[YuliiaKovalova]

Summary

• Add automatic analysis of completed, failed fsharp-ci checks and the maintainer-only /analyze-build-failure command.
• Use an idiomatic F# fetcher with researched, pinned #r "nuget" dependencies: FsHttp 15.0.3 and FSharp.Data 8.2.0.
• Preserve exact Azure build/PR/head/merge/producer binding, redirect allowlists, bounded extraction, regular-versus-proto selection, cleanup and deterministic deduplication.
• Make the analyst reproduce a failure, apply a minimal fix, run the same check and related tests, and publish only after successful validation: a safe-output push for an eligible same-repository PR, or a checked .patch and optional surgical suggestions for a contributor fork. Missing validation blocks code publication; no fork push or new write secret is introduced.
• Expose the same collector and binlog MCP tools through the local build-failure-analyst agent.
• Exercise regressions on every PR and main push, every Monday and manual dispatch. CI recompiles both callers and checks generated locks for drift; a trusted failure notifier routes breakage to the PR author and repository owners.

Reviewer-requested compaction

Library/API research preceded the rewrite. Both complete CodeCompaction passes followed the repository's NoBloat and logic-rounds instructions: reuse hunt, three diverse proposals, three new cross-model adversarial reviewers, and real-branch survivor prototypes with formatting, compilation and regression sweeps.

Fetcher	Physical lines	Non-whitespace characters
Original C# at be3548a00	859	24,058
Initial passing F# rewrite	516	13,239
After pass 1	460	12,630
After pass 2, final	446	12,376

The final script is approximately 48% smaller by both measures, without minification or weakened guards. Cross-model review also exposed and fixed mixed HTTP-status/body-timeout retry reentry; the regression requires exactly three attempts. The contributor follow-up leaves this fetcher byte-identical.

Local contributors and fork delivery

The agent profile reuses Microsoft.AITools.BinlogMcp 1.0.0 from the existing .config/dotnet-tools.json. After installing the documented SDKs/PowerShell/GitHub CLI/Copilot CLI prerequisites and running dotnet tool restore in a trusted checkout:

$context = pwsh .github\workflows\scripts\prepare-build-failure-analysis.ps1 -PrNumber 20727
copilot --agent build-failure-analyst --add-dir (Split-Path $context) -i "Analyze the validated failure using context @$context"

The preparer invokes the exact F# collector used in CI, returns a credential-free context JSON, restores the caller's environment and stops on unsuccessful/incomplete evidence. -BuildId selects an explicit build. The local method requires a clean worktree at the verified head, preserves the contributor's branch/work, and returns a checked patch and before/after commands rather than pretending local gh-aw safe-output tools exist.

For forks, CI attempts and checks the fix without pushing to the fork. The guarded publication job revalidates the current failed build and both PR revisions, checks the complete patch with real Git at the verified head, enforces the 64-KiB / 25-file and protected-file/type boundaries, and uploads a downloadable .patch retained for 14 days. The PR summary links it with apply instructions and explicitly says it has not been applied to the branch.

Surgical changes may additionally have up to three GitHub suggestion review comments for one file, each bounded to 20 original/replacement lines and pinned to the verified head. Command retries deduplicate bot-published summaries and reviews by exact request/revision/location.

Maintained source, failure ownership and repository guidance

shared/build-failure-analysis-shared.md is the FSharp-owned golden source, not a vendored Runtime/Roslyn dependency. Its header links the canonical source and regeneration command. Regression CI automatically compiles both callers and checks drift; the existing aw-auto-update.md automates toolchain upgrades and regeneration on dispatch. Its scheduled operation is not claimed to be enabled.

PR authors are responsible for repairing a reproducible regression before merge, including one introduced by an otherwise unrelated change. @dotnet/fsharp-team-msft, the CODEOWNERS team, owns triage and help with shared tooling/infrastructure; owners repair or revert default-branch breakage rather than disabling the check.

build-failure-analysis-test-failure.yml runs from the trusted default branch on failed regression runs. It never checks out or downloads failed PR code/artifacts. It updates one author/owner report for a current open PR, or one owner-triaged incident for default-branch failures/missing PR association. Current revision and run-attempt checks suppress stale, closed and superseded/recovered PR notifications. Branch-protection settings were not changed.

The playbook is grounded in 139 real failed fsharp-ci timelines exposed for 2026-09-09 through 2026-10-08: bootstrap/resource synchronization, XLF regeneration, Roslyn/MSBuild/.NET Framework binding redirects, offline Source Build pins/cache/native bootstrap and NuGet pruning. The preceding requested month was not exposed by the API. No NU1605 or NU1900-NU1904 appeared in the retained issue text, so no downgrade/vulnerable-version example is invented.

The fetch job stages the trusted default-branch playbook separately; analyzed PR source does not supply the agent's instructions.

Validation and deployment boundaries

• Full PR-branch regression sweep: 25 methods passed. Coverage retains the fetcher's archive/resource/revision/transport tests and adds fork delivery, exact inclusive patch/suggestion limits, real Git applicability without executing/applying proposals, protected paths/types, bot-only retry deduplication, local collector/environment behavior and failure-owner routing.
• gh-aw v0.89.21 strict compilation/schema validation: both workflows compiled, 0 warnings, no regeneration drift.
• Fantomas check and native actionlint passed; only gh-aw's documented concurrency.queue extension is ignored.
• The native pinned MCP server was restored and exercised in an isolated .NET 10-compatible probe: all 35 CI-allowlisted tools were present among 38 tools; binlog_errors observed a real generated failing MSBuild diagnostic and binlog_overview succeeded.
• Separate Skill Validation has a pre-existing name-conformance failure in the unchanged performance-celebration-article agent, also recorded at the previous published head in run 37919814823. The build-failure agent has no reported conformance errors; the unrelated agent is not changed here.
• Live Azure/GitHub executions rejected a wrong-PR build and stale merge revision. Current builds with a failed publisher but no matching producer-owned build-log artifact were explicitly skipped with inert outputs; that completeness guard was not weakened.
• Live safe-output push/patch/suggestion publication and the trusted notifier need an eligible run after deployment on main; they have not been exercised from this contributor-fork PR. No test notification issues/comments were created.

The binlog MCP runtime retains its required tag-only reference, while .github/aw/actions-lock.json retains the image pin:

sha256:ca760fd18bf8e6168d9b304d65c5d2340e4135fc9080c6e2f2eb4800368e3df4

This is workflow-only; azure-pipelines-PR.yml excludes .github/*.

Note

This pull request was prepared with GitHub Copilot.

[YuliiaKovalova]

Follow-up fixes are pushed in 575bf6854 (with test-cache cleanup in 35b8701f6).

• Repeated commands now require a successful agent job and Execute GitHub Copilot CLI step as well as successful safe-output processing, so an empty placeholder after agent failure no longer suppresses retries.
• Artifact redirects are followed only with auto-redirect disabled and every hop revalidated against dnceng-public/public.
• Extraction now removes partial outputs on budget or archive failure.
• Added focused command-publication and archive-boundary regressions, including traversal, absolute/drive paths, symlink/device entries, .proto.binlog exclusion, and budget cleanup.

Validation: 6 tests pass; gh-aw v0.89.21 strict compilation/schema validation reports 2 workflows, 0 warnings; native actionlint passes with the documented gh-aw queue extension ignore. The binlog MCP image remains pinned to the current sha256:ca760fd1…e3df4 revision while the runtime MCP reference stays tag-only.