[automated] Merge branch 'net11.0' => 'release/11.0.1xx-preview7'

.github/aw/actions-lock.json

@@ -30,10 +30,10 @@
       "version": "v7.0.1",
       "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
     },
-    "github/gh-aw-actions/setup@v0.82.14": {
+    "github/gh-aw-actions/setup@v0.83.4": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.82.14",
-      "sha": "b6d1443e05b8716267fa19425b99aa4f12006b4a"
+      "version": "v0.83.4",
+      "sha": "e89c65e17eb281bbd5ff2ff9e9199a03e96654c7"
     }
   }
 }

.github/policies/resourceManagement.yml

@@ -718,5 +718,44 @@ configuration:
       - addLabel:
           label: partner/syncfusion
       description: Add 'partner/syncfusion' label to issues opened by the Syncfusion partner team
+    - if:
+      - payloadType: Pull_Request
+      - isPullRequest
+      - isActivitySender:
+          user: github-actions[bot]
+          issueAuthor: False
+      - isAction:
+          action: Opened
+      - or:
+        - and:
+          - targetsBranch:
+              branch: net11.0
+          - titleContains:
+              pattern: '^\[automated\] Merge branch ''main'' => ''net11\.0''$'
+              isRegex: True
+        - and:
+          - targetsBranch:
+              branch: release/11.0.1xx-preview7
+          - titleContains:
+              pattern: '^\[automated\] Merge branch ''net11\.0'' => ''release/11\.0\.1xx-preview7''$'
+              isRegex: True
+        - and:
+          - targetsBranch:
+              branch: release/11.0.1xx-rc1
+          - titleContains:
+              pattern: '^\[automated\] Merge branch ''net11\.0'' => ''release/11\.0\.1xx-rc1''$'
+              isRegex: True
+        - and:
+          - targetsBranch:
+              branch: release/11.0.1xx-rc2
+          - titleContains:
+              pattern: '^\[automated\] Merge branch ''net11\.0'' => ''release/11\.0\.1xx-rc2''$'
+              isRegex: True
+      then:
+      - approvePullRequest:
+          comment: Auto-approved automated inter-branch merge.
+      - enableAutoMerge:
+          mergeMethod: merge
+      description: '[Inter-branch merge] Auto-approve and enable auto-merge for exact forward-merge flows'
 onFailure: 
 onSuccess: 

