---
name: "Parallel-safety audit on PR (on open / sync)"
description: >-
  Automatically audits the MSTest tests changed by a non-draft PR for
  parallel-safety when the change touches `test/**`, or the repository-root
  `Directory.Build.props` / `Directory.Build.targets` / `Directory.Packages.props`
  that every test project imports.

# Triggers:
# - pull_request `opened` / `reopened` / `ready_for_review` — initial audit
#   on the PR's first appearance as a non-draft.
# - pull_request `synchronize` — re-audit when new commits are pushed so the
#   comment stays current. Combined with `paths` so we only fire when test
#   files change, and with `concurrency.cancel-in-progress` so
#   superseded runs are cancelled.
#
# NOTE: the trigger filters on `test/**` **only**, not `src/**`. gh-aw ORs the
# `paths` entries, so listing `src/**` would fire a full audit on every
# source-only PR that changes no tests — wasted runs with nothing to audit. A
# PR that changes both a test and production code still matches `test/**` and
# still gets the changed-`src/` list (the extraction step diffs `src/`
# regardless of what triggered the run), so read-set analysis is unaffected.
#
# The repository-root `Directory.Build.props` / `.targets` and
# `Directory.Packages.props` are listed as individual files because
# `test/Directory.Build.props` imports them: an `MSTestParallelizeScope` added
# there opts in **every** test assembly at once without touching anything under
# `test/`. Being single files rather than a `src/**`-style wildcard, they do not
# reintroduce source-only runs.
#
# The companion `/parallel-audit` slash command lives in
# `parallel-safety-audit-command.md`. They must remain separate workflows
# because mixing `slash_command` with other triggers makes gh-aw's activation
# gate always require a command-position match, silently skipping the agent on
# every `pull_request` invocation.
on:
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review]
    paths:
      - "test/**"
      - "Directory.Build.props"
      - "Directory.Build.targets"
      - "Directory.Packages.props"

# Skip draft PRs and OneLocBuild localization check-in PRs (authored by
# dotnet-bot) — only run for human-authored PRs in a reviewable state.
if: >
  github.event.pull_request.draft == false
  && !(
    github.event.pull_request.user.login == 'dotnet-bot'
    && startsWith(github.event.pull_request.title, 'Localized file check-in')
  )

permissions:
  contents: read
  pull-requests: read
  copilot-requests: write

imports:
  - shared/parallel-safety-audit-shared.md

# This workflow fires on every PR open / reopen / ready-for-review and on every
# push (`synchronize`) that touches `test/**` — the same high-frequency trigger
# set as `test-reviewer-on-pr.agent.md`, which crossed the enterprise default of 5K
# on a busy weekend and failed every subsequent activation (see issues #9086 and
# #9053). Raise the daily budget so a busy day of PR pushes does not skip audits.
max-daily-ai-credits: 20K

safe-outputs:
  report-failure-as-issue: false
  messages:
    footer: "> 🤖 **Automated content by GitHub Copilot.** Generated by the [{workflow_name}]({agentic_workflow_url}) workflow.{ai_credits_suffix} · [◷]({history_link})"
  noop:
    report-as-issue: false

concurrency:
  group: parallel-safety-audit-${{ github.event.pull_request.number }}
  cancel-in-progress: true

timeout-minutes: 20
---

<!-- Body provided by shared/parallel-safety-audit-shared.md -->
