with nothing that could change, redirect, or
+ # add ambiguity to what is actually fetched.
+ if (-not [string]::IsNullOrEmpty($uri.UserInfo) -or
+ -not $uri.IsDefaultPort -or
+ -not [string]::IsNullOrEmpty($uri.Query) -or
+ -not [string]::IsNullOrEmpty($uri.Fragment)) {
+ return $false
+ }
+ $expectedPath = "/dnceng-public/public/_apis/test/Runs/$RunId/Results/$ResultId/Attachments/$AttachmentId"
+ return $uri.AbsolutePath -ieq $expectedPath
+}
+
+function Invoke-DownloadFile {
+ param(
+ [string]$Url,
+ [string]$Path,
+ [long]$MaximumBytes,
+ [int]$MaxAttempts = 3,
+ [datetime]$Deadline = [datetime]::MaxValue
+ )
+
+ $perRequestTimeout = [TimeSpan]::FromMinutes(2)
+
+ for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
+ # Bound each attempt by the smaller of the per-request ceiling and the time left on the
+ # aggregate publish budget. HttpClient.Timeout stops applying once ResponseHeadersRead
+ # returns, so a host that sends headers then stalls the body would otherwise hold the job
+ # open indefinitely. A CancellationTokenSource covers the whole operation (GetAsync *and*
+ # the body reads), giving a hard wall-clock cap and honoring the shared deadline.
+ $remainingBudget = $Deadline - (Get-Date)
+ if ($remainingBudget -le [TimeSpan]::Zero) {
+ throw "Publish budget exhausted before downloading '$Url'."
+ }
+ $attemptTimeout = if ($remainingBudget -lt $perRequestTimeout) { $remainingBudget } else { $perRequestTimeout }
+
+ $completed = $false
+ $caught = $null
+ $statusCode = 0
+ $handler = $null
+ $client = $null
+ $response = $null
+ $inputStream = $null
+ $outputStream = $null
+ $cts = $null
+ try {
+ $cts = [System.Threading.CancellationTokenSource]::new()
+ $cts.CancelAfter($attemptTimeout)
+ $token = $cts.Token
+
+ $handler = [System.Net.Http.HttpClientHandler]::new()
+ $handler.AllowAutoRedirect = $true
+ $handler.MaxAutomaticRedirections = 5
+ $client = [System.Net.Http.HttpClient]::new($handler)
+ # The cancellation token, not HttpClient.Timeout, enforces the wall-clock bound so it
+ # also covers the post-headers body read.
+ $client.Timeout = [System.Threading.Timeout]::InfiniteTimeSpan
+ $response = $client.GetAsync(
+ $Url,
+ [System.Net.Http.HttpCompletionOption]::ResponseHeadersRead,
+ $token
+ ).GetAwaiter().GetResult()
+ [void]$response.EnsureSuccessStatusCode()
+ if ($response.Content.Headers.ContentLength -and
+ $response.Content.Headers.ContentLength.Value -gt $MaximumBytes) {
+ throw "Download exceeded the $MaximumBytes-byte size limit."
+ }
+
+ $inputStream = $response.Content.ReadAsStreamAsync().GetAwaiter().GetResult()
+ $outputStream = [System.IO.File]::Create($Path)
+ $buffer = New-Object byte[] 81920
+ $total = 0L
+ while (($read = $inputStream.ReadAsync($buffer, 0, $buffer.Length, $token).GetAwaiter().GetResult()) -gt 0) {
+ $total += $read
+ if ($total -gt $MaximumBytes) {
+ throw "Download exceeded the $MaximumBytes-byte size limit."
+ }
+ $outputStream.Write($buffer, 0, $read)
+ }
+ $completed = $true
+ }
+ catch {
+ $caught = $_
+ if ($response) {
+ $statusCode = [int]$response.StatusCode
+ }
+ }
+ finally {
+ if ($outputStream) { $outputStream.Dispose() }
+ if ($inputStream) { $inputStream.Dispose() }
+ if ($response) { $response.Dispose() }
+ if ($client) { $client.Dispose() }
+ if ($handler) { $handler.Dispose() }
+ if ($cts) { $cts.Dispose() }
+ if (-not $completed) {
+ Remove-Item -LiteralPath $Path -Force -ErrorAction SilentlyContinue
+ }
+ }
+
+ if ($completed) {
+ return
+ }
+ $nonRetryableClientError = $statusCode -ge 400 -and
+ $statusCode -lt 500 -and
+ $statusCode -notin @(408, 429)
+ if ($attempt -ge $MaxAttempts -or $nonRetryableClientError) {
+ throw $caught
+ }
+ Start-Sleep -Seconds $attempt
+ }
+}
+
+function Get-SnapshotRoot {
+ param([string]$Platform)
+
+ switch ($Platform) {
+ "android" { return "src/Controls/tests/TestCases.Android.Tests/snapshots" }
+ "ios" { return "src/Controls/tests/TestCases.iOS.Tests/snapshots" }
+ "macos" { return "src/Controls/tests/TestCases.Mac.Tests/snapshots" }
+ "windows" { return "src/Controls/tests/TestCases.WinUI.Tests/snapshots" }
+ default { return $null }
+ }
+}
+
+function Get-ValidatedSnapshotPathHint {
+ param(
+ [string]$Platform,
+ [string]$SnapshotFileName,
+ [string]$PathHint
+ )
+
+ if ([string]::IsNullOrWhiteSpace($PathHint)) {
+ return $null
+ }
+ $snapshotRoot = Get-SnapshotRoot -Platform $Platform
+ $normalized = $PathHint -replace '\\', '/'
+ if (-not $snapshotRoot -or
+ $normalized.Contains("..") -or
+ -not $normalized.StartsWith("$snapshotRoot/", [StringComparison]::Ordinal) -or
+ [System.IO.Path]::GetFileName($normalized) -ne $SnapshotFileName) {
+ return $null
+ }
+ return $normalized
+}
+
+function Get-SnapshotCandidatePaths {
+ param(
+ [string]$Platform,
+ [string]$SnapshotFileName,
+ [string]$EnvironmentName,
+ [string]$BaselinePathHint,
+ [string]$RepositoryRoot
+ )
+
+ if ($SnapshotFileName -notmatch '^[A-Za-z0-9][A-Za-z0-9._ -]*\.png$' -or
+ $SnapshotFileName.Contains("..")) {
+ return @()
+ }
+
+ $snapshotRoot = Get-SnapshotRoot -Platform $Platform
+ if (-not $snapshotRoot) {
+ return @()
+ }
+
+ $paths = New-Object System.Collections.Generic.List[string]
+ $seen = @{}
+ $addPath = {
+ param([string]$Candidate)
+ $normalized = $Candidate -replace '\\', '/'
+ if ($normalized.Contains("..") -or
+ -not $normalized.StartsWith("$snapshotRoot/", [StringComparison]::Ordinal) -or
+ [System.IO.Path]::GetFileName($normalized) -ne $SnapshotFileName -or
+ $seen.ContainsKey($normalized)) {
+ return
+ }
+ $seen[$normalized] = $true
+ $paths.Add($normalized)
+ }
+
+ $validatedPathHint = Get-ValidatedSnapshotPathHint `
+ -Platform $Platform `
+ -SnapshotFileName $SnapshotFileName `
+ -PathHint $BaselinePathHint
+ if ($validatedPathHint) {
+ & $addPath $validatedPathHint
+ }
+ if (-not [string]::IsNullOrWhiteSpace($EnvironmentName) -and
+ $EnvironmentName -match '^[a-z0-9][a-z0-9._-]*$') {
+ & $addPath "$snapshotRoot/$EnvironmentName/$SnapshotFileName"
+ }
+
+ $localSnapshotRoot = Join-Path $RepositoryRoot ($snapshotRoot -replace '/', [System.IO.Path]::DirectorySeparatorChar)
+ if (Test-Path -LiteralPath $localSnapshotRoot -PathType Container) {
+ foreach ($directory in @(Get-ChildItem -LiteralPath $localSnapshotRoot -Directory | Sort-Object Name)) {
+ & $addPath "$snapshotRoot/$($directory.Name)/$SnapshotFileName"
+ }
+ }
+
+ return $paths.ToArray()
+}
+
+function Select-BaselineCandidate {
+ param(
+ [object[]]$CandidateFiles,
+ [string]$PreferredPath
+ )
+
+ $files = @($CandidateFiles | Where-Object { $null -ne $_ })
+ if (-not [string]::IsNullOrWhiteSpace($PreferredPath)) {
+ $preferred = @($files | Where-Object {
+ [string]::Equals(
+ [string]$_.repositoryPath,
+ $PreferredPath,
+ [StringComparison]::Ordinal)
+ })
+ if ($preferred.Count -eq 1) {
+ return [pscustomobject]@{
+ localPath = [string]$preferred[0].localPath
+ repositoryPath = [string]$preferred[0].repositoryPath
+ status = "resolved from the tested runtime environment"
+ }
+ }
+ return [pscustomobject]@{
+ localPath = $null
+ repositoryPath = $null
+ status = "preferred runtime environment snapshot was unavailable at the tested merge commit"
+ }
+ }
+
+ if ($files.Count -eq 1) {
+ return [pscustomobject]@{
+ localPath = [string]$files[0].localPath
+ repositoryPath = [string]$files[0].repositoryPath
+ status = "only matching snapshot at the tested merge commit"
+ }
+ }
+ return [pscustomobject]@{
+ localPath = $null
+ repositoryPath = $null
+ status = $(if ($files.Count -gt 1) {
+ "ambiguous across multiple snapshot environments"
+ }
+ else {
+ "not found at the tested merge commit"
+ })
+ }
+}
+
+function Invoke-GhApiJson {
+ param(
+ [string]$Method,
+ [string]$Endpoint,
+ [object]$Body,
+ [datetime]$Deadline = [datetime]::MaxValue
+ )
+
+ if ($Deadline -ne [datetime]::MaxValue -and (Get-Date) -ge $Deadline) {
+ throw "Publish budget exhausted before gh api $Method $Endpoint."
