From 36c070cc1f7f7998db2893a3d4e5b038170a4f65 Mon Sep 17 00:00:00 2001
From: Shane Neuville <5375137+PureWeen@users.noreply.github.com>
Date: Tue, 28 Jul 2026 08:27:54 -0500
Subject: [PATCH 1/9] Auto-approve and auto-merge automated inter-branch merge
 PRs

The inter-branch merge flow opens "[automated] Merge branch ... => ..." PRs but
deliberately never merges them, so every clean forward merge still waits on a
human. Add a Policy Service rule that auto-approves those PRs and enables
auto-merge, matching what dotnet/roslyn and dotnet/vscode-csharp already do.

Scoped to the two flows this repo runs, and uses a merge commit because the
merge flow requires one rather than a squash or rebase. Conflicted PRs are
unaffected and still need a human.
---
 .github/policies/resourceManagement.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/.github/policies/resourceManagement.yml b/.github/policies/resourceManagement.yml
index 7d9edabb69ed..59437832a9a8 100644
--- a/.github/policies/resourceManagement.yml
+++ b/.github/policies/resourceManagement.yml
@@ -718,5 +718,26 @@ configuration:
       - addLabel:
           label: partner/syncfusion
       description: Add 'partner/syncfusion' label to issues opened by the Syncfusion partner team
+    - if:
+      - payloadType: Pull_Request
+      - isPullRequest
+      - isAction:
+          action: Opened
+      - isActivitySender:
+          user: github-actions[bot]
+          issueAuthor: False
+      - or:
+        - titleContains:
+            pattern: "[automated] Merge branch 'main' => 'net11.0'"
+            isRegex: False
+        - titleContains:
+            pattern: "[automated] Merge branch 'net11.0' => 'release/"
+            isRegex: False
+      then:
+      - approvePullRequest:
+          comment: Auto-approved automated inter-branch merge.
+      - enableAutoMerge:
+          mergeMethod: merge
+      description: '[Inter-branch merge] Auto-approve and enable auto-merge on automated branch merge Pull Requests'
 onFailure: 
 onSuccess: 

From 52f581ee9325f359336231f4dbac8495a3e754d5 Mon Sep 17 00:00:00 2001
From: Shane Neuville <5375137+PureWeen@users.noreply.github.com>
Date: Tue, 28 Jul 2026 12:46:54 -0500
Subject: [PATCH 2/9] Scope automatic inter-branch merges to main => net11.0

Require both the exact generated title and the exact net11.0 target branch.
Do not auto-merge the net11.0 => release flow. The Policy Service still
enables native auto-merge with mergeMethod=merge, while maui-pr remains a
required check in a separate ruleset with no app bypass.
---
 .github/policies/resourceManagement.yml | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/.github/policies/resourceManagement.yml b/.github/policies/resourceManagement.yml
index 59437832a9a8..d2a256111eac 100644
--- a/.github/policies/resourceManagement.yml
+++ b/.github/policies/resourceManagement.yml
@@ -726,18 +726,16 @@ configuration:
       - isActivitySender:
           user: github-actions[bot]
           issueAuthor: False
-      - or:
-        - titleContains:
-            pattern: "[automated] Merge branch 'main' => 'net11.0'"
-            isRegex: False
-        - titleContains:
-            pattern: "[automated] Merge branch 'net11.0' => 'release/"
-            isRegex: False
+      - targetsBranch:
+          branch: net11.0
+      - titleContains:
+          pattern: "[automated] Merge branch 'main' => 'net11.0'"
+          isRegex: False
       then:
       - approvePullRequest:
-          comment: Auto-approved automated inter-branch merge.
+          comment: Auto-approved automated main to net11.0 merge.
       - enableAutoMerge:
           mergeMethod: merge
-      description: '[Inter-branch merge] Auto-approve and enable auto-merge on automated branch merge Pull Requests'
+      description: '[Inter-branch merge] Auto-approve and enable auto-merge for main to net11.0'
 onFailure: 
 onSuccess: 

From 7238fa0c252b46e4f47d2e3adb4796b53aff7519 Mon Sep 17 00:00:00 2001
From: Shane Neuville <5375137+PureWeen@users.noreply.github.com>
Date: Tue, 28 Jul 2026 13:35:41 -0500
Subject: [PATCH 3/9] Auto-merge net11.0 forward merges into release branches

