Fix docs PR generation for release branches

[David Pine (IEvangelist)]

Description

PR Documentation Check has authored and committed documentation for release-bound changes, then failed before opening the Aspire docs PR. Issue #19054 now tracks 35 confirmed release/13.5 failures; 31 still need recovery.

gh-aw patch generation uses the workflow's configured base-branch before it can honor the agent's per-call base. The workflow configured main, while its depth-1 workspace was based on release/13.5, so git merge-base could not traverse the shallow boundary and returned ERR_SYSTEM. Fetching full history is not a safe workaround because it could produce a patch containing the entire main-to-release divergence.

This change:

• exposes the target resolver's effective Aspire docs branch and uses it for agent-time patch generation;
• provides an explicit main fallback in the separate safe-output job, where the handler still honors the allowlisted per-call release base while applying the patch;
• retains depth-1 checkouts and workspace-root authoring;
• removes the duplicate aspire.dev agent checkout from release-update-support-mdx, which could shadow the checkout containing the authored branch;
• upgrades all eight gh-aw workflows to stable v0.85.4 and recompiles every lock file, action pin, and generated maintenance workflow together.

The upstream dynamic-base limitation remains open in github/gh-aw#41265. v0.85.4 includes the separate re-shallowing fix from github/gh-aw#50378, but upgrading alone does not resolve dynamic patch-base selection.

Validation:

• Compiled and schema-validated all eight workflow sources with the verified gh-aw v0.85.4 release binary.
• Confirmed all eight lock files report compiler v0.85.4.
• Confirmed no checkout uses fetch-depth: 0.
• Confirmed a depth-1 release-based docs commit has a merge base with the release tip but not with a separately shallow-fetched main.

After this merges, affected source PRs need a fresh workflow_dispatch; GitHub's Re-run jobs action would reuse the old workflow revision. The recovery inventory and resulting Aspire docs PRs will be tracked in #19054.

• Fixes PR Documentation Check fails to create docs PRs for release branches #19054
• Fixes Agentic Maintenance (microsoft/aspire.dev) workflow fails on every scheduled run — GH_AW_GITHUB_TOKEN secret is not configured #18615

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19055

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19055"

[github-actions]

Tests selector (audit mode)

The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement.

Runs the full test matrix + all jobs (ALL) — run-all fallback: '.gitattributes' is neither Layer-1-owned nor matched by a Layer 2 rule

---

Selection computed for commit 7c6f208.

[Copilot]

🔵 Human review recommended

Cross-repository PR generation and compiler-wide workflow changes require final human validation despite no concrete defects found.

Pull request overview

Fixes #19054 by aligning documentation patch generation with the dynamically resolved Aspire docs release branch.

Changes:

• Exposes and uses the effective docs branch, with a safe-output main fallback.
• Removes duplicate aspire.dev agent checkout behavior.
• Upgrades and recompiles all gh-aw workflows to v0.85.4.

File summaries

File	Description
.github/workflows/pr-docs-check.md	Wires the resolved docs branch into patch generation.
.github/workflows/release-update-support-mdx.md	Uses one root agent checkout.
.github/workflows/analyze-ci-failure.lock.yml	Recompiled with gh-aw v0.85.4.
.github/workflows/daily-repo-status.lock.yml	Recompiled with gh-aw v0.85.4.
.github/workflows/extension-changelog.lock.yml	Recompiled with gh-aw v0.85.4.
.github/workflows/milestone-changelog.lock.yml	Recompiled with gh-aw v0.85.4.
.github/workflows/pr-docs-check.lock.yml	Contains the compiled dynamic-base fix.
.github/workflows/release-notes-generate.lock.yml	Recompiled with gh-aw v0.85.4.
.github/workflows/release-update-support-mdx.lock.yml	Contains the compiled checkout fix.
.github/workflows/repo-pulse.lock.yml	Recompiled with gh-aw v0.85.4.
.github/workflows/agentics-maintenance.yml	Removes obsolete generated maintenance workflow.
.github/workflows/agentics-maintenance-microsoft-aspire.dev.yml	Regenerates side-repository maintenance.
.github/aw/actions-lock.json	Updates gh-aw action pins.
.gitattributes	Removes the custom merge strategy for generated locks.

Review details

• Files reviewed: 10/14 changed files
• Comments generated: 0
• Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.