[Amaury Levé (Evangelink)]

Description

Updates the root .github/workflows/*.yml GitHub Actions group from the CAO task to the requested target versions and immutable SHAs:

• actions/create-github-app-token 3.1.1 -> 3.2.0
• github/gh-aw-actions/setup and setup-cli 0.88.8 -> 0.89.15
• actions/checkout 6.x -> 7.0.1
• actions/upload-artifact 7.0.0 -> 7.0.1
• actions/setup-node 6.3.0 -> 7.0.0
• actions/setup-dotnet 5.2.0 -> 6.0.0
• actions/setup-java 5.7.0 -> 6.0.1
• actions/cache 5.1.0 -> 6.1.0
• azure/login 3.0.0 -> 3.1.0

The update is rebased onto the current main tip, including workflow files added after the original Dependabot branch and the generated lock-file action inventories. No workflow logic, inputs, or outputs were changed. The actions/checkout v7 migration was checked against the workflow_run and pull_request_target workflows; no affected workflow checks out untrusted fork code in a privileged context. The setup-node, setup-dotnet, setup-java, and cache usages retain compatible inputs and behavior.

Validation performed locally:

• Verified every active target action reference in .github/workflows/*.yml uses the requested immutable SHA.
• Verified the diff is limited to root workflow files and passes git diff --check.
• Full GitHub Actions validation will run for this PR before merge.

Replaces the stale Dependabot branch in #20233.

Resolves microsoft/central-agentic-ops#373

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20382

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20382"

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Amaury Levé (Evangelink)]

Validation evidence for microsoft/central-agentic-ops#373:

• Local pin audit passed for all active target action references in .github/workflows/*.yml; git diff --check passed and the diff is workflow-only.
• Official PR checks completed with 424 successes and 11 skips. The full CI run is https://github.com/microsoft/aspire/actions/runs/35874852730.
• The full CI run completed with failures in Infrastructure (ubuntu-latest) and the aggregate final-results checks. The Infrastructure log reports Infrastructure.Tests.CiWorkflowTests.RunTestsInstallsJavaForProjectsThatRequireIt plus SelectTests fixture/self-test failures; no workflow action step failed.
• The triggered Outerloop Tests run https://github.com/microsoft/aspire/actions/runs/35874852758 failed in Acquisition on macOS, Windows, and Ubuntu because the test runner returned exit code 8 with no failed tests reported (timeout/hang-dump path).

The replacement PR remains open for review. This session cannot close or update #20233 because the authenticated identity has read-only permission on microsoft/aspire; both pull-request close/update attempts were denied. A maintainer with write permission should close the superseded Dependabot PR.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Ankit Jain (radical)]

[automated] Extended CI confidence requires action

Reviewer actions

• Required before merge: Fix the final-head CI contract failures and rerun CI plus Outerloop Tests.
  Done when: both pin-sensitive Infrastructure.Tests assertions pass, the Acquisition outerloop smoke runs a nonzero test count on macOS/Ubuntu/Windows, and the linked final-head runs are green.
• Required before merge: Regenerate the generated gh-aw workflows with gh aw compile --dependabot.
  Done when: compilation/validation succeeds for all eight changed .lock.yml files and a second regeneration leaves git diff empty.
• Required before merge: Exercise the unique privileged action contexts on the final PR head, or record explicit maintainer risk acceptance where no safe run exists.
  Done when: linked logs show the exact new SHAs starting successfully for azure/login OIDC, actions/create-github-app-token token/checkout usage, github/gh-aw-actions/setup, and checkout v7 under workflow_run; unsafe mutation/release paths instead have a named approver and rationale, with Actions-policy confirmation for action paths that could not be safely started.

Ready-to-use pr-testing prompt

Use the pr-testing skill to test PR #20382. Focus on final-head GitHub Actions evidence only: rerun CI after updating the two pin-sensitive Infrastructure.Tests expectations; confirm the path-triggered Outerloop Tests Acquisition smoke runs nonzero tests and passes on macOS, Ubuntu, and Windows; run the canonical gh aw compile --dependabot regeneration and verify a second compile produces no diff; and use the smallest safe dry-run/trial workflows to exercise the exact new SHAs for azure/login with OIDC, actions/create-github-app-token including token-backed checkout/cross-repo shapes, github/gh-aw-actions/setup, and checkout v7 in workflow_run context. Verify exact Download action repository log lines and relevant outputs. Do not publish, create/update issues or branches, deploy Azure resources, or execute release side effects; record explicit maintainer risk acceptance for any context that cannot be exercised safely.

Change classification

• GitHub Actions workload change: 54 root workflow files update 190 executable uses: references across 10 action paths; no trigger, condition, input, output, matrix, artifact name, or workflow logic changed.
• Generated workflow dependency change: eight gh-aw .lock.yml files plus the agentics maintenance workflow update github/gh-aw-actions and supporting action pins.
• Specialized contexts: the diff reaches outerloop plumbing, package/artifact production, privileged App-token workflows, scheduled Azure OIDC automation, and release-only GitHub workflows; it does not change the internal Azure DevOps definition or deployment scenario behavior.

Confidence at a glance

🔴 Final-head PR checks — Applicable CI and outerloop validation failed

• Why it applies: ci.yml, run-tests.yml, specialized-test-runner.yml, tests-outerloop.yml, and the action pins used by their jobs changed.
• Evidence: Head 52dc1b6f8c604f53798c260aa6ca748e0be23c2f has 424 passing, 11 skipped, and 7 failing checks. CI run 35874852730 reached attempt 4; Infrastructure.Tests passed 1,306/1,308 tests but failed CiWorkflowTests.RunTestsInstallsJavaForProjectsThatRequireIt and ExtensionReleaseWorkflowTests.ExtensionReleaseWorkflowChecksOutHelpersFromWorkflowDefinitionCommit because both still expect the old setup-java/checkout SHAs. The remaining two CI failures are aggregate result checks.
• Gap or disposition: Outerloop run 35874852758 loaded the exact new checkout/setup-dotnet/setup-java/upload-artifact SHAs, but Acquisition reported Zero tests ran and exit code 8 on macOS, Ubuntu, and Windows; its final-results aggregator also failed. No hang dumps were found. These three jobs plus the outerloop aggregator account for the other four failed checks.
• Action: Update the pin-sensitive test expectations, determine why the outerloop smoke selected zero tests, and rerun both workflows at the final head until the substantive and aggregate checks are green.

🔴 Generated gh-aw workflows — Canonical regeneration evidence is missing

• Why it applies: This is a dependency-only update to eight generated gh-aw lock workflows (analyze-ci-failure, daily-repo-status, extension-changelog, milestone-changelog, pr-docs-check, release-notes-generate, release-update-support-mdx, and repo-pulse).
• Evidence: The PR records a local pin audit and git diff --check, but no gh aw compile --dependabot result or post-regeneration empty diff. The corresponding .md sources are present.
• Gap or disposition: Manual pin replacement and source-reading checks do not prove generated locks match the compiler's canonical dependency resolution.
• Action: Run gh aw compile --dependabot, review any additional generated changes, then run it again and record that the diff is empty.

🔴 Privileged and event-specific action shapes — Exact final-head runtime coverage is missing

• Why it applies: Unique shapes include checkout v7 under workflow_run; App-token minting for the current repository and microsoft/aspire.dev, including token-backed checkout/push; scheduled Azure OIDC login; and github/gh-aw-actions/setup in generated agent workflows. Release workflows also combine App tokens with full-history/token-backed checkout and mutation steps.
• Evidence: No final-head run started azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906, actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1, or github/gh-aw-actions/setup@045beb2d14bda8d0c1f2e83b41527f63770d2855. The automatic workflow_run consumers execute their default-branch definitions, so the rerun comments on this PR do not exercise the PR's checkout v7 pin. Repository Actions-policy endpoints returned 403, so unstarted action paths could not be independently confirmed against the allow-list.
• Gap or disposition: Static review confirms the changed workflow_run checkouts do not request fork PR code, and checkout v7's new fail-closed behavior is compatible with the declared refs. It does not prove the event-specific runtime paths, privileged token contracts, OIDC login, or unstarted action paths are accepted and functional.
• Action: Use safe dry-run/trial workflows to execute representative shapes and inspect exact action download/start lines. Do not run live release, branch mutation, issue mutation, or Azure resource changes; obtain explicit policy confirmation and maintainer risk acceptance for contexts that cannot be exercised safely.

🟢 Common GitHub-hosted action shapes — Exact new SHAs executed successfully

• Why it applies: Most references use ordinary GitHub-hosted checkout, tool setup, caching, and artifact upload shapes.
• Evidence: Final-head runs loaded the exact new SHAs. The successful Quarantined Tests smoke exercised checkout/setup-dotnet/setup-java/upload-artifact on macOS, Ubuntu, and Windows. A successful Linux Java extension E2E job exercised checkout, setup-node, setup-dotnet, setup-java, cache v6.1.0, and upload-artifact; the cache restored successfully. TypeScript/Markdown jobs exercised setup-node v7. Native CLI archive jobs exercised checkout/setup-node/upload-artifact on Windows x64/ARM64 and uploaded the expected artifacts. The package-build job uploaded built-nugets and logs with upload-artifact v7.0.1. Copilot Setup Steps loaded the exact github/gh-aw-actions SHA through setup-cli and completed installation/build setup.
• Gap or disposition: These runs also prove GitHub currently permits the exact common action SHAs and that the hosted runners satisfy their Node 24/ESM runtime requirements. They do not cover the distinct privileged shapes listed above.

🟢 Pin integrity and major-version compatibility — Tags and reviewed inputs match

• Why it applies: The update crosses major versions for checkout, setup-node, setup-dotnet, setup-java, and cache.
• Evidence: Upstream tags resolve exactly to every pinned SHA and displayed version: checkout v7.0.1, setup-node v7.0.0, setup-dotnet v6.0.0, setup-java v6.0.1, cache v6.1.0, upload-artifact v7.0.1, create-github-app-token v3.2.0, Azure/login v3.1.0, and gh-aw-actions v0.89.15. Primary-source notes identify checkout v7's safer pull_request_target/workflow_run default, ESM migrations, setup-java's renamed-but-compatible jdk-file alias, and hosted-runner requirements. No removed always-auth, legacy Java distribution, jdkFile, or self-hosted-runner usage was found in the affected workflows.
• Gap or disposition: No pin/comment mismatch or incompatible changed input was found. Runtime gaps are isolated to the unique contexts above rather than the common action contracts.

⚪ Internal Azure DevOps definition 1602 — Not applicable

• Why it applies: The PR touches GitHub package/release workflows, so the official-build boundary was checked explicitly.
• Evidence: All changed paths are under .github/workflows/; no eng/pipelines/**, eng/common/**, Arcade/MSBuild plumbing, signing configuration, official-build artifact layout, or input consumed by definition 1602 changed.
• Gap or disposition: A definition-1602 run would not execute or validate these GitHub Actions pins. The release-only GitHub contexts remain covered by the privileged-shape action above, not by AzDO.

⚪ Deployment end-to-end execution — Not applicable

• Why it applies: deployment-tests.yml received only common checkout/setup-dotnet/upload-artifact pin replacements; no deployment scenario, Azure orchestration input, authorization contract, selector, generated AppHost, or result artifact behavior changed.
• Evidence: Equivalent common action shapes ran successfully elsewhere on the final head. The only changed azure/login reference is the separate scheduled update-azure-vm-sizes.yml automation and is accounted for as a unique OIDC shape above.
• Gap or disposition: A real Azure deployment would add cost and side effects without validating a distinct deployment-specific change in this diff.

[Ankit Jain (radical)]

Outerloop test failures are unrelated.

[Ankit Jain (radical)]

And the failing infrastructure tests are asserting the hash - that is excessive, so we can remove that.

[Amaury Levé (Evangelink)]

Addressed in d1e8527. The Infrastructure tests now verify the action identity and workflow behavior without pinning an exact action SHA; both previously failing tests pass.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Ankit Jain (radical)]

[automated] Correction: github/gh-aw-actions is covered by GitHub's Allow actions created by GitHub policy, which applies to both actions/* and github/*, so it does not require an explicit allow-list entry.

The existing azure/login action is already permitted by the effective organization/enterprise policy and executed successfully in the scheduled Update Azure VM Sizes workflow. It does not appear in the repository-level specified-actions list, so its authorization is inherited from a higher-level policy rather than managed here. No repository-level allow-list change is requested for this PR.

[Ankit Jain (radical)]

[automated] Reviewed the GitHub Actions version and immutable-SHA updates. The changed GitHub-owned actions are covered by policy, and the existing Azure action is permitted through the effective organization/enterprise policy.

[Ankit Jain (radical)]

Thank you for your contribution, Amaury Levé (@Evangelink) !