[ci-scan-feedback] Harden fixer PR-dedup and scanner chronic-recurrence guard

[github-actions]

Triggering signals

• Redundant fixer PRs — same-KBE duplicates slip past Step 3 dedup. KBE #129045 carries three [ci-fix] PRs: #129235 (closed), #129652 (merged 06-22), and #130016 (opened 06-30, 8 days after the merge). Step 3.2 ("merged fix PR exists → skip") did not fire.
• Two open PRs for one KBE — violates Hard rule 5. KBE #128890 has both #129523 and #129651 open. Step 3.1 ("open fix PR exists → skip") did not fire across runs.
• Re-filed after close. KBE #128765: #129328 closed 06-16, then #129653 opened 06-20. Step 3.3 ("closed-unmerged within 30d → skip") did not fire.
• PR opened on an already-resolved KBE (rejected). #130106 — MichalStrehovsky (MEMBER): "[ci-scan] Test failure: CustomAttributeDecoderTests.TestCustomAttributeDecoderGenericUsingReflection on maccatalyst #128450 resolved this. The proposed fix is unlikely to help because the entire test assembly is already rooted by default." Contributes to fix_reject_rate_30d = 33.3% 🔴 (tracker [ci-scan-feedback] KPI Tracker #128742).
• Chronic scanner duplicates (duplicates_30d = 8). The same signatures are re-filed as fresh KBEs despite the existing recently-closed search: X509Certificate2CollectionRemoveRangeArray crossgen2 R2R ×5 ([ci-scan] Test failure: X509Certificate2CollectionRemoveRangeArray under crossgen2 R2R #128538, [ci-scan] Test failure: X509Certificate2CollectionRemoveRangeArray under crossgen2 R2R #128815, [ci-scan] Test failure: X509Certificate2CollectionRemoveRangeArray under crossgen2 R2R #128993, [ci-scan] Test failure: X509Certificate2CollectionRemoveRangeArray under crossgen2 R2R #129210, [ci-scan] Test failure: X509Certificate2CollectionRemoveRangeArray under crossgen2 R2R (recurrence) #129576), crossgen2_comparison.py ×5 ([ci-scan] Build break: crossgen2_comparison.py fails with Python 3.14 asyncio.get_event_loop() removal #128992, [ci-scan] Build break: crossgen2 comparison NativeOrReadyToRunImage hash mismatch on linux arm #129013, [ci-scan] Test failure: crossgen2_comparison.py asyncio incompatibility with Python 3.14 #129171, [ci-scan] Build break: crossgen2_comparison.py fails with Python 3.14 asyncio #129211, [ci-scan] Build break: crossgen2-comparison hash mismatch on windows x86 (recurrence) #129603), genActualType/GitHub_19288 JIT ×4 ([ci-scan] Test failure: GitHub_19288 JIT assert genActualType mismatch in Morph under MinOpts stress #128947, [ci-scan] JIT assertion: genActualType comparison mismatch under jitstress MinOpts #128994, [ci-scan] JIT assertion: genActualType comparison mismatch in GitHub_19288 under MinOpts stress (recurrence) #129011, [ci-scan] Test failure: GitHub_19288 JIT assert genActualType mismatch in Morph under MinOpts stress #129028).

Proposed edits

• .github/workflows/ci-failure-fix.md:154 (Step 3 — Existing-artifact dedup) — add a search-reliability rule: the per-KBE #<kbe> token search is unreliable (GitHub's tokenizer drops the leading #), so enumerate every [ci-fix] PR once, parse each Linked KBE: #<n> marker into a <kbe> -> [PRs] map, and make checks 1–3 consult that map. Ties to the redundant-PR and re-filed-after-close signals above.
• .github/workflows/shared/create-kbe.instructions.md:121-132 (Search recently-closed KBEs) — add a chronic-recurrence guard: if ≥ 2 closed [ci-scan] predecessors share the same test-name stem, record existing-kbe #<n> and do not file an Nth duplicate; widen the predecessor look-back from 30d to 90d for such stems. Ties to the duplicates_30d = 8 chronic-recurrence signal.