Cover both main => net11.0 and net11.0 => release/* automated merge PRs.
Re-approve and re-arm auto-merge when Arcade synchronizes the merge branch so
the organization latest-push approval rule is satisfied. Human conflict
resolution pushes do not match because their activity sender is not
GitHub Actions.
---
 .github/policies/resourceManagement.yml | 26 ++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/.github/policies/resourceManagement.yml b/.github/policies/resourceManagement.yml
index d2a256111eac..481ef45bf7ac 100644
--- a/.github/policies/resourceManagement.yml
+++ b/.github/policies/resourceManagement.yml
@@ -721,21 +721,29 @@ configuration:
     - if:
       - payloadType: Pull_Request
       - isPullRequest
-      - isAction:
-          action: Opened
       - isActivitySender:
           user: github-actions[bot]
           issueAuthor: False
-      - targetsBranch:
-          branch: net11.0
-      - titleContains:
-          pattern: "[automated] Merge branch 'main' => 'net11.0'"
-          isRegex: False
+      - or:
+        - isAction:
+            action: Opened
+        - isAction:
+            action: Synchronize
+      - or:
+        - and:
+          - targetsBranch:
+              branch: net11.0
+          - titleContains:
+              pattern: "[automated] Merge branch 'main' => 'net11.0'"
+              isRegex: False
+        - titleContains:
+            pattern: "[automated] Merge branch 'net11.0' => 'release/"
+            isRegex: False
       then:
       - approvePullRequest:
-          comment: Auto-approved automated main to net11.0 merge.
+          comment: Auto-approved automated inter-branch merge.
       - enableAutoMerge:
           mergeMethod: merge
-      description: '[Inter-branch merge] Auto-approve and enable auto-merge for main to net11.0'
+      description: '[Inter-branch merge] Auto-approve and enable auto-merge for main to net11.0 and net11.0 to release'
 onFailure: 
 onSuccess: 

From 5a23ca304cacad6c5df9b4321a5be15ac1c2eb13 Mon Sep 17 00:00:00 2001
From: Shane Neuville <5375137+PureWeen@users.noreply.github.com>
Date: Tue, 28 Jul 2026 16:49:30 -0500
Subject: [PATCH 4/9] Require PR-author provenance for synchronized merge PRs

Require GitHub Actions to be both the activity sender and PR author before
automatically approving an Opened or Synchronize event. This excludes human
and fork PRs updated by the /rebase workflow. Also anchor both generated titles
and require exact target branches; release auto-merge fails closed when the
release train advances until the policy is updated.
---
 .github/policies/resourceManagement.yml | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/.github/policies/resourceManagement.yml b/.github/policies/resourceManagement.yml
index 481ef45bf7ac..13a7ef40dc0f 100644
--- a/.github/policies/resourceManagement.yml
+++ b/.github/policies/resourceManagement.yml
@@ -724,6 +724,8 @@ configuration:
       - isActivitySender:
           user: github-actions[bot]
           issueAuthor: False
+      - isActivitySender:
+          issueAuthor: True
       - or:
         - isAction:
             action: Opened
@@ -734,16 +736,19 @@ configuration:
           - targetsBranch:
               branch: net11.0
           - titleContains:
-              pattern: "[automated] Merge branch 'main' => 'net11.0'"
-              isRegex: False
-        - titleContains:
-            pattern: "[automated] Merge branch 'net11.0' => 'release/"
-            isRegex: False
+              pattern: '^\[automated\] Merge branch ''main'' => ''net11\.0''$'
+              isRegex: True
+        - and:
+          - targetsBranch:
+              branch: release/11.0.1xx-preview7
+          - titleContains:
+              pattern: '^\[automated\] Merge branch ''net11\.0'' => ''release/11\.0\.1xx-preview7''$'
+              isRegex: True
       then:
       - approvePullRequest:
           comment: Auto-approved automated inter-branch merge.
       - enableAutoMerge:
           mergeMethod: merge
-      description: '[Inter-branch merge] Auto-approve and enable auto-merge for main to net11.0 and net11.0 to release'
+      description: '[Inter-branch merge] Auto-approve and enable auto-merge for exact forward-merge flows'
 onFailure: 
 onSuccess: 

