Harden CI dependency validation and merge gate

[David Pine (IEvangelist)]

Why

main is not flaky: deterministic dependency regressions were merging before CI could finish. In the sampled history, all 49 auto-merged dependency PRs merged before validation completed, and 34 later failed. The active repository ruleset requires no status checks, so native auto-merge had nothing to wait for.

CI also restored only TypeScript AppHost roots even though the repository contains 27 committed npm lockfiles, leaving nested frontends and APIs unvalidated until integration tests or not validating them directly at all.

What changed

• keeps policy-driven native auto-merge enabled
• adds versioned main branch protection requiring CI Gate and strict latest-main validation
• restores Angular to TypeScript ~6.0.3 and prevents another unsupported TypeScript major update
• validates all 27 tracked sample lockfiles and finite non-AppHost build scripts
• runs every pull request and adds one stable, always-evaluated CI Gate
• makes matrix failure handling, timeouts, concurrency, permissions, and scheduled drift detection explicit
• pins Node 24.18.0, Aspire CLI 13.4.6, and runner major labels
• preserves relative binlog paths, removes the broken HTML test logger, and publishes diagnostics safely on every outcome

Validation

• Ubuntu 24.04 build, repository-wide JavaScript validation, and integration tests passed
• Windows 2025 build passed
• CI Gate, GitOps branch-policy/schema validation, and CLA checks passed
• the current-head rerun demonstrated fail-closed behavior: an abandoned Windows runner caused CI Gate to fail; retrying the same SHA succeeded only after Windows completed
• Ubuntu test results and platform-specific binlogs were published successfully

Merge behavior

The GitOps policy continues to call GitHub's native enableAutoMerge. The new repository-owned branch-protection policy requires the GitHub Actions CI Gate context and requiresStrictStatusChecks: true, so failed, cancelled, skipped, abandoned, or stale validation cannot merge. Removing the auto-merge label still cancels auto-merge.

[Copilot]

Pull request overview

This PR aims to prevent dependency regressions from merging ahead of CI completion by hardening CI validation and introducing a stable merge gate, while also correcting the Angular sample’s TypeScript version to a supported range.

Changes:

• Downgrades the Angular sample TypeScript dependency to ~6.0.3 and updates the lockfile accordingly.
• Adds a repository-wide JavaScript validation script to restore Aspire AppHosts and run npm ci / npm run build across committed lockfiles.
• Updates the CI workflow to run on PRs, add explicit concurrency/permissions/timeouts, publish diagnostics consistently, and introduce a CI Gate job; temporarily disables policy-driven auto-merge and prevents Dependabot TypeScript major updates for the Angular sample.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
samples/aspire-with-javascript/AspireJavaScript.Angular/package.json	Pins TypeScript back to ~6.0.3 for Angular compatibility.
samples/aspire-with-javascript/AspireJavaScript.Angular/package-lock.json	Aligns the lockfile with the TypeScript downgrade.
build/validate-javascript.sh	New script to validate all committed JS lockfiles and build scripts in samples.
.github/workflows/ci.yml	Hardens CI triggers/behavior and adds an explicit CI Gate job.
.github/policies/auto-merge.yml	Temporarily disables the auto-merge policy.
.github/dependabot.yml	Prevents Dependabot from opening TypeScript major-update PRs for the Angular sample.

Files not reviewed (1)

• samples/aspire-with-javascript/AspireJavaScript.Angular/package-lock.json: Generated file

Suppressed comments (2)

.github/workflows/ci.yml:63

• apt-get install is run without -y, which will typically prompt for confirmation and fail in a non-interactive GitHub Actions runner. Add -y (or set DEBIAN_FRONTEND=noninteractive) so the step is deterministic.

        wget -q https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb
        sudo dpkg -i packages-microsoft-prod.deb
        sudo apt-get update
        sudo apt-get install azure-functions-core-tools-4

.github/workflows/ci.yml:194

• The ci-gate job has the same indentation issue as build: the steps: list items are aligned with steps: instead of being indented beneath it, which will make the workflow YAML invalid.

    timeout-minutes: 5
    steps:
    - name: Verify required jobs succeeded
      shell: bash
      env:
        BUILD_RESULT: ${{ needs.build.result }}
      run: |

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Adam Ratzman (adamint)]

Reviewed bfda518. I don’t see a new must-fix issue. I verified the two-leg matrix rolls up to the exact CI Gate context; run 30952149550 proves the gate fails closed, and run 31427008700 passes all three jobs while validating 27 lockfiles and 11 AppHosts. One proof gap: the branch-protection API returns 404 for my token, so I couldn’t verify the policy’s live post-merge materialization.

[Adam Ratzman (adamint)]

The existing thread is resolved and outdated, the pinned head is unchanged, and all required checks are green. Approved.