+ }
+
+ $arguments = @("api", "--method", $Method, $Endpoint)
+ $payloadPath = $null
+ $process = $null
+ try {
+ if ($null -ne $Body) {
+ $payloadPath = [System.IO.Path]::GetTempFileName()
+ $Body | ConvertTo-Json -Depth 20 -Compress | Set-Content -LiteralPath $payloadPath -Encoding UTF8
+ $arguments += @("--input", $payloadPath)
+ }
+
+ $startInfo = [System.Diagnostics.ProcessStartInfo]::new()
+ $startInfo.FileName = "gh"
+ $startInfo.UseShellExecute = $false
+ $startInfo.RedirectStandardOutput = $true
+ $startInfo.RedirectStandardError = $true
+ foreach ($argument in $arguments) {
+ [void]$startInfo.ArgumentList.Add([string]$argument)
+ }
+
+ $process = [System.Diagnostics.Process]::new()
+ $process.StartInfo = $startInfo
+ if (-not $process.Start()) {
+ throw "gh api $Method $Endpoint could not be started."
+ }
+ $stdoutTask = $process.StandardOutput.ReadToEndAsync()
+ $stderrTask = $process.StandardError.ReadToEndAsync()
+
+ if ($Deadline -eq [datetime]::MaxValue) {
+ $process.WaitForExit()
+ }
+ else {
+ $remainingMilliseconds = [Math]::Floor(($Deadline - (Get-Date)).TotalMilliseconds)
+ if ($remainingMilliseconds -le 0 -or
+ -not $process.WaitForExit([int][Math]::Min([int]::MaxValue, $remainingMilliseconds))) {
+ try {
+ $process.Kill($true)
+ $process.WaitForExit()
+ }
+ catch {
+ # The process may have exited between the timeout and termination request.
+ }
+ throw "Publish budget exhausted while calling gh api $Method $Endpoint."
+ }
+ }
+
+ $output = $stdoutTask.GetAwaiter().GetResult()
+ $stderr = $stderrTask.GetAwaiter().GetResult()
+ if ($process.ExitCode -ne 0) {
+ throw "gh api $Method $Endpoint failed: $stderr $output"
+ }
+ $text = ([string]$output).Trim()
+ if ([string]::IsNullOrWhiteSpace($text)) {
+ return $null
+ }
+ return $text | ConvertFrom-Json
+ }
+ finally {
+ if ($payloadPath) {
+ Remove-Item -LiteralPath $payloadPath -Force -ErrorAction SilentlyContinue
+ }
+ if ($null -ne $process) {
+ $process.Dispose()
+ }
+ }
+}
+
+function Get-AssetBranchRef {
+ param(
+ [string]$Repository,
+ [string]$Branch,
+ [datetime]$Deadline = [datetime]::MaxValue
+ )
+
+ try {
+ return Invoke-GhApiJson -Method "GET" -Endpoint "repos/$Repository/git/ref/heads/$Branch" -Deadline $Deadline
+ }
+ catch {
+ if ($_.Exception.Message -match 'HTTP 404|Reference does not exist') {
+ return $null
+ }
+ throw
+ }
+}
+
+function Initialize-AssetBranch {
+ param(
+ [string]$Repository,
+ [string]$Branch,
+ [datetime]$Deadline = [datetime]::MaxValue
+ )
+
+ $existing = Get-AssetBranchRef -Repository $Repository -Branch $Branch -Deadline $Deadline
+ if ($existing) {
+ return $existing
+ }
+
+ $repositoryInfo = Invoke-GhApiJson -Method "GET" -Endpoint "repos/$Repository" -Deadline $Deadline
+ $defaultBranch = [string]$repositoryInfo.default_branch
+ if ([string]::IsNullOrWhiteSpace($defaultBranch)) {
+ throw "Repository '$Repository' did not expose a default branch."
+ }
+ $defaultRef = Invoke-GhApiJson -Method "GET" -Endpoint "repos/$Repository/git/ref/heads/$defaultBranch" -Deadline $Deadline
+ try {
+ Invoke-GhApiJson -Method "POST" -Endpoint "repos/$Repository/git/refs" -Body @{
+ ref = "refs/heads/$Branch"
+ sha = $defaultRef.object.sha
+ } -Deadline $Deadline | Out-Null
+ }
+ catch {
+ if ($_.Exception.Message -notmatch 'HTTP 422|Reference already exists') {
+ throw
+ }
+ }
+
+ $created = Get-AssetBranchRef -Repository $Repository -Branch $Branch -Deadline $Deadline
+ if (-not $created) {
+ throw "Asset branch '$Branch' could not be initialized."
+ }
+ return $created
+}
+
+function Publish-GitAssets {
+ param(
+ [string]$Repository,
+ [string]$Branch,
+ [object[]]$Assets,
+ [string]$CommitMessage,
+ [datetime]$Deadline = [datetime]::MaxValue,
+ [int]$MaxAttempts = 5
+ )
+
+ Initialize-AssetBranch -Repository $Repository -Branch $Branch -Deadline $Deadline | Out-Null
+
+ $blobByHash = @{}
+ $entries = New-Object System.Collections.Generic.List[object]
+ foreach ($asset in $Assets) {
+ $bytes = [System.IO.File]::ReadAllBytes([string]$asset.localPath)
+ $hash = [Convert]::ToHexString([System.Security.Cryptography.SHA256]::HashData($bytes))
+ if (-not $blobByHash.ContainsKey($hash)) {
+ $blob = Invoke-GhApiJson -Method "POST" -Endpoint "repos/$Repository/git/blobs" -Body @{
+ content = [Convert]::ToBase64String($bytes)
+ encoding = "base64"
+ } -Deadline $Deadline
+ $blobByHash[$hash] = $blob.sha
+ }
+ $entries.Add([ordered]@{
+ path = [string]$asset.assetPath
+ mode = "100644"
+ type = "blob"
+ sha = $blobByHash[$hash]
+ })
+ }
+
+ for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
+ $branchRef = Get-AssetBranchRef -Repository $Repository -Branch $Branch -Deadline $Deadline
+ if (-not $branchRef) {
+ Initialize-AssetBranch -Repository $Repository -Branch $Branch -Deadline $Deadline | Out-Null
+ $branchRef = Get-AssetBranchRef -Repository $Repository -Branch $Branch -Deadline $Deadline
+ }
+ $parentSha = [string]$branchRef.object.sha
+ $parentCommit = Invoke-GhApiJson -Method "GET" -Endpoint "repos/$Repository/git/commits/$parentSha" -Deadline $Deadline
+ $tree = Invoke-GhApiJson -Method "POST" -Endpoint "repos/$Repository/git/trees" -Body @{
+ base_tree = $parentCommit.tree.sha
+ tree = $entries.ToArray()
+ } -Deadline $Deadline
+ $commit = Invoke-GhApiJson -Method "POST" -Endpoint "repos/$Repository/git/commits" -Body @{
+ message = $CommitMessage
+ tree = $tree.sha
+ parents = @($parentSha)
+ } -Deadline $Deadline
+
+ try {
+ Invoke-GhApiJson -Method "PATCH" -Endpoint "repos/$Repository/git/refs/heads/$Branch" -Body @{
+ sha = $commit.sha
+ force = $false
+ } -Deadline $Deadline | Out-Null
+ return [string]$commit.sha
+ }
+ catch {
+ if ($attempt -ge $MaxAttempts -or $_.Exception.Message -notmatch 'HTTP 409|HTTP 422|not a fast forward') {
+ throw
+ }
+ if ($Deadline -ne [datetime]::MaxValue -and (Get-Date).AddSeconds($attempt) -ge $Deadline) {
+ throw "Publish budget exhausted before retrying the asset branch update."
+ }
+ Start-Sleep -Seconds $attempt
+ }
+ }
+
+ throw "Asset branch update exhausted $MaxAttempts attempts."
+}
+
+function Get-VisualEvidenceDedupKey {
+ param([object]$Evidence)
+
+ # Key on stable *logical* identity only: platform + snapshot + resolved
+ # runtime environment (leg). Build/run/result identifiers are intentionally
+ # excluded so that retry attempts of the same logical snapshot failure
+ # collapse to a single panel instead of consuming the bounded comparison
+ # budget with duplicate retry panels. The caller sorts newest-first, so the
+ # retained entry is the latest attempt; genuinely different environments or
+ # platforms still produce distinct keys.
