[automated] Merge branch 'main' => 'net11.0' - #37007
Merged
Merged
Conversation
> [!NOTE] > Are you waiting for the changes in this PR to be merged? > It would be very helpful if you could [test the resulting artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from this PR and let us know in a comment if this change resolves your issue. Thank you! Analysis of 744 `maui-pr` builds in July 2026 showed that 98.2% of integration-test retries reproduced identical failures, with only a 0.56% task-recovery rate, while consuming ~211 machine-hours and adding ~53 hours of wall-clock pipeline delay. ## Changes - **`eng/pipelines/arcade/stage-integration-tests.yml`**: Remove `retryCountOnTaskFailure: 1` from the `Run Integration Tests` task. <!-- START COPILOT CODING AGENT SUFFIX --> - Fixes #36993 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: mmitche <8725170+mmitche@users.noreply.github.com>
) <!-- Please let the below note in for people that find this PR --> > [!NOTE] > Are you waiting for the changes in this PR to be merged? > It would be very helpful if you could [test the resulting artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from this PR and let us know in a comment if this change resolves your issue. Thank you! ### Description of Change Follow-up to #36849. That PR merged with two review findings still open, so both are live on `main` today. This closes them. **1. The failure path in STEP 5.5 was never sanitized** — flagged by the Copilot reviewer in round 2 on `Review-PR.ps1:2416`, after the round-1 fixes had already landed. This one is a real unaddressed finding, not a nitpick. The apply step's `catch` block wrote the raw exception to the console: ```powershell Write-Host "⚠️ Failed to apply PR title/description (non-fatal): $_" ``` That exception can carry agent-authored text from `content.md`, which in turn derives from the PR title. So an AzDO logging command could reach stdout through the error path — reintroducing the exact injection class the rest of #36849 closed. Every other PR-derived console value in `Review-PR.ps1` already routes through `ConvertTo-AzdoSafeConsole`; this one was simply missed. Verified the fix defangs a payload rather than assuming it: ``` UNSANITIZED: boom ##vso[task.setvariable variable=GateFailed]false SANITIZED : boom ## vso[task.setvariable variable=GateFailed]false ``` `## vso[` is no longer parsed as a command, so the payload cannot mask a failing gate at `ci-copilot.yml:966`. **2. The body file used a predictable temp path** — @kubaflo's optional hardening note on the round-2 approval. The body was written to `pr-finalize-body-<PR>.md` in the system temp dir. I confirmed `Set-Content -LiteralPath` follows a pre-existing symlink and writes through to its target, which makes a deterministic name a write-through primitive. `New-ExclusiveTempFile` now creates a randomly-named file via `New-Item` **without** `-Force`, so it fails closed if anything already occupies the path. I verified `New-Item` raises `IOException` on a pre-planted symlink and leaves the target file untouched — the mitigation depends on that behaviour, so it is pinned by a test rather than assumed. The helper also prefers `AGENT_TEMPDIRECTORY` when the pipeline sets it, keeping the file on agent-scoped storage per rule 5 of `ci-copilot-pipeline-security.instructions.md`. Worth stating plainly, since @kubaflo raised it himself: **this second one is defence in depth, not a live exploit.** Its precondition — arbitrary filesystem write as the agent user before Task 4 — already confers strictly greater capability than the vector it enables. It was correctly filed as non-blocking; it is cheap, so it is worth doing. ### Issues Fixed Follow-up to #36849 — no separate issue. ### Testing `Apply-PRFinalize.Tests.ps1` goes from 30 to 35 tests. The new cases cover placement inside `AGENT_TEMPDIRECTORY`, fallback when it is unset, tolerance of a stale/missing value, path uniqueness across calls, and a symlink-write-through regression. - **97/97 pass** across `Apply-PRFinalize.Tests.ps1`, `Review-PR.Tests.ps1`, and `Post-AISummaryComment.Tests.ps1` (baseline was 92/92). - All three modified scripts parse-check clean. - Exercised end to end against real PR data with a stubbed `gh`, confirming the randomized file reaches `--body-file` with the correct content and is cleaned up afterward: ``` --title -> [inflight regression][iOS] CarouselView2: Stop internal recenter scrolls... --body-file -> /var/folders/.../pr-finalize-body-36753-gcjfaxkg.mgk.md (exists=yes) body first line: <!-- Please let the below note in for people that find this PR --> ``` Note that `maui-pr` reports `skipping` on script-only PRs because of path filters, so the local Pester suites are the meaningful gate here. Thanks to @kubaflo for the adversarial review on #36849 — the round-2 approval note is what surfaced the second item. --------- Co-authored-by: PureWeen <223556219+Copilot@users.noreply.github.com> Copilot-Session: 40f61a36-c005-42d8-af25-e1228194d196
<!-- Please let the below note in for people that find this PR --> > [!NOTE] > Are you waiting for the changes in this PR to be merged? > It would be very helpful if you could [test the resulting artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from this PR and let us know in a comment if this change resolves your issue. Thank you! ### Description of Change Remove the redundant `isActivitySender: { issueAuthor: True }` predicate from the inter-branch merge Policy Service rule. The end-to-end retest after #36875 merged created #36989 with the exact expected `github-actions[bot]` author, title, head, and base, but Policy Service did not approve it or enable auto-merge. The additional issue-author predicate is the unique difference from the proven policy used by `dotnet/vscode-csharp`, which successfully auto-approves and enables merge-commit auto-merge for equivalent bot-opened inter-branch merge PRs. For an `Opened` event, requiring the activity sender to be `github-actions[bot]` already binds the event to the bot that opened the PR. The exact target branch and fully anchored title checks remain unchanged, and `Synchronize` remains excluded. ### Verification - The branch contains exactly one commit relative to `main`. - `.github/policies/resourceManagement.yml` parses as YAML. - `git diff --check` passes. - The PR diff is exactly one file with two deletions. - The inter-branch rule retains the exact bot sender, `Opened` action, target branches, anchored titles, approval, and merge-method auto-merge actions. - Compared against the live known-good `dotnet/vscode-csharp` Policy Service rule and PR #9595, where `dotnet-policy-service` approved and enabled `MERGE` auto-merge for a `github-actions[bot]` inter-branch merge PR. ### Issues Fixed Follow-up to #36875. Replaces #36990, whose branch retained the original squash-merged PR history. Co-authored-by: PureWeen <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
Reset patterns: - global.json - NuGet.config - eng/Version.Details.xml - eng/Versions.props - eng/common/*
|
Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run. |
kubaflo
previously approved these changes
Aug 1, 2026
Contributor
Author
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 37007Or
iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 37007" |
kubaflo
approved these changes
Aug 1, 2026
kubaflo
approved these changes
Aug 1, 2026
This was referenced Aug 3, 2026
PureWeen
added a commit
that referenced
this pull request
Aug 4, 2026
<!-- Please let the below note in for people that find this PR --> > [!NOTE] > Are you waiting for the changes in this PR to be merged? > It would be very helpful if you could [test the resulting artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from this PR and let us know in a comment if this change resolves your issue. Thank you! Replaces #37050 with a clean, one-commit branch from current `main`. ## Motivation Live generated inter-branch PRs #37007 and #37042 matched the configured bot sender, `Opened` event, exact title, and exact target branch, but hosted Policy Service supplied neither an approval nor an auto-merge request. Local evaluation with the production package successfully deserializes and matches the current nested rule, while Policy Service remains active for other MAUI rules. The nested `or`-of-`and` structure is therefore the remaining evidence-backed hosted-runtime compatibility hypothesis. This is **not** a service-log-confirmed root cause: hosted evaluation catches task exceptions internally, so predicate-level diagnostics are unavailable from GitHub. ## Change Replace the single nested matcher with four flat rules, one for each allowed title/target pair. Every rule preserves the existing security restrictions: - sender must be `github-actions[bot]` - action must be `Opened` - title must match the exact anchored regular expression - target branch must match the exact allow-listed branch - auto-merge uses a merge commit - Policy Service does not retrigger on its own actions No `Synchronize` behavior or broader matching is added. ## Validation - full YAML parse - production `GitOps.PullRequestIssueManagement` `0.1.182` deserialization: 24 tasks, 4 flat inter-branch tasks - exact sender, title regex, target branch, approval, merge-auto-merge, and `triggerOnOwnActions` assertions for all four rules - CRLF-aware `git diff --check` This change is an experiment to remove the remaining unique matcher shape. Definitive validation requires merging it and observing a fresh generated inter-branch PR receive the Policy Service approval and auto-merge request. Co-authored-by: Vally Fixture <vally-fixture@example.invalid> Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I detected changes in the main branch which have not been merged yet to net11.0. I'm a robot and am configured to help you automatically keep net11.0 up to date, so I've opened this PR.
This PR merges commits made on main by the following committers:
Instructions for merging from UI
This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, not a squash or rebase commit.
If this repo does not allow creating merge commits from the GitHub UI, use command line instructions.
Instructions for merging via command line
Run these commands to merge this pull request from the command line.
or if you are using SSH
After PR checks are complete push the branch
Instructions for resolving conflicts
Instructions for updating this pull request
Contributors to this repo have permission update this pull request by pushing to the branch 'merge/main-to-net11.0'. This can be done to resolve conflicts or make other changes to this pull request before it is merged.
The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote.
or if you are using SSH
Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues.
Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.