[automated] Merge branch 'main' => 'net11.0' - #36886
Merged
Merged
Conversation
…lies (#34884) <!-- Please let the below note in for people that find this PR --> > [!NOTE] > Are you waiting for the changes in this PR to be merged? > It would be very helpful if you could [test the resulting artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from this PR and let us know in a comment if this change resolves your issue. Thank you! ## Summary Escalates the code-review skill's **Blast Radius Assessment** so it also fires for behavioral changes to .NET MAUI's frequently-regressed component families, and defines what a reviewer should actually do when the change is prose rather than code. **Scope: one file, `.github/skills/code-review/SKILL.md`.** No eval, test, or product code changes. >⚠️ **This description was previously inaccurate.** It described adding 3 scenarios to `.github/skills/code-review/tests/eval.yaml` (6 → 9), `expect_activation: false` flags, and a changelog header. None of that is in this PR — and none of it exists in the repo: `eval.yaml` was deleted when the suite migrated to Vally (`ee47f113d5`), `expect_activation` appears nowhere, and the cited `review-rules.md` does not exist. Rewritten to match the diff. ### Changes **Step 6 — Blast Radius Assessment** - Extends the mandatory Blast-Radius + Failure-Mode escalation to the eight frequently-regressed families: CollectionView, CarouselView, Image/Graphics, Theme/Style, Gesture/Tap, Button/Entry, Toolbar, Shell/TabBar. The list is stated inline and is sufficient on its own; `.github/agents/maui-expert-reviewer.md`'s `Frequently Regressed Components` table mirrors it with per-family risk areas and is read for that detail when present. - Forbids claiming the Step 2 expert reviewer's Regression Prevention dimension "fired." Its output is findings-only, so an empty result cannot distinguish *ran and found nothing* from *never ran* — the reviewer runs the probes itself either way. - Carves out genuinely inert prose, but defines what is **not** inert (public API docs, analyzer/compiler directives, agent-instruction files this repo executes, comments encoding a precondition) and gives those changes probes that are actually answerable — the contract the text encodes — rather than routing them into runtime questions about startup ordering and `PlatformView` nullity. **Step 1 — retrieval robustness** - A failed or unauthenticated retrieval command is a fact about one tool, not about the review. Directs a retry through another read-only route instead of asking the caller to paste the diff. **Review output template** - The Blast Radius gloss said infrastructure/handler/platform only, so a reviewer following the template could omit the section for either trigger added here. ### Why the wording is load-bearing `SKILL.md` is an executable agent-instruction file *and* is overlaid into eval fixtures, so edits here are prompt changes with measurable behavior. That was demonstrated during this PR: an earlier revision naming `review_input` as the remedy for a deficient environment taught the agent that a failed `gh` call meant it should stop and ask the user to paste the diff, dropping the `happy-path-code-review-request` stimulus from 3/3 to 0/3. The Step 1 change above targets the residual bail. ### Known gaps - **No eval stimulus exercises this text.** Verified: no file under `tests/*.vally.yaml` references any of the eight families, `Frequently Regressed`, or the prose-inertness rule. A future change could invert this guidance and the suite would still report green. Closing this needs a fixture plus grader thresholds and is proposed as follow-up rather than bundled here. - One `happy-path` trial still bails (2/3 vs baseline 3/3). With n=3, and the baseline itself having bailed 1/3 on an earlier run, this is not yet distinguishable from flake. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a9f85d71-55b4-4713-b900-079bf36a5047
Reset patterns: - global.json - NuGet.config - eng/Version.Details.xml - eng/Versions.props - eng/common/*
|
Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run. |
This was referenced Jul 28, 2026
Contributor
Author
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 36886Or
iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 36886" |
kubaflo
approved these changes
Jul 29, 2026
Contributor
Author
Skill Validation Results
✅ Skill Validation Results —
|
kubaflo
pushed a commit
that referenced
this pull request
Jul 31, 2026
<!-- Please let the below note in for people that find this PR --> > [!NOTE] > Are you waiting for the changes in this PR to be merged? > It would be very helpful if you could [test the resulting artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from this PR and let us know in a comment if this change resolves your issue. Thank you! ### Description of Change Auto-approve and enable GitHub native auto-merge for immutable snapshots of these exact forward-merge targets: ```text main => net11.0 net11.0 => release/11.0.1xx-preview7 net11.0 => release/11.0.1xx-rc1 net11.0 => release/11.0.1xx-rc2 ``` ### Immutable snapshot design Each caller workflow checks for its generated merge PR before invoking Arcade: ```text no open merge PR -> run Arcade and create a fresh snapshot open merge PR -> leave its branch unchanged while CI runs ``` The checks use exact head/base pairs and require the PR authoring App to be `github-actions` with `isCrossRepository == false`. The release workflow resolves the current `MergeToBranch` from `github-merge-flow-release-11.jsonc` on `net11.0`, and passes `configuration_file_branch: net11.0` to Arcade so the gate and merge implementation use the same source of truth. Workflow runs are serialized with distinct concurrency groups so simultaneous push/schedule/manual runs cannot both pass the check and create or update the same PR. Because scheduled workflows start from the default branch, the release schedule uses a schedule-only job to dispatch `merge-net11-to-release.yml` at ref `net11.0`; the dispatched run is not a schedule event and cannot recurse. During rollout, the schedule job first compares the parsed safety-critical sections (`concurrency`, `CheckForOpenMergePullRequest`, and `Merge`) between the workflow on `main` and `net11.0`. It skips the dispatch until the full immutable-snapshot gate has propagated, while allowing unrelated branch-specific workflow differences. Fetch or parse failures fail visibly instead of dispatching an unknown