Auto-merge clean inter-branch forward merges

.github/policies/resourceManagement.yml

@@ -718,5 +718,46 @@ configuration:
       - addLabel:
           label: partner/syncfusion
       description: Add 'partner/syncfusion' label to issues opened by the Syncfusion partner team
+    - if:
+      - payloadType: Pull_Request
+      - isPullRequest
+      - isActivitySender:
+          user: github-actions[bot]
+          issueAuthor: False
+      - isActivitySender:
+          issueAuthor: True
+      - isAction:
+          action: Opened
+      - or:
+        - and:
+          - targetsBranch:
+              branch: net11.0
+          - titleContains:
+              pattern: '^\[automated\] Merge branch ''main'' => ''net11\.0''$'
+              isRegex: True
+        - and:
+          - targetsBranch:
+              branch: release/11.0.1xx-preview7
+          - titleContains:
+              pattern: '^\[automated\] Merge branch ''net11\.0'' => ''release/11\.0\.1xx-preview7''$'
+              isRegex: True
+        - and:
+          - targetsBranch:
+              branch: release/11.0.1xx-rc1
+          - titleContains:
+              pattern: '^\[automated\] Merge branch ''net11\.0'' => ''release/11\.0\.1xx-rc1''$'
+              isRegex: True
+        - and:
+          - targetsBranch:
+              branch: release/11.0.1xx-rc2
+          - titleContains:
+              pattern: '^\[automated\] Merge branch ''net11\.0'' => ''release/11\.0\.1xx-rc2''$'
+              isRegex: True
+      then:
+      - approvePullRequest:
+          comment: Auto-approved automated inter-branch merge.
+      - enableAutoMerge:
+          mergeMethod: merge
+      description: '[Inter-branch merge] Auto-approve and enable auto-merge for exact forward-merge flows'
 onFailure: 
 onSuccess: 

.github/workflows/merge-main-to-net11.yml

@@ -7,7 +7,7 @@
 #   - ResetToTargetPaths: auto-resets version files to target branch versions
 #   - QuietComments: reduces GitHub notification noise
 #   - Skips PRs when only Maestro bot commits exist
-#   - Updates existing open PR instead of creating new ones
+#   - Keeps each generated PR immutable while CI runs; later commits flow in the next PR
 
 name: Merge main to net11.0
 
@@ -25,8 +25,46 @@ permissions:
   contents: write
   pull-requests: write
 
+concurrency:
+  group: merge-main-to-net11
+  cancel-in-progress: false
+
 jobs:
+  CheckForOpenMergePullRequest:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      should_run: ${{ steps.check.outputs.should_run }}
+    steps:
+      - name: Check for an open main to net11.0 merge PR
+        id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          pr_number="$(gh pr list \
+            --repo "$REPOSITORY" \
+            --state open \
+            --app 'github-actions' \
+            --head 'merge/main-to-net11.0' \
+            --base 'net11.0' \
+            --limit 100 \
+            --json number,isCrossRepository \
+            --jq '[.[] | select(.isCrossRepository == false)][0].number // empty')"
+
+          if [[ -n "$pr_number" ]]; then
+            echo "Merge PR #$pr_number is still open; leaving its branch unchanged while CI runs."
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "No open main to net11.0 merge PR exists."
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+          fi
+
   Merge:
+    needs: CheckForOpenMergePullRequest
+    if: needs.CheckForOpenMergePullRequest.outputs.should_run == 'true'
     uses: dotnet/arcade/.github/workflows/inter-branch-merge-base.yml@main
     with:
       configuration_file_path: 'github-merge-flow-net11.jsonc'

.github/workflows/merge-net11-to-release.yml

@@ -4,7 +4,7 @@
 # This workflow must be triggered FROM the net11.0 branch because the arcade merge
 # script uses GITHUB_REF_NAME as the config lookup key. When triggered via
 # workflow_dispatch from the GitHub UI, select 'net11.0' from the branch dropdown.
-# The schedule trigger only works when this file exists on net11.0.
+# The default-branch schedule dispatches a second run from net11.0.
 
