Onboard the Build Failure Analysis agentic workflow

.github/workflows/build-failure-analysis-command.md

@@ -0,0 +1,157 @@
+---
+name: "Build Failure Analysis (command)"
+description: >-
+  Rerun the build-failure analysis on a pull request when a maintainer comments
+  `/analyze-build-failure`. Same body as `build-failure-analysis.md` — it does
+  NOT rebuild: it inspects the PR's **latest** Azure Pipelines `dotnet-sdk-public-ci`
+  build and, **only when that latest build has failed** (it stops if the
+  newest build is still running or has succeeded), downloads the binary logs
+  that build already produced (all build legs) and delegates to the
+  `build-failure-analyst` agent (which queries the binlogs live via the
+  containerized `binlog-mcp` MCP server). Useful when a previous run was
+  cancelled, the analysis comment was dismissed, or the agent needs another
+  pass. Like the auto workflow it performs **no build**; the generated jobs do
+  check out the repository (and, for the slash-command event, the PR branch)
+  for agent tooling only — the PR's code is never built or executed.
+
+on:
+  slash_command:
+    name: analyze-build-failure
+    events: [pull_request_comment]
+  roles: [admin, maintainer, write]
+  reaction: "eyes"
+  # Gate the AI pipeline on the fetch job so the agent only runs when a binlog
+  # was actually retrieved from a failed Azure DevOps build.
+  needs: [fetch-binlog]
+
+# Skip activation (and the agent) unless a binlog was retrieved — e.g. if the
+# PR's latest Azure DevOps build did not fail, or the PR is out of scope.
+if: needs.fetch-binlog.outputs.binlog-found == 'true'
+
+# Least-privilege for the workflow/agent jobs. The agent runs read-only; it
+# does NOT post directly. All PR writes it produces (summary comment + inline
+# review suggestions) go through gh-aw **safe-outputs**, which the compiler
+# emits as a separate `safe_outputs` job granted `pull-requests: write` +
+# `issues: write` in the generated lock. (The slash-command trigger also adds
+# an acknowledgement reaction to the command comment; gh-aw emits that in its
+# own generated job with the scope it needs — it is not driven by this agent
+# job.) Keep `pull-requests: read` here so the AI agent job stays
+# least-privilege — do NOT raise it to `write`, that would hand PR-write scope
+# to the agent job unnecessarily.
+permissions:
+  contents: read
+  pull-requests: read
+  copilot-requests: write
+
+concurrency:
+  # Distinct from the automatic workflow's group (`build-failure-analysis-<pr>`).
+  # Concurrency groups are repository-global, so sharing the name made the two
+  # workflows cancel each other for the same PR: a newly failing build would
+  # kill an on-demand analysis a maintainer had just asked for. Each still
+  # collapses its own repeat invocations for a PR.
+  group: build-failure-analysis-cmd-${{ github.event.issue.number || github.event.pull_request.number || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number || github.run_id }}
+  cancel-in-progress: true
+
+timeout-minutes: 30
+
+
+# Narrow the safe-output target for the on-demand path.
+#
+# The rest of `safe-outputs` comes from shared/build-failure-analysis-shared.md;
+# gh-aw lets the main workflow override an individual safe-output type, and only
+# `target` is intended to differ here. Unlike the automatic (check_run/dispatch)
+# workflow, this one HAS a triggering item — the PR the command was typed on —
+# and `fetch-binlog` resolves that very same PR from `github.event.issue.number`,
+# so `triggering` is equivalent by construction while removing the agent's
+# ability to name a different issue/PR. `"*"` stays unavoidable on the automatic
+# path, which has no triggering item; see the note in the shared file.
+#
+# KEEP IN SYNC with `safe-outputs` in shared/build-failure-analysis-shared.md:
+# overriding a type replaces it wholesale, so `max` and `hide-older-comments`
+# are restated verbatim and must not be allowed to drift.
