Fix bot-opened inter-branch merge policy matching - #36990
Closed
PureWeen wants to merge 10 commits into
Closed
Conversation
The inter-branch merge flow opens "[automated] Merge branch ... => ..." PRs but deliberately never merges them, so every clean forward merge still waits on a human. Add a Policy Service rule that auto-approves those PRs and enables auto-merge, matching what dotnet/roslyn and dotnet/vscode-csharp already do. Scoped to the two flows this repo runs, and uses a merge commit because the merge flow requires one rather than a squash or rebase. Conflicted PRs are unaffected and still need a human.
Require both the exact generated title and the exact net11.0 target branch. Do not auto-merge the net11.0 => release flow. The Policy Service still enables native auto-merge with mergeMethod=merge, while maui-pr remains a required check in a separate ruleset with no app bypass.
Cover both main => net11.0 and net11.0 => release/* automated merge PRs. Re-approve and re-arm auto-merge when Arcade synchronizes the merge branch so the organization latest-push approval rule is satisfied. Human conflict resolution pushes do not match because their activity sender is not GitHub Actions.
Require GitHub Actions to be both the activity sender and PR author before automatically approving an Opened or Synchronize event. This excludes human and fork PRs updated by the /rebase workflow. Also anchor both generated titles and require exact target branches; release auto-merge fails closed when the release train advances until the policy is updated.
Enumerate the remaining .NET 11 release milestones as exact target/title pairs. This preserves the fail-closed target validation while avoiding a policy update when the train advances from preview7 through rc1 and rc2.
Before invoking Arcade, skip the merge workflow when its generated PR is still open. This turns each PR into an immutable snapshot: later source commits wait for the next PR instead of synchronizing the current one and dismissing its approval. Serialize workflow runs to avoid duplicate creation races. With generated PRs no longer updated, Policy Service only approves the safe Opened event; Synchronize is removed entirely.
Use exact bot-authored same-repository PR queries, resolve the active release target from net11.0, and dispatch scheduled release merges from the required branch. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
Keep the release gate and Arcade on the same net11.0 configuration, defer scheduled dispatch until the safety-critical workflow sections have propagated, and scope read-only checks to read permissions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
Remove the redundant issue-author predicate that does not match App-authored pull request events. The Opened action and github-actions bot sender already bind the rule to the bot-created PR event. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
PureWeen
temporarily deployed
to
copilot-pat-pool
July 31, 2026 17:10 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 36990Or
iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 36990" |
PureWeen
temporarily deployed
to
copilot-pat-pool
July 31, 2026 17:10 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
PureWeen
temporarily deployed
to
copilot-pat-pool
July 31, 2026 17:11 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Resolve the Policy Service rule in favor of the proven bot-sender-only Opened-event pattern. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s inter-branch merge automation by adding Policy Service rules to auto-approve/auto-merge specific bot-opened forward-merge PRs, and by adjusting the merge workflows to avoid updating an already-open merge PR while CI is running.
Changes:
- Add a new Policy Service rule to approve and enable merge-commit auto-merge for tightly allow-listed,
github-actions[bot]-opened forward merges. - Add concurrency + “check for existing open merge PR” gating so merge workflows keep generated PRs immutable during CI.
- For the net11→release flow, add a default-branch scheduled dispatcher that triggers the actual merge run from
net11.0.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/merge-net11-to-release.yml | Adds schedule-dispatch + immutability gate and concurrency for net11→release merge PR generation. |
| .github/workflows/merge-main-to-net11.yml | Adds immutability gate and concurrency for main→net11 merge PR generation. |
| .github/policies/resourceManagement.yml | Adds an inter-branch merge Policy Service rule for bot-opened PR auto-approval + auto-merge. |
Copilot's findings
- Files reviewed: 1/1 changed files
- Comments generated: 1
Comment on lines
721
to
727
| - if: | ||
| - payloadType: Pull_Request | ||
| - isPullRequest | ||
| - isActivitySender: | ||
| user: github-actions[bot] | ||
| issueAuthor: False | ||
| - isActivitySender: | ||
| issueAuthor: True | ||
| - isAction: |
Member
Author
kubaflo
pushed a commit
that referenced
this pull request
Aug 1, 2026
<!-- Please let the below note in for people that find this PR --> > [!NOTE] > Are you waiting for the changes in this PR to be merged? > It would be very helpful if you could [test the resulting artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from this PR and let us know in a comment if this change resolves your issue. Thank you! ### Description of Change Remove the redundant `isActivitySender: { issueAuthor: True }` predicate from the inter-branch merge Policy Service rule. The end-to-end retest after #36875 merged created #36989 with the exact expected `github-actions[bot]` author, title, head, and base, but Policy Service did not approve it or enable auto-merge. The additional issue-author predicate is the unique difference from the proven policy used by `dotnet/vscode-csharp`, which successfully auto-approves and enables merge-commit auto-merge for equivalent bot-opened inter-branch merge PRs. For an `Opened` event, requiring the activity sender to be `github-actions[bot]` already binds the event to the bot that opened the PR. The exact target branch and fully anchored title checks remain unchanged, and `Synchronize` remains excluded. ### Verification - The branch contains exactly one commit relative to `main`. - `.github/policies/resourceManagement.yml` parses as YAML. - `git diff --check` passes. - The PR diff is exactly one file with two deletions. - The inter-branch rule retains the exact bot sender, `Opened` action, target branches, anchored titles, approval, and merge-method auto-merge actions. - Compared against the live known-good `dotnet/vscode-csharp` Policy Service rule and PR #9595, where `dotnet-policy-service` approved and enabled `MERGE` auto-merge for a `github-actions[bot]` inter-branch merge PR. ### Issues Fixed Follow-up to #36875. Replaces #36990, whose branch retained the original squash-merged PR history. Co-authored-by: PureWeen <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!
Description of Change
Remove the redundant
isActivitySender: { issueAuthor: True }predicate from the inter-branch merge Policy Service rule.The end-to-end retest after #36875 merged created #36989 with the exact expected
github-actions[bot]author, title, head, and base, but Policy Service did not approve it or enable auto-merge. The additional issue-author predicate is the unique difference from the proven policy used bydotnet/vscode-csharp, which successfully auto-approves and enables merge-commit auto-merge for equivalent bot-opened inter-branch merge PRs.For an
Openedevent, requiring the activity sender to begithub-actions[bot]already binds the event to the bot that opened the PR. The exact target branch and fully anchored title checks remain unchanged, andSynchronizeremains excluded.Verification
.github/policies/resourceManagement.ymlparses as YAML.git diff --checkpasses.Openedaction, target branches, anchored titles, approval, and merge-method auto-merge actions.dotnet/vscode-csharpPolicy Service rule and PR GraphicsView does not call Drawable's Draw() after each Invalidate on iOS #9595, wheredotnet-policy-serviceapproved and enabledMERGEauto-merge for agithub-actions[bot]inter-branch merge PR.Issues Fixed
Follow-up to #36875.