Add daily main to release/14.0 synchronization

[Jose Perez Rodriguez (joperezr)]

Description

Keep the advance release/14.0 integration branch current while main develops 13.6, without introducing 14.0-only changes into 13.6.

• Add a daily 08:23 UTC workflow plus manual dispatch from main, using the existing Aspire repository App.
• Open one snapshot-branch PR at a time from main into release/14.0, requesting native auto-merge with a merge commit. Preserve ancestry, leave conflicts in an actionable PR, and never overwrite a pending branch or a maintainer's conflict resolution.
• Respect applicable approvals, checks, and push restrictions. An already-ready PR is merged normally with a pinned head SHA, matching gh pr merge --auto behavior. No CI-completion merge handler or administrative override is added.
• Register failures with the scheduled-workflow watchdog and document conflict resolution, approval-only App bypass rulesets, and disabling the sync before merging 14.0 back into main after cutting release/13.6.

Repository configuration

Repository merge commits must be enabled, while a separate main ruleset can remain squash-only. Merge commits must be allowed for release/14.0, and branch push restrictions must permit the App.

For approval-free bot merges, scope an approval-only ruleset to release/14.0 and grant the App pull-request-only bypass there; retain required CI in a separate ruleset without App bypass. Overlapping classic branch protection currently requires one approval and must also be accounted for. Native auto-merge has reported limitations honoring approval bypass; keep a manual approval fallback rather than bypassing CI. This PR changes no repository settings.

The separate version-only PR is #20037, targeting release/14.0 and setting 14.0.0-preview.1.

Validation

Passed 51 targeted Infrastructure.Tests cases across SyncMainToRelease14Tests and MonitorScheduledWorkflowsIntegrationTests, including API behavior, mergeability retries, conflicts, settings, idempotency, identity changes, and failure propagation. Existing .github/workflows/** routing already selects Infrastructure.Tests; no test-trigger map update is required.

Security considerations

The workflow creates an explicitly repository-scoped, short-lived App token with contents and pull-request write permissions. It runs only from main in microsoft/aspire, never checks out or executes branch code, validates the synchronization PR's identity before merge requests, and does not modify protection settings. Required CI must remain outside any approval-bypass ruleset configured by maintainers.

Fixes # (issue)

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20039

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20039"

[github-actions]

Tests selector

1 / 99 PR test projects · 0 PR jobs · 0 advisory-only targets, from 5 changed files.

Selected PR test projects (1 / 99)

Infrastructure.Tests

Selected PR jobs (0)

none

Advisory workflow impact (0)

none

---

How these were chosen — grouped by what changed

📄 .github/workflows/README.md (changed)
→ 1 directly: Infrastructure.Tests

📄 .github/workflows/monitor-scheduled-workflows.config.json (changed)
→ 1 directly: Infrastructure.Tests

📄 .github/workflows/sync-main-to-release-14.yml (changed)
→ 1 directly: Infrastructure.Tests

🧪 tests/Infrastructure.Tests/WorkflowScripts/SyncMainToRelease14Tests.cs (changed test)
→ 1 directly: Infrastructure.Tests

🧪 tests/Infrastructure.Tests/WorkflowScripts/sync-main-to-release-14.harness.mjs (changed test)
→ 1 directly: Infrastructure.Tests

Job reasons

none

---

Selection computed for commit 6104f09.

[Copilot]

Copilot review overview

🟡 Changes recommended

The App token cannot merge workflow-file changes, and two immediately mergeable states are handled incorrectly.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 2

New issues introduced by this change (2)

Severity	Finding
	.github/​workflows/​sync-main-to-release-14.yml — This token cannot reliably synchronize all of main: the first batch created by this PR already…
	.github/​workflows/​sync-main-to-release-14.yml — This ready-state check is narrower than the gh pr merge --auto behavior cited above: GitHub CLI…

What changed in this PR

Adds automated daily synchronization from main into release/14.0.

Changes:

• Adds snapshot-branch PR creation and auto-merge.
• Adds workflow contract and scenario tests.
• Documents operations and registers watchdog monitoring.

File	Description
.github/​workflows/​sync-main-to-release-14.yml	Implements synchronization.
.github/​workflows/​README.md	Documents lifecycle and policies.
.github/​workflows/​monitor-scheduled-workflows.config.json	Registers watchdog monitoring.
tests/​Infrastructure.Tests/​WorkflowScripts/​SyncMainToRelease14Tests.cs	Adds workflow tests.
tests/​Infrastructure.Tests/​WorkflowScripts/​sync-main-to-release-14.harness.mjs	Simulates API scenarios.