Fix generated-options CI routing for shipped API baselines

[thomhurst]

Generated options PRs that modify PublicAPI.Shipped.txt were classified as ordinary changes, running the full repository pipeline and skipping the generated-options freshness gate. Accept both API baseline files within the existing package-scoped allowlist so these PRs use their tool validation job and provenance check.

The required pipeline (ubuntu-latest) check remains the final gate for either route; no branch-protection changes are needed. Workflow comments clarify this relationship. Existing ownership, branch, manifest, and unrelated-path restrictions remain enforced.

Validation:

• Routing regression fails before the fix and passes afterward; covers .NET, Maven/Gradle, kubectl/kustomize, baseline-only updates, and mixed handwritten/workflow/package paths.
• Provenance tests exercise baseline routing with current and stale generator inputs.
• Test-ResolveGeneratedIntegrationValidation.ps1, Test-GeneratedOptionsProvenance.ps1, Test-RequiredPipelineContext.ps1, and git diff --check pass.
• Actual file lists from Pulumi [Automated] Update pulumi CLI Options #4736, kubectl [Automated] Update kubectl CLI Options #4694, and Maven [Automated] Update mvn CLI Options #4717 select their expected tool solutions.

Closes #4740

Summary by CodeRabbit

• Bug Fixes

  • Improved change detection for generated integration validation, including shipped public API baseline updates.
  • Prevented unrelated file changes from incorrectly triggering generated validation.

• Tests

  • Expanded coverage across supported package types and combinations of shipped, unshipped, and generated files.
  • Added freshness validation scenarios for generated integration outputs and central package changes.

• Documentation

  • Added workflow comments clarifying API baseline coverage and validation status checks.

[github-actions]

Review: Fix generated-options CI routing for shipped API baselines

Scope is tight and matches the stated bug (#4740): Resolve-GeneratedIntegrationValidation.ps1 now treats PublicAPI.Shipped.txt the same as PublicAPI.Unshipped.txt for classifying an automated options PR as a generated integration, so those PRs get routed to the tool-specific validation job instead of falling back to full-repo validation.

What I checked:

• scripts/Resolve-GeneratedIntegrationValidation.ps1: the one-line addition is symmetric with the existing Unshipped.txt handling and consistent with how Sync-PublicApiBaselines.ps1 / Assert-PublicApiBaselines.ps1 already treat both baseline files elsewhere in the repo — this isn't introducing a new asymmetry, it's closing one.
• Security/gating model is unchanged: routing still requires HeadRepository == Repository, PullRequestAuthor == repo owner, and a automated/update-cli-options-<tool> branch prefix, so this doesn't widen what an arbitrary contributor PR can do to skip full validation — only automated same-owner PRs benefit.
• Test-ResolveGeneratedIntegrationValidation.ps1: the new matrix (dotnet/mvn/gradle/kubectl/kustomize, including two tools that share a package) correctly exercises both "shipped baseline alone" and "shipped + unshipped + generation json" as accepted, and confirms a shipped-baseline change can't be used to mask unrelated handwritten files, other packages, or CI/script changes (each unrelated-path case still trips the unexpectedPaths branch). Good regression coverage for the exact failure mode described in the PR.
• Test-GeneratedOptionsProvenance.ps1: Assert-GeneratedBaselineFreshness correctly asserts the routing step accepts a shipped-baseline-only change set before running the freshness check. It's only wired into two of the eight Assert-GeneratedOptionsFreshness call sites (the "clean pass" and "stale after central-package-bump" scenarios) — the other six exercise freshness-check behavior that's orthogonal to this fix (missing provenance, provenance-writer changes, corrupted metadata, stale generator import), so not switching them over is reasonable rather than a gap; re-asserting the same routing precondition at every call site would just be redundant.
• Workflow comments in dotnet.yml are accurate and add useful context without altering behavior.

No correctness issues found, and the test additions specifically target the regression this PR closes. No previous review comments exist on this PR to reconcile against.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 4f6f9df6-11ab-4580-8839-ac0a53c4b67d

📥 Commits

Reviewing files that changed from the base of the PR and between 11c25d9 and 2567829.

📒 Files selected for processing (4)

• .github/workflows/dotnet.yml
• scripts/Resolve-GeneratedIntegrationValidation.ps1
• scripts/Test-GeneratedOptionsProvenance.ps1
• scripts/Test-ResolveGeneratedIntegrationValidation.ps1

Included review availability: Your plan provides up to 4 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The change classifies PublicAPI.Shipped.txt as a generated integration artifact. Provenance tests now use resolved validation routes. Resolver tests cover supported tools, mixed generated paths, and unrelated paths.

Changes

Generated validation routing

Layer / File(s)	Summary
Shipped baseline classification .github/workflows/dotnet.yml, scripts/Resolve-GeneratedIntegrationValidation.ps1	The resolver accepts PublicAPI.Shipped.txt alongside unshipped and generated files. Workflow comments describe both validation routes and the stable pipeline check.
Freshness assertion routing scripts/Test-GeneratedOptionsProvenance.ps1	The provenance test resolves the generated-integration route before freshness checks. Its temporary repository now includes a solution and shipped API baseline.
Resolver scenario coverage scripts/Test-ResolveGeneratedIntegrationValidation.ps1	Tests cover shipped baseline changes across dotnet, Maven, Gradle, kubectl, and kustomize. Tests also reject shipped baselines paired with unrelated paths.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 25678

Shipped API baseline changes now receive the intended generated validation and freshness checks while unrelated changes remain excluded from this route. The change is ready to merge.

Poem

A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: correcting generated-options CI routing for shipped API baselines.
Linked Issues check	✅ Passed	The changes satisfy issue [#4740]. They classify PublicAPI.Shipped.txt as a generated integration, route it through provenance freshness validation, test current and stale provenance, preserve unrelat…
Out of Scope Changes check	✅ Passed	All changes support the linked issue. The workflow comments, routing update, provenance test updates, and resolver coverage are directly related to shipped-baseline validation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/generated-ci-routing

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}