.github/scripts/Apply-PRFinalize.Tests.ps1

@@ -37,7 +37,8 @@ BeforeAll {
         'Test-FinalizeIsNoOp',
         'Get-FinalizeRecommendation',
         'Merge-PreservedTitlePrefix',
-        'Merge-PreservedBodyPreamble'
+        'Merge-PreservedBodyPreamble',
+        'New-ExclusiveTempFile'
     )) {
         $function = $ast.Find({
             $args[0] -is [System.Management.Automation.Language.FunctionDefinitionAst] -and
@@ -317,3 +318,193 @@ Describe 'Security regressions — AzDO logging-command injection' {
             Should -Be '[iOS] new'
     }
 }
+
+Describe 'New-ExclusiveTempFile' {
+    BeforeAll {
+        $script:SandboxDir = Join-Path ([System.IO.Path]::GetTempPath()) "apply-prfinalize-tests-$([System.IO.Path]::GetRandomFileName())"
+        New-Item -ItemType Directory -Path $script:SandboxDir -Force | Out-Null
+        $script:OriginalAgentTemp = $env:AGENT_TEMPDIRECTORY
+        $env:AGENT_TEMPDIRECTORY = $script:SandboxDir
+    }
+
+    AfterAll {
+        $env:AGENT_TEMPDIRECTORY = $script:OriginalAgentTemp
+        Remove-Item -LiteralPath $script:SandboxDir -Recurse -Force -ErrorAction SilentlyContinue
+    }
+
+    It 'creates the file inside AGENT_TEMPDIRECTORY when it is set' {
+        $path = New-ExclusiveTempFile -Prefix 'pr-finalize-body-123'
+        try {
+            Test-Path -LiteralPath $path | Should -BeTrue
+            (Split-Path -Parent $path) | Should -Be $script:SandboxDir
+        } finally {
+            Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue
+        }
+    }
+
+    It 'produces a unique path on each call, so the name is not predictable' {
+        $a = New-ExclusiveTempFile -Prefix 'pr-finalize-body-123'
+        $b = New-ExclusiveTempFile -Prefix 'pr-finalize-body-123'
+        try {
+            $a | Should -Not -Be $b
+        } finally {
+            Remove-Item -LiteralPath $a -Force -ErrorAction SilentlyContinue
+            Remove-Item -LiteralPath $b -Force -ErrorAction SilentlyContinue
+        }
+    }
+
+    # These pin the actual finding-#2 behaviour. The earlier version of this test was
+    # vacuous: it never planted a symlink at a path the helper would try, so a
+    # predictable-name Set-Content write-through implementation still passed it. The
+    # -NameGenerator seam forces known candidates so a symlink can be planted precisely.
+    It 'refuses a pre-planted symlink and leaves its target untouched' {
+        $secret = Join-Path $script:SandboxDir 'secret-existing.txt'
+        Set-Content -LiteralPath $secret -Value 'ORIGINAL' -Encoding UTF8
+
+        $planted = Join-Path $script:SandboxDir 'pr-finalize-body-123-forced0.md'
+        New-Item -ItemType SymbolicLink -Path $planted -Target $secret | Out-Null
+
+        # $script: scope is required — a plain $i++ inside the scriptblock would mutate a
+        # local copy, so every attempt would re-request the planted name.
+        $script:ForcedIndex = 0
+        $path = New-ExclusiveTempFile -Prefix 'pr-finalize-body-123' -NameGenerator {
+            $n = "forced$($script:ForcedIndex)"; $script:ForcedIndex++; $n
+        }
+        try {
+            # It must have skipped the planted path entirely...
+            $path | Should -Not -Be $planted
+            'REPLACEMENT BODY' | Set-Content -LiteralPath $path -Encoding UTF8
+            # ...so the symlink target is untouched, and the link is still a link.
+            (Get-Content -Raw -LiteralPath $secret).Trim() | Should -Be 'ORIGINAL'
+            (Get-Item -LiteralPath $planted).LinkType | Should -Be 'SymbolicLink'
+            (Get-Content -Raw -LiteralPath $path).Trim() | Should -Be 'REPLACEMENT BODY'
+        } finally {
+            Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue
+            Remove-Item -LiteralPath $planted -Force -ErrorAction SilentlyContinue
+        }
+    }
+
+    It 'refuses a dangling pre-planted symlink rather than creating its target' {
+        $missingTarget = Join-Path $script:SandboxDir 'never-created.txt'
+        $planted = Join-Path $script:SandboxDir 'pr-finalize-body-123-dangle0.md'
+        New-Item -ItemType SymbolicLink -Path $planted -Target $missingTarget | Out-Null
+
+        $script:DangleIndex = 0
+        $path = New-ExclusiveTempFile -Prefix 'pr-finalize-body-123' -NameGenerator {
+            $n = "dangle$($script:DangleIndex)"; $script:DangleIndex++; $n
+        }
+        try {
+            $path | Should -Not -Be $planted
+            'REPLACEMENT BODY' | Set-Content -LiteralPath $path -Encoding UTF8
+            # Writing through a dangling link would have created the target.
+            Test-Path -LiteralPath $missingTarget | Should -BeFalse
+        } finally {
