You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Separate telemetry hook maintenance from skills bundles - #20283
Superseded by #20947, which follows native replacement #20946 in the recovered open-draft chain #20932 → #20946 → #20947. This original draft is being closed unmerged to remove the misleading duplicate retirement review. Its published branch and original stack membership are preserved.
This original PR's branch contains the client-selection, native-plugin, and retirement chain while targeting main. Pushing that branch caused GitHub to auto-mark original native PR #20287 as merged because its old base advanced to contain native head 1edda7dfea84c159232d7aee4a4c049ace961b43. No merge endpoint was called, and that operation did not land code on main. Original stack record 20288 remains ordered [20283, 20287], preserving the historical open/merged states.
The historical retirement scope removes the dormant embedded AspireSkills bundle/provider/archive surface after native agent setup, while preserving direct CLI telemetry execution. Telemetry hooks are maintained independently with immutable released-source lineage, stale/replay/version-regression protection, atomic publication, and standalone provenance.
Stack recovery: register and verify the recovered open-draft replacement chain before merge.
Catalog and provenance: preserve the native catalog gate associated with Establish source release flow for aspire-skills aspire-skills#72 and the genuine v0.0.3 receipt. Standalone metadata pins a83ca78b9d35b8238f9c4fdba72cb779defe2a90; normalized SHA-512 values are 6fa64f350e2709a7abb52842232cc8d584e24d104b17a200a93ca4010d36a838dd1f6f73b83e92cd2ad0d8ad4abf9753323f840dc28625ccaf2f082097667181 for track-telemetry.sh and 303dc8d0eba181154222dacf6151d6bbe24614dd0e3144704fab1cb83c81f149e95cac47e87488357f0c04d232629a2f91f5551fe33e5c6c91f25a8f97aa0af3 for track-telemetry.ps1. No version floor or legacy fallback is introduced.
Security: complete security review for executable-source synchronization and provenance validation.
Validation
Final native parent receipt:
CLI/XLF, CLI.Tests, and CLI E2E builds passed with 0 warnings and 0 errors.
The updater downloads executable scripts only from a pinned full commit on the canonical released-main first-parent lineage, verifies the exact declared version and normalized SHA-512 hashes, checks tracked and pending-PR baselines, and stages all outputs before publication. Security review remains pending on successor #20947.
Checklist
Is this feature complete?
Yes. Ready to ship.
No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
Yes
No
Did you add public API?
Yes
If yes, did you have an API Review for it?
Yes
No
Did you add <remarks /> and <code /> elements on your triple slash comments?
Yes
No
No
Does the change make any security assumptions or guarantees?
Yes
If yes, have you done a threat model and had a security review?
Separates telemetry-hook synchronization from the embedded Aspire skills bundle while preserving runtime hook installation and the current bundle fallback.
Changes:
Adds standalone hook provenance, update/verification scripts, and workflows.
Adds extensive offline maintenance and workflow coverage.
Removes archive-coupled bundle maintenance and scheduled monitoring.
workflow_dispatch can be run against a non-main ref, and this checkout defaults to that selected ref. The subsequent force-push then creates the synchronization branch from that ref, so a manual replay can accidentally include unrelated branch commits in the PR to main. Pin the checkout to main (as update-nix-cli-flake.yml does) and cover that invariant in TelemetryHookWorkflowTests.
Update PR testing guidance after removing verifier
eng/scripts/verify-aspire-skills-bundle.ps1:1
Deleting this verifier leaves .agents/skills/pr-testing/ci-infra-testing.md:552-555 instructing PR testers to run verify-aspire-skills-bundle.ps1. Update that guidance in this PR so automated testing does not invoke a nonexistent script.
The reason will be displayed to describe this comment to others. Learn more.
Copilot review overview
🔵 Needs a closer look
The updater rewrites valid CRLF PowerShell hooks during an otherwise idempotent replay.
Review effort: Balanced Findings: None
Previously missed (1)
In code that hasn't changed since last review
Normalize hook bytes to make Windows replay idempotent
eng/scripts/telemetry-hooks.common.ps1:403
A replay is not idempotent on Windows. .gitattributes leaves *.ps1 under text=auto, and Assert-TelemetryHooksLocalFiles correctly accepts a CRLF checkout after normalization, but this raw-byte comparison then treats the same canonical script as changed and rewrites it to LF, changing both the worktree and timestamp. Compare normalized bytes for hook files (while keeping metadata byte-exact), and cover this in ReplayingSameCommitPreservesBytesAndTimestamps with a CRLF/BOM fixture.
