Minor fixes and updates in agentic-workflows (#66597)

Author: DeagleGross

.github/aw/actions-lock.json

@@ -1,19 +1,19 @@
 {
   "entries": {
-    "actions/github-script@v8": {
-      "repo": "actions/github-script",
-      "version": "v8",
-      "sha": "ed597411d8f924073f98dfc5c65a23a2325f34cd"
-    },
     "actions/github-script@v9": {
       "repo": "actions/github-script",
       "version": "v9",
-      "sha": "373c709c69115d41ff229c7e5df9f8788daa9553"
+      "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
+    },
+    "actions/github-script@v9.0.0": {
+      "repo": "actions/github-script",
+      "version": "v9.0.0",
+      "sha": "d746ffe35508b1917358783b479e04febd2b8f71"
     },
-    "github/gh-aw-actions/setup@v0.71.1": {
+    "github/gh-aw-actions/setup@v0.71.5": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.71.1",
-      "sha": "239aec45b78c8799417efdd5bc6d8cc036629ec1"
+      "version": "v0.71.5",
+      "sha": "b8068426813005612b960b5ab0b8bd2c27142323"
     }
   }
 }

.github/workflows/browsertesting-deps-update.lock.yml

@@ -17,13 +17,21 @@ network:
     - defaults
     - dotnet
     - containers
+    - github
 
 tools:
   github:
   edit:
-  bash: ["curl", "grep", "sed", "jq", "git", "cat", "ls", "find", "bash", "head", "tail", "dotnet", "source", "chmod"]
+  bash: ["grep", "sed", "jq", "git", "cat", "ls", "find", "bash", "head", "tail", "dotnet", "source", "chmod"]
   web-fetch:
 
+mcp-servers:
+  nuget:
+    container: "mcr.microsoft.com/dotnet/sdk:10.0"
+    entrypoint: "dnx"
+    entrypointArgs: ["NuGet.Mcp.Server", "--source", "https://api.nuget.org/v3/index.json", "--yes"]
+    allowed: ["get-latest-package-version"]
+
 safe-outputs:
   create-pull-request:
     title-prefix: "[package] "
@@ -82,14 +90,11 @@ Perform these checks and apply changes:
 
 ### Step 1: Check for a newer CsWin32 version
 
-Fetch the latest stable version of Microsoft.Windows.CsWin32 from NuGet:
+Use the NuGet MCP server's `get-latest-package-version` tool to look up the latest stable version
+of `Microsoft.Windows.CsWin32`.
 
-```bash
-PACKAGE_ID_LOWER=$(echo "Microsoft.Windows.CsWin32" | tr '[:upper:]' '[:lower:]')
-VERSIONS=$(curl -s "https://api.nuget.org/v3-flatcontainer/${PACKAGE_ID_LOWER}/index.json")
-LATEST=$(echo "$VERSIONS" | jq -r '.versions[]' | grep -v '-' | tail -1)
-echo "Latest stable version: $LATEST"
-```
+Do NOT use `curl`, `web-fetch`, or any direct HTTP requests to the NuGet API — they are blocked
+by the network firewall.
 
 Compare with the current version in `eng/Versions.props` under `<MicrosoftWindowsCsWin32Version>`.
 
@@ -127,6 +132,10 @@ If the build fails on Linux due to platform-specific runtime dependencies, that'
 is that the source generator runs and produces files in `obj/`. Check if the source generation step completes
 even if later compilation steps have errors.
 
+**Important:** `NETSDK1127` (missing targeting pack), missing SDK, or restore/feed failures are **not**
+acceptable platform-specific build issues — they indicate a broken restore/toolset. If encountered, rerun
+`bash -c 'source activate.sh && ./restore.sh'`, inspect the restore output for errors, and do not proceed to `noop`.
+
 After building, inspect CsWin32's generated output:
 
 ```bash
@@ -138,7 +147,12 @@ find src/Servers/IIS/obj -name "*.g.cs" | head -20
 
 ### Step 3: Research what changed in CsWin32
 
-Use `web_fetch` to check CsWin32's release notes and changelog:
+Use the `github` tool to check CsWin32's releases and referenced issues:
+
+- Use `list_releases` or `get_release` on `microsoft/CsWin32` for release notes and changelog.
+- Use `get_issue` on `microsoft/CsWin32` to check the status of referenced issues (e.g., issue #1086).
+
+If the `github` tool output lacks detail (e.g., release body is truncated), fall back to `web_fetch`:
 
 ```
 https://github.com/microsoft/CsWin32/releases
@@ -152,8 +166,8 @@ Look for:
 - Issues referenced in this codebase's workaround comments
 
 Also check the status of referenced GitHub issues. For example, if a workaround comment
-references `https://github.com/microsoft/CsWin32/issues/1086`, use `web_fetch` to check
-if the issue is closed/resolved.
+references `https://github.com/microsoft/CsWin32/issues/1086`, use the `github` tool's
+`get_issue` on `microsoft/CsWin32` to check if the issue is closed/resolved.
 
 ---
 
@@ -318,6 +332,10 @@ After the PR is created, use the `add-comment` safe output to post a comment on
 - The CsWin32 version is already the latest stable release
 - No workarounds were found that can be fixed (verified by checking `obj/` generated code and CsWin32 issue status)
 - You searched for ALL patterns above and found nothing actionable
+- All required checks completed successfully (NuGet version lookup, GitHub issue research, restore, build, and generated-source inspection)
+
+Do **not** call `noop` if any required check failed or was skipped. If a check could not be completed
+(e.g., restore failed, build failed, NuGet lookup failed), report the failure details instead of calling `noop`.
 
 The `noop` message must list what was checked (version, patterns searched, issues checked).