+ # When the environment is unresolved (the gatherer sets environmentName to null whenever a
+ # build exposes multiple environment hints for one platform), platform + snapshot alone cannot
+ # tell two distinct legs apart: distinct iOS legs failing the same snapshot would both key on
+ # "ios|name.png|" and one would be collapsed as if it were a retry of the other. Prefer the AzDO
+ # test-run *name* -- the pipeline job/leg display name carried through gathering -- as the leg
+ # identity in that case: it is stable across retries of the SAME leg (a retry re-runs the same
+ # job and reuses its run name) yet differs between DISTINCT legs, so same-leg retries collapse to
+ # one panel (freeing MaxComparisons slots for genuinely distinct failures) while distinct legs
+ # stay separate. Only when no run name is available do we fall back to the per-result identifier,
+ # which never collapses distinct legs (fails safe); its cost is that a same-leg retry lacking a
+ # run name is not collapsed, which the downstream omittedCount caveat still surfaces.
+ $environmentName = [string]$Evidence.environmentName
+ $runName = [string]$Evidence.runName
+ $legDiscriminator = if (-not [string]::IsNullOrWhiteSpace($environmentName)) {
+ $environmentName
+ }
+ elseif (-not [string]::IsNullOrWhiteSpace($runName)) {
+ "run:$runName"
+ }
+ else {
+ "leg:$([string]$Evidence.runId):$([string]$Evidence.resultId)"
+ }
+ $parts = @(
+ [string]$Evidence.platform,
+ [string]$Evidence.snapshotFileName,
+ $legDiscriminator
+ )
+ return ($parts -join '|').ToLowerInvariant()
+}
+
+function Save-Context {
+ param(
+ [object]$Context,
+ [string]$Path
+ )
+
+ $Context | ConvertTo-Json -Depth 100 | Set-Content -LiteralPath $Path -Encoding UTF8
+}
+
+function Remove-VisualDownloadDirectory {
+ param([string]$Path)
+
+ if (-not [string]::IsNullOrWhiteSpace($Path) -and (Test-Path -LiteralPath $Path)) {
+ Remove-Item -LiteralPath $Path -Recurse -Force -ErrorAction SilentlyContinue
+ }
+}
+
+try {
+$context = Get-Content -LiteralPath $ContextJsonPath -Raw -Encoding UTF8 | ConvertFrom-Json
+if ([string]$context.repository -ne $Repository) {
+ throw "Context repository '$($context.repository)' did not match trusted repository '$Repository'."
+}
+if ([int]$context.pr.number -ne $PrNumber) {
+ throw "Context PR '$($context.pr.number)' did not match trusted PR '$PrNumber'."
+}
+
+$visualEvidence = @($context.visualEvidence.comparisons | Where-Object { $null -ne $_ })
+if ($visualEvidence.Count -eq 0) {
+ Write-Host "No visual snapshot failures were detected."
+ $context | Add-Member -NotePropertyName visualAssets -NotePropertyValue ([ordered]@{
+ published = $false
+ comparisonCount = 0
+ errors = @()
+ }) -Force
+ Save-Context -Context $context -Path $ContextJsonPath
+ exit 0
+}
+
+$deduped = [ordered]@{}
+$dedupeDroppedCount = 0
+foreach ($evidence in @($visualEvidence | Sort-Object `
+ @{ Expression = { if ($_.completedDate) { [datetime]$_.completedDate } else { [datetime]::MinValue } }; Descending = $true }, `
+ @{ Expression = { [int]$_.buildId }; Descending = $true }, `
+ @{ Expression = { [int]$_.resultId }; Descending = $true })) {
+ $key = Get-VisualEvidenceDedupKey -Evidence $evidence
+ if (-not $deduped.Contains($key)) {
+ $deduped[$key] = $evidence
+ }
+ else {
+ $dedupeDroppedCount++
+ }
+}
+
+$allUnique = @($deduped.Values)
+$selectedEvidence = @($allUnique | Select-Object -First $MaxComparisons)
+$omittedCount = [Math]::Max(0, $allUnique.Count - $selectedEvidence.Count) + $dedupeDroppedCount
+$assets = New-Object System.Collections.Generic.List[object]
+$prepared = New-Object System.Collections.Generic.List[object]
+$errors = New-Object System.Collections.Generic.List[string]
+$preparationFailureCount = 0
+$totalBytes = 0L
+$index = 0
+
+# Aggregate wall-clock budget shared by preparation and Git publication. Reserve four minutes below
+# the workflow's 16-minute hard stop so a budget failure can still update context.json and let the
+# ordinary-report fallback run. Every download and gh API call observes the same deadline.
+$publishBudgetSeconds = 720
+$parsedPublishBudget = 0
+if (-not [string]::IsNullOrWhiteSpace($env:REVIEW_TESTS_PUBLISH_BUDGET_SECONDS) -and
+ [int]::TryParse($env:REVIEW_TESTS_PUBLISH_BUDGET_SECONDS, [ref]$parsedPublishBudget) -and
+ $parsedPublishBudget -gt 0) {
+ $publishBudgetSeconds = $parsedPublishBudget
+}
+$publishDeadline = (Get-Date).AddSeconds($publishBudgetSeconds)
+
+foreach ($evidence in $selectedEvidence) {
+ $index++
+ if ((Get-Date) -ge $publishDeadline) {
+ # Budget exhausted: items $index..Count (inclusive of the current one) are untouched. Record
+ # them as omitted and stop before starting any more downloads.
+ $remaining = $selectedEvidence.Count - $index + 1
+ if ($remaining -gt 0) {
+ $omittedCount += $remaining
+ $errors.Add("Publish budget of ${publishBudgetSeconds}s exhausted before preparing $remaining remaining comparison(s); they were omitted.")
+ }
+ break
+ }
+ $runId = [int]$evidence.runId
+ $resultId = [int]$evidence.resultId
+ $buildId = [int]$evidence.buildId
+ $snapshotFileName = [string]$evidence.snapshotFileName
+ $slug = Get-SafeAssetSlug -Value ([System.IO.Path]::GetFileNameWithoutExtension($snapshotFileName))
+ $revision = [string]$evidence.buildSourceVersion
+ $revisionPath = if ($revision -match '^[0-9a-fA-F]{12,40}$') { $revision.Substring(0, 12).ToLowerInvariant() } else { "unknown" }
+ $assetPrefix = "pr-$PrNumber/$revisionPath/build-$buildId/$('{0:d2}' -f $index)-$slug"
+
+ try {
+ $actual = $evidence.actual
+ if (-not $actual -or
+ -not (Test-AzDoAttachmentUrl -Url ([string]$actual.url) -RunId $runId -ResultId $resultId -AttachmentId ([int]$actual.id))) {
+ throw "Actual attachment URL did not match the expected AzDO result."
+ }
+ if ($actual.size -and [long]$actual.size -gt $MaxFileBytes) {
+ throw "Actual attachment exceeds the per-file size limit."
+ }
+
+ $actualPath = Join-Path $DownloadDirectory "$assetPrefix-actual.png"
+ New-Item -ItemType Directory -Force -Path (Split-Path -Parent $actualPath) | Out-Null
+ Invoke-DownloadFile -Url ([string]$actual.url) -Path $actualPath -MaximumBytes $MaxFileBytes -Deadline $publishDeadline
+ if (-not (Test-PngFile -Path $actualPath -MaximumBytes $MaxFileBytes)) {
+ throw "Actual attachment was not a bounded PNG."
+ }
+
+ $itemAssets = New-Object System.Collections.Generic.List[object]
+ $actualSize = (Get-Item -LiteralPath $actualPath).Length
+ $itemAssets.Add([ordered]@{ kind = "actual"; localPath = $actualPath; assetPath = "$assetPrefix-actual.png"; size = $actualSize })
+
+ $diffPath = $null
+ if ($evidence.diff) {
+ $diff = $evidence.diff
+ if (Test-AzDoAttachmentUrl -Url ([string]$diff.url) -RunId $runId -ResultId $resultId -AttachmentId ([int]$diff.id)) {
+ if (-not $diff.size -or [long]$diff.size -le $MaxFileBytes) {
+ $diffCandidatePath = Join-Path $DownloadDirectory "$assetPrefix-diff.png"
+ try {
+ Invoke-DownloadFile -Url ([string]$diff.url) -Path $diffCandidatePath -MaximumBytes $MaxFileBytes -Deadline $publishDeadline
+ if (Test-PngFile -Path $diffCandidatePath -MaximumBytes $MaxFileBytes) {
+ $diffPath = $diffCandidatePath
+ $itemAssets.Add([ordered]@{ kind = "diff"; localPath = $diffPath; assetPath = "$assetPrefix-diff.png"; size = (Get-Item -LiteralPath $diffPath).Length })
+ }
+ else {
+ Remove-Item -LiteralPath $diffCandidatePath -Force -ErrorAction SilentlyContinue
+ }
+ }
+ catch {
+ # The diff is optional and the renderer supports a null diff, so a
+ # diff download/validation failure must not bubble to the outer
+ # per-comparison catch and discard the already-validated actual
+ # (and any baseline). Isolate it like the baseline candidate
+ # downloads below and keep publishing the remaining panel.
+ Remove-Item -LiteralPath $diffCandidatePath -Force -ErrorAction SilentlyContinue
+ $diffPath = $null
+ }
+ }
+ }
+ }
+
+ $baselinePath = $null
+ $baselineRepositoryPath = $null
+ $baselineStatus = "not found at the tested merge commit"
+ if ($evidence.kind -ne "missing-baseline" -and $revision -match '^[0-9a-fA-F]{40}$') {
+ $candidatePaths = @(Get-SnapshotCandidatePaths `
+ -Platform ([string]$evidence.platform) `
+ -SnapshotFileName $snapshotFileName `
+ -EnvironmentName ([string]$evidence.environmentName) `
+ -BaselinePathHint ([string]$evidence.baselinePathHint) `
+ -RepositoryRoot $RepoRoot)
+ $candidateFiles = New-Object System.Collections.Generic.List[object]
+ foreach ($candidatePath in $candidatePaths) {
+ $candidateUrl = "https://raw.githubusercontent.com/$Repository/$revision/$(ConvertTo-UrlPath $candidatePath)"
+ $candidateLocalPath = Join-Path $DownloadDirectory "$assetPrefix-baseline-$($candidateFiles.Count).png"
+ try {
+ Invoke-DownloadFile -Url $candidateUrl -Path $candidateLocalPath -MaximumBytes $MaxFileBytes -Deadline $publishDeadline
+ if (Test-PngFile -Path $candidateLocalPath -MaximumBytes $MaxFileBytes) {
+ $candidateFiles.Add([ordered]@{
+ repositoryPath = $candidatePath
+ localPath = $candidateLocalPath
+ })
+ }
+ else {
+ # The download succeeded but the payload is not a usable PNG (e.g. an HTML
+ # 404 body or an oversized image). Mirror the diff-download and catch-path
+ # cleanup so a rejected candidate never lingers in the temp download dir and
+ # is never mistaken for a validated baseline.
+ Remove-Item -LiteralPath $candidateLocalPath -Force -ErrorAction SilentlyContinue
+ }
+ }
+ catch {
+ Remove-Item -LiteralPath $candidateLocalPath -Force -ErrorAction SilentlyContinue
+ }
+ }
+
+ $preferredPath = $null
+ if ($evidence.baselinePathHint) {
+ $preferredPath = [string]$evidence.baselinePathHint
+ }
+ elseif ($evidence.environmentName) {
+ $root = Get-SnapshotRoot -Platform ([string]$evidence.platform)
+ if ($root) {
+ $preferredPath = "$root/$($evidence.environmentName)/$snapshotFileName"
+ }
+ }
+
+ $baselineSelection = Select-BaselineCandidate `
+ -CandidateFiles $candidateFiles.ToArray() `
+ -PreferredPath $preferredPath
+ $baselinePath = [string]$baselineSelection.localPath
+ $baselineRepositoryPath = [string]$baselineSelection.repositoryPath
+ $baselineStatus = [string]$baselineSelection.status
+ }
+ elseif ($evidence.kind -eq "missing-baseline") {
+ $baselineRepositoryPath = Get-ValidatedSnapshotPathHint `
+ -Platform ([string]$evidence.platform) `
+ -SnapshotFileName $snapshotFileName `
+ -PathHint ([string]$evidence.baselinePathHint)
+ $baselineStatus = "baseline was not present in CI"
+ }
+
+ if ($baselinePath) {
+ $itemAssets.Add([ordered]@{ kind = "baseline"; localPath = $baselinePath; assetPath = "$assetPrefix-baseline.png"; size = (Get-Item -LiteralPath $baselinePath).Length })
+ }
+
+ $itemBytes = (@($itemAssets | ForEach-Object { [long]$_.size }) | Measure-Object -Sum).Sum
+ if (($totalBytes + $itemBytes) -gt $MaxTotalBytes) {
+ # Items $index..Count (inclusive of the current one, which is being rejected for the byte
+ # cap) are untouched. Use the index-based remainder -- matching the publish-budget break
+ # above -- so comparisons that already failed preparation (counted in
+ # $preparationFailureCount) are not also double-counted here as omitted.
+ $omittedCount += [Math]::Max(0, $selectedEvidence.Count - $index + 1)
+ break
+ }
+ $totalBytes += $itemBytes
+ foreach ($asset in $itemAssets) {
+ $assets.Add($asset)
+ }
+
+ $prepared.Add([ordered]@{
+ testName = $(if ($evidence.testName) { [string]$evidence.testName } else { [System.IO.Path]::GetFileNameWithoutExtension($snapshotFileName) })
+ automatedTestName = [string]$evidence.automatedTestName
+ platform = [string]$evidence.platform
+ snapshotFileName = $snapshotFileName
+ description = $(if ($evidence.description) { [string]$evidence.description } else { [string]$evidence.kind })
+ buildId = $buildId
+ buildUrl = [string]$evidence.buildUrl
+ baselineRepositoryPath = $baselineRepositoryPath
+ baselineStatus = $baselineStatus
+ baselineAssetPath = $(if ($baselinePath) { "$assetPrefix-baseline.png" } else { $null })
+ actualAssetPath = "$assetPrefix-actual.png"
+ diffAssetPath = $(if ($diffPath) { "$assetPrefix-diff.png" } else { $null })
+ })
+ }
+ catch {
+ $preparationFailureCount++
+ $errors.Add("$snapshotFileName (build $buildId, run $runId, result $resultId): $($_.Exception.Message)")
+ }
+}
+
+if ($assets.Count -eq 0 -or $prepared.Count -eq 0) {
+ $message = "Visual comparisons were detected, but no bounded image set could be prepared for publishing."
+ if ($errors.Count -gt 0) {
+ $message += " " + ($errors.ToArray() -join " ")
+ }
+ $context | Add-Member -NotePropertyName visualAssets -NotePropertyValue ([ordered]@{
+ published = $false
+ omittedCount = $omittedCount
+ preparationFailureCount = $preparationFailureCount
+ errors = $errors.ToArray()
+ }) -Force
+ Save-Context -Context $context -Path $ContextJsonPath
+ Write-Warning $message
+ exit 0
+}
+
+try {
+ $headSha = [string]$context.pr.headRefOid
+ $headLabel = if ($headSha.Length -ge 7) { $headSha.Substring(0, 7) } else { "unknown" }
+ $assetCommit = Publish-GitAssets `
+ -Repository $Repository `
+ -Branch $AssetBranch `
+ -Assets $assets.ToArray() `
+ -CommitMessage "[skip ci] Store /review tests visuals for PR #$PrNumber at $headLabel" `
+ -Deadline $publishDeadline
+
+ $published = New-Object System.Collections.Generic.List[object]
+ foreach ($comparison in $prepared) {
+ $rawPrefix = "https://raw.githubusercontent.com/$Repository/$assetCommit/"
+ $published.Add([ordered]@{
+ testName = $comparison.testName
+ automatedTestName = $comparison.automatedTestName
+ platform = $comparison.platform
+ snapshotFileName = $comparison.snapshotFileName
+ description = $comparison.description
+ buildId = $comparison.buildId
+ buildUrl = $comparison.buildUrl
+ baselineRepositoryPath = $comparison.baselineRepositoryPath
+ baselineStatus = $comparison.baselineStatus
+ baselineUrl = $(if ($comparison.baselineAssetPath) { "$rawPrefix$($comparison.baselineAssetPath)" } else { $null })
+ actualUrl = "$rawPrefix$($comparison.actualAssetPath)"
+ diffUrl = $(if ($comparison.diffAssetPath) { "$rawPrefix$($comparison.diffAssetPath)" } else { $null })
+ })
+ }
+
+ $context | Add-Member -NotePropertyName visualAssets -NotePropertyValue ([ordered]@{
+ published = $true
+ branch = $AssetBranch
+ commit = $assetCommit
+ comparisonCount = $published.Count
+ omittedCount = $omittedCount
+ preparationFailureCount = $preparationFailureCount
+ comparisons = $published.ToArray()
+ errors = $errors.ToArray()
+ }) -Force
+ Save-Context -Context $context -Path $ContextJsonPath
+ Write-Host "Published $($published.Count) visual comparison(s) at asset commit $assetCommit."
+}
+catch {
+ # A Git/API failure occurred AFTER images were prepared. Preserve the omission and preparation
+ # counters already computed above -- discarding them (the prior behavior) rendered real omitted or
+ # failed comparisons as zero -- and append this failure to the existing error list. Set an explicit
+ # publicationFailed flag so the merger classifies this as a post-preparation publication failure
+ # instead of inferring it from a non-empty error list, which also holds pre-publication budget and
+ # omission messages emitted before any image was prepared.