From fd90796d01ec92d92d43c25dc070457ba507df6f Mon Sep 17 00:00:00 2001
From: Shane Neuville <5375137+PureWeen@users.noreply.github.com>
Date: Tue, 28 Jul 2026 17:04:46 -0500
Subject: [PATCH 5/9] Allow exact preview7, rc1, and rc2 merge targets

Enumerate the remaining .NET 11 release milestones as exact target/title pairs.
This preserves the fail-closed target validation while avoiding a policy update
when the train advances from preview7 through rc1 and rc2.
---
 .github/policies/resourceManagement.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/policies/resourceManagement.yml b/.github/policies/resourceManagement.yml
index 13a7ef40dc0f..3f0cf98fa7e3 100644
--- a/.github/policies/resourceManagement.yml
+++ b/.github/policies/resourceManagement.yml
@@ -744,6 +744,18 @@ configuration:
           - titleContains:
               pattern: '^\[automated\] Merge branch ''net11\.0'' => ''release/11\.0\.1xx-preview7''$'
               isRegex: True
+        - and:
+          - targetsBranch:
+              branch: release/11.0.1xx-rc1
+          - titleContains:
+              pattern: '^\[automated\] Merge branch ''net11\.0'' => ''release/11\.0\.1xx-rc1''$'
+              isRegex: True
+        - and:
+          - targetsBranch:
+              branch: release/11.0.1xx-rc2
+          - titleContains:
+              pattern: '^\[automated\] Merge branch ''net11\.0'' => ''release/11\.0\.1xx-rc2''$'
+              isRegex: True
       then:
       - approvePullRequest:
           comment: Auto-approved automated inter-branch merge.

From 7ea1094ac54680505942df2ffbf3efd6572108d5 Mon Sep 17 00:00:00 2001
From: Shane Neuville <5375137+PureWeen@users.noreply.github.com>
Date: Wed, 29 Jul 2026 15:24:38 -0500
Subject: [PATCH 6/9] Keep generated merge PRs immutable while CI runs

Before invoking Arcade, skip the merge workflow when its generated PR is
still open. This turns each PR into an immutable snapshot: later source commits
wait for the next PR instead of synchronizing the current one and dismissing
its approval. Serialize workflow runs to avoid duplicate creation races.

With generated PRs no longer updated, Policy Service only approves the safe
Opened event; Synchronize is removed entirely.
---
 .github/policies/resourceManagement.yml      |  7 ++--
 .github/workflows/merge-main-to-net11.yml    | 35 +++++++++++++++++++-
 .github/workflows/merge-net11-to-release.yml | 33 +++++++++++++++++-
 3 files changed, 68 insertions(+), 7 deletions(-)

diff --git a/.github/policies/resourceManagement.yml b/.github/policies/resourceManagement.yml
index 3f0cf98fa7e3..eaf032e54a39 100644
--- a/.github/policies/resourceManagement.yml
+++ b/.github/policies/resourceManagement.yml
@@ -726,11 +726,8 @@ configuration:
           issueAuthor: False
       - isActivitySender:
           issueAuthor: True
-      - or:
-        - isAction:
-            action: Opened
-        - isAction:
-            action: Synchronize
+      - isAction:
+          action: Opened
       - or:
         - and:
           - targetsBranch:
diff --git a/.github/workflows/merge-main-to-net11.yml b/.github/workflows/merge-main-to-net11.yml
index 947eaadbf3d4..d3516ead2312 100644
--- a/.github/workflows/merge-main-to-net11.yml
+++ b/.github/workflows/merge-main-to-net11.yml
@@ -7,7 +7,7 @@
 #   - ResetToTargetPaths: auto-resets version files to target branch versions
 #   - QuietComments: reduces GitHub notification noise
 #   - Skips PRs when only Maestro bot commits exist
-#   - Updates existing open PR instead of creating new ones
+#   - Keeps each generated PR immutable while CI runs; later commits flow in the next PR
 