definition. The read-only snapshot checks use read-only `GITHUB_TOKEN` permissions. Only the reusable Arcade merge job retains content and pull-request write access. New source commits that arrive while a merge PR is open wait for the next generated PR. Once the current PR merges or closes, the next push or daily schedule creates a fresh snapshot containing the remaining commits. This intentionally stops using Arcade's existing "fast-forward the open merge PR" behavior. The generated PR head does not change during CI, so source-branch pushes do not invalidate its approval or restart CI. ### Policy Service rule The rule runs only on `Opened`; `Synchronize` is not accepted. It requires: - event sender `github-actions[bot]` - event sender is also the PR author - exact target branch - exact, fully anchored generated title Human conflict-resolution pushes do not trigger reapproval. Bot-attributed `/rebase` synchronization also does not trigger the policy, closing the review-bypass path identified in the adversarial review. ### Review behavior and accepted limitation `MAUI protection` intentionally remains: ```text dismiss_stale_reviews_on_push: true require_last_push_approval: false required_approving_review_count: 1 ``` This preserves the repository's human-review workflow: a maintainer who pushes a fix to another person's PR can provide the subsequent approval without requiring a third reviewer. This PR does not modify repository rulesets or add a bypass. The generated merge PR remains safe under these settings. Policy Service approves only the initial `Opened` snapshot, the caller workflow refuses to invoke Arcade while the exact bot-authored PR remains open, and any out-of-band head push dismisses the approval with no automatic reapproval path. Ordinary target-branch advancement does not require the generated PR to update because the required status-check rules use `strict_required_status_checks_policy: false`. If the immutable head remains conflict-free, its approval remains valid, and required checks pass, auto-merge can complete against the advanced base. In the narrower case where base activity actually changes the reviewed diff or merge base, GitHub can dismiss the approval and safely stall the PR. That fail-closed limitation is accepted for this automation. ### Exact branch and title allow-list ```text net11.0 + ^[automated] Merge branch 'main' => 'net11.0'$ release/...-preview7 + ^[automated] Merge branch 'net11.0' => 'release/...-preview7'$ release/...-rc1 + ^[automated] Merge branch 'net11.0' => 'release/...-rc1'$ release/...-rc2 + ^[automated] Merge branch 'net11.0' => 'release/...-rc2'$ ``` Each entry in the file contains the full literal branch and anchored regex. Targets outside this allow-list remain manual. ### Merge behavior ```yaml - enableAutoMerge: mergeMethod: merge ``` This always creates a true merge commit, never squash or rebase. Arcade relies on merge ancestry to determine what remains to flow. GitHub completes auto-merge only when the PR has no merge conflict and required checks pass. ### Required checks | ruleset | checks | Policy Service bypass | | --- | --- | --- | | `MAUI required CI checks` | `maui-pr` | **none** | | `MAUI device and UI test checks` | `maui-pr-devicetests`, `maui-pr-uitests` | pull requests only | A failing or pending `maui-pr` blocks the merge. Device/UI checks do not. `MAUI protection` has no Policy Service bypass. It requires one ordinary approval; Policy Service supplies it for the exact authenticated `Opened` events above. ### CODEOWNERS PR #36890 removes the invalid CODEOWNERS file. `Require review from Code Owners` is disabled in `MAUI protection`; the ordinary one-approval requirement remains. ### Accepted trust boundary An initial `Opened` event authorizes on exact title/base plus `github-actions[bot]` as both sender and PR author. A collaborator with repository push access could deliberately create a same-repository workflow and matching PR. Real `maui-pr` from Azure Pipelines integration 9426 must still pass, but there is no additional human review under the intentionally ordinary one-review policy. This tradeoff is accepted for these exact forward-merge target pairs. The immutable-snapshot gate prevents later human content from being reapproved through synchronization. No new App is installed and no bypass is added to `MAUI protection` or the `maui-pr` ruleset. ### Verification - Both caller workflows pass `actionlint`. - All three changed YAML files parse successfully. - The live target resolver returns `release/11.0.1xx-preview7`. - Exact App/head/base/same-repository queries identify #36886 (`main => net11.0`) and #36880 (`net11.0 => release/11.0.1xx-preview7`). - The semantic rollout check rejects the current old `net11.0` workflow and accepts matching safety-critical sections. - Official GitHub documentation confirms that `workflow_dispatch` events created with `GITHUB_TOKEN` start workflow runs; the dispatched event skips the schedule-only job. - The Policy Service file parses and GitOps schema validation runs on every update. - The live `MAUI protection` settings and effective non-strict required-status-check rules were reverified on 2026-07-31. ### Issues Fixed None; infrastructure automation. --------- Co-authored-by: PureWeen <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I detected changes in the main branch which have not been merged yet to net11.0. I'm a robot and am configured to help you automatically keep net11.0 up to date, so I've opened this PR.
This PR merges commits made on main by the following committers:
Instructions for merging from UI
This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, not a squash or rebase commit.
If this repo does not allow creating merge commits from the GitHub UI, use command line instructions.
Instructions for merging via command line
Run these commands to merge this pull request from the command line.
or if you are using SSH
After PR checks are complete push the branch
Instructions for resolving conflicts
Instructions for updating this pull request
Contributors to this repo have permission update this pull request by pushing to the branch 'merge/main-to-net11.0'. This can be done to resolve conflicts or make other changes to this pull request before it is merged.
The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote.
or if you are using SSH
Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues.
Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.