Fix release-readiness tracker warnings: filter cross-repo PR cross-references and drop invalid authorAssociation gh field

[PureWeen]

Note

Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!

Problem

The [Release Readiness] tracker issues were rendering gh warnings embedded in their bodies, two distinct root causes:

1. Cross-repo timeline cross-references (e.g. SR8 tracker #35876). Get-IssueTimelinePrs walked a regression issue's cross-referenced timeline events and collected the source PR number without checking which repository the PR lives in. Real examples found live:

• regression [Android] MissingMethodException AccessibilityNodeInfoCompat.set_Checked(bool) on 10.0.70 due to AndroidX.Core 1.17 breaking change #35584 ← PR What does MAUI offer to easen the process of drawing custom controls #102 in zhollis21/AniSprinkles (an unrelated personal app)
• regression [Android] Native RenderThread crash (SIGSEGV, GLFunctorDrawable / SkSurface::getCanvas null) with multiple auto-sizing WebViews on a navigated page — 10.0.70 #35771 ← PR [Spec] Microsoft.Extensions.Hosting and/or Microsoft.Extensions.DependencyInjection #24 in praveenkumarkarunanithi/maui (a fork)

Looked up against dotnet/maui these 404 (gh pr view 24 ... Could not resolve to a PullRequest), and the warning gets written into the tracker issue. Worse, a foreign PR whose number happens to exist in dotnet/maui (e.g. #877 from DIPSAS/DIPS.Mobile.UI) silently mis-matches an unrelated dotnet/maui PR as a "fix candidate" with no warning at all.

2. Invalid gh pr list field (e.g. SR9 tracker #35867). Get-CandidatePrChecks requested gh pr list --json number,title,author,authorAssociation,updatedAt,url, but authorAssociation is not a valid gh pr list projection field (it's REST-only). The whole query failed (Unknown JSON field: "authorAssociation"), surfacing a warning and silently degrading the maintainer spoof-gate.

Fix

• Get-IssueTimelinePrs: drop any cross-reference whose repository.full_name ≠ the target repo. The timeline API populates repository.full_name for same-repo references too, so legitimate dotnet/maui fix PRs are preserved. This fixes both the noisy 404 warnings and the silent wrong-repo mis-matches.
• Get-CandidatePrChecks: remove authorAssociation from the gh pr list projection and fetch author_association per title-matched candidate via gh api repos/{repo}/pulls/{n} (cheap — candidate matches are almost always 0–1). Fail closed: an unreadable association excludes the PR so a Candidate-titled spoof can't slip through.

Tests

Adds 8 deterministic, offline (gh-stubbed) regression assertions: cross-repo timeline filtering (keeps same-repo, drops foreign #24/#102 and non-PR events; foreign-only → 0 candidates) and the REST author-association spoof-gate (MEMBER accepted, CONTRIBUTOR excluded, spoof-only reports exclusion). Offline suite: 492 passed / 0 failed.

Scope check: the sibling Preview engine (Get-PreviewReadiness.ps1) has neither code path, so no change is needed there.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 36029

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 36029"

[github-actions]

Skill Validation Results

@PureWeen — new skill validation results are available based on this last commit: 1a5a2c0.
To request a fresh validation after new comments or commits, comment /evaluate-skills.

✅ Skill Validation Results — 1a5a2c0 · Fix release-readiness tracker warnings: filter cross-repo PR cross-references and drop invalid authorAssociation gh field · 2026-06-19T18:45:14Z

✅ Static Checks Passed

Skills: 20 | Eval specs linted: 7

Full lint output

── .github/skills/agentic-labeler/tests/eval.vally.yaml
npm warn deprecated prebuild-install@7.1.3: No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
✔ .github/skills/agentic-labeler/tests/eval.vally.yaml is valid
── .github/skills/code-review/tests/eval.capability.vally.yaml
✔ .github/skills/code-review/tests/eval.capability.vally.yaml is valid
── .github/skills/code-review/tests/eval.vally.yaml
✔ .github/skills/code-review/tests/eval.vally.yaml is valid
── .github/skills/code-review/tests/hermeticity.vally.yaml
✔ .github/skills/code-review/tests/hermeticity.vally.yaml is valid
── .github/skills/evaluate-pr-tests/tests/eval.vally.yaml
✔ .github/skills/evaluate-pr-tests/tests/eval.vally.yaml is valid
── .github/skills/try-fix/tests/eval.vally.yaml
✔ .github/skills/try-fix/tests/eval.vally.yaml is valid
── .github/skills/verify-tests-fail-without-fix/tests/eval.vally.yaml
✔ .github/skills/verify-tests-fail-without-fix/tests/eval.vally.yaml is valid