+safe-outputs:
+  add-comment:
+    max: 5
+    target: "triggering"
+    hide-older-comments:
+      enabled: true
+      match:
+        - build-failure-analysis
+        - build-failure-analysis-command
+  create-pull-request-review-comment:
+    max: 25
+    target: "triggering"
+
+imports:
+  - uses: shared/pat_pool.md
+    with:
+      environment: copilot-pat-pool
+  - shared/build-failure-analysis-fetch.md
+  - shared/build-failure-analysis-shared.md
+
+environment: copilot-pat-pool
+
+engine:
+  id: copilot
+  env:
+    COPILOT_GITHUB_TOKEN: ${{ case(needs.pat_pool.outputs.pat_number == '0', secrets.COPILOT_PAT_0, needs.pat_pool.outputs.pat_number == '1', secrets.COPILOT_PAT_1, needs.pat_pool.outputs.pat_number == '2', secrets.COPILOT_PAT_2, needs.pat_pool.outputs.pat_number == '3', secrets.COPILOT_PAT_3, needs.pat_pool.outputs.pat_number == '4', secrets.COPILOT_PAT_4, needs.pat_pool.outputs.pat_number == '5', secrets.COPILOT_PAT_5, needs.pat_pool.outputs.pat_number == '6', secrets.COPILOT_PAT_6, needs.pat_pool.outputs.pat_number == '7', secrets.COPILOT_PAT_7, needs.pat_pool.outputs.pat_number == '8', secrets.COPILOT_PAT_8, needs.pat_pool.outputs.pat_number == '9', secrets.COPILOT_PAT_9, 'NO COPILOT PAT AVAILABLE') }}
+
+
+# Custom job that reuses the binlogs from the PR's most recent failed Azure
+# DevOps `dotnet-sdk-public-ci` build instead of rebuilding. Mirrors the fetch-binlog job
+# in build-failure-analysis.md; it locates the build by the PR's merge branch
+# (no `check_run` payload is available on a slash command).
+# Steps that run in the agent job. The top-level `if:` gates these on binlogs
+# having been retrieved, so the agent never runs without something to analyse.
+steps:
+  - name: Download analysis artifact
+    uses: actions/download-artifact@v8.0.1
+    with:
+      name: build-failure-analysis-data
+      path: /tmp/binlogs
+
+  - name: Export agent context
+    shell: bash
+    env:
+      GH_AW_BINLOG_FOUND_VALUE: ${{ needs.fetch-binlog.outputs.binlog-found }}
+      GH_AW_PR_NUMBER_VALUE: ${{ needs.fetch-binlog.outputs.pr-number }}
+      GH_AW_PR_HEAD_SHA_VALUE: ${{ needs.fetch-binlog.outputs.pr-head-sha }}
+      GH_AW_PR_MERGE_SHA_VALUE: ${{ needs.fetch-binlog.outputs.pr-merge-sha }}
+      GH_AW_ADO_BUILD_URL_VALUE: ${{ needs.fetch-binlog.outputs.ado-build-url }}
+      GH_AW_MISSING_LEGS_VALUE: ${{ needs.fetch-binlog.outputs.missing-legs }}
+      GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
+    run: |
+      # See build-failure-analysis.md for the binlog path conventions. The
+      # per-leg binlogs are read through the binlog-mcp MCP server (mounted at
+      # `/data/binlogs`); GH_AW_BINLOG_HOST_PATH points at the Azure DevOps
+      # build for human-facing references.
+      BINLOG_DIR="/data/binlogs"
+      LIST=""
+      if [ "${GH_AW_BINLOG_FOUND_VALUE:-false}" = "true" ] && [ -d /tmp/binlogs ]; then
+        for f in /tmp/binlogs/*.binlog; do
+          [ -f "$f" ] || continue
+          LIST="${LIST}${BINLOG_DIR}/$(basename "$f")"$'\n'
+        done
+      fi
+      FIRST=$(printf '%s' "$LIST" | head -1)
+      {
+        echo "GH_AW_BUILD_OUTCOME=failure"
+        echo "GH_AW_BINLOG_DIR=${BINLOG_DIR}"
+        echo "GH_AW_BINLOG_PATH=${FIRST}"
+        echo "GH_AW_BINLOG_HOST_PATH=${GH_AW_ADO_BUILD_URL_VALUE}"
+        echo "GH_AW_PR_NUMBER=${GH_AW_PR_NUMBER_VALUE}"
+        echo "GH_AW_PR_HEAD_SHA=${GH_AW_PR_HEAD_SHA_VALUE}"
+        echo "GH_AW_PR_MERGE_SHA=${GH_AW_PR_MERGE_SHA_VALUE}"
+        echo "GH_AW_MISSING_LEGS=${GH_AW_MISSING_LEGS_VALUE}"
+        echo "GH_AW_WORKSPACE=${GH_AW_GITHUB_WORKSPACE}"
+        echo "GH_AW_BINLOG_LIST<<GH_AW_EOF"
+        printf '%s' "$LIST"
+        echo "GH_AW_EOF"
+      } >> "$GITHUB_ENV"
+
+
+---
+
+<!--
+  Body provided by shared/build-failure-analysis-shared.md.
+-->