[ci-scan-feedback] Route platform crypto/config failures to loop-in

[github-actions]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection results could not be parsed.

Review the workflow run logs for details.

Triggering signals

• [ci-fix] Needs review: apply KMAC key-size requirements on SymCrypt-OpenSSL (refs #129939) #130594 ([ci-fix] help-wanted, closed unmerged) — vcsjones (MEMBER): "This is not the right fix and we need to understand what is going on before proceeding. The issue is assigned to me as I intend to address this after investigating the AZL configuration." The fixer guessed a KMAC key-size expectation change to make an AzureLinux-only crypto failure pass. [ci-fix] Needs review: apply KMAC key-size requirements on SymCrypt-OpenSSL (refs #129939) #130594 (comment)
• Fixer rejection rate is 🔴 (33.3%, 2/6) on the KPI tracker ([ci-scan-feedback] KPI Tracker #128742); [ci-fix] Needs review: apply KMAC key-size requirements on SymCrypt-OpenSSL (refs #129939) #130594 is the still-unguarded half (the [ci-fix] Needs review: root CustomAttributeDecoderTests enum types for Apple-mobile trimming (refs #128450) #130106 already-rooted half is covered by the Step 5.2 already-rooted caution).
• The previous feedback tick's tracker snapshot claimed to add this crypto/config caution but no [ci-scan-feedback] PR was ever opened — the guidance never landed in ci-failure-fix.md. This PR actually lands it.

Proposed edits

• .github/workflows/ci-failure-fix.md (Step 5.2, after the "Already-rooted test-assembly caution" paragraph) — add a "Platform crypto/config caution" that routes OS/distro-dependent crypto failures (key size, algorithm, curve, or padding accepted on one leg but rejected/unavailable on another — AzureLinux/azl, FIPS, OpenSSL provider/policy differences) to Branch COMMENT (Step 5.5) instead of a guessed expectation change, unless source confirms an unambiguous platform-agnostic defect. Directly targets the [ci-fix] Needs review: apply KMAC key-size requirements on SymCrypt-OpenSSL (refs #129939) #130594 rejection class.

Expected behavior change

The next fixer run that encounters a cryptographic failure confined to a specific OS/distro leg will loop in the owning security area with the distro/config difference rather than opening a help-wanted PR that guesses an asserted key size or algorithm — the exact pattern maintainers rejected on #130594 as "not the right fix; need to understand the platform config first." This should lower the fixer rejection rate without suppressing any real fix, since genuine platform-agnostic defects remain in bounds.

Note

This PR was generated by an AI/Copilot agent (ci-failure-scan-feedback).

Generated by CI Outer-Loop Failure Scanner — Feedback · 300.3 AIC · ⊞ 19K · ◷

---

Note

This was originally intended as a pull request, but the git push operation failed.

Original error: The process '/usr/bin/git' failed with exit code 1

Workflow Run: View run details and download bundle artifact

The bundle file is available in the agent artifact in the workflow run linked above.

To create a pull request with the changes:

# Download the artifact from the workflow run
gh run download 29746429915 -n agent -D /tmp/agent-29746429915

# Fetch the bundle into a temporary ref, then update the local branch
git fetch /tmp/agent-29746429915/aw-ci-scan-feedback-crypto-config-caution.bundle refs/heads/ci-scan-feedback-crypto-config-caution:refs/bundles/create-pr-ci-scan-feedback-crypto-config-caution-7e266acc4eba2016-cd734c8e
git update-ref refs/heads/ci-scan-feedback-crypto-config-caution-7e266acc4eba2016 refs/bundles/create-pr-ci-scan-feedback-crypto-config-caution-7e266acc4eba2016-cd734c8e
git checkout ci-scan-feedback-crypto-config-caution-7e266acc4eba2016
# Ensure the working tree matches the updated branch
git reset --hard
# Remove the temporary bundle ref
git update-ref -d refs/bundles/create-pr-ci-scan-feedback-crypto-config-caution-7e266acc4eba2016-cd734c8e

# Push the branch to origin
git push origin ci-scan-feedback-crypto-config-caution-7e266acc4eba2016

# Create the pull request
gh pr create --title '[ci-scan-feedback] Route platform crypto/config failures to loop-in' --base main --head ci-scan-feedback-crypto-config-caution-7e266acc4eba2016 --repo dotnet/runtime

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/runtime-infrastructure
See info in area-owners.md if you want to be subscribed.

[kotlarmilos]

Duplicate of #131037