+ $message = "Visual asset publishing failed without changing the deterministic test verdict: $($_.Exception.Message)"
+ $errors.Add($message)
+ $context | Add-Member -NotePropertyName visualAssets -NotePropertyValue ([ordered]@{
+ published = $false
+ publicationFailed = $true
+ omittedCount = $omittedCount
+ preparationFailureCount = $preparationFailureCount
+ errors = $errors.ToArray()
+ }) -Force
+ Save-Context -Context $context -Path $ContextJsonPath
+ Write-Warning $message
+}
+}
+finally {
+ Remove-VisualDownloadDirectory -Path $DownloadDirectory
+}
diff --git a/.github/workflows/copilot-review-tests.lock.yml b/.github/workflows/copilot-review-tests.lock.yml
index ee2c5c80614f..0a3df9bafb53 100644
--- a/.github/workflows/copilot-review-tests.lock.yml
+++ b/.github/workflows/copilot-review-tests.lock.yml
@@ -1,5 +1,5 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"ed85e47ab87b1207354be3a367c21b8c566d97aceb80ec42834fd64e9cf471b8","body_hash":"15f953ad260d4d86e27a2752118921b52bd24910c98322e88dd4ebaf40752c18","compiler_version":"v0.82.14","strict":true,"agent_id":"copilot","agent_model":"claude-opus-4.8","engine_versions":{"copilot":"1.0.71"}}
-# gh-aw-manifest: {"version":1,"secrets":["COPILOT_PAT_0","COPILOT_PAT_1","COPILOT_PAT_2","COPILOT_PAT_3","COPILOT_PAT_4","COPILOT_PAT_5","COPILOT_PAT_6","COPILOT_PAT_7","COPILOT_PAT_8","COPILOT_PAT_9","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"afc8ef0362fdea5c6431b7aeab4b017904e4c69530f30017507c28bff48c7498","body_hash":"14c66e233d3662f50998b006d0508f6a963dae8990b0822838e152d9e1939492","compiler_version":"v0.82.14","strict":true,"agent_id":"copilot","agent_model":"claude-opus-4.8","engine_versions":{"copilot":"1.0.71"}}
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_PAT_0","COPILOT_PAT_1","COPILOT_PAT_2","COPILOT_PAT_3","COPILOT_PAT_4","COPILOT_PAT_5","COPILOT_PAT_6","COPILOT_PAT_7","COPILOT_PAT_8","COPILOT_PAT_9","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"11d5960a326750d5838078e36cf38b85af677262","version":"v4"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"b6d1443e05b8716267fa19425b99aa4f12006b4a","version":"v0.82.14"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.1","digest":"sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.1@sha256:ad2a979c2cd8b50098e84938ca9c9c1580eb8e91526f101a90adfba7859b2c32"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]}
# This file was automatically generated by gh-aw (v0.82.14). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
#
# ___ _ _
@@ -47,6 +47,7 @@
# Custom actions used:
# - actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
# - actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+# - actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
# - actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
# - actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
# - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -71,6 +72,9 @@ on:
- created
- edited
# permissions: # Permissions applied to pre-activation job
+ # actions: read
+ # checks: read
+ # contents: write
# issues: write
# pull-requests: write
# roles: # Roles processed as role check in pre-activation job
@@ -109,12 +113,55 @@ on:
# else
# echo "should_run=false" >> "$GITHUB_OUTPUT"
# fi
- # - if: github.event_name == 'issue_comment' && steps.exact_command.outputs.should_run == 'true'
- # name: Hide the /review tests command comment as resolved when authorized
+ # - id: authorization
+ # if: github.event_name == 'issue_comment' && steps.exact_command.outputs.should_run == 'true'
+ # name: Authorize and hide the /review tests command comment
# uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
# with:
# github-token: ${{ github.token }}
- # script: "// Only hide when the command is exactly `/review tests` (should_run) AND the\n// commenter is an authorized collaborator (write/maintain/admin). This mirrors\n// the workflow's own role gate but is self-contained, so an unauthorized user's\n// comment is always left visible. A failed hide must not block activation.\n// Only act on newly-created comments. The gh-aw slash_command trigger also fires\n// on `edited`, so without this guard, editing any existing comment to say\n// `/review tests` would minimize that comment (and collapse its entire history).\nif (context.payload.action !== 'created') {\n core.info('Skipping hide: comment was edited, not created.');\n return;\n}\nconst { owner, repo } = context.repo;\nconst actor = context.actor;\nlet permission = 'none';\ntry {\n const res = await github.rest.repos.getCollaboratorPermissionLevel({ owner, repo, username: actor });\n permission = res.data.permission;\n} catch (e) {\n core.info(`Permission lookup for ${actor} failed: ${e.message}`);\n}\n// Must mirror the workflow `roles:` frontmatter (admin/maintain/write) — keep in sync.\nif (!['admin', 'maintain', 'write'].includes(permission)) {\n core.info(`Actor ${actor} is not an authorized collaborator (${permission}); leaving the /review tests comment.`);\n return;\n}\n// Minimize (hide as resolved) rather than delete: the rerun scanner replays the PR's\n// REST comment history, and minimized comments are still returned by the REST list\n// endpoint — only collapsed in the web UI. node_id is the comment's GraphQL global id.\nconst subjectId = context.payload.comment.node_id;\ntry {\n await github.graphql(\n `mutation($id: ID!) {\n minimizeComment(input: { subjectId: $id, classifier: RESOLVED }) {\n minimizedComment { isMinimized }\n }\n }`,\n { id: subjectId }\n );\n core.info(`Hid /review tests command comment ${subjectId} as resolved.`);\n} catch (e) {\n core.warning(`Could not hide /review tests command comment ${subjectId}: ${e.message}`);\n}\n"
+ # script: "// Only hide when the command is exactly `/review tests` (should_run) AND the\n// commenter is an authorized collaborator (write/maintain/admin). This mirrors\n// the workflow's own role gate but is self-contained, so an unauthorized user's\n// comment is always left visible. A failed hide must not block activation.\ncore.setOutput('authorized', 'false');\nconst { owner, repo } = context.repo;\nconst actor = context.actor;\nlet permission = 'none';\ntry {\n const res = await github.rest.repos.getCollaboratorPermissionLevel({ owner, repo, username: actor });\n permission = res.data.permission;\n} catch (e) {\n core.info(`Permission lookup for ${actor} failed: ${e.message}`);\n}\n// Must mirror the workflow `roles:` frontmatter (admin/maintain/write) — keep in sync.\nif (!['admin', 'maintain', 'write'].includes(permission)) {\n core.info(`Actor ${actor} is not an authorized collaborator (${permission}); leaving the /review tests comment.`);\n return;\n}\ncore.setOutput('authorized', 'true');\n// Only hide newly-created comments. The slash_command trigger also fires on\n// `edited`; an authorized edit may run, but must not collapse comment history.\nif (context.payload.action !== 'created') {\n core.info('Skipping hide: comment was edited, not created.');\n return;\n}\n// Minimize (hide as resolved) rather than delete: the rerun scanner replays the PR's\n// REST comment history, and minimized comments are still returned by the REST list\n// endpoint — only collapsed in the web UI. node_id is the comment's GraphQL global id.\nconst subjectId = context.payload.comment.node_id;\ntry {\n await github.graphql(\n `mutation($id: ID!) {\n minimizeComment(input: { subjectId: $id, classifier: RESOLVED }) {\n minimizedComment { isMinimized }\n }\n }`,\n { id: subjectId }\n );\n core.info(`Hid /review tests command comment ${subjectId} as resolved.`);\n} catch (e) {\n core.warning(`Could not hide /review tests command comment ${subjectId}: ${e.message}`);\n}\n"
+ # - if: steps.exact_command.outputs.should_run == 'true' && steps.check_membership.outputs.is_team_member == 'true' && steps.check_command_position.outputs.command_position_ok == 'true'
+ # name: Checkout trusted review scripts
+ # uses: actions/checkout@v4
+ # with:
+ # persist-credentials: false
+ # - continue-on-error: true
+ # env:
+ # BUILD_ID: ${{ inputs.build_id }}
+ # CHECK_NAME: ${{ inputs.check_name }}
+ # GH_TOKEN: ${{ github.token }}
+ # PR_NUMBER: ${{ github.event.issue.number || inputs.pr_number }}
+ # if: steps.exact_command.outputs.should_run == 'true' && steps.check_membership.outputs.is_team_member == 'true' && steps.check_command_position.outputs.command_position_ok == 'true'
+ # name: Gather test-failure context
+ # run: |
+ # set -euo pipefail
+ # if [ -z "${PR_NUMBER}" ]; then
+ # echo "PR number is required."
