[ci-scan-feedback] harden fixer self-dedup with a non-integrity-gated branch-list backstop #132949

Triggering signals

• ([ci-fix] Needs review: select gen-debug-dump-docs Helix post-command shell by WindowsShell (refs #131382) #131981, MEMBER kotlarmilos: "Duplicate [ci-fix] Stop dump-doc collection on unsupported Helix targets (refs #131382) #131515." — a [ci-fix] help PR that duplicated the fixer's own earlier PR [ci-fix] Stop dump-doc collection on unsupported Helix targets (refs #131382) #131515; both live on ci-fix/131382-... branches and both link KBE [ci-scan] Build break: Windows Helix work items fail on unexpanded $HELIX_PYTHONPATH in gen-debug-dump-docs post-command #131382, [ci-fix] Needs review: select gen-debug-dump-docs Helix post-command shell by WindowsShell (refs #131382) #131981)
• (rubric finding: list_branches on dotnet/runtime shows two ci-fix/131382-helix-pythonpath-windowsshell-* branches, plus ci-fix/android-x509-...-128890-... and ci-fix/reflection-unwrap-tie-128766-... where the KBE id is mid-name, not a prefix — so Step 3's ci-fix/<kbe>- prefix key never matched them)
• (rubric finding: github MCP search_pull_requests/search_issues for [ci-scan]/[ci-fix] artifacts returns [Filtered] under the integrity gate — 71 [ci-scan] items filtered this tick — silently emptying the dedup PR map, while list_branches returns unfiltered results)

Proposed edits

• (.github/workflows/ci-failure-fix.md:166 — add a non-integrity-gated list_branches dedup backstop with a position-independent (^|-)ci-fix/(.*-)?<kbe>(-|$) token match; directly closes the gap that let [ci-fix] Needs review: select gen-debug-dump-docs Helix post-command shell by WindowsShell (refs #131382) #131981 duplicate [ci-fix] Stop dump-doc collection on unsupported Helix targets (refs #131382) #131515)
• (.github/workflows/ci-failure-fix.md:166 — update dedup check 1 to treat either a PR-map hit or a matching branch as authoritative, even when the PR search is [Filtered])
• (.github/workflows/ci-failure-fix.md:253,263 — require the numeric KBE id to be the first hyphen-delimited branch token in Steps 5.3/5.4 so the branch-list key is reliable going forward)

Expected behavior change

On the next fixer run, before opening a [ci-fix] PR the agent enumerates repository branches (which the integrity gate does not filter) and skips any KBE that already has a ci-fix/...<kbe>... branch, regardless of where the id sits in the name. This prevents the recurring failure mode where an integrity-[Filtered] PR search hid the fixer's own prior PR and it opened a duplicate for the same KBE (#131981 vs #131515).

Generated by CI Outer-Loop Failure Scanner — Feedback · opus48 · 541.6 AIC · ⌖ 26.5 AIC · ⊞ 20.6K · ◷

To create a pull request with the changes:

# Download the artifact from the workflow run
gh run download 33312726322 -n agent -D /tmp/agent-33312726322

# Fetch the bundle into a temporary ref, then update the local branch
git fetch /tmp/agent-33312726322/aw-ci-scan-feedback-dedup-branchlist.bundle refs/heads/ci-scan-feedback-dedup-branchlist:refs/bundles/create-pr-ci-scan-feedback-dedup-branchlist-ff21e57fce465c60-95c03704
git update-ref refs/heads/ci-scan-feedback-dedup-branchlist-ff21e57fce465c60 refs/bundles/create-pr-ci-scan-feedback-dedup-branchlist-ff21e57fce465c60-95c03704
git checkout ci-scan-feedback-dedup-branchlist-ff21e57fce465c60
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d refs/bundles/create-pr-ci-scan-feedback-dedup-branchlist-ff21e57fce465c60-95c03704

# Push the branch to origin
git push origin ci-scan-feedback-dedup-branchlist-ff21e57fce465c60

# Create the pull request
gh pr create --title '[ci-scan-feedback] harden fixer self-dedup with a non-integrity-gated branch-list backstop' --base main --head ci-scan-feedback-dedup-branchlist-ff21e57fce465c60 --repo dotnet/runtime