 name: Merge main to net11.0
 
@@ -25,8 +25,41 @@ permissions:
   contents: write
   pull-requests: write
 
+concurrency:
+  group: merge-main-to-net11
+  cancel-in-progress: false
+
 jobs:
+  CheckForOpenMergePullRequest:
+    runs-on: ubuntu-latest
+    outputs:
+      should_run: ${{ steps.check.outputs.should_run }}
+    steps:
+      - name: Check for an open main to net11.0 merge PR
+        id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          pr_number="$(gh pr list \
+            --repo "$REPOSITORY" \
+            --state open \
+            --head 'merge/main-to-net11.0' \
+            --base 'net11.0' \
+            --json number \
+            --jq '.[0].number // empty')"
+
+          if [[ -n "$pr_number" ]]; then
+            echo "Merge PR #$pr_number is still open; leaving its branch unchanged while CI runs."
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "No open main to net11.0 merge PR exists."
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+          fi
+
   Merge:
+    needs: CheckForOpenMergePullRequest
+    if: needs.CheckForOpenMergePullRequest.outputs.should_run == 'true'
     uses: dotnet/arcade/.github/workflows/inter-branch-merge-base.yml@main
     with:
       configuration_file_path: 'github-merge-flow-net11.jsonc'
diff --git a/.github/workflows/merge-net11-to-release.yml b/.github/workflows/merge-net11-to-release.yml
index 3d987723028c..5cd41241891b 100644
--- a/.github/workflows/merge-net11-to-release.yml
+++ b/.github/workflows/merge-net11-to-release.yml
@@ -20,10 +20,41 @@ permissions:
   contents: write
   pull-requests: write
 
+concurrency:
+  group: merge-net11-to-release
+  cancel-in-progress: false
+
 jobs:
+  CheckForOpenMergePullRequest:
+    if: github.ref_name == 'net11.0'
+    runs-on: ubuntu-latest
+    outputs:
+      should_run: ${{ steps.check.outputs.should_run }}
+    steps:
+      - name: Check for an open net11.0 to release merge PR
+        id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          pr_number="$(gh pr list \
+            --repo "$REPOSITORY" \
+            --state open \
+            --json number,headRefName \
+            --jq '[.[] | select(.headRefName | startswith("merge/net11.0-to-release/"))][0].number // empty')"
+
+          if [[ -n "$pr_number" ]]; then
+            echo "Merge PR #$pr_number is still open; leaving its branch unchanged while CI runs."
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "No open net11.0 to release merge PR exists."
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+          fi
+
   Merge:
+    needs: CheckForOpenMergePullRequest
     # Only run if triggered from net11.0 (push trigger or correct workflow_dispatch)
-    if: github.ref_name == 'net11.0'
+    if: github.ref_name == 'net11.0' && needs.CheckForOpenMergePullRequest.outputs.should_run == 'true'
     uses: dotnet/arcade/.github/workflows/inter-branch-merge-base.yml@main
     with:
       configuration_file_path: 'github-merge-flow-release-11.jsonc'

From 2467b16f40429e0408b3f27247bac2268e729995 Mon Sep 17 00:00:00 2001
From: PureWeen <223556219+Copilot@users.noreply.github.com>
Date: Wed, 29 Jul 2026 15:51:58 -0500
Subject: [PATCH 7/9] Harden inter-branch merge snapshot detection

Use exact bot-authored same-repository PR queries, resolve the active release target from net11.0, and dispatch scheduled release merges from the required branch.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
---
 .github/workflows/merge-main-to-net11.yml    |  6 ++-
 .github/workflows/merge-net11-to-release.yml | 53 ++++++++++++++++++--
 2 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/merge-main-to-net11.yml b/.github/workflows/merge-main-to-net11.yml
index d3516ead2312..c777a1a07471 100644
--- a/.github/workflows/merge-main-to-net11.yml
+++ b/.github/workflows/merge-main-to-net11.yml
@@ -44,10 +44,12 @@ jobs:
           pr_number="$(gh pr list \
             --repo "$REPOSITORY" \
             --state open \
+            --app 'github-actions' \
             --head 'merge/main-to-net11.0' \
             --base 'net11.0' \
-            --json number \
-            --jq '.[0].number // empty')"
+            --limit 100 \
+            --json number,isCrossRepository \
+            --jq '[.[] | select(.isCrossRepository == false)][0].number // empty')"
 
