Add AI memory-leak scanner + fixer agentic workflows

[kubaflo]

Note

Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!

Note

🤖 AI-generated PR. These workflows, and this description, were produced with AI assistance. Please review carefully before merging.

Summary

Adds two gh-aw agentic workflows that proactively find and fix managed, cross-platform memory leaks in MAUI — turning the AI-driven leak-hunting flow several contributors already run by hand (scan → repro → measure → file → fix) into a repeatable, reviewable pipeline.

Design principle: only empirically-proven leaks. The scanner files an issue only when a plain dotnet test demonstrates the leak; the fixer opens a PR only with a red→green regression test proving the fix. There is no "you're missing a test" / coverage-gap mode — every artifact is backed by a passing/failing test.

Key property: neither workflow needs an emulator/simulator or a MAUI source build to detect a leak — the leak signature is proven by a dotnet test against the shipped Microsoft.Maui.Controls NuGet package on the plain library TFM, so detection runs on a standard GitHub-hosted runner.

Only 4 files are added — the workflow source (.md) and its compiled artifact (.lock.yml) for each:

.github/workflows/daily-leak-hunter.md   + .lock.yml
.github/workflows/leak-fixer.md          + .lock.yml

---

1. daily-leak-hunter — the scanner (files [leak-scan] issues)

Trigger: schedule: every 12h + manual (workflow_dispatch). Files only empirically-proven [leak-scan] issues — up to 8 per run.

1. Sweeps every focus area of the managed surface (src/Core/src, src/Controls/src/Core, src/Essentials/src) in one run — it does not stop after the first find.
2. Each focus area is seeded with proven MAUI leak signatures (from the community's known-leak catalog) so the hunt targets where leaks actually live: shared publisher → strong CollectionChanged/PropertyChanged (e.g. Picker.ItemsSource, TableRoot, SelectedItems, GradientStops), shared ICommand → CanExecuteChanged (ListView.RefreshCommand, SwipeItemView.Command, BackButtonBehavior.Command), VSM state triggers → DeviceDisplay.MainDisplayInfoChanged, and static/ResourceDictionary roots.
3. For each candidate it writes a standalone control / leaky / mitigation xUnit repro (referencing the shipped package, no source build) and measures retention with WeakReference + a forced GC. All candidates go in one test project (one [Fact] each, one restore/run).
4. It files a [leak-scan] issue only for each leak the test confirms — the leaky scenario retains while both the control and the mitigation release. A false positive is treated as worse than a quiet run; unconfirmed candidates are dropped. If a run proves nothing, it files nothing (no fallback mode).

De-dup & safety: skips a leak already covered by one of its own open [leak-scan] issues; never touches product or test code (read-only + create-issue); noop: report-as-issue: false.

---

2. leak-fixer — the fixer (opens draft [leak-fix] PRs)

Trigger: schedule: every 12h + manual (workflow_dispatch). At most one action per run, with de-dup + a 3-attempt cap. It picks the higher-priority of two tracks:

Track C — respond to review feedback (checked first)

Before doing new work, it checks whether one of its own open [leak-fix] PRs (hosted on this repo — fork-hosted heads it can't push to are left for a human) has an unaddressed CHANGES_REQUESTED review. If so it works on that PR: applies the valid requested changes (pushes a commit, re-validated so the PR's own test still holds) and/or posts a comment pushing back on any request that is wrong, would regress behaviour, or asks for a mute. A loop-guard (act only on a review newer than the PR's last commit and the workflow's last comment) prevents re-processing the same review.

Track A — [leak-scan] runtime leak → [leak-fix] PR

For the selected proven leak it:

1. Writes a focused regression test in Controls.Core.UnitTests.
2. Builds MAUI from source and confirms the test FAILS on main — proving it catches the leak.
3. Implements the minimal, idiomatic managed fix — a weak subscription / teardown mirroring the existing WeakEventManager / WeakNotify*Proxy patterns.
4. Rebuilds and confirms the same test now PASSES, no neighbouring regressions.
5. Opens a draft [leak-fix] PR with Fixes #N and the red→green evidence.