Expected behavior change

The next fixer run stops opening a second/third [ci-fix] PR for a KBE that already has an open, merged, or recently-closed fix PR — because dedup now resolves each candidate through a parsed Linked KBE: map instead of a #-token search that GitHub silently fails to match, which is the exact mechanism behind the #129045 (3 PRs), #128890 (2 open), and #128765 (re-filed) churn and the wasted #130016-after-merge effort. The next scanner run stops re-filing chronic, long-cycle recurring signatures (crossgen2 R2R flakes, JIT stress asserts) as fresh duplicate KBEs that maintainers close as duplicate, cutting the duplicates_30d noise.

Note

This PR description and its proposed edits were generated by GitHub Copilot (the CI Outer-Loop Failure Scanner — Feedback workflow) running under the dotnet/runtime agentic-workflows automation.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

• #128501 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [ci-scan] Test failure: AsyncProfilerTests.StateMachineAsync_CallstackStressWithVaryingDepths under libraries-jitstress #129938 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by CI Outer-Loop Failure Scanner — Feedback · ● 8M · ◷

---

Note

This was originally intended as a pull request, but the git push operation failed.

Workflow Run: View run details and download patch artifact

The patch file is available in the agent artifact in the workflow run linked above.

To create a pull request with the changes:

# Download the artifact from the workflow run
gh run download 28583018185 -n agent -D /tmp/agent-28583018185

# Create a new branch
git checkout -b ci-scan-feedback/harden-dedup-gates-20260702-2f80944f72e7e146

# Apply the patch (--3way handles cross-repo patches where files may already exist)
git am --3way /tmp/agent-28583018185/aw-ci-scan-feedback-harden-dedup-gates-20260702.patch

# Push the branch to origin
git push origin ci-scan-feedback/harden-dedup-gates-20260702-2f80944f72e7e146

# Create the pull request
gh pr create --title '[ci-scan-feedback] Harden fixer PR-dedup and scanner chronic-recurrence guard' --base main --head ci-scan-feedback/harden-dedup-gates-20260702-2f80944f72e7e146 --repo dotnet/runtime

Show patch preview (57 of 57 lines)

From 5d7214e31637758d7c4e03c77be5cd6925735792 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 2 Jul 2026 10:52:54 +0000
Subject: [PATCH] [ci-scan-feedback] Harden fixer PR-dedup and scanner
 chronic-recurrence guard

Fixer (ci-failure-fix.md Step 3): the per-KBE `#<kbe>` search is unreliable (GitHub drops the leading #), letting duplicate [ci-fix] PRs through (KBE #129045 got 3 PRs incl. one 8 days after a merge; #128890 has 2 open). Add a rule to enumerate all [ci-fix] PRs once and dedup against a parsed Linked-KBE map.

Scanner (create-kbe.instructions.md): add a chronic-recurrence guard so signatures with >=2 closed predecessors (X509 crossgen2 x5, crossgen2_comparison.py x5, genActualType x4) are not re-filed as fresh duplicates; widen the recently-closed look-back to 90d for such stems.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/ci-failure-fix.md                 |  2 ++
 .github/workflows/shared/create-kbe.instructions.md | 13 +++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/.github/workflows/ci-failure-fix.md b/.github/workflows/ci-failure-fix.md
index 28271b34..67cba160 100644
--- a/.github/workflows/ci-failure-fix.md
+++ b/.github/workflows/ci-failure-fix.md
@@ -151,6 +151,8 @@ Before doing any analysis work, confirm nothing already handles this KBE. Use th
 5. **Author already engaged on the KBE.** From the KBE comments you read in Step 2, if any `MEMBER`/`OWNER` comment expresses active investigation or fix-forward intent (case-insensitive any of: `i'm fixing`, `i am fixing`, `investigating`, `will investigate`, `looking into`, `root cause`, `fix forward`, `fix-forward`, `landing in #`, `wait for #`, `pr is up`, `working on`), do NOT duplicate their work -> `-> skipped: author already engaged on #<kbe>`.
 6. **Prior hand-off comment** — if the KBE already carries a comment containing the marker `<!-- ci-fix:handoff -->`, a hand-off
... (truncated)