+ # exit 1
+ # fi
+ # args=(-PrNumber "${PR_NUMBER}" -OutputDirectory "CustomAgentLogsTmp/TestFailureReview")
+ # if [ -n "${BUILD_ID:-}" ]; then
+ # args+=(-BuildId "${BUILD_ID}")
+ # fi
+ # if [ -n "${CHECK_NAME:-}" ]; then
+ # args+=(-CheckName "${CHECK_NAME}")
+ # fi
+ # timeout -k 30s 20m pwsh .github/skills/review-test-failures/scripts/Gather-TestFailureContext.ps1 "${args[@]}"
+ # - continue-on-error: true
+ # env:
+ # GH_TOKEN: ${{ github.token }}
+ # PR_NUMBER: ${{ github.event.issue.number || inputs.pr_number }}
+ # if: steps.exact_command.outputs.should_run == 'true' && steps.check_membership.outputs.is_team_member == 'true' && steps.check_command_position.outputs.command_position_ok == 'true' && (github.event_name != 'workflow_dispatch' || inputs.suppress_output != true)
+ # name: Publish visual comparison assets
+ # run: "set -euo pipefail\ncontext=\"CustomAgentLogsTmp/TestFailureReview/${PR_NUMBER}/context.json\"\ntimeout -k 30s 16m pwsh .github/skills/review-test-failures/scripts/Publish-TestVisualAssets.ps1 \\\n -PrNumber \"${PR_NUMBER}\" \\\n -ContextJsonPath \"${context}\"\n"
+ # - if: steps.exact_command.outputs.should_run == 'true' && steps.check_membership.outputs.is_team_member == 'true' && steps.check_command_position.outputs.command_position_ok == 'true'
+ # name: Upload test-failure context
+ # uses: actions/upload-artifact@v7.0.1
+ # with:
+ # if-no-files-found: warn
+ # name: review-tests-context-${{ github.run_id }}
+ # path: CustomAgentLogsTmp/TestFailureReview/${{ github.event.issue.number || inputs.pr_number }}
+ # retention-days: 1
workflow_dispatch:
inputs:
aw_context:
@@ -411,6 +458,7 @@ jobs:
GH_AW_ENGINE_ID: "copilot"
GH_AW_EXPR_A77326CF: ${{ github.event.issue.number || inputs.pr_number }}
GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+ GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
GH_AW_INPUTS_BUILD_ID: ${{ inputs.build_id }}
GH_AW_INPUTS_CHECK_NAME: ${{ inputs.check_name }}
GH_AW_INPUTS_PR_NUMBER: ${{ inputs.pr_number }}
@@ -582,29 +630,18 @@ jobs:
path: /tmp/gh-aw
- name: Verify connectivity to AzDO and Helix
run: "set -euo pipefail\n\ncheck_url() {\n local label=\"$1\" url=\"$2\"\n local code\n code=$(curl -s -o /dev/null -w \"%{http_code}\" \"$url\")\n echo \"$label: HTTP $code\"\n}\n\necho \"=== AzDO API check ===\"\ncheck_url \"AzDO\" 'https://dev.azure.com/dnceng-public/public/_apis/build/builds?definitions=302&branchName=refs/heads/main&%24top=1&api-version=7.1'\n\necho \"=== Helix API check ===\"\ncheck_url \"Helix\" 'https://helix.dot.net/api/2019-06-17/jobs?count=1'\n"
- - env:
- BUILD_ID: ${{ inputs.build_id }}
- CHECK_NAME: ${{ inputs.check_name }}
- GH_TOKEN: ${{ github.token }}
+ - continue-on-error: true
+ name: Download test-failure context
+ uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+ with:
+ name: review-tests-context-${{ github.run_id }}
+ path: /tmp/gh-aw/agent/review-tests-context-${{ github.run_id }}/${{ github.event.issue.number || inputs.pr_number }}
+ - continue-on-error: true
+ env:
+ CONTEXT_PATH: /tmp/gh-aw/agent/review-tests-context-${{ github.run_id }}/${{ github.event.issue.number || inputs.pr_number }}/context.json
PR_NUMBER: ${{ github.event.issue.number || inputs.pr_number }}
- name: Gather test-failure context
- run: |-
- set -euo pipefail
-
- if [ -z "${PR_NUMBER}" ]; then
- echo "PR number is required."
- exit 1
- fi
-
- args=(-PrNumber "${PR_NUMBER}" -OutputDirectory "CustomAgentLogsTmp/TestFailureReview")
- if [ -n "${BUILD_ID:-}" ]; then
- args+=(-BuildId "${BUILD_ID}")
- fi
- if [ -n "${CHECK_NAME:-}" ]; then
- args+=(-CheckName "${CHECK_NAME}")
- fi
-
- pwsh .github/skills/review-test-failures/scripts/Gather-TestFailureContext.ps1 "${args[@]}"
+ name: Seal trusted visual merger inputs
+ run: "set -euo pipefail\nif [ ! -f \"${CONTEXT_PATH}\" ]; then\n echo \"No test-failure context artifact was available; continuing without trusted visual merge inputs.\"\n exit 0\nfi\ntrusted=\"${RUNNER_TEMP}/review-tests-trusted-${GITHUB_RUN_ID}-${PR_NUMBER}\"\nsudo install -d -o root -g root -m 0555 \"${trusted}\"\nsudo install -o root -g root -m 0444 \"${CONTEXT_PATH}\" \"${trusted}/context.json\"\nsudo install -o root -g root -m 0555 \\\n .github/skills/review-test-failures/scripts/Merge-TestVisualsIntoComment.ps1 \\\n \"${trusted}/Merge-TestVisualsIntoComment.ps1\""
- name: Configure Git credentials
env:
@@ -1096,6 +1133,13 @@ jobs:
if [ ! -f /tmp/gh-aw/agent_output.json ]; then
echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
fi
+ - continue-on-error: true
+ env:
+ PR_NUMBER: ${{ github.event.issue.number || inputs.pr_number }}
+ if: always()
+ name: Merge trusted visuals into the analysis comment
+ run: "set -euo pipefail\ntrusted=\"${RUNNER_TEMP}/review-tests-trusted-${GITHUB_RUN_ID}-${PR_NUMBER}\"\nagent_output=\"/tmp/gh-aw/agent_output.json\"\nif [ ! -f \"${agent_output}\" ] || [ ! -f \"${trusted}/context.json\" ]; then\n echo \"No agent comment payload or trusted visual context was available; leaving the ordinary analysis unchanged.\"\n exit 0\nfi\nunset COPILOT_GITHUB_TOKEN GH_TOKEN GITHUB_TOKEN GH_AW_GITHUB_TOKEN GH_AW_GITHUB_MCP_SERVER_TOKEN GITHUB_MCP_SERVER_TOKEN\npwsh \"${trusted}/Merge-TestVisualsIntoComment.ps1\" \\\n -PrNumber \"${PR_NUMBER}\" \\\n -Repository \"${GITHUB_REPOSITORY}\" \\\n -ContextJsonPath \"${trusted}/context.json\" \\\n -AgentOutputPath \"${agent_output}\""
+
- name: Upload agent artifacts
if: always()
continue-on-error: true
@@ -1713,12 +1757,16 @@ jobs:
runs-on: ubuntu-slim
environment: copilot-pat-pool
permissions:
+ actions: read
+ checks: read
+ contents: write
issues: write
pull-requests: write
env:
GH_AW_RUNTIME_FEATURES: ${{ vars.GH_AW_RUNTIME_FEATURES }}
outputs:
activated: ${{ steps.check_membership.outputs.is_team_member == 'true' && steps.check_command_position.outputs.command_position_ok == 'true' }}
+ authorization_result: ${{ steps.authorization.outcome }}
exact_command_result: ${{ steps.exact_command.outcome }}
exact_command_should_run: ${{ steps.exact_command.outputs.should_run }}
matched_command: ${{ steps.check_command_position.outputs.matched_command }}
@@ -1779,7 +1827,8 @@ jobs:
COMMENT_BODY: ${{ github.event.comment.body }}
EVENT_NAME: ${{ github.event_name }}
ISSUE_PULL_REQUEST_URL: ${{ github.event.issue.pull_request.url }}
- - name: Hide the /review tests command comment as resolved when authorized
+ - name: Authorize and hide the /review tests command comment
+ id: authorization
if: github.event_name == 'issue_comment' && steps.exact_command.outputs.should_run == 'true'
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
@@ -1789,13 +1838,7 @@ jobs:
// commenter is an authorized collaborator (write/maintain/admin). This mirrors
// the workflow's own role gate but is self-contained, so an unauthorized user's
// comment is always left visible. A failed hide must not block activation.
- // Only act on newly-created comments. The gh-aw slash_command trigger also fires
- // on `edited`, so without this guard, editing any existing comment to say
- // `/review tests` would minimize that comment (and collapse its entire history).
- if (context.payload.action !== 'created') {
- core.info('Skipping hide: comment was edited, not created.');
- return;
- }
+ core.setOutput('authorized', 'false');
const { owner, repo } = context.repo;
const actor = context.actor;
let permission = 'none';
@@ -1810,6 +1853,13 @@ jobs:
core.info(`Actor ${actor} is not an authorized collaborator (${permission}); leaving the /review tests comment.`);
return;
}
+ core.setOutput('authorized', 'true');
+ // Only hide newly-created comments. The slash_command trigger also fires on
+ // `edited`; an authorized edit may run, but must not collapse comment history.
+ if (context.payload.action !== 'created') {
+ core.info('Skipping hide: comment was edited, not created.');
+ return;
+ }
// Minimize (hide as resolved) rather than delete: the rerun scanner replays the PR's
// REST comment history, and minimized comments are still returned by the REST list
// endpoint — only collapsed in the web UI. node_id is the comment's GraphQL global id.
@@ -1827,6 +1877,53 @@ jobs:
} catch (e) {
core.warning(`Could not hide /review tests command comment ${subjectId}: ${e.message}`);
}
+ - name: Checkout trusted review scripts
+ if: steps.exact_command.outputs.should_run == 'true' && steps.check_membership.outputs.is_team_member == 'true' && steps.check_command_position.outputs.command_position_ok == 'true'
+ uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+ with:
+ persist-credentials: false
+ - name: Gather test-failure context
+ if: steps.exact_command.outputs.should_run == 'true' && steps.check_membership.outputs.is_team_member == 'true' && steps.check_command_position.outputs.command_position_ok == 'true'
+ run: |
+ set -euo pipefail
+ if [ -z "${PR_NUMBER}" ]; then
+ echo "PR number is required."
+ exit 1
+ fi
+ args=(-PrNumber "${PR_NUMBER}" -OutputDirectory "CustomAgentLogsTmp/TestFailureReview")
+ if [ -n "${BUILD_ID:-}" ]; then
+ args+=(-BuildId "${BUILD_ID}")
+ fi
+ if [ -n "${CHECK_NAME:-}" ]; then
+ args+=(-CheckName "${CHECK_NAME}")
+ fi
+ timeout -k 30s 20m pwsh .github/skills/review-test-failures/scripts/Gather-TestFailureContext.ps1 "${args[@]}"
+ env:
+ BUILD_ID: ${{ inputs.build_id }}
+ CHECK_NAME: ${{ inputs.check_name }}
+ GH_TOKEN: ${{ github.token }}
+ PR_NUMBER: ${{ github.event.issue.number || inputs.pr_number }}
+ continue-on-error: true
+ - name: Publish visual comparison assets
+ if: steps.exact_command.outputs.should_run == 'true' && steps.check_membership.outputs.is_team_member == 'true' && steps.check_command_position.outputs.command_position_ok == 'true' && (github.event_name != 'workflow_dispatch' || inputs.suppress_output != true)
+ run: |
+ set -euo pipefail
+ context="CustomAgentLogsTmp/TestFailureReview/${PR_NUMBER}/context.json"
+ timeout -k 30s 16m pwsh .github/skills/review-test-failures/scripts/Publish-TestVisualAssets.ps1 \
+ -PrNumber "${PR_NUMBER}" \
+ -ContextJsonPath "${context}"
+ env:
+ GH_TOKEN: ${{ github.token }}
+ PR_NUMBER: ${{ github.event.issue.number || inputs.pr_number }}
+ continue-on-error: true
+ - name: Upload test-failure context
+ if: steps.exact_command.outputs.should_run == 'true' && steps.check_membership.outputs.is_team_member == 'true' && steps.check_command_position.outputs.command_position_ok == 'true'
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ if-no-files-found: warn
+ name: review-tests-context-${{ github.run_id }}
+ path: CustomAgentLogsTmp/TestFailureReview/${{ github.event.issue.number || inputs.pr_number }}
+ retention-days: 1
safe_outputs:
needs:
diff --git a/.github/workflows/copilot-review-tests.md b/.github/workflows/copilot-review-tests.md
index f9d0cea129d8..921755f0d3e0 100644
--- a/.github/workflows/copilot-review-tests.md
+++ b/.github/workflows/copilot-review-tests.md
@@ -30,6 +30,9 @@ on:
# pull-requests:write — issues:write alone yields "Resource not accessible by
# integration" on PR conversation comments.
permissions:
+ actions: read
+ checks: read
+ contents: write
issues: write
pull-requests: write
steps:
@@ -51,7 +54,8 @@ on:
else
echo "should_run=false" >> "$GITHUB_OUTPUT"
fi
- - name: Hide the /review tests command comment as resolved when authorized
+ - name: Authorize and hide the /review tests command comment
+ id: authorization
if: github.event_name == 'issue_comment' && steps.exact_command.outputs.should_run == 'true'
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
@@ -61,13 +65,7 @@ on:
// commenter is an authorized collaborator (write/maintain/admin). This mirrors
// the workflow's own role gate but is self-contained, so an unauthorized user's
// comment is always left visible. A failed hide must not block activation.
- // Only act on newly-created comments. The gh-aw slash_command trigger also fires
- // on `edited`, so without this guard, editing any existing comment to say
- // `/review tests` would minimize that comment (and collapse its entire history).
- if (context.payload.action !== 'created') {
- core.info('Skipping hide: comment was edited, not created.');
- return;
- }
+ core.setOutput('authorized', 'false');
const { owner, repo } = context.repo;
const actor = context.actor;
let permission = 'none';
@@ -82,6 +80,13 @@ on:
core.info(`Actor ${actor} is not an authorized collaborator (${permission}); leaving the /review tests comment.`);
return;
}
+ core.setOutput('authorized', 'true');
+ // Only hide newly-created comments. The slash_command trigger also fires on
+ // `edited`; an authorized edit may run, but must not collapse comment history.
+ if (context.payload.action !== 'created') {
+ core.info('Skipping hide: comment was edited, not created.');
+ return;
+ }
// Minimize (hide as resolved) rather than delete: the rerun scanner replays the PR's
// REST comment history, and minimized comments are still returned by the REST list
// endpoint — only collapsed in the web UI. node_id is the comment's GraphQL global id.
@@ -99,6 +104,77 @@ on:
} catch (e) {
core.warning(`Could not hide /review tests command comment ${subjectId}: ${e.message}`);
}
+ - name: Checkout trusted review scripts
+ if: >-
+ steps.exact_command.outputs.should_run == 'true' &&
+ steps.check_membership.outputs.is_team_member == 'true' &&
+ steps.check_command_position.outputs.command_position_ok == 'true'
+ uses: actions/checkout@v4
+ with:
+ persist-credentials: false
+ - name: Gather test-failure context
+ if: >-
+ steps.exact_command.outputs.should_run == 'true' &&
+ steps.check_membership.outputs.is_team_member == 'true' &&
+ steps.check_command_position.outputs.command_position_ok == 'true'
+ # Resilience: a transient failure gathering context (AzDO/Helix/network) must
+ # NOT fail the pre-activation job, otherwise the agent job — which is designed
+ # to post a short failure report when the context files are missing (see the
+ # prompt's pre-flight below) — is skipped entirely and the run goes silent.
+ # The whole downstream already tolerates a missing context.json (the artifact
+ # download is continue-on-error, the seal/merge steps exit 0 when it's absent).
+ continue-on-error: true
+ env:
+ GH_TOKEN: ${{ github.token }}
+ PR_NUMBER: ${{ github.event.issue.number || inputs.pr_number }}
+ BUILD_ID: ${{ inputs.build_id }}
+ CHECK_NAME: ${{ inputs.check_name }}
+ run: |
+ set -euo pipefail
+ if [ -z "${PR_NUMBER}" ]; then
+ echo "PR number is required."
+ exit 1
+ fi
+ args=(-PrNumber "${PR_NUMBER}" -OutputDirectory "CustomAgentLogsTmp/TestFailureReview")
+ if [ -n "${BUILD_ID:-}" ]; then
+ args+=(-BuildId "${BUILD_ID}")
+ fi
+ if [ -n "${CHECK_NAME:-}" ]; then
+ args+=(-CheckName "${CHECK_NAME}")
+ fi
+ timeout -k 30s 20m pwsh .github/skills/review-test-failures/scripts/Gather-TestFailureContext.ps1 "${args[@]}"
+ - name: Publish visual comparison assets
+ if: >-
+ steps.exact_command.outputs.should_run == 'true' &&
+ steps.check_membership.outputs.is_team_member == 'true' &&
+ steps.check_command_position.outputs.command_position_ok == 'true' &&
+ (github.event_name != 'workflow_dispatch' || inputs.suppress_output != true)
+ continue-on-error: true
+ env:
+ GH_TOKEN: ${{ github.token }}
+ PR_NUMBER: ${{ github.event.issue.number || inputs.pr_number }}
+ run: |
+ set -euo pipefail
+ context="CustomAgentLogsTmp/TestFailureReview/${PR_NUMBER}/context.json"
+ timeout -k 30s 16m pwsh .github/skills/review-test-failures/scripts/Publish-TestVisualAssets.ps1 \
+ -PrNumber "${PR_NUMBER}" \
+ -ContextJsonPath "${context}"
+ - name: Upload test-failure context
+ if: >-
+ steps.exact_command.outputs.should_run == 'true' &&
+ steps.check_membership.outputs.is_team_member == 'true' &&
+ steps.check_command_position.outputs.command_position_ok == 'true'
+ uses: actions/upload-artifact@v7.0.1
+ with:
+ name: review-tests-context-${{ github.run_id }}
+ path: CustomAgentLogsTmp/TestFailureReview/${{ github.event.issue.number || inputs.pr_number }}
+ # 'warn' (not 'error'): with the gather step now allowed to fail, an empty or
+ # absent context directory must not fail the pre-activation job. Failing here
+ # would skip the agent job and its documented "post a short failure report"
+ # fallback; the missing artifact is instead surfaced as a log warning and the
+ # download step (continue-on-error) + seal/merge no-file guards handle absence.
+ if-no-files-found: warn
+ retention-days: 1
workflow_dispatch:
inputs:
pr_number:
@@ -201,29 +277,55 @@ steps:
echo "=== Helix API check ==="
check_url "Helix" 'https://helix.dot.net/api/2019-06-17/jobs?count=1'
- - name: Gather test-failure context
+ - name: Download test-failure context
+ continue-on-error: true
+ uses: actions/download-artifact@v8.0.1
+ with:
+ name: review-tests-context-${{ github.run_id }}
+ path: /tmp/gh-aw/agent/review-tests-context-${{ github.run_id }}/${{ github.event.issue.number || inputs.pr_number }}
+ - name: Seal trusted visual merger inputs
+ # Supplementary visual-merge setup. If sealing the trusted inputs fails (e.g. a sudo/install
+ # filesystem error) do NOT fail the whole review — the ordinary analysis comment must still
+ # post. This stays fail-closed: the downstream merge step reads ONLY the root-owned trusted
+ # dir and no-ops when "${trusted}/context.json" is absent, so a failed seal can never merge
+ # untrusted PR-controlled inputs.