+            Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue
+            Remove-Item -LiteralPath $planted -Force -ErrorAction SilentlyContinue
+        }
+    }
+
+    It 'throws instead of falling back to a predictable path when every candidate is occupied' {
+        $secret = Join-Path $script:SandboxDir 'secret-exhaust.txt'
+        Set-Content -LiteralPath $secret -Value 'ORIGINAL' -Encoding UTF8
+
+        $planted = 0..4 | ForEach-Object {
+            $link = Join-Path $script:SandboxDir "pr-finalize-body-123-exhaust$_.md"
+            New-Item -ItemType SymbolicLink -Path $link -Target $secret | Out-Null
+            $link
+        }
+
+        try {
+            $script:ExhaustIndex = 0
+            { New-ExclusiveTempFile -Prefix 'pr-finalize-body-123' -NameGenerator {
+                $n = "exhaust$($script:ExhaustIndex)"; $script:ExhaustIndex++; $n
+            } } | Should -Throw -ExpectedMessage '*after 5 attempts*'
+            # No fallback path was written, so the symlink target is still intact.
+            (Get-Content -Raw -LiteralPath $secret).Trim() | Should -Be 'ORIGINAL'
+        } finally {
+            $planted | ForEach-Object { Remove-Item -LiteralPath $_ -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    It 'tries exactly MaxAttempts candidates before giving up' {
+        $secret = Join-Path $script:SandboxDir 'secret-count.txt'
+        Set-Content -LiteralPath $secret -Value 'ORIGINAL' -Encoding UTF8
+        $planted = 0..4 | ForEach-Object {
+            $link = Join-Path $script:SandboxDir "pr-finalize-body-123-count$_.md"
+            New-Item -ItemType SymbolicLink -Path $link -Target $secret | Out-Null
+            $link
+        }
+
+        try {
+            $script:Calls = 0
+            { New-ExclusiveTempFile -Prefix 'pr-finalize-body-123' -NameGenerator { $n = "count$($script:Calls)"; $script:Calls++; $n } } |
+                Should -Throw
+            $script:Calls | Should -Be 5
+        } finally {
+            $planted | ForEach-Object { Remove-Item -LiteralPath $_ -Force -ErrorAction SilentlyContinue }
+        }
+    }
+
+    It 'surfaces a non-collision failure immediately instead of retrying it away' {
+        # A missing base directory can never be resolved by picking another name, so it must
+        # propagate rather than be masked by the generic "after N attempts" message.
+        $saved = $env:AGENT_TEMPDIRECTORY
+        $env:AGENT_TEMPDIRECTORY = $script:SandboxDir
+        try {
+            $script:Calls = 0
+            { New-ExclusiveTempFile -Prefix 'missing-dir/nope/body' -NameGenerator { $script:Calls++; 'x' } } |
+                Should -Throw -ExpectedMessage '*Could not find a part of the path*'
+            $script:Calls | Should -Be 1
+        } finally {
+            $env:AGENT_TEMPDIRECTORY = $saved
+        }
+    }
+
+    It 'ignores AGENT_TEMPDIRECTORY when it points at a file rather than a directory' {
+        $saved = $env:AGENT_TEMPDIRECTORY
+        $asFile = Join-Path $script:SandboxDir 'not-a-directory.txt'
+        Set-Content -LiteralPath $asFile -Value 'x' -Encoding UTF8
+        $env:AGENT_TEMPDIRECTORY = $asFile
+        try {
+            $path = New-ExclusiveTempFile -Prefix 'pr-finalize-body-123'
+            try {
+                Test-Path -LiteralPath $path | Should -BeTrue
+                (Split-Path -Parent $path) | Should -Not -Be $asFile
+            } finally {
+                Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue
+            }
+        } finally {
+            $env:AGENT_TEMPDIRECTORY = $saved
+        }
+    }
+
+    It 'falls back to the system temp directory when AGENT_TEMPDIRECTORY is unset' {
+        $saved = $env:AGENT_TEMPDIRECTORY
+        $env:AGENT_TEMPDIRECTORY = $null
+        try {
+            $path = New-ExclusiveTempFile -Prefix 'pr-finalize-body-123'
+            try {
+                Test-Path -LiteralPath $path | Should -BeTrue
+            } finally {
+                Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue
+            }
+        } finally {
+            $env:AGENT_TEMPDIRECTORY = $saved
+        }
+    }
+
+    It 'ignores AGENT_TEMPDIRECTORY when it points at a missing directory' {
+        $saved = $env:AGENT_TEMPDIRECTORY
+        $env:AGENT_TEMPDIRECTORY = Join-Path $script:SandboxDir 'does-not-exist'
+        try {
+            $path = New-ExclusiveTempFile -Prefix 'pr-finalize-body-123'
+            try {
+                Test-Path -LiteralPath $path | Should -BeTrue
+            } finally {
+                Remove-Item -LiteralPath $path -Force -ErrorAction SilentlyContinue
+            }
+        } finally {
+            $env:AGENT_TEMPDIRECTORY = $saved
+        }
+    }
+}