Safety

• Enforces red→green in both directions — a fix without a demonstrated failing-then-passing test is rejected.
• Never mutes / skips / disables a test; rejects its own attempt if the only thing that goes green is a mute — including when a review asks for one (it pushes back with a comment instead).
• One action per run — Track C review-response or one new Track A [leak-fix] PR, never both.
• Writes only via scoped safe-outputs (agent job is read-only); PR branches are limited to leak-fix/**, changes to managed src/** (+ PublicAPI.Unshipped.txt).
• Skips cleanly if already fixed on main, out of scope (needs a device fix), or attempt-capped.

---

Validated end-to-end on dotnet/maui itself (pre-merge)

Both workflows were executed on this repo's own Actions infrastructure (via short-lived push-triggered test branches, since workflow_dispatch only lights up once a workflow is on main). Real outputs, all on dotnet/maui:

• Multi-leak in one run — a single hunter run filed 5 distinct proven [leak-scan] issues via the catalog-seeded sweep: [leak-scan] SwipeItemView.Command leaks the control via strong ICommand.CanExecuteChanged (no weak proxy, no unload teardown) #36343 SwipeItemView.Command, [leak-scan] ListView.RefreshCommand leaks the control via strong ICommand.CanExecuteChanged (no weak proxy, no unload teardown) #36344 ListView.RefreshCommand, [leak-scan] Shell BackButtonBehavior.Command leaks via strong ICommand.CanExecuteChanged (no weak proxy, no detach teardown) #36345 Shell BackButtonBehavior.Command (all ICommand.CanExecuteChanged), [leak-scan] Picker.ItemsSource leaks the control via strong CollectionChanged subscription (no weak proxy, no unload teardown) #36346 Picker.ItemsSource, [leak-scan] IndicatorView.ItemsSource leaks the control via strong CollectionChanged subscription (no weak proxy, no unload tear [Content truncated due to length] #36347 IndicatorView.ItemsSource (CollectionChanged). [leak-scan] ListView.RefreshCommand leaks the control via strong ICommand.CanExecuteChanged (no weak proxy, no unload teardown) #36344 and [leak-scan] Shell BackButtonBehavior.Command leaks via strong ICommand.CanExecuteChanged (no weak proxy, no detach teardown) #36345 are leaks not previously tracked upstream.
• Proven-only — a later run filed [leak-scan] [leak-scan] CollectionView.SelectedItems leaks the control via SelectionList's strong CollectionChanged subscription (no weak pr [Content truncated due to length] #36350 CollectionView.SelectedItems and (correctly) nothing else, having de-duped the already-filed leaks.
• Track A fix — [leak-fix] Fix ResourceDictionary MergedDictionaries memory leak (Fixes #36308) #36309 [leak-fix] Fix ResourceDictionary MergedDictionaries memory leak (regression test red→green + managed fix).
• Track C review-response — on [leak-fix] Fix ResourceDictionary.ValuesChanged memory leak (Fixes #36251) #36253 the fixer independently re-read the code, agreed with the reviewer's findings, validated the reviewer's WeakEventManager approach (24/24, red→green), and posted the concrete fix.

---

Notes for reviewers

• Everything the workflows file/open is AI-generated and clearly labelled as such; treat them as high-quality drafts for human review.
• The workflows are self-contained (.md source + compiled .lock.yml); merging them enables the schedule triggers on main.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 36342

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 36342"

[Copilot]

Pull request overview

Adds two new gh-aw agentic workflows to automate (1) scanning for managed MAUI memory leaks and (2) turning confirmed leak issues / coverage gaps into draft PRs, along with their compiled .lock.yml artifacts.

Changes:

• Add Daily Memory Leak Hunter workflow to file [leak-scan] and [leak-test-gap] issues.
• Add Memory Leak Fixer workflow to open draft [leak-fix] / [leak-test] PRs and optionally respond to review feedback on its own PRs.
• Add the compiled gh-aw .lock.yml workflow artifacts for both workflows.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 5 comments.