 name: Merge net11.0 to next release
 
@@ -20,10 +20,147 @@ permissions:
   contents: write
   pull-requests: write
 
+concurrency:
+  group: merge-net11-to-release
+  cancel-in-progress: false
+
 jobs:
+  DispatchScheduledRun:
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
+    steps:
+      - name: Check that net11.0 has the immutable-snapshot gate
+        id: current
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          main_workflow="$RUNNER_TEMP/merge-net11-to-release-main.yml"
+          net11_workflow="$RUNNER_TEMP/merge-net11-to-release-net11.yml"
+
+          if ! gh api \
+            -H "Accept: application/vnd.github.raw+json" \
+            "repos/$REPOSITORY/contents/.github/workflows/merge-net11-to-release.yml?ref=main" \
+            > "$main_workflow"; then
+            echo "::error::Failed to read the workflow on main."
+            exit 1
+          fi
+
+          if ! gh api \
+            -H "Accept: application/vnd.github.raw+json" \
+            "repos/$REPOSITORY/contents/.github/workflows/merge-net11-to-release.yml?ref=net11.0" \
+            > "$net11_workflow"; then
+            echo "::error::Failed to read the workflow on net11.0."
+            exit 1
+          fi
+
+          if ruby - "$main_workflow" "$net11_workflow" <<'RUBY'
+          require 'yaml'
+
+          main = YAML.safe_load_file(ARGV[0], aliases: true)
+          net11 = YAML.safe_load_file(ARGV[1], aliases: true)
+
+          safety_sections = [
+            ['concurrency'],
+            ['jobs', 'CheckForOpenMergePullRequest'],
+            ['jobs', 'Merge']
+          ]
+
+          def section(workflow, path)
+            path.reduce(workflow) { |value, key| value&.fetch(key, nil) }
+          end
+
+          exit(safety_sections.all? { |path| section(main, path) == section(net11, path) } ? 0 : 2)
+          RUBY
+          then
+            echo "should_dispatch=true" >> "$GITHUB_OUTPUT"
+          else
+            validation_exit="$?"
+            if [[ "$validation_exit" -eq 2 ]]; then
+              echo "::notice::net11.0 does not have the current immutable-snapshot gate yet; skipping the scheduled dispatch."
+              echo "should_dispatch=false" >> "$GITHUB_OUTPUT"
+            else
+              echo "::error::Failed to validate the workflow on net11.0."
+              exit 1
+            fi
+          fi
+
+      - name: Dispatch the scheduled run from net11.0
+        if: steps.current.outputs.should_dispatch == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+        run: gh workflow run merge-net11-to-release.yml --repo "$REPOSITORY" --ref net11.0
+
+  CheckForOpenMergePullRequest:
+    if: github.event_name != 'schedule' && github.ref_name == 'net11.0'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      should_run: ${{ steps.check.outputs.should_run }}
+    steps:
+      - name: Resolve the current release target
+        id: target
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          $configText = gh api `
+            -H "Accept: application/vnd.github.raw+json" `
+            "repos/$env:REPOSITORY/contents/github-merge-flow-release-11.jsonc?ref=net11.0" |
+            Out-String
+
+          if ($LASTEXITCODE -ne 0)
+          {
+            throw "Failed to read the net11.0 merge-flow configuration."
+          }
+
+          $config = $configText | ConvertFrom-Json
+          $mergeToBranch = $config.'merge-flow-configurations'.'net11.0'.MergeToBranch
+
+          if ($mergeToBranch -notmatch '^release/[A-Za-z0-9._/-]+$')
+          {
+            throw "Invalid MergeToBranch value '$mergeToBranch'."
+          }
+
+          "merge_to_branch=$mergeToBranch" >> $env:GITHUB_OUTPUT
+
+      - name: Check for an open net11.0 to release merge PR
+        id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MERGE_TO_BRANCH: ${{ steps.target.outputs.merge_to_branch }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          pr_number="$(gh pr list \
+            --repo "$REPOSITORY" \
+            --state open \
+            --app github-actions \
+            --head "merge/net11.0-to-$MERGE_TO_BRANCH" \
+            --base "$MERGE_TO_BRANCH" \
+            --limit 100 \
+            --json number,isCrossRepository \
+            --jq '[.[] | select(.isCrossRepository == false)][0].number // empty')"
+
+          if [[ -n "$pr_number" ]]; then
+            echo "Merge PR #$pr_number is still open; leaving its branch unchanged while CI runs."
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "No open net11.0 to release merge PR exists."
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+          fi
+
   Merge:
+    needs: CheckForOpenMergePullRequest
     # Only run if triggered from net11.0 (push trigger or correct workflow_dispatch)
-    if: github.ref_name == 'net11.0'
+    if: github.ref_name == 'net11.0' && needs.CheckForOpenMergePullRequest.outputs.should_run == 'true'
     uses: dotnet/arcade/.github/workflows/inter-branch-merge-base.yml@main
     with:
+      configuration_file_branch: 'net11.0'
       configuration_file_path: 'github-merge-flow-release-11.jsonc'