Add vs18.9 to merge-flow config; retire vs18.3

[JanProvaznik]

Phase 1.3 of the 18.9 release (#14213).

1.3a — add vs18.9 to the merge chain

vs18.9 was snapped from main on 2026-06-30. This routes vs18.8 -> vs18.9 and adds vs18.9 -> main so forward-merge automation reaches main through the new release branch.

1.3b — retire vs18.3

Applying the combined SDK + VS retirement rule (retire only when both lifecycles are out of support):

• SDK: band 10.0.2xx (paired with vs18.3) is past end-of-support — EoS May 2026 per the SDK/MSBuild/VS versioning lifecycle table.
• VS: 18.3 is superseded (current stable is 18.7) and out of support.

Both agree, so vs18.3 is removed and vs18.0 now forwards directly to vs18.6. vs18.0 (SDK 10.0.1xx) stays in the chain because .1xx bands are supported throughout the .NET 10 lifecycle, so its fixes keep flowing forward.

Resulting chain:
vs16.11 -> vs17.8 -> vs17.11 -> vs17.12 -> vs17.14 -> vs18.0 -> vs18.6 -> vs18.7 -> vs18.8 -> vs18.9 -> main

[Copilot]

Pull request overview

Updates the repository’s forward-merge automation configuration to reflect the MSBuild 18.9 release branch creation and to retire an out-of-support release branch, keeping the servicing chain aligned with supported VS/SDK lifecycles.

Changes:

• Insert vs18.9 into the forward-merge chain so merges flow vs18.8 -> vs18.9 -> main.
• Retire vs18.3 from the merge flow and rewire vs18.0 to merge directly to vs18.6.
• Add/adjust inline comments documenting the lifecycle rationale (SDK band support + VS support status).

[github-actions]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection results could not be parsed.

Review the workflow run logs for details.

Error Messages Quality — LGTM

This PR modifies only .config/git-merge-flow-config.jsonc, a pure configuration file. There are no user-facing diagnostic strings, MSBuild error/warning codes, or Strings.resx entries involved. No error message quality concerns apply.

Generated by Expert Code Review (on open) for #14214 · 1.5K AIC · ⊞ 32.1K · ◷

[github-actions]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection results could not be parsed.

Review the workflow run logs for details.

Build Infrastructure Care — LGTM ✅

All checks pass:

Check	Result
Chain monotonically increasing	✅ vs16.11→vs17.8→vs17.11→vs17.12→vs17.14→vs18.0→vs18.6→vs18.7→vs18.8→vs18.9→main
vs18.9 placed correctly	✅ after vs18.8, before main
vs18.9 branch exists remotely	✅ refs/heads/vs18.9 confirmed live
All chain branches exist remotely	✅ every entry in the config maps to a live remote branch
vs18.3 retirement conditions	✅ SDK 10.0.2xx EoS May 2026 (past), VS 18.3 superseded — both conditions satisfied before removal
Retirement tombstone comment	✅ inline rationale with date recorded in the config
File is self-contained	✅ single JSONC file, read from main branch only

The stale merge/vs18.8-to-main remote branch is a pre-existing in-flight artifact from the old chain; the automation reads the config fresh on each run and will open the new vs18.8→vs18.9 and vs18.9→main PRs while that old branch goes stale — expected transitional state, not a defect introduced by this change.

No issues found in the Build Infrastructure Care dimension.

Generated by Expert Code Review (on open) for #14214 · 1.5K AIC · ⊞ 32.1K · ◷

[github-actions]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection results could not be parsed.

Review the workflow run logs for details.