File	Description
.github/workflows/daily-leak-hunter.md	New scanner workflow spec (two-pass leak hunt + coverage-gap scan) and safe-output configuration.
.github/workflows/daily-leak-hunter.lock.yml	Compiled workflow artifact for the leak hunter.
.github/workflows/leak-fixer.md	New fixer workflow spec (Track A/B PR creation + Track C review-response loop) and safe-output configuration.
.github/workflows/leak-fixer.lock.yml	Compiled workflow artifact for the leak fixer.

[kubaflo]

🔍 AI-generated reply on @kubaflo's behalf.

Partially addressed on the current head: the R1 gh pr list query now post-filters select(.headRepositoryOwner.login == $owner) (same-repo only), and any write is further gated by push-to-pull-request-branch.required-title-prefix: [leak-fix] plus the fork-head push limitation. A stray same-repo [leak-fix]-titled PR from another author is still theoretically enumerable; adding an agentic-workflows label filter would fully close that. Leaving open to track the optional label hardening.

[kubaflo]

🔍 AI-generated reply on @kubaflo's behalf.

This is an intentional floor: the repro pins a shipped baseline so a confirmed leak reproduces against a real release rather than an unreleased head. Agreed it drifts as versions advance — a good follow-up is to resolve the current shipped patch dynamically (e.g. from the latest 10.0.* NuGet) instead of a literal. Leaving open to track that improvement.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

[kubaflo]

🔍 AI-generated reply on @kubaflo's behalf.

Partially addressed on the current head: the R1 gh pr list query now post-filters select(.headRepositoryOwner.login == $owner) (same-repo only), and any write is further gated by push-to-pull-request-branch.required-title-prefix: [leak-fix] plus the fork-head push limitation. A stray same-repo [leak-fix]-titled PR from another author is still theoretically enumerable; adding an agentic-workflows label filter would fully close that. Leaving open to track the optional label hardening.

[kubaflo]

🔍 AI-generated reply on @kubaflo's behalf.

Good spot — the PR description mentions a [leak-test-gap] / coverage-gap mode that isn't in this iteration of the workflows. That's a description/scope drift, not a code issue; I'll trim the description to match what actually ships here. Leaving open to track the description edit.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 5 comments.

[kubaflo]

🔍 AI-generated reply on @kubaflo's behalf.

Deliberate headroom rather than a bug: the primary path writes a Controls.Core.UnitTests regression test, but some rooting leaks are only reproducible as a DeviceTest, so DeviceTests/** stays in the allow-ceiling (it doesn't mandate touching it). It's still test-only code and bounded by max-patch-size. Leaving open — happy to drop it if you'd prefer the tighter net-only scope.

[kubaflo]

🔍 AI-generated reply on @kubaflo's behalf.

Partially addressed on the current head: the R1 gh pr list query now post-filters select(.headRepositoryOwner.login == $owner) (same-repo only), and any write is further gated by push-to-pull-request-branch.required-title-prefix: [leak-fix] plus the fork-head push limitation. A stray same-repo [leak-fix]-titled PR from another author is still theoretically enumerable; adding an agentic-workflows label filter would fully close that. Leaving open to track the optional label hardening.

[kubaflo]

🔍 AI-generated reply on @kubaflo's behalf.

This is an intentional floor: the repro pins a shipped baseline so a confirmed leak reproduces against a real release rather than an unreleased head. Agreed it drifts as versions advance — a good follow-up is to resolve the current shipped patch dynamically (e.g. from the latest 10.0.* NuGet) instead of a literal. Leaving open to track that improvement.

[PureWeen]

Really like this — the leak-scan → validated [leak-fix] PR pipeline is clean, and Track C (respond to review feedback before taking on new work) is a nice touch. We're adopting the same review-response pattern on the ci-fix loop (#36317), so I've been reading Track C closely and wanted to flag one thing worth hardening before it runs live.

