Fix Skill Validation results comment: define missing agentCount + harden comment posting

[PureWeen]

Note

Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!

The bug

The Skill Validation workflow's Post results comment job was failing on its Post comment step with:

ReferenceError: agentCount is not defined
    at eval (... actions/github-script/v7 ...)
##[error]Unhandled error: ReferenceError: agentCount is not defined

The github-script step builds a badge array that references agentCount:

badge('Skills', String(skillCount), '8250df'),
badge('Agents', String(agentCount), '0969da'),   // ❌ agentCount never defined/produced

…but agentCount was never defined in the script and never produced as an artifact, whereas skillCount is defined (reads static-results/skill-count.txt). The script threw while constructing the comment body — before any API call — so the results comment was never posted.

This was introduced on 2026-06-16 in commit 1c0c0eb200 (#35713, "Style skill validation results comment") and has silently broken the results comment on every Skill Validation run since.

It is a real, deterministic workflow bug — not a permissions issue (the job already has pull-requests: write + issues: write) and not a merge/close race (the failure is a JS ReferenceError, not a 403).

The fix

Self-contained to .github/workflows/skill-validation.yml:

1. Producer — In the existing Save results artifact step (the one that writes skill-count.txt/spec-count.txt), add an agent count written to agent-count.txt in the same sv-results/ dir, flowing through the same static-check-results upload/download wiring:

   agent_count=$(find .github/agents -mindepth 1 -maxdepth 1 -name '*.md' -type f 2>/dev/null | wc -l | tr -d ' ')
   echo "$agent_count" > sv-results/agent-count.txt

2. Definition — In the Post comment github-script step, define agentCount mirroring skillCount/specCount exactly (read static-results/agent-count.txt inside a try/catch that falls back to '?'), placed alongside the existing definitions so it's in scope before the badge array.
3. Hardening — Wrap the badge + body construction in a try/catch. On any failure it logs via console.error and core.warning (no silent swallowing) and posts a minimal plain-text fallback body (keeping the <!-- skill-validation-results --> marker so the upsert still finds/updates the comment). The results comment now always posts even if the badge formatting breaks.

Validation

• YAML parses (yaml.safe_load).
• agentCount is defined (script line ~898) before its only use in the badge array (line ~1178).
• The embedded github-script JS passes node --check (balanced braces / valid scope) when wrapped in an async function (it uses top-level await, which github-script permits).

The embedded JS can't be executed locally (depends on the github/context/core runtime), so dynamic behavior wasn't run; logic was reviewed by hand.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 36003

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 36003"

[PureWeen]

Adversarial multi-model review — PR #36003

Methodology: 3 independent reviewers (different model families) with adversarial consensus, run over 2 rounds (find → fix → re-review until clean). Code-only review; CI status is out of scope.

Round 1 — 1 finding (fixed)

⚠️ Config Impact — agent_count would always be 0 in CI. The new producer counts *.md under .github/agents, but the static-check job's sparse-checkout only materialized .github/skills and .github/plugin.json, so the directory was never checked out and the new Agents badge would silently misreport 0.
Consensus: 2/3 reviewers (the third's edge-case note corroborated the mechanism). Verified against source.
Resolved in 85cbf3a by adding .github/agents to that job's sparse-checkout (only static-check produces the count, so the other jobs' checkouts were intentionally left unchanged).

Round 2 — clean

✅ 3/3 reviewers: no remaining issues. Re-verified end-to-end:

• agentCount is defined (mirroring skillCount/specCount) and in scope before its badge use; not shadowed.
• Producer→consumer artifact wiring intact: sv-results/agent-count.txt → static-check-results → static-results/agent-count.txt.
• try/catch hardening is correct: let body; is assigned on both paths; content/authorLine/badges stay scoped inside the try; the fallback uses only pre-computed values (marker, statuses, headSha7, runUrl) so it can't rethrow, and preserves the marker so the upsert still updates (not duplicates) the comment.
• Errors are logged (console.error + core.warning), not swallowed.
• .github/agents holds 6 markdown files → badge now reads a meaningful count.
• Under pull_request_target, the file count is attacker-influenceable but purely cosmetic — find | wc -l never reads/executes file content, and the new log lines emit only an integer/JS-error string (no secret exposure).

Test coverage: No automated tests exercise this workflow (standard for CI YAML); the embedded github-script was validated locally via yaml.safe_load + node --check. The next Skill Validation run on a PR is the real-world check.

Prior reviews: none.

Verdict posted as a comment (not approve/request-changes) — approval remains a human decision.

[kubaflo]

Note

🤖 This review was automatically generated by a multi-model AI review system (Claude Opus 4.8, GPT-5.5, Gemini 3.1 Pro). Three models independently reviewed the code, then cross-pollinated their findings to produce this consolidated review.

Multi-Model Review — PR #36003 Round 1

Verdict: ✅ LGTM (Unanimous: Opus, GPT, Gemini)
Confidence: High

Summary

Perfect unanimous approval across all three models. This PR correctly fixes a real ReferenceError with clean, low-risk code that mirrors proven patterns. No bugs, no security issues, no disagreements during cross-pollination.

What This PR Fixes

Problem: The skill-validation workflow comment was crashing with:

ReferenceError: agentCount is not defined

The code called badge('Agents', String(agentCount), ...) but never declared agentCount, so the comment posting failed.

Root Cause Confirmed (All 3 Reviewers):

• agentCount variable was missing
• Producer (static-check job) writes agent-count.txt but consumer never reads it
• Sparse-checkout includes .github/agents directory, so the count is valid

Verification (All 3 Reviewers Agreed)

✅ Exactly one declaration — const agentCount at line 899, no redeclaration SyntaxError
✅ Artifact path correct — sv-results/agent-count.txt → static-check-results artifact → static-results/ directory
✅ Safe fallback — Mirrors proven skillCount pattern with '?' fallback
✅ Catch block cannot re-throw — Uses only variables declared before the try block
✅ Fallback preserves marker — Upsert logic still works if count read fails
✅ YAML valid — No syntax errors

Independent Triangulation

All three models reviewed independently and reached the same conclusion:

• Opus: LGTM (1 optional suggestion about agent count glob pattern — verified as correct by GPT)
• GPT: LGTM (confirmed glob matches repository conventions, including non-.agent.md files)
• Gemini: LGTM (verified fix resolves ReferenceError and error handling is safe)

Cross-Pollination Notes

• Zero disagreements — All findings aligned
• Glob pattern confirmed correct — Two reviewers independently verified the broad *.md glob is intentional (counts maui-expert-reviewer.md which doesn't use .agent.md suffix)
• Failing check explained — GPT noted the currently-failing CI run uses the old pull_request_target base workflow, so the failure doesn't invalidate this PR
• Defense-in-depth validated — Catch block can't re-throw because it only uses variables declared before the try

The fix is correct, complete, and low-risk. Ready for merge.