24-dimension review — 23/24 LGTM

#	Dimension	Verdict
1	Correctness	✅ LGTM
2	Concurrency	✅ LGTM — N/A (config only)
3	Performance	✅ LGTM — N/A (config only)
4	Memory	✅ LGTM — N/A (config only)
5	Error Handling	✅ LGTM
6	Logging	✅ LGTM — N/A (config only)
7	Security	✅ LGTM
8	API Design / Schema	✅ LGTM
9	Backward Compatibility	✅ LGTM
10	Design Before Implementation	✅ LGTM
11	Code Clarity	🔵 NIT (see inline comment)
12	Naming Conventions	✅ LGTM
13	Test Coverage	✅ LGTM
14	Edge Cases	✅ LGTM — vs18.9 branch confirmed at 0ac5599
15	Dependencies	✅ LGTM
16	Error Messages	✅ LGTM — N/A
17	Binary Log	✅ LGTM — N/A
18	Documentation Accuracy	✅ LGTM
19	Build Infrastructure	✅ LGTM
20	Scope & PR Discipline	✅ LGTM
21	Change Wave Compliance	✅ LGTM — N/A
22	Cross-platform	✅ LGTM — N/A
23	Public API Surface	✅ LGTM — N/A
24	Ecosystem Impact	✅ LGTM

Key verification points:

• Chain topology is correct and linear: vs16.11 → vs17.8 → vs17.11 → vs17.12 → vs17.14 → vs18.0 → vs18.6 → vs18.7 → vs18.8 → vs18.9 → main — no cycles, no dangling refs, main is terminal only
• vs18.9 branch exists (0ac5599) before this config lands on main — no missing-target risk on first automation run
• vs18.3 retirement satisfies both required conditions (SDK 10.0.2xx EoS May 2026 ✓; VS 18.3 out of support ✓)
• SDK band 10.0.4xx for vs18.9 follows the established progression naturally after 10.0.3xx for vs18.6
• Single-file, single-concern PR with a thorough description and release tracking reference (MSBuild Release Checklist 18.9 #14213)

One NIT (non-blocking, left as inline comment on line 26): the retirement tombstone comment explains why vs18.3 was retired but not what routing it replaced. Adding (was: vs18.0 → vs18.3 → vs18.6) would help future chain-history auditing.

Generated by Expert Code Review (on open) for #14214 · 1.5K AIC · ⊞ 32.1K · ◷

[github-actions]

Caution

agentic threat detected
Threat detection flagged this output in warn mode. Manual review is REQUIRED before any follow-up automation.

Details

The threat detection results could not be parsed.

Review the workflow run logs for details.

Code Clarity & Readability

Two concrete clarity issues; one minor note.

---

ISSUE 1 — Retirement tombstone omits the prior routing

// vs18.3 (SDK 10.0.2xx) retired 2026-06: SDK band 10.0.2xx out of support (EoS May 2026) and VS 18.3 out of support.

Concrete scenario: A future maintainer is asked to re-add vs18.3 if its support window is extended. Reading the config, they see vs18.0 → vs18.6 and a retirement note for vs18.3 — but the note never states that vs18.0 previously targeted vs18.3. They cannot reconstruct the original chain (vs18.0 → vs18.3 → ...) from the file alone.

Suggested fix:

// vs18.3 (SDK 10.0.2xx) retired 2026-06: was the MergeToBranch target for vs18.0;
// SDK band 10.0.2xx out of support (EoS May 2026) and VS 18.3 out of support; vs18.0 now merges directly to vs18.6.

---

ISSUE 2 — vs18.7 and vs18.8 silently omit SDK band info

"vs18.7": { ... }  // "(VS)"
"vs18.8": { ... }  // "(VS)"

vs18.6 carries (VS, SDK 10.0.3xx) and the new vs18.9 entry carries (VS, SDK 10.0.4xx), establishing a clear pattern. vs18.7 and vs18.8 just say (VS).

Concrete scenario: A maintainer is diagnosing a regression in SDK 10.0.3xx builds and searches the config comments for the corresponding branch. The absence of any SDK annotation on vs18.7/vs18.8 makes it ambiguous whether those branches have no dedicated SDK band (a VS-only release) or whether the band was simply not recorded. Either answer affects where they look for the fix.

If vs18.7 and vs18.8 genuinely have no SDK band, make that explicit:

// Automate opening PRs to merge msbuild's vs18.7 (VS only, no dedicated SDK band) into vs18.8 (VS)

---

Minor note — (SDK X, VS) vs (VS, SDK X) ordering is inconsistent

vs17.12 and vs17.14 put SDK first; vs18.6 and vs18.9 put VS first. This is cosmetic and has no operational impact, so not flagging as an issue — but worth normalising in a follow-up if the file is touched again.

Generated by Expert Code Review (on open) for #14214 · 1.5K AIC · ⊞ 32.1K