Track C ingests review content from any author and can act on it. R1 selects the newest CHANGES_REQUESTED review filtered only by state, then R2 reads its body + inline comments and may APPLY code changes from them. On a public PR, anyone can submit a "Request changes" review without write access — so a review body from an untrusted account could carry instructions the agent then actions, and the APPLY / PUSH BACK split is a prompt-level judgment, not a handler-level gate. (min-integrity: approved gates the trigger, not the review text you fetch mid-run.)

Cheap fix that matches the trust model you already rely on elsewhere: only action reviews whose author has write access — filter to author_association ∈ {OWNER, MEMBER, COLLABORATOR} before R2. One extra clause in the R1 jq:

gh api "repos/$GITHUB_REPOSITORY/pulls/$N/reviews" \
  --jq 'map(select(.state=="CHANGES_REQUESTED"
             and (.author_association | IN("OWNER","MEMBER","COLLABORATOR"))))
        | sort_by(.submitted_at) | last' \
  > /tmp/gh-aw/agent/review_${N}.json

Same idea for the inline pulls/$N/comments fetch (it also carries author_association). This is the same "the prompt is a soft constraint, not a handler-level one" note you gave us on ci-fix #36317 — so we're taking it on both loops. Not blocking, your call; flagging it because we're about to mirror this exact flow.

[kubaflo]

🔍 This is an AI-generated comment posted on @kubaflo's behalf.

@PureWeen @copilot-pull-request-reviewer — ready for re-review. Pushed 5 commits addressing the review:

Implemented + threads resolved

• 🔴 De-dup key (empirically confirmed by [leak-scan] Shell BackButtonBehavior.Command leaks via strong ICommand.CanExecuteChanged (no weak proxy, no detach teardown) #36345/[leak-scan] BackButtonBehavior.Command: non-weak ICommand.CanExecuteChanged strongly roots the BackButtonBehavior (no teardown) #36354) — now extracts the first dotted Type.Member token anywhere in the title (awk match), so off-contract titles normalize to the same rooting-API key. Verified both dup titles → BackButtonBehavior.Command. (11d6b42cdcf)
• gh missing from bash allowlist — added, lock now grants shell(gh:*); the Step 2 de-dup call would otherwise fail on first run. (bbe3fd17b3a)
• Track C security — reviews + inline comments now filtered to author_association ∈ {OWNER, MEMBER, COLLABORATOR}, closing the raw-gh api integrity-gate bypass. (2feb1d407e4)
• Idle noop — noop: report-as-issue: false added to leak-fixer. (2feb1d407e4)
• Title-prefix scoping — push-to-pr [leak-fix → [leak-fix]; add-comment narrowed to [leak-fix]. (11d6b42cdcf)
• Focus-area 7 — dropped platform DeviceDisplay example that violated the net-only constraint. (0543e280d23)
• Stale memory-leak-label findings — the query already uses agentic-workflows.

Left open (with replies) — cost cap max-daily-ai-credits (your cost tolerance), DeviceTests allow-ceiling headroom, dynamic shipped-version pin, R1 optional label filter, PR-description [leak-test-gap] trim, NuGet-doc wording.

All gh aw compile runs: 0 errors. Not force-pushed.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 7 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

[PureWeen]

Adversarial re-review (round 2) — 3 independent reviewers, consensus

Methodology: three independent model reviewers under adversarial consensus (agree / dispute / discard), cross-checked against the existing Copilot inline comments and my round-1 review. The two .lock.yml files are compiler-generated — I verified facts against them (shell(gh:*) granted, noop report-as-issue:"false", required_title_prefix:"[leak-fix]", min-integrity: approved), not their content.

