Fix regression scanner attribution source

[PureWeen]

Note

Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!

Summary

• Keep merged regression-fix discovery structural-only by removing body from gh pr list.
• Fetch each fix PR's body and author_association atomically from the REST issue resource, then use that REST body for linked-issue discovery and trusted attribution.
• Extract the deterministic attribution orchestration into a helper and add regression coverage proving search-list bodies are not required.

This is a focused follow-up to #35925. It avoids disabling gh-aw integrity filtering and leaves the workflow source and generated lock unchanged.

Production-shaped verification

A local 60-day scan with MaxPRs=1 now resolves fix PR #35768 to introducing PR #31931 at af540589fc5a3b053cd8c08334d0ca5a0125451b, reports attribution source pr-body, and emits usableCount: 1.

Validation

• Pester: 77 passed
• gh aw compile regression-corpus-scanner with source/lock parity
• Vally 0.10.0 strict lint for .github/skills/code-review/tests/eval.vally.yaml
• git diff --check
• Three-reviewer adversarial consensus: clean

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 36686

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 36686"

[Copilot]

Pull request overview

This PR adjusts the regression-fix PR discovery/attribution flow used by the regression-corpus scanner to keep the initial GitHub search results structural-only while still enabling deterministic linked-issue discovery and trusted introducing-PR attribution.

Changes:

• Remove body from gh pr list results in Get-MergedRegressionFixPRs to keep merged-fix discovery structural-only.
• Add Get-FixPrContext to fetch the fix PR’s REST issue body + author_association together, and introduce Get-RegressionAttributionContext to centralize deterministic attribution orchestration.
• Extend Pester coverage to validate that attribution works without relying on gh pr list bodies, and that untrusted fix bodies are used for issue discovery but not attribution.

Show a summary per file

File	Description
.github/scripts/Find-RegressionFixPRs.ps1	Switches fix PR discovery to omit body from search results; adds REST-backed fix context + shared attribution orchestrator to keep attribution deterministic and trust-aware.
.github/scripts/Find-RegressionFixPRs.Tests.ps1	Updates/extends unit tests to cover the new REST-backed context and attribution behavior, including coverage for “search results omit body” scenarios.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 0

[kubaflo]

🔍 AI-generated review — automated multi-model consensus (Claude Opus 4.8 · GPT-5.5 · Gemini 3.1 Pro), run on behalf of @kubaflo. Independent reviews → cross-pollinated → synthesized. This is a COMMENT (not an approval).

✅ LGTM — with two low, non-blocking notes

A faithful, security-improving refactor of the regression-scanner attribution path (follow-up to #35925). Opus dot-sourced the head functions, ran the full Pester suite (77/77 pass), and empirically exercised the null-context path; GPT concurred with no findings. Consensus verdict is LGTM.

Verified:

• Logic-preserving on the trusted path — Get-RegressionAttributionContext faithfully extracts the old inlined loop: same source ordering (comment-before-body), same trusted-only gating for pr-body/issue-body, same fix/linked-issue exclusion + first-reference break. The one divergence (new -and $fixPrBody guard) is outcome-neutral (an empty body yields no references).
• Integrity gap genuinely closed — discovery and the trust signal now both derive from the single REST issue fetch in Get-FixPrContext, so differently-filtered data (search-list body vs REST body) is never combined. author_association from the issue resource is the correct trust signal for a PR; untrusted PR body drives discovery only, and every attribution source (pr-body/issue-body/issue-comment) is trust-gated. The trusted path is sealed against spoofing.
• No new bugs — $null / PSCustomObject / missing-Body all resolve to '' safely; list flow returns correctly downstream.

---

Optional (non-blocking) — your call, @PureWeen

1. Fail-closed on a fix-PR REST hiccup drops discovery and attribution for that candidate. .github/scripts/Find-RegressionFixPRs.ps1 — when Get-FixPrContext returns $null (transient 5xx / rate-limit / network), $fixPrBody='' → no linked-issue discovery and the candidate collapses to needsHumanAttribution. Base main ran discovery off the search-list $pr.body independently of the association fetch, so a transient failure there only dropped the pr-body source. All three models agree this new behavior is the correct fail-closed direction for a security-sensitive attribution pipeline and it self-heals (the scheduled scan re-lists merged PRs within the lookback window), so it's a conscious-sign-off item, not a defect. Consider a per-PR "fix context unavailable; skipping" log line for observability (Invoke-GhJson -AllowFailure already warns).

2. Add a null-context test. .github/scripts/Find-RegressionFixPRs.Tests.ps1 — the new tests cover the trusted-body and untrusted-body-discovery-only paths, but not Get-RegressionAttributionContext -FixPrContext $null (precisely the behavioral change above), nor comment-before-body precedence inside the extracted helper. Suggest an It asserting empty LinkedIssueNumbers / null attribution and Should -Invoke Get-IssueContext -Times 0.

Neither blocks merge.

ℹ️ Per policy this bot posts a comment, not a formal approval — merge/approve is @kubaflo's call.

_{Models: claude-opus-4.8 (LGTM), gpt-5.5 (LGTM), gemini-3.1-pro-preview (flagged #1 as medium; reconciled to low by the suite-run + null-path probe) · consensus: LGTM · confidence: high · findings: 2 low / 0 blocking}

[kubaflo]

LGTM — approving.

Standing 3-model review (Opus 4.8 / GPT-5.5 / Gemini 3.1 Pro) at this head reached LGTM consensus: the regression-scanner attribution-source fix is correct and fail-closed behavior is preserved. Only two low, non-blocking notes were raised (fail-closed REST-hiccup sign-off; a null-context test) — neither blocks merge.

CI is clean (required checks green; only the advisory Build Analysis is pending).

🤖 AI-generated review (GitHub Copilot CLI, on behalf of @kubaflo).