Retain main's dead Playwright scanner cleanup and resolve the overlapping Copilot detection test using editor evidence without a fabricated CLI probe.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c0f73663-c37c-4c5a-b83d-89f0b8d13c5f
Use --agents and project/global scope, default to detected and universal-skill clients, and leave agent-specific legacy skill directories untouched.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c0f73663-c37c-4c5a-b83d-89f0b8d13c5f
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The workflow currently creates overprivileged App tokens with an unconfirmed Action pin, and its branch-name-only authorization can be spoofed by forked pull requests.
if ($missingBundlePaths.Count -gt 0 -or -not $archiveChanged) {
throw "Telemetry hook scripts can only change on '$allowedHeadRef' or as part of a complete generated bundle update. Make changes in microsoft/aspire-skills and run the synchronization workflow instead of editing these copies manually."
}
Write-Host "Telemetry hook changes are part of a complete generated bundle update; canonical content is checked separately."
throw "Telemetry hook scripts can only change on '$allowedHeadRef'. Make changes in microsoft/aspire-skills and run the synchronization workflow instead of editing these copies manually."
**Action:** Run `playwright-cli install --skills` to generate agent skill files in the primary skill directory (`.claude/skills/playwright-cli/`), then mirror the skill directory to all other detected agent environment skill directories (e.g., `.github/skills/playwright-cli/`, `.opencode/skill/playwright-cli/`). The mirror is a full sync — files are created, updated, and stale files are removed so all environments have identical skill content.
**Action:** Run `playwright-cli install --skills` once in an owned temporary workspace, where it generates `.claude/skills/playwright-cli/`. Capture the complete payload, including supporting files, and publish it only to the selected agents' deduplicated skill directories in the requested scope (`--scope project|user`, default `project`). Copilot and OpenCode share `.agents/skills/playwright-cli/`; Claude uses `.claude/skills/playwright-cli/` and honors its user configuration-directory override. These common skill locations also work with compatible editor-hosted agents, without a separate VS Code installation target.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
the
area-engineering-systems
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Description
Important
Superseded by #20947, which follows native replacement #20946 in the recovered open-draft chain
#20932 → #20946 → #20947. This original draft is being closed unmerged to remove the misleading duplicate retirement review. Its published branch and original stack membership are preserved.This original PR's branch contains the client-selection, native-plugin, and retirement chain while targeting
main. Pushing that branch caused GitHub to auto-mark original native PR #20287 as merged because its old base advanced to contain native head1edda7dfea84c159232d7aee4a4c049ace961b43. No merge endpoint was called, and that operation did not land code onmain. Original stack record20288remains ordered[20283, 20287], preserving the historical open/merged states.The historical retirement scope removes the dormant embedded AspireSkills bundle/provider/archive surface after native agent setup, while preserving direct CLI telemetry execution. Telemetry hooks are maintained independently with immutable released-source lineage, stale/replay/version-regression protection, atomic publication, and standalone provenance.
Part of #20246 and epic #20245.
Historical merge gates
These gates carry forward to successor #20947:
a83ca78b9d35b8238f9c4fdba72cb779defe2a90; normalized SHA-512 values are6fa64f350e2709a7abb52842232cc8d584e24d104b17a200a93ca4010d36a838dd1f6f73b83e92cd2ad0d8ad4abf9753323f840dc28625ccaf2f082097667181fortrack-telemetry.shand303dc8d0eba181154222dacf6151d6bbe24614dd0e3144704fab1cb83c81f149e95cac47e87488357f0c04d232629a2f91f5551fe33e5c6c91f25a8f97aa0af3fortrack-telemetry.ps1. No version floor or legacy fallback is introduced.Validation
Final native parent receipt:
Final retirement tip receipt:
dotnet build src\Aspire.Cli\Aspire.Cli.csproj /t:UpdateXlf /p:SkipNativeBuild=true— passed, 0 warnings and 0 errors.dotnet build tests\Aspire.Cli.Tests\Aspire.Cli.Tests.csproj /p:SkipNativeBuild=true— passed, 0 warnings and 0 errors.dotnet build tests\Aspire.Cli.EndToEnd.Tests\Aspire.Cli.EndToEnd.Tests.csproj /p:SkipNativeBuild=true— passed, 0 warnings and 0 errors.pwsh -NoProfile -File eng\scripts\verify-telemetry-hooks.ps1— verified v0.0.3 against canonical commita83ca78b9d35b8238f9c4fdba72cb779defe2a90.git diff --check— clean.Security considerations
The updater downloads executable scripts only from a pinned full commit on the canonical released-main first-parent lineage, verifies the exact declared version and normalized SHA-512 hashes, checks tracked and pending-PR baselines, and stages all outputs before publication. Security review remains pending on successor #20947.
Checklist
<remarks />and<code />elements on your triple slash comments?