⏭️ LLM Evaluation: Skipped

No changed skills with eval specs found.

🔍 Full results and investigation steps

[MauiBot]

Expert Review — 1 findings

See inline comments for details.

[MauiBot]

[major] GitHub API shape handling — This drops every cross-referenced PR unless the timeline payload contains source.issue.repository.full_name. The REST timeline issue payloads also expose repository_url, which identifies the source repo. Accept both repository.full_name and repository_url and add a repository_url-only same-repo regression fixture so same-repo PR references are not silently skipped if the nested repository object is absent.

[MauiBot]

AI Review Summary

@PureWeen — new AI review results are available based on this last commit: 1a5a2c0. To request a fresh review after new comments or commits, comment /review rerun.

Review Sessions — click to expand

Gate — Test Before & After Fix

Gate Result: ⚠️ SKIPPED

No tests were detected in this PR.

Recommendation: Add tests to verify the fix using the write-tests-agent.

---

Pre-Flight — Context & Validation

Issue: #36029 - PR-only infrastructure fix (no linked issue)
PR: #36029 - Fix release-readiness tracker warnings: filter cross-repo PR cross-references and drop invalid authorAssociation gh field
Platforms Affected: infrastructure / release-readiness tooling (Windows PowerShell validation)
Files Changed: 1 implementation, 1 test

Key Findings

• PR fixes two release-readiness tracker warning sources: foreign repository timeline cross-references being treated as dotnet/maui PR candidates, and an invalid gh pr list --json authorAssociation projection.
• The implementation filters timeline PR references by repository.full_name before collecting candidate PR numbers, removes the invalid list projection, and fetches REST author_association for title-matched Candidate PRs.
• Gate was already completed separately and skipped because no tests were detected by the gate script; the PR does include offline PowerShell regression assertions in .github/skills/release-readiness/tests/Test-ReleaseReadiness.ps1.
• GitHub CLI is unauthenticated in this environment, so PR checks and authenticated review surfaces could not be queried via gh; public REST data and the local merge checkout were used instead.

Code Review Summary

Verdict: NEEDS_DISCUSSION
Confidence: low
Errors: 0 | Warnings: 0 | Suggestions: 0

Key code review findings:

• No actionable ❌ Error or ⚠️ Warning findings were identified by the independent code-review sub-agent.
• CI status is undetermined because gh pr checks --required requires authentication in this environment; confidence is capped low.
• Failure-mode probes confirmed the PR handles foreign low-number PRs, foreign same-number PRs, contributor Candidate PR spoofing, unverifiable maintainer Candidate PRs, and valid Candidate PRs with unverifiable siblings.

Fix Candidates

#	Source	Approach	Test Result	Files Changed	Notes
PR	PR #36029	Filter timeline cross-references by repository.full_name; fetch author_association per Candidate-titled PR using REST; suppress handled lookup warnings via Invoke-Gh -Quiet.	⚠️ SKIPPED (Gate)	.github/skills/release-readiness/scripts/Get-ReleaseReadiness.ps1, .github/skills/release-readiness/tests/Test-ReleaseReadiness.ps1	Original PR; gate skipped by prior step.

---

Code Review — Deep Analysis

Code Review — PR #36029

Independent Assessment

What this changes: Release-readiness tooling now filters timeline cross-referenced PRs to the configured repo, removes unsupported authorAssociation from gh pr list --json, fetches REST author_association only for Candidate-titled PRs, and adds offline regression tests.

Inferred motivation: Prevent tracker-body warning spam and false fix-candidate detection from foreign PR references or invalid gh projections.

Reconciliation with PR Narrative

Author claims: Fixes cross-repo timeline leakage and invalid Candidate PR author-association lookup; adds deterministic tests.

Agreement/disagreement: Agree. The implementation matches the stated defects and tests the relevant failure modes.

Prior Review Reconciliation

Prior ❌ Error Finding	Source	Status	Evidence
None found	MauiBot review, inline comments API, issue comments API	—	MauiBot had no ❌ findings; inline comments were empty; issue comments had dogfood + skill-validation only.

gh is unauthenticated, so public REST endpoints and the local merge checkout were used. No GitHub comments were posted.

Blast Radius Assessment

• Runs for all instances: No — release-readiness script only.
• Startup impact: None.
• Static/shared state: Existing $Script:Warnings; new -Quiet suppresses warnings only at selected handled lookup sites.

CI Status

• Required-check result: undetermined.
• Classification: gh pr checks 36029 --required could not run because gh auth login is required. Public status for head 1a5a2c0 shows skill-validation success, but required checks could not be confirmed.
• Action taken: confidence capped low; no posting.

Local validation observed by the sub-agent: Test-ReleaseReadiness.ps1 -SkipE2E = 528 passed / 2 failed. Baseline parent also fails the same two truncation-marker assertions, so failures appear pre-existing/unrelated.

Findings

No actionable ❌ Error or ⚠️ code findings.

Failure-Mode Probing

• Foreign timeline PR with low/nonexistent dotnet/maui number: filtered by repository.full_name before Get-PrInfo.
• Foreign PR number exists in dotnet/maui: also filtered, preventing silent wrong-PR match.
• Contributor opens “Candidate” PR: excluded via REST author association.
• Maintainer Candidate association lookup fails: excluded fail-closed and surfaced as unverifiable with rerun guidance.
• Valid Candidate plus unverifiable sibling: valid PR remains reported; sibling is surfaced.

Verdict: NEEDS_DISCUSSION

Confidence: low
Summary: Code is targeted and appears sound, with relevant regression coverage. LGTM cannot be used because required CI status is undetermined due unauthenticated gh.

---

Fix — Analysis & Comparison

Fix Candidates

#	Source	Approach	Test Result	Files Changed	Notes
1	try-fix-1	REST pulls-list for Candidate PRs plus canonical timeline pull_request.url filtering.	❌ FAILED	2 files	Failed under PowerShell StrictMode because optional author_association was accessed directly when absent.
2	try-fix-2	GraphQL-first: timeline CrossReferencedEvent.source.repository.nameWithOwner filtering plus Candidate PR PullRequest.authorAssociation in one GraphQL query.	⚠️ PARTIAL	2 files	PR-specific assertions passed; full suite retained known unrelated 528/2 baseline failures. More complex than PR fix.
PR	PR #36029	Filter REST timeline cross-references by repository.full_name; remove invalid gh pr list projection; fetch author_association only for Candidate-titled PRs via REST with quiet handled failures.	⚠️ SKIPPED (Gate)	2 files	Original PR. Gate was skipped by prior step; code-review found no actionable code issues.

Cross-Pollination

Model	Round	New Ideas?	Details
gpt-5.5 / maui-expert-reviewer	2	Yes	Proposed GraphQL-first approach after try-fix-1 StrictMode failure.
gpt-5.5 / maui-expert-reviewer	3	No	No meaningfully different third approach remains; other options are field/fallback variants or less authoritative/brittle mechanisms.

Exhausted: Yes
Selected Fix: PR #36029 — The best alternative (GraphQL-first) is broader and more complex, while the PR fix is smaller, targeted, authoritative, and avoids the invalid gh pr list field without changing the data-access architecture. No candidate passed all tests and was demonstrably better than the PR fix.

---

Recommended PR Title & Description

Assessment: ✏️ Recommend updating — the provided current title is unknown and the current description is empty, so the PR metadata does not describe the actual release-readiness tooling fix.

