s/agent-fix-win AI found a better alternative fix than the PR s/agent-reviewed PR was reviewed by AI agent workflow (full 4-phase review) labels May 24, 2026
@MauiBot
Copy link
Copy Markdown
Collaborator

MauiBot commented May 24, 2026

🤖 AI Summary

👋 @github-actions[bot] — new AI review results are available. Please review the latest session below.

📊 Review Session56ab44e · Reset files to net11.0 · 2026-05-24 15:17 UTC
🚦 Gate — Test Before & After Fix

Gate Result: ⚠️ SKIPPED

No tests were detected in this PR.

Recommendation: Add tests to verify the fix using the write-tests-agent.


🧪 UI Tests

No UI test categories needed for this PR (no UI-relevant changes).


🔍 Regression Cross-Reference

🟢 No implementation files modified — skipping regression cross-reference.


🔍 Pre-Flight — Context & Validation

Issue: N/A - Automated main -> net11.0 merge; no linked issue found
PR: #35464 - [automated] Merge branch 'main' => 'net11.0'
Platforms Affected: android, iOS, build/CI infrastructure
Files Changed: 65 implementation/infrastructure, 0 test

Key Findings

  • PR is an automated branch-forward merge from main into net11.0; there is no issue-specific reproduction and the gate result was skipped because no tests were detected.
  • Expert code review found branch-regression candidates, including Android/device-test TFM defaults reverting to net10.0 on a net11.0 branch.
  • Existing CI status is not green: Build Analysis and overall maui-pr report failures.

Code Review Summary

Verdict: NEEDS_CHANGES
Confidence: high
Errors: 3 | Warnings: 1 | Suggestions: 0

Key code review findings:

  • eng/devices/devices-shared.cake:3 and eng/pipelines/ci-device-tests.yml:107 default device tests to net10.0, so Android/device test lanes can target the wrong TFM on net11.0.
  • src/Controls/src/Build.Tasks/SetPropertiesVisitor.cs:141 and src/Controls/src/SourceGen/Visitors/SetPropertiesVisitor.cs:145 check SkipProperties.Contains(propertyName) when propertyName is empty for implicit content properties.
  • src/BlazorWebView/src/Maui/iOS/IOSWebViewManager.cs:269 removed the null guard before requestUrl.ToString(), risking an exception before decisionHandler.
  • ⚠️ eng/common/templates-official/variables/sdl-variables.yml:5 no longer matches the SDL Guardian version pinned in eng/common/sdl/packages.config.

Fix Candidates

# Source Approach Test Result Files Changed Notes
PR PR #35464 Automated merge from main into net11.0 ⚠️ SKIPPED (Gate: no tests detected) 65 files Original PR; code review found regressions requiring changes

🔬 Code Review — Deep Analysis

Code Review — PR #35464

Independent Assessment

What this changes: Merges recent main changes into net11.0, including workflows, build infra, XAML/build-task code, iOS WebView code, samples/templates, and dependency-flow/labeler automation.
Inferred motivation: Keep net11.0 current with main.

Reconciliation with PR Narrative

Author claims: Automated main -> net11.0 merge.
Agreement/disagreement: Matches, but several branch-specific net11.0 fixes appear regressed.

Findings

❌ Error — Device tests target net10 on net11 branch

eng/devices/devices-shared.cake:3 and eng/pipelines/ci-device-tests.yml:107 change defaults from net11.0 to net10.0, so net11 device-test lanes can build/run the wrong TFM.

❌ Error — Implicit content-property skip check uses wrong name

src/Controls/src/Build.Tasks/SetPropertiesVisitor.cs:141 checks SkipProperties.Contains(propertyName) while propertyName is XmlName.Empty; it should use computed name. Same regression in SourceGen at src/Controls/src/SourceGen/Visitors/SetPropertiesVisitor.cs:145.

❌ Error — iOS WebView navigation null guard removed

src/BlazorWebView/src/Maui/iOS/IOSWebViewManager.cs:269 now calls requestUrl.ToString() without the previous null guard/cancel path, risking an exception before decisionHandler.

⚠️ Warning — SDL Guardian version mismatch

eng/common/templates-official/variables/sdl-variables.yml:5 sets 0.109.0, while eng/common/sdl/packages.config pins 0.199.0; comment says they must stay in sync.