+ continue-on-error: true
env:
- GH_TOKEN: ${{ github.token }}
PR_NUMBER: ${{ github.event.issue.number || inputs.pr_number }}
- BUILD_ID: ${{ inputs.build_id }}
- CHECK_NAME: ${{ inputs.check_name }}
+ CONTEXT_PATH: /tmp/gh-aw/agent/review-tests-context-${{ github.run_id }}/${{ github.event.issue.number || inputs.pr_number }}/context.json
run: |
set -euo pipefail
-
- if [ -z "${PR_NUMBER}" ]; then
- echo "PR number is required."
- exit 1
+ if [ ! -f "${CONTEXT_PATH}" ]; then
+ echo "No test-failure context artifact was available; continuing without trusted visual merge inputs."
+ exit 0
fi
-
- args=(-PrNumber "${PR_NUMBER}" -OutputDirectory "CustomAgentLogsTmp/TestFailureReview")
- if [ -n "${BUILD_ID:-}" ]; then
- args+=(-BuildId "${BUILD_ID}")
- fi
- if [ -n "${CHECK_NAME:-}" ]; then
- args+=(-CheckName "${CHECK_NAME}")
+ trusted="${RUNNER_TEMP}/review-tests-trusted-${GITHUB_RUN_ID}-${PR_NUMBER}"
+ sudo install -d -o root -g root -m 0555 "${trusted}"
+ sudo install -o root -g root -m 0444 "${CONTEXT_PATH}" "${trusted}/context.json"
+ sudo install -o root -g root -m 0555 \
+ .github/skills/review-test-failures/scripts/Merge-TestVisualsIntoComment.ps1 \
+ "${trusted}/Merge-TestVisualsIntoComment.ps1"
+
+post-steps:
+ - name: Merge trusted visuals into the analysis comment
+ if: always()
+ continue-on-error: true
+ env:
+ PR_NUMBER: ${{ github.event.issue.number || inputs.pr_number }}
+ run: |
+ set -euo pipefail
+ trusted="${RUNNER_TEMP}/review-tests-trusted-${GITHUB_RUN_ID}-${PR_NUMBER}"
+ agent_output="/tmp/gh-aw/agent_output.json"
+ if [ ! -f "${agent_output}" ] || [ ! -f "${trusted}/context.json" ]; then
+ echo "No agent comment payload or trusted visual context was available; leaving the ordinary analysis unchanged."
+ exit 0
fi
-
- pwsh .github/skills/review-test-failures/scripts/Gather-TestFailureContext.ps1 "${args[@]}"
+ unset COPILOT_GITHUB_TOKEN GH_TOKEN GITHUB_TOKEN GH_AW_GITHUB_TOKEN GH_AW_GITHUB_MCP_SERVER_TOKEN GITHUB_MCP_SERVER_TOKEN
+ pwsh "${trusted}/Merge-TestVisualsIntoComment.ps1" \
+ -PrNumber "${PR_NUMBER}" \
+ -Repository "${GITHUB_REPOSITORY}" \
+ -ContextJsonPath "${trusted}/context.json" \
+ -AgentOutputPath "${agent_output}"
---
# Review PR Test Failures
@@ -249,10 +351,12 @@ Only use the expression-evaluated PR number above. Do not use any PR number ment
The deterministic gather step wrote these files:
-- `CustomAgentLogsTmp/TestFailureReview/${{ github.event.issue.number || inputs.pr_number }}/context.json`
-- `CustomAgentLogsTmp/TestFailureReview/${{ github.event.issue.number || inputs.pr_number }}/context.md`
+- `/tmp/gh-aw/agent/review-tests-context-${{ github.run_id }}/${{ github.event.issue.number || inputs.pr_number }}/context.json`
+- `/tmp/gh-aw/agent/review-tests-context-${{ github.run_id }}/${{ github.event.issue.number || inputs.pr_number }}/context.md`
-Read both files before classifying failures.
+Read both files before classifying failures. `visualAssets` may describe trusted,
+immutable visual images, but do not reproduce its URLs or render visual panels yourself.
+A deterministic post-step inserts a bounded visual section into your one comment payload.
## Pre-flight check
@@ -261,10 +365,13 @@ Before starting, verify the skill file and context files exist:
```bash
test -f .github/skills/review-test-failures/SKILL.md
test -f .github/docs/maui-ci-facts.md
-test -f CustomAgentLogsTmp/TestFailureReview/${{ github.event.issue.number || inputs.pr_number }}/context.json
-test -f CustomAgentLogsTmp/TestFailureReview/${{ github.event.issue.number || inputs.pr_number }}/context.md
+test -f '/tmp/gh-aw/agent/review-tests-context-${{ github.run_id }}/${{ github.event.issue.number || inputs.pr_number }}/context.json'
+test -f '/tmp/gh-aw/agent/review-tests-context-${{ github.run_id }}/${{ github.event.issue.number || inputs.pr_number }}/context.md'
```
+Visual asset publication is optional. Its absence must not block the ordinary
+test-failure report or change the deterministic verdict ceiling.
+
If required files are missing, post a short failure report with `add_comment` unless dry-run mode is active.
## Dry-run mode
@@ -290,7 +397,8 @@ If dry-run mode is not active, call `add_comment` exactly once with `item_number
## Tests Failure Analysis
> @[PR author] — test-failure review results are available based on commit [`[sha7]`]([commit URL]).
-> To request a fresh review after new comments, commits, or CI runs, comment `/review tests`.
+
+> Maintainers can request a fresh review after new comments, commits, or CI runs by commenting `/review tests`.
![Overall [verdict]](https://img.shields.io/badge/Overall-[verdict]-[overallColor]?labelColor=30363d&style=flat-square)
@@ -312,6 +420,8 @@ If dry-run mode is not active, call `add_comment` exactly once with `item_number
**Builds (this PR):** [build definition + ID links]. **Base sampling ([base branch], [N] recent build(s) per definition — the actual `baseSampleCount`):** [recent base build ID links].
+
+
### Recommended action
[One concise recommendation.]
@@ -331,4 +441,10 @@ Do not use colorful emojis anywhere in the posted comment; the only status glyph
Use Markdown links, not raw `` tags. gh-aw safe outputs sanitize raw anchors before posting.
-Do not use `` anywhere. Every collapsible section must be collapsed by default.
\ No newline at end of file
+Do not embed, link, summarize, or reproduce individual visual images yourself. Emit the
+`` placeholder exactly once inside the main collapsible.
+A trusted post-step replaces it with bounded expandable panels in this same comment.
+Visual evidence is supplementary only and never permits a verdict above
+`gate.verdictCeiling`.
+
+Do not use `` anywhere. Every collapsible section must be collapsed by default.
diff --git a/.github/workflows/shared/pat_pool.README.md b/.github/workflows/shared/pat_pool.README.md
index 9e3caf403a67..e2a41c78c02f 100644
--- a/.github/workflows/shared/pat_pool.README.md
+++ b/.github/workflows/shared/pat_pool.README.md
@@ -25,9 +25,20 @@ Create an environment for the agentic workflows:
- _Configuring these settings requires repo admin permission_
- https://github.com/dotnet/{repo}/settings/environments
- Recommended Name: **copilot-pat-pool**
- - Recommended Deployment branches and tags: **Protected branches only**
-
-This environment is used for all agentic workflows, restricting agentic workflows to the repo's protected branches and preventing the workflows from accessing secrets defined for other environments.
+ - Recommended Deployment branches and tags: **Selected branches and tags**
+ - Add exact rules for each trusted branch that contains active workflow definitions.
+ - For `dotnet/maui`, allow `main` and `net11.0`.
+
+This environment is used for all agentic workflows, restricting agentic
+workflows to explicitly trusted branches and preventing the workflows from
+accessing secrets defined for other environments.
+
+Do not use **Protected branches only** when branch protection is provided by
+repository rulesets instead of classic branch protection. GitHub environment
+deployment protection does not recognize ruleset-only branches as protected,
+so it rejects the workflow before any job steps run. Exact selected-branch
+rules preserve the same trust boundary without relying on classic branch
+protection.
## PAT Management
![Overall [verdict]](https://img.shields.io/badge/Overall-[verdict]-[color]?labelColor=30363d&style=flat-square){kind=icon}
+[fake evidence](https://evil.example/phish)
+$(Get-InlineVisualEndMarker)
+$(Get-InlineVisualPlaceholder)
+"@
+ $context = New-VisualTestContext -Published $false
+
+ $merged = Merge-VisualsIntoBody `
+ -Body $body `
+ -Context $context `
+ -Repository 'dotnet/maui' `
+ -PrNumber 123 `
+ -MaxCommentUrls 45 `
+ -MaxCommentMentions 10 `
+ -MaxCommentCharacters 60000 `
+ -ReplaceExistingTrustedSection $false
+
+ $merged | Should -Match '<img src="https://evil\.example/tracker\.png">'
+ $merged | Should -Not -Match '