✅ Round-1 findings resolved (3/3 agree; de-dup reproduced locally)

• gh missing from the bash allowlist → now allow-listed; the lock grants shell(gh:*). (bbe3fd1)
• Brittle sed de-dup key → replaced with a Type.Member awk extraction; I reproduced that Shell BackButtonBehavior.Command and BackButtonBehavior.Command: now collapse to one key. (11d6b42) — one residual edge below.
• noop auto-issue → report-as-issue: false on both workflows. (2feb1d4)
• Raw-gh injection vector past min-integrity → the author_association gate is now applied to both the review fetch and the inline-comment fetch. (2feb1d4)
• Title-prefix scoping → [leak-fix] prefixes + required_title_prefix on push/comment. (11d6b42)
• DeviceDisplay contradiction in focus area 7 → removed. (0543e28)

🆕 New this round (see inline)

• daily-leak-hunter.md:145 ⚠️ the new de-dup awk over-collapses namespace-qualified titles → silent under-filing (2/3, reproduced).
• leak-fixer.md:353 ⚠️ the de-dup hardening from this PR was not mirrored into the fixer’s Track A selection → duplicate [leak-fix] PRs on the same off-contract titles (reproduced), plus an unescaped jq regex at L365.

🔁 Corroborating the existing Copilot inline comments (independent agreement — not re-posted inline)

• Track C can act on any same-repo [leak-fix] PR (fixer ~226–229) — 3/3 agree this is the strongest remaining gap (one reviewer rated it must-fix). push-to-pull-request-branch is bounded only by title-prefix, not branch. Scope Step R1 to --label agentic-workflows and/or add allowed-branches: ["leak-fix/**"].
• author_association ≠ write access (fixer ~250) — the gate correctly closes the injection vector; the residual is precision: MEMBER/COLLABORATOR isn’t strictly write. Either query repos/{repo}/collaborators/{user}/permission for write|maintain|admin, or soften the “write access” comment.
• Probe scope vs Essentials refs (hunter ~229) / probe omits the DispatcherProvider bootstrap (hunter ~235) — agree; both are bounded (wasted/always-dropped candidates and false-negatives, not false filings).
• TreatWarningsAsErrors=false (fixer 439/479) — contested: two reviewers noted the CI-fidelity gap, one judged it a deliberate, documented choice caught by full CI on the draft PR. Non-blocking.

⏳ Still open from round 1

• max-ai-credits: -1 (hunter 42–43, fixer 60–61) — unbounded spend. The environment gating these runs had no required-reviewer protection rules when I checked in round 1, so there is no approval gate acting as the real spend control. Acknowledged / deferred by the author.

Notes

• No unit tests — expected; these are workflow definitions.
• Not blocking merge from my side. COMMENT only — approval is a human decision.

[kubaflo]

🔍 This is an AI-generated comment posted on @kubaflo's behalf.

@PureWeen addressed the round-3 de-dup findings in 53bc444a72c — the hunter now extracts the last Type.Member pair (fixing the Microsoft.Maui.* over-collapse), the fixer mirrors the same awk extraction (no more prefix-cut mis-key), and $API is regex-escaped before the jq test() so the dot matches literally. Both locks recompiled (0 errors). Ready for re-review — thanks!

[PureWeen]

Re-reviewed 53bc444a — both round-3 de-dup findings verified resolved (I ran the actual awk/sed/jq, so this is empirical, not just a read):

• Hunter over-collapse — the last-Type.Member-pair extraction keys Microsoft.Maui.Controls.Picker.ItemsSource → Picker.ItemsSource and …TableRoot.Section → TableRoot.Section (distinct), while Shell BackButtonBehavior.Command / BackButtonBehavior.Command: still collapse together. Version tokens like net10.0 are safely skipped. ✅
• Fixer mirror + jq escaping — the fixer now uses the identical extractor, and API_RE makes the jq test() dot literal (BackButtonBehavior.Command no longer matches BackButtonBehaviorXCommand). ✅

Lock regeneration is correct — the hash-only lock diff is expected because the workflow body is {{#runtime-import}}-ed from the .md at runtime. Details on the two inline threads.

The remaining items from my earlier review are unchanged this round and non-blocking from my side — the strongest is still Track C acting on any same-repo [leak-fix] PR (bounded only by title-prefix, not branch); the author_association gate closes the injection vector but MEMBER/COLLABORATOR isn’t strictly write; and max-ai-credits: -1 remains unbounded. Nice iteration on the de-dup. 👍