Devil's Advocate

This is an automated merge, so many changes are expected. However, the flagged issues are concrete regressions against the PR base, not stylistic concerns. CI is also failing (Build Analysis, maui-pr).

Verdict: NEEDS_CHANGES

Confidence: high
Summary: Found verified regressions on modified lines. Inline findings were written to CustomAgentLogsTmp/PRState/35464/PRAgent/inline-findings.json; no GitHub comments were posted.


🔧 Fix — Analysis & Comparison

Fix Candidates

# Source Approach Test Result Files Changed Notes
1 try-fix Use computed implicit content-property name for XAML SkipProperties checks ⚠️ BLOCKED 2 files Targets expert-review XAML error; dotnet test blocked by missing .NET 11 runtime assembly in local Arcade task load
2 try-fix Restore explicit net11.0 defaults for Android/device-test CI ⚠️ BLOCKED (static pass) 2 files Simple branch fix; static net10.0 check passed, YAML/device execution blocked
3 try-fix Derive Cake fallback TFM from global.json, keep CI matrix at net11.0 ⚠️ BLOCKED (static + dry-run pass) 2 files Best available candidate: Android Cake dry-run reported net11.0-android and avoids future stale fallback drift
PR PR #35464 Automated merge from main into net11.0 ⚠️ SKIPPED (Gate) 65 files Gate skipped: no tests detected; code review found regressions

Cross-Pollination

Model Round New Ideas? Details
code-review + maui-expert-reviewer 1 Yes Identified three independent regression areas: device-test TFM, XAML implicit content-property skip checks, iOS WebView null guard
try-fix loop 2 Yes Failure from try-fix-1 shifted focus to Android-relevant device-test TFM candidates because local XAML validation is blocked by SDK/runtime mismatch
try-fix loop 3 Yes try-fix-2's hardcoded net11.0 fix led to try-fix-3's more robust global.json-derived Cake fallback
try-fix loop 4 No Further Android-relevant alternatives would be trivial variants of explicit TFM, dynamic TFM, or failing fast on missing TFM; no additional meaningfully different approach was identified

Exhausted: Yes
Selected Fix: Candidate #3 (conditional) — best validated Android-relevant alternative because static checks passed and dotnet cake eng/devices/android.cake --dryrun --target=buildOnly --targetFrameworkVersion=net11.0 reported Build Target Framework: net11.0-android. It is not a full PASS because Android device execution was unavailable and the pre-run gate detected no tests.


📋 Report — Final Recommendation

Comparative Report — PR #35464

Candidates compared

Rank Candidate Result evidence Assessment
1 try-fix-3 ⚠️ BLOCKED, but static check and Android Cake dry-run passed (Build Target Framework: net11.0-android) Best Android-relevant candidate. It fixes the stale device-test TFM default by deriving the Cake fallback from global.json, while keeping the CI matrix at net11.0, reducing future branch-forward drift.
2 try-fix-2 ⚠️ BLOCKED, static checks passed Also fixes the Android/device-test TFM regression, but hardcodes net11.0 in Cake, making it more likely to regress on a future branch-forward merge.
3 pr-plus-reviewer ⚠️ SKIPPED/BLOCKED for runtime validation; sandbox patch passed diff check Improves the PR's WebView UI-test retry helper based on expert reviewer feedback. It does not address the Android TFM regression identified by the try-fix phase, so it is less suitable for the Android-focused comparison.
4 try-fix-1 ⚠️ BLOCKED by missing local .NET 11 runtime assembly before tests executed Likely addresses the XAML implicit content-property skip-check finding, but it is not Android-focused and had no executed regression coverage.
5 pr ⚠️ SKIPPED — gate found no tests Raw PR leaves the try-fix phase's Android TFM concern unaddressed and has no regression-test evidence.

No candidate had a completed failing regression-test result. Under the required rule, any candidate with a failed regression test would rank below passing candidates; here the distinction is blocked/skipped validation quality and Android relevance.

Winner

try-fix-3 is the winning candidate. It has the strongest Android-specific evidence among the candidates: static checks remove the stale net10.0 defaults from the relevant device-test files, and the Android Cake dry-run resolves the build target as net11.0-android. It is also more robust than try-fix-2 because the Cake fallback follows global.json instead of remaining a branch-stale literal.


Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

s/agent-fix-win AI found a better alternative fix than the PR s/agent-reviewed PR was reviewed by AI agent workflow (full 4-phase review)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants