Skip to content

[automated] Merge branch 'main' => 'net11.0' - #37007

Merged
kubaflo merged 5 commits into
net11.0from
merge/main-to-net11.0
Aug 1, 2026
Merged

[automated] Merge branch 'main' => 'net11.0'#37007
kubaflo merged 5 commits into
net11.0from
merge/main-to-net11.0

Conversation

@github-actions

@github-actions github-actions Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

I detected changes in the main branch which have not been merged yet to net11.0. I'm a robot and am configured to help you automatically keep net11.0 up to date, so I've opened this PR.

This PR merges commits made on main by the following committers:

  • PureWeen
  • Copilot

Instructions for merging from UI

This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, not a squash or rebase commit.

merge button instructions

If this repo does not allow creating merge commits from the GitHub UI, use command line instructions.

Instructions for merging via command line

Run these commands to merge this pull request from the command line.

git fetch
git checkout main
git pull --ff-only
git checkout net11.0
git pull --ff-only
git merge --no-ff main

# If there are merge conflicts, resolve them and then run git merge --continue to complete the merge
# Pushing the changes to the PR branch will re-trigger PR validation.
git push https://github.com/dotnet/maui HEAD:merge/main-to-net11.0
or if you are using SSH
git push git@github.com:dotnet/maui HEAD:merge/main-to-net11.0

After PR checks are complete push the branch

git push

Instructions for resolving conflicts

⚠️ If there are merge conflicts, you will need to resolve them manually before merging. You can do this using GitHub or using the command line.

Instructions for updating this pull request

Contributors to this repo have permission update this pull request by pushing to the branch 'merge/main-to-net11.0'. This can be done to resolve conflicts or make other changes to this pull request before it is merged.
The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote.

git fetch
git checkout -b merge/main-to-net11.0 origin/net11.0
git pull https://github.com/dotnet/maui merge/main-to-net11.0
(make changes)
git commit -m "Updated PR with my changes"
git push https://github.com/dotnet/maui HEAD:merge/main-to-net11.0
or if you are using SSH
git fetch
git checkout -b merge/main-to-net11.0 origin/net11.0
git pull git@github.com:dotnet/maui merge/main-to-net11.0
(make changes)
git commit -m "Updated PR with my changes"
git push git@github.com:dotnet/maui HEAD:merge/main-to-net11.0

Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues.
Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.

Copilot AI and others added 4 commits August 1, 2026 14:28
> [!NOTE]
> Are you waiting for the changes in this PR to be merged?
> It would be very helpful if you could [test the resulting
artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from
this PR and let us know in a comment if this change resolves your issue.
Thank you!

Analysis of 744 `maui-pr` builds in July 2026 showed that 98.2% of
integration-test retries reproduced identical failures, with only a
0.56% task-recovery rate, while consuming ~211 machine-hours and adding
~53 hours of wall-clock pipeline delay.

## Changes

- **`eng/pipelines/arcade/stage-integration-tests.yml`**: Remove
`retryCountOnTaskFailure: 1` from the `Run Integration Tests` task.

<!-- START COPILOT CODING AGENT SUFFIX -->

- Fixes #36993

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: mmitche <8725170+mmitche@users.noreply.github.com>
)

<!-- Please let the below note in for people that find this PR -->
> [!NOTE]
> Are you waiting for the changes in this PR to be merged?
> It would be very helpful if you could [test the resulting
artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from
this PR and let us know in a comment if this change resolves your issue.
Thank you!

### Description of Change

Follow-up to #36849. That PR merged with two review findings still open,
so both are live on `main` today. This closes them.

**1. The failure path in STEP 5.5 was never sanitized** — flagged by the
Copilot reviewer in round 2 on `Review-PR.ps1:2416`, after the round-1
fixes had already landed. This one is a real unaddressed finding, not a
nitpick.

The apply step's `catch` block wrote the raw exception to the console:

```powershell
Write-Host "  ⚠️ Failed to apply PR title/description (non-fatal): $_"
```

That exception can carry agent-authored text from `content.md`, which in
turn derives from the PR title. So an AzDO logging command could reach
stdout through the error path — reintroducing the exact injection class
the rest of #36849 closed. Every other PR-derived console value in
`Review-PR.ps1` already routes through `ConvertTo-AzdoSafeConsole`; this
one was simply missed.

Verified the fix defangs a payload rather than assuming it:

```
UNSANITIZED: boom ##vso[task.setvariable variable=GateFailed]false
SANITIZED  : boom ## vso[task.setvariable variable=GateFailed]false
```

`## vso[` is no longer parsed as a command, so the payload cannot mask a
failing gate at `ci-copilot.yml:966`.

**2. The body file used a predictable temp path** — @kubaflo's optional
hardening note on the round-2 approval.

The body was written to `pr-finalize-body-<PR>.md` in the system temp
dir. I confirmed `Set-Content -LiteralPath` follows a pre-existing
symlink and writes through to its target, which makes a deterministic
name a write-through primitive.

`New-ExclusiveTempFile` now creates a randomly-named file via `New-Item`
**without** `-Force`, so it fails closed if anything already occupies
the path. I verified `New-Item` raises `IOException` on a pre-planted
symlink and leaves the target file untouched — the mitigation depends on
that behaviour, so it is pinned by a test rather than assumed. The
helper also prefers `AGENT_TEMPDIRECTORY` when the pipeline sets it,
keeping the file on agent-scoped storage per rule 5 of
`ci-copilot-pipeline-security.instructions.md`.

Worth stating plainly, since @kubaflo raised it himself: **this second
one is defence in depth, not a live exploit.** Its precondition —
arbitrary filesystem write as the agent user before Task 4 — already
confers strictly greater capability than the vector it enables. It was
correctly filed as non-blocking; it is cheap, so it is worth doing.

### Issues Fixed

Follow-up to #36849 — no separate issue.

### Testing

`Apply-PRFinalize.Tests.ps1` goes from 30 to 35 tests. The new cases
cover placement inside `AGENT_TEMPDIRECTORY`, fallback when it is unset,
tolerance of a stale/missing value, path uniqueness across calls, and a
symlink-write-through regression.

- **97/97 pass** across `Apply-PRFinalize.Tests.ps1`,
`Review-PR.Tests.ps1`, and `Post-AISummaryComment.Tests.ps1` (baseline
was 92/92).
- All three modified scripts parse-check clean.
- Exercised end to end against real PR data with a stubbed `gh`,
confirming the randomized file reaches `--body-file` with the correct
content and is cleaned up afterward:

```
--title -> [inflight regression][iOS] CarouselView2: Stop internal recenter scrolls...
--body-file -> /var/folders/.../pr-finalize-body-36753-gcjfaxkg.mgk.md (exists=yes)
body first line: <!-- Please let the below note in for people that find this PR -->
```

Note that `maui-pr` reports `skipping` on script-only PRs because of
path filters, so the local Pester suites are the meaningful gate here.

Thanks to @kubaflo for the adversarial review on #36849 — the round-2
approval note is what surfaced the second item.

---------

Co-authored-by: PureWeen <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 40f61a36-c005-42d8-af25-e1228194d196
<!-- Please let the below note in for people that find this PR -->
> [!NOTE]
> Are you waiting for the changes in this PR to be merged?
> It would be very helpful if you could [test the resulting
artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from
this PR and let us know in a comment if this change resolves your issue.
Thank you!

### Description of Change

Remove the redundant `isActivitySender: { issueAuthor: True }` predicate
from the inter-branch merge Policy Service rule.

The end-to-end retest after #36875 merged created #36989 with the exact
expected `github-actions[bot]` author, title, head, and base, but Policy
Service did not approve it or enable auto-merge. The additional
issue-author predicate is the unique difference from the proven policy
used by `dotnet/vscode-csharp`, which successfully auto-approves and
enables merge-commit auto-merge for equivalent bot-opened inter-branch
merge PRs.

For an `Opened` event, requiring the activity sender to be
`github-actions[bot]` already binds the event to the bot that opened the
PR. The exact target branch and fully anchored title checks remain
unchanged, and `Synchronize` remains excluded.

### Verification

- The branch contains exactly one commit relative to `main`.
- `.github/policies/resourceManagement.yml` parses as YAML.
- `git diff --check` passes.
- The PR diff is exactly one file with two deletions.
- The inter-branch rule retains the exact bot sender, `Opened` action,
target branches, anchored titles, approval, and merge-method auto-merge
actions.
- Compared against the live known-good `dotnet/vscode-csharp` Policy
Service rule and PR #9595, where `dotnet-policy-service` approved and
enabled `MERGE` auto-merge for a `github-actions[bot]` inter-branch
merge PR.

### Issues Fixed

Follow-up to #36875. Replaces #36990, whose branch retained the original
squash-merged PR history.

Co-authored-by: PureWeen <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
Reset patterns:
- global.json
- NuGet.config
- eng/Version.Details.xml
- eng/Versions.props
- eng/common/*
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.

kubaflo
kubaflo previously approved these changes Aug 1, 2026
@github-actions

github-actions Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor Author

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 37007

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 37007"

@kubaflo
kubaflo merged commit ae5d0e9 into net11.0 Aug 1, 2026
5 of 14 checks passed
@kubaflo
kubaflo deleted the merge/main-to-net11.0 branch August 1, 2026 18:05
@github-actions github-actions Bot added this to the .NET 11.0-preview7 milestone Aug 1, 2026
PureWeen added a commit that referenced this pull request Aug 4, 2026
<!-- Please let the below note in for people that find this PR -->
> [!NOTE]
> Are you waiting for the changes in this PR to be merged?
> It would be very helpful if you could [test the resulting
artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from
this PR and let us know in a comment if this change resolves your issue.
Thank you!

Replaces #37050 with a clean, one-commit branch from current `main`.

## Motivation

Live generated inter-branch PRs #37007 and #37042 matched the configured
bot sender, `Opened` event, exact title, and exact target branch, but
hosted Policy Service supplied neither an approval nor an auto-merge
request. Local evaluation with the production package successfully
deserializes and matches the current nested rule, while Policy Service
remains active for other MAUI rules.

The nested `or`-of-`and` structure is therefore the remaining
evidence-backed hosted-runtime compatibility hypothesis. This is **not**
a service-log-confirmed root cause: hosted evaluation catches task
exceptions internally, so predicate-level diagnostics are unavailable
from GitHub.

## Change

Replace the single nested matcher with four flat rules, one for each
allowed title/target pair. Every rule preserves the existing security
restrictions:

- sender must be `github-actions[bot]`
- action must be `Opened`
- title must match the exact anchored regular expression
- target branch must match the exact allow-listed branch
- auto-merge uses a merge commit
- Policy Service does not retrigger on its own actions

No `Synchronize` behavior or broader matching is added.

## Validation

- full YAML parse
- production `GitOps.PullRequestIssueManagement` `0.1.182`
deserialization: 24 tasks, 4 flat inter-branch tasks
- exact sender, title regex, target branch, approval, merge-auto-merge,
and `triggerOnOwnActions` assertions for all four rules
- CRLF-aware `git diff --check`

This change is an experiment to remove the remaining unique matcher
shape. Definitive validation requires merging it and observing a fresh
generated inter-branch PR receive the Policy Service approval and
auto-merge request.

Co-authored-by: Vally Fixture <vally-fixture@example.invalid>
Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants