Skip to content

[ci-scan-feedback] Route platform-specific crypto-config failures to loop-in #131469

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kotlarmilos merged 2 commits into from
Jul 29, 2026
+2 −0
Merged

[ci-scan-feedback] Route platform-specific crypto-config failures to loop-in #131469

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
58b05c4
Initial plan
Copilot Jul 28, 2026
d983663
Add Platform crypto-config caution to ci-failure-fix Step 5.2
Copilot Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/ci-failure-fix.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,8 @@ Always try to produce a real candidate change first. Read every file you would m

**Already-rooted test-assembly caution.** For any failing leg, when the symptom is a type, assembly, or method *missing at run time* (a `FileNotFoundException` for a `*.TestAssembly.dll`, a reflection lookup returning null, a missing logging/DI provider), first inspect the harness and project sources for existing roots and for whether the missing artifact is already present in the app/layout. If the test assembly or member is already rooted, do **not** propose another `[DynamicDependency]`, `.rd.xml`/`ILLink.Descriptors.xml` root, or `TrimmerRootAssembly` — the change is a no-op reviewers will reject. Similarly, if the assembly is already copied into the app bundle/layout, do **not** propose an additional bundle-copy. Only add a root or copy step when source confirms it is missing. Otherwise pin a concrete product-side root cause, or treat it as no-producible-diff and route to Branch COMMENT (Step 5.5).

**Platform crypto-config caution.** When a `System.Security.Cryptography.*` test fails only on a specific distro/OS crypto configuration (AzureLinux/mariner, `linux_musl`, FIPS, or an OpenSSL-provider variant) and the candidate change would hard-code a platform-specific crypto expectation — a key-size floor, algorithm availability, cipher enable/disable, or a per-distro test-expectation change — do **not** open a confident (Branch FIX) PR. The correct behavior depends on the distro's crypto provider configuration, which is a security-area-owner decision, so a guessed expectation change will be rejected. Route to Branch COMMENT (Step 5.5, loop-in), or Branch HELP (Step 5.4) only when you name the specific platform crypto configuration as the explicit open question for a human to confirm.

Once you have a candidate diff, classify it:

**Confident (Branch FIX, Step 5.3)** — ALL of:
Expand Down