Flatten inter-branch merge policy matchers - #37050
Closed
PureWeen wants to merge 3 commits into
Closed
Conversation
Remove the redundant issue-author predicate that does not match App-authored pull request events. The Opened action and github-actions bot sender already bind the rule to the bot-created PR event. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
Avoid the unique nested or-of-and matcher shape while preserving the exact bot, Opened event, target branch, title, and merge-method requirements for every allowed flow. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
PureWeen
temporarily deployed
to
copilot-pat-pool
August 3, 2026 18:23 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
|
Azure Pipelines: 1 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Member
Author
|
@kubaflo please re-review this follow-up. It preserves the exact sender/action/title/target allow-list and replaces only the hosted-service-unique nested matcher shape with four flat rules. |
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.sh | bash -s -- 37050Or
iex "& { $(irm https://raw.githubusercontent.com/dotnet/maui/main/eng/scripts/get-maui-pr.ps1) } 37050" |
PureWeen
temporarily deployed
to
copilot-pat-pool
August 3, 2026 18:24 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
PureWeen
temporarily deployed
to
copilot-pat-pool
August 3, 2026 18:24 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
PureWeen
temporarily deployed
to
copilot-pat-pool
August 3, 2026 18:26 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
PureWeen
temporarily deployed
to
copilot-pat-pool
August 3, 2026 18:27 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
github-actions
Bot
added
the
area-infrastructure
PureWeen
temporarily deployed
to
copilot-pat-pool
August 3, 2026 18:28 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the GitOps Policy Service configuration to improve reliability of the inter-branch merge auto-approval/auto-merge automation by avoiding a nested or-of-and matcher shape and instead expressing each allowed forward-merge flow as a separate, flat rule.
Changes:
- Replaced a single compound inter-branch merge matcher with four explicit rules, each matching one exact (target branch, anchored title regex) pair.
- Added per-rule metadata (
description,triggerOnOwnActions: false) while keeping the sender/action constraints and the approval +mergeauto-merge actions intact.
Show a summary per file
| File | Description |
|---|---|
| .github/policies/resourceManagement.yml | Splits the inter-branch merge Policy Service rule into four flat rules with explicit title/target matching and the same approve + merge-auto-merge actions. |
Copilot's findings
- Files reviewed: 1/1 changed files
- Comments generated: 1
Comment on lines
+721
to
+723
| - description: '[Inter-branch merge] Auto-approve main to net11.0' | ||
| triggerOnOwnActions: false | ||
| if: |
Member
Author
|
Superseded by #37068, recreated from current main with only the flat-rule rewrite as a single commit. No history was rewritten. |
PureWeen
added a commit
that referenced
this pull request
Aug 4, 2026
<!-- Please let the below note in for people that find this PR --> > [!NOTE] > Are you waiting for the changes in this PR to be merged? > It would be very helpful if you could [test the resulting artifacts](https://github.com/dotnet/maui/wiki/Testing-PR-Builds) from this PR and let us know in a comment if this change resolves your issue. Thank you! Replaces #37050 with a clean, one-commit branch from current `main`. ## Motivation Live generated inter-branch PRs #37007 and #37042 matched the configured bot sender, `Opened` event, exact title, and exact target branch, but hosted Policy Service supplied neither an approval nor an auto-merge request. Local evaluation with the production package successfully deserializes and matches the current nested rule, while Policy Service remains active for other MAUI rules. The nested `or`-of-`and` structure is therefore the remaining evidence-backed hosted-runtime compatibility hypothesis. This is **not** a service-log-confirmed root cause: hosted evaluation catches task exceptions internally, so predicate-level diagnostics are unavailable from GitHub. ## Change Replace the single nested matcher with four flat rules, one for each allowed title/target pair. Every rule preserves the existing security restrictions: - sender must be `github-actions[bot]` - action must be `Opened` - title must match the exact anchored regular expression - target branch must match the exact allow-listed branch - auto-merge uses a merge commit - Policy Service does not retrigger on its own actions No `Synchronize` behavior or broader matching is added. ## Validation - full YAML parse - production `GitOps.PullRequestIssueManagement` `0.1.182` deserialization: 24 tasks, 4 flat inter-branch tasks - exact sender, title regex, target branch, approval, merge-auto-merge, and `triggerOnOwnActions` assertions for all four rules - CRLF-aware `git diff --check` This change is an experiment to remove the remaining unique matcher shape. Definitive validation requires merging it and observing a fresh generated inter-branch PR receive the Policy Service approval and auto-merge request. Co-authored-by: Vally Fixture <vally-fixture@example.invalid> Copilot-Session: 1b2b2dd6-bf5f-4179-8a8f-c4c85b9bce26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Are you waiting for the changes in this PR to be merged?
It would be very helpful if you could test the resulting artifacts from this PR and let us know in a comment if this change resolves your issue. Thank you!
Description of Change
Split the inter-branch merge Policy Service rule into four flat rules, one for each exact allowed target/title pair.
Fresh bot-opened PRs #36989, #37007, and #37042 received neither a Policy Service review nor an auto-merge request. The latest test, #37042, exactly matched the configured sender,
Openedaction, target branch, and anchored title, while Policy Service continued processing other MAUI PR events normally.The investigation ruled out sender normalization, configuration parsing, regex matching, task-count limits, missing App permissions, and unsupported individual primitives. The remaining MAUI-specific difference from working policies is the nested
or-of-andmatcher that combinestargetsBranchwith anchored regex titles. Policy Service swallows condition/action exceptions without a visible GitHub diagnostic, so its hosted failure cannot be distinguished further without service-side evaluation logs.This change removes that unique compound shape. Each flow now uses the flat condition layout already used by working dotnet-org policies:
github-actions[bot]senderOpenedevents onlytriggerOnOwnActions: falseSecurity
The allow-list is unchanged. The rules still reject synchronize events, non-bot senders, mismatched titles, and mismatched target branches. Splitting the rule does not broaden any accepted source/target pair or change the merge method.
Verification
GitOps.PullRequestIssueManagementNuGet package (0.1.182). It loads all 24 event responder tasks and all four flat rules with the expected condition/action types.Opened-only behavior, explicit own-action suppression, approval action, andmergeauto-merge method.git diff --checkpasses with the repository's CRLF convention.Follow-up validation
After this policy change merges, close #37042 and let the existing workflow create a fresh PR. The success criteria are a
dotnet-policy-serviceapproval, aMERGEauto-merge request, and automatic completion aftermaui-prpasses.Issues Fixed
Follow-up to #36875 and #36992.