Add agentic workflow to update DefaultVersions.props#16993
Conversation
Adds a gh-aw scheduled (weekly) agentic workflow that mimics dependabot for the toolset version properties in the Arcade SDK's DefaultVersions.props, which regular dependabot cannot update. It checks nuget.org and the configured NuGet feeds (prereleases allowed), updates matching versions elsewhere in the repo, requests package mirroring when needed, and honors xunit special instructions. Fixes #16992 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds the repository’s first GitHub Agentic Workflow (gh-aw) to periodically update the Arcade SDK’s DefaultVersions.props-backed toolset version properties by scanning nuget.org and configured feeds and opening a consolidated PR with bumps.
Changes:
- Introduces an agent prompt workflow definition for updating
DefaultVersions.props(and matching versions across the repo). - Adds the compiled gh-aw lock workflow YAML and an actions SHA lockfile.
- Marks
*.lock.ymlworkflows as generated in.gitattributes(and sets merge behavior).
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/update-default-versions.md | gh-aw source workflow prompt and rules for resolving package IDs and version selection. |
| .github/workflows/update-default-versions.lock.yml | Compiled GitHub Actions workflow that runs the agent and creates PRs via Safe Outputs. |
| .github/aw/actions-lock.json | Generated action SHA lock entries for gh-aw compilation/runtime. |
| .gitattributes | Marks compiled *.lock.yml as generated and configures merge behavior. |
Copilot's findings
- Files reviewed: 4/4 changed files
- Comments generated: 3
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
| | `Microsoft.Signed.Wix` | `MicrosoftSignedWixVersion` | | ||
| | `Microsoft.WixToolset.Sdk` | `MicrosoftWixToolsetSdkVersion` | | ||
| | `Microsoft.ManifestTool.CrossPlatform` | `MicrosoftManifestToolCrossPlatformVersion` | | ||
| | `Microsoft.VisualStudio.Eng.MicroBuild.Core` | `MicrosoftVisualStudioEngMicroBuildCoreVersion` | |
There was a problem hiding this comment.
the wix and microbuild packages aren't available on nuget, they're internal packages. we shouldn't update them via this workflow.
There was a problem hiding this comment.
This workflow updates packages coming from nuget.org or the defined NuGet.config repo feeds. Many of those dependencies aren't available on nuget.org, i.e. sn.
From the PR description:
Checks nuget.org and every feed configured in NuGet.config for newer versions (prereleases allowed).
If a newer version exists on nuget.org but not on dotnet-public, it still makes the change and adds a mirroring-request table to the PR body per MirroringPackages.md (the PR build will fail until mirrored — expected).
There was a problem hiding this comment.
@ViktorHofer I know, what I meant to say is that e.g. for Wix it's not as simple as "just bump the version", it needs manual changes (@joeloff is working on upgrading to Wix5 for example).
There was a problem hiding this comment.
and for MicroBuild the example here is wrong, the package id is Microsoft.VisualStudioEng.MicroBuild.Core
There was a problem hiding this comment.
For Microsoft.Signed.Wix it actually was as simple as updating the version: #16987. For the newer wix package, sure. We can add constraints to this workflow when we see dependencies that need special handling. This doesn't need to be perfect, initially. I just want to get the agentic workflow in to try it out and then refine it based on that.
There was a problem hiding this comment.
Fixed in 50fff2d — the example now uses Microsoft.VisualStudioEng.MicroBuild.Core. I also added a note that several dot placements can collapse to the same property name (MicrosoftVisualStudioEngMicroBuildCoreVersion could split as Microsoft.VisualStudio.Eng.MicroBuild.Core or Microsoft.VisualStudioEng.MicroBuild.Core), so the workflow disambiguates by validating candidates against the feeds and never invents an unconfirmed ID.
There was a problem hiding this comment.
Good point. I added a comment-marker mechanism so packages can opt out of unconstrained bumps, and applied it to MicrosoftWixToolsetSdkVersion (757e1bb): it's now annotated <!-- minor-patch-only: ... -->, so the workflow will only take WiX minor/patch updates (e.g. within 6.0.x) and will leave major upgrades like the WiX 5/6 migration to a human. There's also a stronger no-auto-update marker available if a package should be skipped entirely.
- Correct the MicroBuild example package ID to Microsoft.VisualStudioEng.MicroBuild.Core and clarify that feed validation disambiguates dot placements. - Add a 'no-auto-update' opt-out marker (honored by the workflow) above MicrosoftWixToolsetSdkVersion since WiX major upgrades need manual changes. - Constrain the workflow to not bump across major versions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Major version bumps are now permitted by default. Packages that must stay within their current major can opt in via a 'minor-patch-only' comment marker directly above the property. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
WiX can take minor/patch bumps automatically; only major upgrades need coordinated manual changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
gentle ping @akoeplinger |
Implements the proposal in #16992.
Adds a GitHub Agentic Workflow (gh-aw) — the repository's first — that runs weekly and acts like a "dependabot on steroids" for the toolset version properties defined in the Arcade SDK's
DefaultVersions.props. Regular dependabot cannot update these because they are SDK-provided MSBuild properties rather thanPackageReference/PackageVersionitems.What the workflow does
PackageIdwith dots removed +Version), validating candidates against the feeds and skipping anything it cannot confidently resolve or that is an MSBuild reference like$(ArcadeSdkVersion).NuGet.configfor newer versions (prereleases allowed).Directory.Packages.props, docs).It opens a single consolidated PR per run. The agent job is read-only; all writes go through the
create-pull-requestsafe output, and a human reviews/approves every PR.Files
.github/workflows/update-default-versions.md— the workflow.github/workflows/update-default-versions.lock.yml— compiled output.github/aw/actions-lock.json— SHA-pinned actions lockfile (generated).gitattributes— marks*.lock.ymlas generated