Recommended title

[Infrastructure] Release Readiness: Filter cross-repo PR references and fix Candidate author lookup

Recommended description

### Description of Change

Fixes two sources of warning noise and candidate misclassification in the release-readiness tracker tooling:

- `Get-IssueTimelinePrs` now keeps only timeline cross-referenced PRs from the target repo, preventing foreign PRs from being looked up as dotnet/maui fix candidates. This avoids both noisy 404 warnings for low foreign PR numbers and silent same-number mismatches against unrelated dotnet/maui PRs.
- `Get-CandidatePrChecks` no longer requests unsupported `authorAssociation` from `gh pr list --json`. It lists open PRs on the main branch using valid fields, then fetches REST `author_association` only for Candidate-titled PRs and fails closed when the association cannot be verified.

The fix also suppresses handled transient REST lookup failures from the tracker body via `Invoke-Gh -Quiet`, while still surfacing unverifiable Candidate-titled PRs as structured WATCH details.

### Key Technical Details

- Timeline cross-reference filtering uses the source issue/PR repository identity so only same-repo PRs are considered release fix candidates.
- Candidate PR spoof protection accepts only maintainer associations: `OWNER`, `MEMBER`, or `COLLABORATOR`.
- Unverifiable author-association lookups are excluded fail-closed and reported separately from confirmed non-maintainer spoofers.

### Tests

Adds deterministic offline PowerShell regression assertions for:

- Keeping same-repo timeline PR references while dropping foreign PR references and non-PR events.
- Returning no candidates for foreign-only timeline references.
- Accepting a maintainer-authored Candidate PR and excluding contributor-authored Candidate PRs.
- Reporting unverifiable Candidate-titled PRs without labeling them as confirmed non-maintainers.
- Suppressing handled `Invoke-Gh -Quiet` warnings from tracker output.

### Issues Fixed

PR-only infrastructure fix; no linked product issue.

---

Report — Final Recommendation

Comparative Report — PR #36029

Candidates Compared

Candidate	Approach	Test Result	Assessment
pr	Filters timeline PR cross-references by repository.full_name; removes invalid gh pr list --json authorAssociation; fetches REST author_association only for Candidate-titled PRs with quiet handled failures.	⚠️ Gate skipped; PR-specific offline assertions present.	Small, targeted, and matches the observed public timeline payload shape. Expert review found one hardening gap around accepting repository_url if nested repository.full_name is absent.
pr-plus-reviewer	Same as pr, plus a fallback from repository_url to source repo full name and an offline repository-url-only regression fixture.	⚠️ Relevant assertions passed; full -SkipE2E suite reports known unrelated 529/2 baseline.	Best balance: preserves the PR's targeted fix while addressing the expert reviewer's only actionable concern with a small, local change.
try-fix-1	REST pulls-list for Candidate PRs plus canonical timeline pull_request.url filtering.	❌ Failed.	Must rank lower than candidates without regression failure. It throws under PowerShell StrictMode when optional author_association is absent.
try-fix-2	GraphQL-first timeline and Candidate PR queries, including authorAssociation in one GraphQL flow.	⚠️ Relevant assertions passed; full suite retained known unrelated 528/2 baseline.	Viable but broader and more complex than necessary. Adds GraphQL pagination/query plumbing for a localized release-readiness script fix.

Ranking

1. pr-plus-reviewer — wins. It is the raw PR's targeted fix plus the only expert-review hardening suggestion, with relevant regression coverage.
2. pr — acceptable and targeted, but slightly less robust than pr-plus-reviewer for timeline payload shape variation.
3. try-fix-2 — relevant assertions passed, but it is a larger GraphQL rewrite with more moving parts and no clear benefit over the PR-lineage fix.
4. try-fix-1 — failed regression validation under StrictMode and must rank below candidates whose relevant assertions passed.

Winning Candidate

Winner: pr-plus-reviewer

pr-plus-reviewer should be selected because it keeps the PR's minimal REST/CLI architecture, avoids the invalid gh pr list field, filters foreign timeline PRs, and adds a low-risk repository_url fallback for the expert reviewer's API-shape concern. Candidates with failed regression tests were ranked lower as required.

---

Future Action — review latest findings

No alternative fix was selected for this run. Review the session findings and CI results before merging.