           if [[ -n "$pr_number" ]]; then
             echo "Merge PR #$pr_number is still open; leaving its branch unchanged while CI runs."
diff --git a/.github/workflows/merge-net11-to-release.yml b/.github/workflows/merge-net11-to-release.yml
index 5cd41241891b..2f74cf68d0b1 100644
--- a/.github/workflows/merge-net11-to-release.yml
+++ b/.github/workflows/merge-net11-to-release.yml
@@ -4,7 +4,7 @@
 # This workflow must be triggered FROM the net11.0 branch because the arcade merge
 # script uses GITHUB_REF_NAME as the config lookup key. When triggered via
 # workflow_dispatch from the GitHub UI, select 'net11.0' from the branch dropdown.
-# The schedule trigger only works when this file exists on net11.0.
+# The default-branch schedule dispatches a second run from net11.0.
 
 name: Merge net11.0 to next release
 
@@ -25,23 +25,68 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  DispatchScheduledRun:
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
+    steps:
+      - name: Dispatch the scheduled run from net11.0
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+        run: gh workflow run merge-net11-to-release.yml --repo "$REPOSITORY" --ref net11.0
+
   CheckForOpenMergePullRequest:
-    if: github.ref_name == 'net11.0'
+    if: github.event_name != 'schedule' && github.ref_name == 'net11.0'
     runs-on: ubuntu-latest
     outputs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
+      - name: Resolve the current release target
+        id: target
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          $configText = gh api `
+            -H "Accept: application/vnd.github.raw+json" `
+            "repos/$env:REPOSITORY/contents/github-merge-flow-release-11.jsonc?ref=net11.0" |
+            Out-String
+
+          if ($LASTEXITCODE -ne 0)
+          {
+            throw "Failed to read the net11.0 merge-flow configuration."
+          }
+
+          $config = $configText | ConvertFrom-Json
+          $mergeToBranch = $config.'merge-flow-configurations'.'net11.0'.MergeToBranch
+
+          if ($mergeToBranch -notmatch '^release/[A-Za-z0-9._/-]+$')
+          {
+            throw "Invalid MergeToBranch value '$mergeToBranch'."
+          }
+
+          "merge_to_branch=$mergeToBranch" >> $env:GITHUB_OUTPUT
+
       - name: Check for an open net11.0 to release merge PR
         id: check
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MERGE_TO_BRANCH: ${{ steps.target.outputs.merge_to_branch }}
           REPOSITORY: ${{ github.repository }}
         run: |
           pr_number="$(gh pr list \
             --repo "$REPOSITORY" \
             --state open \
-            --json number,headRefName \
-            --jq '[.[] | select(.headRefName | startswith("merge/net11.0-to-release/"))][0].number // empty')"
+            --app github-actions \
+            --head "merge/net11.0-to-$MERGE_TO_BRANCH" \
+            --base "$MERGE_TO_BRANCH" \
+            --limit 100 \
+            --json number,isCrossRepository \
+            --jq '[.[] | select(.isCrossRepository == false)][0].number // empty')"
 
           if [[ -n "$pr_number" ]]; then
             echo "Merge PR #$pr_number is still open; leaving its branch unchanged while CI runs."

From be5efbbfe48953c76a2f1e1b5c0a585ed7e3f2ba Mon Sep 17 00:00:00 2001
From: PureWeen <223556219+Copilot@users.noreply.github.com>
Date: Wed, 29 Jul 2026 16:32:39 -0500
Subject: [PATCH 8/9] Harden release merge workflow rollout

Keep the release gate and Arcade on the same net11.0 configuration, defer scheduled dispatch until the safety-critical workflow sections have propagated, and scope read-only checks to read permissions.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
---
 .github/workflows/merge-main-to-net11.yml    |  3 +
 .github/workflows/merge-net11-to-release.yml | 61 ++++++++++++++++++++
 2 files changed, 64 insertions(+)

