[ci-scan-feedback] ci-scan: add Hard Rule 10 for explicit early exit on no scannable build

[github-actions]

Triggering signals

• Run Fixes link to sentiment analysis example. #79 (2026-06-28T01:27:11Z) and all 79 ci-scan runs since window-start (2026-06-08T13:53:53Z) have correctly skipped via the Step 1 "no scannable build" prose. The stale build window (>14d) reason fires on every run: the most recent failed build is #1453653 (completed 2026-06-08, now 20+ days old). The scanner token cost has been ~36k per run — efficient, but dependent on the agent correctly parsing Step 1 prose. Hard Rule 10 is missing from the Hard Rules section; the only early-exit instruction lives in Step 1 prose.
• Previous feedback ticks surfaced this gap and attempted to file it as a PR. Those attempts misfired: the feedback agent filed GitHub Issues ([ci-scan-feedback] ci-scan: add Hard Rule 10 for early exit on no scannable build #7627, [ci-scan-feedback] ci-scan: add Hard Rule 10 for early exit on no scannable build #7630, [ci-scan-feedback] ci-scan: add Hard Rule 10 to force early exit on no scannable build #7636, [ci-scan-feedback] ci-scan: add Hard Rule 10 to force early exit on no scannable build #7637, [ci-scan-feedback] ci-scan: add Hard Rule 10 to force early exit on no scannable build #7639, [ci-scan-feedback] ci-scan: add Hard Rule 10 to force early exit on no scannable build #7640, [ci-scan-feedback] ci-scan: add Hard Rule 10 to force early exit on no scannable build #7641, [ci-scan-feedback] ci-scan: add Hard Rule 10 to force early exit on no scannable build #7642, [ci-scan-feedback] ci-scan: add Hard Rule 10 to force early exit on no scannable build #7643, [ci-scan-feedback] ci-scan: add Hard Rule 10 to force early exit on no scannable build #7644) instead of PRs. This is the first successful PR carrying the change.

Proposed edits

• .github/workflows/ci-scan.agent.md line 81 (after Hard Rule 9): add Hard Rule 10 — "Exit immediately when no scannable build. When Step 1 yields a skip reason (stale build window (>14d), no follow-up build yet, defer to next run, or no failed build in 7d), print the Step 7 tally row with all zeros, emit noop, and stop. Do not proceed to Steps 2–7." Rationale: the same behavior is already in Step 1 prose (line 92), but having it in the Hard Rules section (which the agent re-reads before every step) makes the early-exit invariant unambiguous and guards against future prompt drift where a reworded Step 1 might be interpreted permissively.

Expected behavior change

The next ci-scan run that encounters a stale build window, no follow-up build, or no failed build in 7 days will exit at Hard Rule 10 — a rule-level gate checked before any AzDO API calls in Step 2 — rather than relying solely on Step 1 prose. This eliminates the risk of a future model reinterpretation proceeding past Step 1, and keeps the "no scannable build" path explicit and auditable in the Hard Rules section where invariants are declared.

Generated by CI Failure Scanner - Feedback (machinelearning) · ● 2.2M · ◷

---

Note

This was originally intended as a pull request, but the git push operation failed.

Workflow Run: View run details and download patch artifact

The patch file is available in the agent artifact in the workflow run linked above.

To create a pull request with the changes:

# Download the artifact from the workflow run
gh run download 28310835765 -n agent -D /tmp/agent-28310835765

# Create a new branch
git checkout -b ci-scan-feedback/add-hard-rule-10-2026-06-28-bd0d57c31724b01b

# Apply the patch (--3way handles cross-repo patches where files may already exist)
git am --3way /tmp/agent-28310835765/aw-ci-scan-feedback-add-hard-rule-10-2026-06-28.patch

# Push the branch to origin
git push origin ci-scan-feedback/add-hard-rule-10-2026-06-28-bd0d57c31724b01b

# Create the pull request
gh pr create --title '[ci-scan-feedback] ci-scan: add Hard Rule 10 for explicit early exit on no scannable build' --base main --head ci-scan-feedback/add-hard-rule-10-2026-06-28-bd0d57c31724b01b --repo dotnet/machinelearning

Show patch (36 lines)

From f630fcaaaf3896716b966ff316c0cf250ad2db2f Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Sun, 28 Jun 2026 04:11:21 +0000
Subject: [PATCH] ci-scan: add Hard Rule 10 for explicit early exit on no
 scannable build

Belt-and-suspenders guard making the Step 1 stop explicit as a Hard Rule.
When no scannable build exists (stale window, no follow-up, or no failed
build in 7d), Rule 10 mandates the agent print the zero tally, emit noop,
and stop without proceeding to Steps 2-7.

Signal: 79+ consecutive ci-scan runs have correctly skipped via Step 1
prose; this rule codifies the same behavior in the Hard Rules section so
it is unambiguous and resistant to future prompt drift.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/ci-scan.agent.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci-scan.agent.md b/.github/workflows/ci-scan.agent.md
index 0937c5f..5860af7 100644
--- a/.github/workflows/ci-scan.agent.md
+++ b/.github/workflows/ci-scan.agent.md
@@ -78,6 +78,7 @@ These invariants are not delegated to the shared file. Honor them even if a shar
 7. **All state under `/tmp/gh-aw/agent/`;** each bash call is a fresh subshell.
 8. **AzDO REST is anonymous;** stay on `https://dev.azure.com/dnceng-public/public/_apis/build/...`. Follow every rule in [Environment constraints](shared/ci-scan.instructions.md#environment-constraints) (pre-bind URLs, `%24top`, no redirection).
 9. **Sanitize every embedded log excerpt** per [Sanitization](shared/ci-scan.instructions.md#sanitization).
+10. **Exit immediately when no scannable build.** When Step 1 yields a skip reason (`stale build window (>14d)`, `no follow-up build yet, defer to next run`, or `no failed build in 7d`), print the Step 7 tally row with all zeros, emit `noop`, and stop. Do not proceed to Steps 2–7.
 
 ## Step 1 - Select the source build
 
-- 
2.54.0