From a2955166df57a54a2be3f425b7e019eb7f04ea2f Mon Sep 17 00:00:00 2001
From: "Behzad.Mirkhanzadeh" <behzadm@microsoft.com>
Date: Wed, 2 Sep 2026 23:03:33 +0000
Subject: [PATCH] ci: fix false-positive issue dedup in go-version-check

The dedup checks used `gh issue list --search "$MARKER"`, which relies on
GitHub's full-text index. That index tokenizes markers like
`go-minor-update:1.27.1` on `-`, `:` and `.`, so it matches unrelated
issues by relevance rather than by exact content.

Observed in run 33692611337: the Tier 3 job searched for
`go-minor-update:1.27.1` and matched two "Release Tracking" issues
(#4667, #4541) that do not contain the marker at all. `existing_count`
became 2, the `== '0'` gate failed, and the "Create issue and assign
Copilot agent" step was skipped. The job still reported success, so the
upgrade issue was never created and the failure was silent.

Replace all four dedup sites (auto-bump, fips-prereq, backport, minor
upgrade) with an exact substring match over open issue bodies via jq.

Verified against the live repo:

  marker                    old(search)   new(exact)
  go-minor-update:1.27.1        3             1   <- only #4832 has it
  go-minor-update:1.27.0        1             0   <- #4748 is closed
  go-patch-update:1.26.8        0             0

Also emit a notice with the match count so a suppressed creation is
visible in the logs instead of silent.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b043d9fe-4797-42bf-9482-c337444c5a6f
---
 .github/workflows/go-version-check.yaml | 27 ++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/go-version-check.yaml b/.github/workflows/go-version-check.yaml
index d29f36aaf5..278465b55d 100644
--- a/.github/workflows/go-version-check.yaml
+++ b/.github/workflows/go-version-check.yaml
@@ -320,8 +320,13 @@ jobs:
           "
           fi
 
-          # Dedup: skip if an open issue already exists for this update
-          EXISTING_ISSUE=$(gh issue list --repo "$REPO" --state open --search "$MARKER" --json number --jq '.[0].number // empty')
+          # Dedup: skip if an open issue already exists for this update.
+          # Match the marker as an exact substring of the body. Do NOT use
+          # `gh issue list --search`: GitHub's full-text index tokenizes markers
+          # like `go-patch-update:1.26.8` on `-`, `:` and `.`, so it returns
+          # false positives (unrelated issues) and silently suppresses creation.
+          EXISTING_ISSUE=$(gh issue list --repo "$REPO" --state open --limit 200 --json number,body \
+            | jq -r --arg m "$MARKER" 'map(select((.body // "") | contains($m))) | .[0].number // empty')
           if [ -n "$EXISTING_ISSUE" ]; then
             echo "::notice::Issue #$EXISTING_ISSUE already exists for this update — skipping"
             exit 0
@@ -445,7 +450,9 @@ jobs:
           GOEXP_CGO0: ${{ steps.prereqs.outputs.goexp_cgo0 }}
         run: |
           MARKER="fips-prereq:${MATRIX_BRANCH}"
-          EXISTING_ISSUE=$(gh issue list --repo "$REPO" --state open --search "$MARKER" --json number --jq '.[0].number // empty')
+          # Exact substring match — see note on dedup in the auto-bump job.
+          EXISTING_ISSUE=$(gh issue list --repo "$REPO" --state open --limit 200 --json number,body \
+            | jq -r --arg m "$MARKER" 'map(select((.body // "") | contains($m))) | .[0].number // empty')
           if [ -n "$EXISTING_ISSUE" ]; then
             echo "::notice::Prerequisite issue #$EXISTING_ISSUE already exists — skipping"
             exit 0
@@ -496,7 +503,9 @@ jobs:
 
           # Dedup
           MARKER="go-backport:${MATRIX_BRANCH}:${UPDATE_TYPE}"
-          EXISTING_ISSUE=$(gh issue list --repo "$REPO" --state open --search "$MARKER" --json number --jq '.[0].number // empty')
+          # Exact substring match — see note on dedup in the auto-bump job.
+          EXISTING_ISSUE=$(gh issue list --repo "$REPO" --state open --limit 200 --json number,body \
+            | jq -r --arg m "$MARKER" 'map(select((.body // "") | contains($m))) | .[0].number // empty')
           if [ -n "$EXISTING_ISSUE" ]; then
             echo "::notice::Backport issue #$EXISTING_ISSUE already exists — skipping"
             exit 0
@@ -573,13 +582,17 @@ jobs:
           REPO: ${{ github.repository }}
         run: |
           MARKER="go-minor-update:${LATEST_MINOR}"
+          # Exact substring match — see note on dedup in the auto-bump job.
+          # The previous `--search "in:body $MARKER"` matched unrelated issues
+          # (e.g. "Release Tracking" issues) and blocked issue creation entirely.
           EXISTING=$(gh issue list \
             --repo "$REPO" \
             --state open \
-            --search "in:body $MARKER" \
-            --json number \
-            --jq 'length')
+            --limit 200 \
+            --json number,body \
+            | jq --arg m "$MARKER" 'map(select((.body // "") | contains($m))) | length')
           echo "existing_count=$EXISTING" >> "$GITHUB_OUTPUT"
+          echo "::notice::Existing open issues matching '${MARKER}': ${EXISTING}"
 
       - name: Fetch MS Go FIPS requirements
         id: msgo_fips_tier3