diff --git a/.github/workflows/merge-main-to-net11.yml b/.github/workflows/merge-main-to-net11.yml
index c777a1a07471..2eeacd49207e 100644
--- a/.github/workflows/merge-main-to-net11.yml
+++ b/.github/workflows/merge-main-to-net11.yml
@@ -32,6 +32,9 @@ concurrency:
 jobs:
   CheckForOpenMergePullRequest:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     outputs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
diff --git a/.github/workflows/merge-net11-to-release.yml b/.github/workflows/merge-net11-to-release.yml
index 2f74cf68d0b1..4d625b992653 100644
--- a/.github/workflows/merge-net11-to-release.yml
+++ b/.github/workflows/merge-net11-to-release.yml
@@ -32,7 +32,64 @@ jobs:
       actions: write
       contents: read
     steps:
+      - name: Check that net11.0 has the immutable-snapshot gate
+        id: current
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          main_workflow="$RUNNER_TEMP/merge-net11-to-release-main.yml"
+          net11_workflow="$RUNNER_TEMP/merge-net11-to-release-net11.yml"
+
+          if ! gh api \
+            -H "Accept: application/vnd.github.raw+json" \
+            "repos/$REPOSITORY/contents/.github/workflows/merge-net11-to-release.yml?ref=main" \
+            > "$main_workflow"; then
+            echo "::error::Failed to read the workflow on main."
+            exit 1
+          fi
+
+          if ! gh api \
+            -H "Accept: application/vnd.github.raw+json" \
+            "repos/$REPOSITORY/contents/.github/workflows/merge-net11-to-release.yml?ref=net11.0" \
+            > "$net11_workflow"; then
+            echo "::error::Failed to read the workflow on net11.0."
+            exit 1
+          fi
+
+          if ruby - "$main_workflow" "$net11_workflow" <<'RUBY'
+          require 'yaml'
+
+          main = YAML.safe_load_file(ARGV[0], aliases: true)
+          net11 = YAML.safe_load_file(ARGV[1], aliases: true)
+
+          safety_sections = [
+            ['concurrency'],
+            ['jobs', 'CheckForOpenMergePullRequest'],
+            ['jobs', 'Merge']
+          ]
+
+          def section(workflow, path)
+            path.reduce(workflow) { |value, key| value&.fetch(key, nil) }
+          end
+
+          exit(safety_sections.all? { |path| section(main, path) == section(net11, path) } ? 0 : 2)
+          RUBY
+          then
+            echo "should_dispatch=true" >> "$GITHUB_OUTPUT"
+          else
+            validation_exit="$?"
+            if [[ "$validation_exit" -eq 2 ]]; then
+              echo "::notice::net11.0 does not have the current immutable-snapshot gate yet; skipping the scheduled dispatch."
+              echo "should_dispatch=false" >> "$GITHUB_OUTPUT"
+            else
+              echo "::error::Failed to validate the workflow on net11.0."
+              exit 1
+            fi
+          fi
+
       - name: Dispatch the scheduled run from net11.0
+        if: steps.current.outputs.should_dispatch == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REPOSITORY: ${{ github.repository }}
@@ -41,6 +98,9 @@ jobs:
   CheckForOpenMergePullRequest:
     if: github.event_name != 'schedule' && github.ref_name == 'net11.0'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     outputs:
       should_run: ${{ steps.check.outputs.should_run }}
     steps:
@@ -102,4 +162,5 @@ jobs:
     if: github.ref_name == 'net11.0' && needs.CheckForOpenMergePullRequest.outputs.should_run == 'true'
     uses: dotnet/arcade/.github/workflows/inter-branch-merge-base.yml@main
     with:
+      configuration_file_branch: 'net11.0'
       configuration_file_path: 'github-merge-flow-release-11.jsonc'

From 120204ee40dc0ff76ae29206fadc0e052f076c3b Mon Sep 17 00:00:00 2001
From: PureWeen <223556219+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 12:09:53 -0500
Subject: [PATCH 9/9] Fix bot-opened merge policy matching

Remove the redundant issue-author predicate that does not match App-authored pull request events. The Opened action and github-actions bot sender already bind the rule to the bot-created PR event.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
---
 .github/policies/resourceManagement.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/policies/resourceManagement.yml b/.github/policies/resourceManagement.yml
index eaf032e54a39..bbe126f9bcab 100644
--- a/.github/policies/resourceManagement.yml
+++ b/.github/policies/resourceManagement.yml
@@ -724,8 +724,6 @@ configuration:
       - isActivitySender:
           user: github-actions[bot]
           issueAuthor: False
-      - isActivitySender:
-          issueAuthor: True
       - isAction:
           action: Opened
       - or: