Bot / automation PR shepherd — daily triage of Dependabot / maestro / winget / homebrew PRs

[radical]

⏩ Work queue

Snapshot 2026-06-21 (ages relative to this date; re-check before acting). Actionable bot & auto-opened PR/issue items only — highest-impact first. Items with a fix already in flight, plus healthy / settled items, sit in the detail sections below.

• 🧑 Merge release/13.4 to main after v13.4.6 release #18356 — resolve conflicts on the release/13.4→main merge-back after v13.4.6; CONFLICTING, needs a maintainer's servicing judgement on which release-specific changes belong on main (1d)

---

This issue tracks the lifecycle of PRs by non-human, non-Copilot actors (Dependabot, dotnet-maestro, github-actions, aspire-repo-bot) on microsoft/aspire, the packaging bots on microsoft/homebrew-aspire and microsoft/winget-pkgs (aspire-winget-bot), and issues auto-opened by automation — driving each toward merged / closed / resolved. These items fall through the cracks: they pile up, go stale, or develop conflicts. Updated in place each run.

Scope boundary: workflow / automation run health (including AI-fixable workflow breaks) lives in #18223, not here. This dashboard owns only the state of the PRs and issues themselves. Copilot-authored PRs are out of scope as bot PRs (but a Copilot PR can be the fix for a tracked item — when it is, the item leaves the queue and is linked below). Automation update PRs carrying the NO-MERGE label (API surface, GitHub/Foundry Models, playground manifests) are deliberately never merged — excluded entirely. GitHub renders a live open/merged/closed badge on every ref below — that badge, not any hand-written marker, is the source of truth for state. The running history of items that have left this dashboard lives in the 🗂️ Activity log comment.

📦 Release / packaging — highest priority (live stable is 13.4.6)

🟢 Both channels fully up to date at 13.4.6 — no open packaging PRs.

• microsoft/homebrew-aspire — cask serves 13.4.6; brew install aspire is current. No open cask PRs.
• microsoft/winget-pkgs — Microsoft.Aspire manifest serves 13.4.6; winget install Microsoft.Aspire is current. No open aspire-winget-bot PRs.

No action unless a new release cuts fresh packaging PRs. (The 13.4.6 cask/manifest bumps that merged this cycle are in the 🗂️ Activity log.)

🔴 Completely broken (bot PRs that can't merge)

PR	Title	Why it can't merge	Action
#18356	Merge release/13.4 to main after v13.4.6 release	CONFLICTING / DIRTY — standard release merge-back conflict from the v13.4.6 cut; already APPROVED (1d).	🧑 Maintainer resolves conflicts + judges which release-specific changes belong on main. Queue item above.

🟢 Easy wins (green / mergeable, ready)

No open dependabot / maestro / aspire-repo-bot PRs are green-and-ready this run — the dependency queue is empty and no other in-scope bot PR is mergeable. (See the 🗂️ Activity log comment for recently merged/closed items.)

🟠 Stuck — needs a human decision

None this run (the one release-housekeeping PR that needs maintainer judgement is under 🔴 above, since it currently can't merge).

📋 Auto-opened issues

🟢 Deployment E2E nightly-failure tracker — #18363 is the single living issue

github-actions opens one [Deployment E2E] Nightly test failure - <date> issue per failing night. #18363 (06-20, 1d) is the living tracker and already carries the run's root cause (ASPIRE009 — the AppHost build can't resolve the installed Aspire CLI bundle layout). The 06-21 nightly re-filed as #18379 and was collapsed back into #18363 (closed as duplicate, logged in the 🗂️ Activity log), so the dedupe holds — only #18363 is open.

The recurring deployment-E2E run investigation and the durable workflow-level dedupe (rewriting the nightly automation so it stops re-filing each night) are both #18223's scope — not re-derived here. #18363 closes passively once the nightly is green/fixed; no lifecycle action pending beyond collapsing each night's re-file.

🟡 Stale single-issue trackers — candidates to verify & close

• [Failing test]: Aspire.Cli.EndToEnd.Tests.PythonReactTemplateTests.CreateAndRunPythonReactProject #16062 (71d) — [Failing test]: Aspire.Cli.EndToEnd.Tests.PythonReactTemplateTests.CreateAndRunPythonReactProject, auto-opened by github-actions; long stale. Lifecycle action: confirm the test is now passing or already quarantined, then close. The flake/signal assessment itself belongs to Automated & scheduled workflow health — rolling 9-day dashboard #18223 — don't re-derive it here.
• [13.4] Changelog feedback #17500 (26d) — [13.4] Changelog feedback, the standing editorial-feedback issue for the 13.4 changelog. 13.4 has shipped (live stable is 13.4.6) and 13.5 feedback is already being collected in [13.5] Changelog feedback #17840, so the 13.4 window is past — closeable on an editorial call.

🟡 [aw] PR Documentation Check failure report — transient, fix owned by #18223

• [aw] PR Documentation Check reported incomplete result #18319 (3d) — "[aw] PR Documentation Check reported incomplete result": the create_pull_request safe-output tool failed to pin a branch before bundle generation.

This is a per-run failure report for the PR Documentation Check agentic workflow. The workflow fix is #18223's (it owns AI-fixable workflow breaks end to end) — kept out of this queue to avoid a duplicate dispatch. As an issue, it's closeable once that workflow is fixed; tracked here only for lifecycle.

⚪ #17840 — "[13.5] Changelog feedback" (19d): standing editorial-feedback collection issue for the 13.5 changelog wiki page. Stays open by design until 13.5 ships; no action.
⚪ #16379 — "[aw] Detection Runs" (60d): a standing tracker for an agentic workflow's detection runs. Workflow-health surface → owned by #18223, not tracked here.

---

_{Auto-generated by the bot-PR shepherd (track stage). Owns bot & auto-opened PR/issue lifecycle; workflow run health is #18223. Updated in place. Last updated: 2026-06-21 06:16 UTC.}

[joperezr]

🤖 Aspire triage pass — 2026-06-17 19:52 UTC

Area: area-engineering-systems (already applied)
Kind: docs (operational tracking issue)
Repro: none — meta/tracking artifact, not a defect report
Affected version(s): n/a (housekeeping for 13.4.5 release packaging + daily bot-PR shepherding)
Severity: S4 — operational tracker; no user-facing regression

Urgency: ⚪ backlog — no milestone
Reason: Self-authored, daily-refreshed tracking issue intended to be reused in place rather than closed/milestoned. Body explicitly says Re-used and refreshed daily.

Suggested owner(s): @joperezr (score 6)
Evidence:

• joperezr merged Merge release/13.4 to main after v13.4.0 release #17817, Merge release/13.3 to main after v13.3.5 release (supersedes #17337) #17343 in area-engineering-systems in the last 90d
• Issue author (@radical) excluded per Step 4 rules; remaining contributors in this area in the lookback window were bots or single-PR authors
• No file paths cited in body, so CODEOWNERS not consulted

Confidence: high
Needs human?: no — established daily-tracker pattern; author is owning it directly

Dry-run mode — no labels or milestone applied. Reply /triage apply to promote, or edit and reapply.

[radical]

🤖 AI work-funnel orchestration pass — 2026-06-17

Triaged the actionable items in this tracker to separate AI-dispatchable code fixes from human-gated work, then reconciled the body markings.

Broken workflows (§2a) — the only "implement a fix" items here

Workflow	Disposition	PR
refresh-typescript-sdks.yml	🤖 AI-fixable — already taken	#18288 (Copilot, draft) — rediscovers AppHosts under the current playground/TypeScriptAppHost / TypeScriptApps/* layout
update-ai-foundry-models.yml	🤖 AI-fixable — already taken	#18290 (open) — retries transient 429 / partial-shard catalog responses within budget
update-azure-vm-sizes.yml	🧑 Human-gated — not dispatchable	—

Why update-azure-vm-sizes is not AI-dispatchable: the job dies at azure/login with Login failed... Ensure 'client-id' and 'tenant-id' are supplied — secrets.AZURE_CREDENTIALS is empty/expired. Every fix path (rotate the SP secret, or migrate to OIDC and register a federated credential + AZURE_CLIENT_ID/TENANT_ID/SUBSCRIPTION_ID) needs a repo admin. A code-only PR can't supply secrets, so an agent can't complete it end-to-end. Action for a human: rotate/repopulate AZURE_CREDENTIALS (or move the job to OIDC).

Everything else in this tracker is human-gated by design

• §1 winget #389252 — watch external dynamic-scan; nudge if it stalls. (monitoring)
• §2b #18263 — blocked on 13.4.5 packages reaching dotnet-public; wait, don't blind re-run.
• §3 / §4 — merge/close/rebase/servicing decisions on Dependabot/maestro/backport PRs. These are governance actions (judgment + write access), not draft-PR work.

Net result

No new Copilot session was dispatched this pass: the two genuinely AI-fixable items already have open fix PRs (#18288, #18290), and the remaining broken workflow plus all PR-shepherding items require a human. The funnel is empty of unclaimed, AI-completable work today. Body markings updated in place (🤖 / 🧑).

[radical]

🤖 AI work-funnel — dispatch pass · 2026-06-18

No new AI-dispatchable items this pass — nothing dispatched. All broken-workflow code fixes are already in flight or merged; everything else needs a human or an upstream/infra fix.

Marked 🧑 (needs a human — future passes skip):

• [main] Update dependencies from dotnet/arcade #16482 — arcade maestro bump. The only red leg is a stale/flaky Cli.EndToEnd-DoctorCommandTests run predating the recent doctor-command fixes; resolution is a maintainer re-run + review & merge of the REVIEW_REQUIRED maestro PR, not a code PR.
• Bump the npm_and_yarn group across 54 directories with 5 updates #15954 — close obsolete 54-dir npm dupe: a maintainer governance call.
• Bump the npm_and_yarn group across 4 directories with 2 updates #17834 — rebase-or-close a conflicting Dependabot bump: a maintainer governance call.

Already covered / not re-dispatched:

• refresh-typescript-sdks → Fix refresh-typescript-sdks workflow for current TypeScript playground layout #18288 (fix PR in flight). update-ai-foundry-models → fix(foundry): retry transient partial/throttled catalog responses in update-ai-foundry-models #18290 (merged; awaiting next scheduled run).
• update-azure-vm-sizes (expired AZURE_CREDENTIALS) and winget-pkgs#389252 remain 🧑 — a secret/external-validation wait no code PR can supply.

From #18223 (health): nothing AI-fixable. CI main (Docker is not running) and Deployment E2E (AcaManagedRedis, Azure/AKS) are infra/Azure flakes with no deterministic code fix; PR-Docs over-budget (#18301) is a budget governance call; PR-Docs #18267/#18235 are gh-aw tooling failures on shallow clones (the #18267 diagnosis pins the bug to the tool's generated pin-branch step, not in-repo workflow source) — upstream/human, not an in-repo fix.

_{Dispatch stage. Markers written in place on the queue above; this comment records the per-pass result.}

[radical]

🔧 Post-run review — 2026-06-18 19:16 UTC

Regressions vs previous run: none. Diffed the new body against the body captured at gather-time (the true 18:55 UTC version). Only five minimal, justified deltas: #16482 age ~53d → ~52d (created 2026-04-27, exactly 52d); refresh-typescript-sdks "last 3 (06-16/17/18)" → "last 4 (06-15/16/17/18)" (06-15 run also failed — verified via gh run list); #17546 cell now notes its fresh CI run is mid-flight with 0 failures (genuine new state, updated 18:05); a one-clause de-dup of the #17972 NO-MERGE note; timestamp bump. Structure intact — ## ⏩ Work queue stays at top, all 4 checkboxes + 🧑 markers preserved, no funnel annotations existed to drop.

Readability / improvement ideas: none worth a format change. The body is skimmable in ~15s and every actionable item links its PR/issue. Format held stable run-to-run.

Data-gathering issues this run:

• userContentEdits lagged ~18h and is newest-first under last:N. The shared post-run prompt's fallback recovery path (userContentEdits.nodes[].diff, "node[0] is the version you just published, node[1] is the prior one") was unreliable this run: with last:10 the nodes are ordered newest-first (index 0 = most recent), and the most recent indexed edit was 01:26Z — the 18:55 UTC run and my 19:14 edit had not propagated to userContentEdits yet. Diffing against node[-2] produced a giant false-regression diff (an ~18h-stale snapshot). The reliable prior version was the body I read at gather-time via gh issue view 18285 --json body at the start of the run.
• This run's underlying state was nearly static (prior run was only ~17 min earlier), so the only real changes were one age tick and [Automated] Update Aspire skills bundle #17546's CI re-run.

Suggested prompt change (for a human to apply): small, optional — in post-run-review.prompt.txt, under the GitHub issue/PR recovery bullet, add a caution that userContentEdits can lag by hours (edits may not be indexed immediately) and that last:N returns newest-first, so it should be treated as a last resort. Reinforce the existing first bullet: the calling prompt should capture the target body at gather-time and the review should diff against that capture, not userContentEdits. This doesn't contradict prior history (the "reuse the previously-read contents" rule already exists — this just flags why the fallback is fragile).