Repository: dotnet/runtime
File: .github/skills/vmr-codeflow-status/scripts/Get-CodeflowStatus.ps1 (PowerShell)

Code before:
$prCommits = $pr.commits

# --- Step 2b: Cross-reference PR body snapshot against actual branch commits ---
$branchVmrCommit = $null
if ($prCommits) {
    # Look through PR branch commits (newest first) for "Backflow from" or "Forward flow from" messages
    # containing the actual VMR/source SHA that was used to create the branch content
    $reversedCommits = @($prCommits)
    [Array]::Reverse($reversedCommits)
    foreach ($c in $reversedCommits) {
        $msg = $c.messageHeadline
        # Backflow commits: "Backflow from https://github.com/dotnet/dotnet / <sha> build <id>"
        if ($msg -match '(?:Backflow|Forward flow) from .+ / ([a-fA-F0-9]+)') {
            $branchVmrCommit = $Matches[1]
            # Keep scanning — we want the most recent (last in original order = first in reversed)
            break
        }
    }
}

# Fallback: if no VMR SHA found in commit messages, check eng/Version.Details.xml on the PR branch
# This catches manual backflow (e.g., `darc vmr backflow` pushed directly) which updates
# the <Source> element but doesn't use a parseable commit message format
$versionDetailsVmrCommit = $null
if (-not $branchVmrCommit -and -not $isForwardFlow) {
    $vdContent = Invoke-GitHubApi "/repos/$Repository/contents/eng/Version.Details.xml?ref=$($pr.headRefName)" -Raw
    if ($vdContent -and $vdContent -match '<Source\s+[^>]*Sha="([a-fA-F0-9]+)"') {
        $versionDetailsVmrCommit = $Matches[1]
        if ($vmrCommit -and -not ($vmrCommit.StartsWith($versionDetailsVmrCommit) -or $versionDetailsVmrCommit.StartsWith($vmrCommit))) {
            $branchVmrCommit = $versionDetailsVmrCommit
        }
    }
}

if ($branchVmrCommit -or $vmrCommit) {
    Write-Section "Snapshot Validation"
    $usedBranchSnapshot = $false
    if ($branchVmrCommit -and $vmrCommit) {
        $bodyShort = Get-ShortSha $vmrCommit
        $branchShort = Get-ShortSha $branchVmrCommit
        $snapshotSourceLabel = if ($versionDetailsVmrCommit -and $branchVmrCommit -eq $versionDetailsVmrCommit) { "Version.Details.xml" } else { "branch commit" }
        if ($vmrCommit.StartsWith($branchVmrCommit) -or $branchVmrCommit.StartsWith($vmrCommit)) {
            Write-Host "  ✅ PR body snapshot ($bodyShort) matches $snapshotSourceLabel ($branchShort)" -ForegroundColor Green
        }
        else {
            Write-Host "  ⚠️  MISMATCH: PR body claims $bodyShort but $snapshotSourceLabel references $branchShort" -ForegroundColor Red
            Write-Host "  The PR body may be stale — using $snapshotSourceLabel ($branchShort) for freshness check" -ForegroundColor Yellow
            # Resolve the SHA to a full SHA for accurate comparison
            $resolvedCommit = Invoke-GitHubApi "/repos/$freshnessRepo/commits/$branchVmrCommit"
            if ($resolvedCommit) {
                $vmrCommit = $resolvedCommit.sha

Review comment (security):
`ref=$($pr.headRefName)` should be URL-encoded (branch names can contain `/` and other characters). This script already uses `EscapeDataString` for other `?ref=` calls (e.g. source-manifest.json); doing the same here avoids intermittent 404s on branches with special characters.
```suggestion
    $vdContent = Invoke-GitHubApi "/repos/$Repository/contents/eng/Version.Details.xml?ref=$([System.Uri]::EscapeDataString($pr.headRefName))" -Raw
```

Code after:
}
elseif ($isBackflow) {
    Write-Status "Flow" "Backflow (dotnet/dotnet → $Repository)" "Cyan"
}

# --- Step 2: Parse PR body metadata ---
Write-Section "Codeflow Metadata"

$body = $pr.body

# Extract subscription ID
$subscriptionId = $null
if ($body -match '\(Begin:([a-f0-9-]+)\)') {
    $subscriptionId = $Matches[1]
    Write-Status "Subscription" $subscriptionId
}

# Extract source commit (VMR commit for backflow, repo commit for forward flow)
$sourceCommit = $null
if ($body -match '\*\*Commit\*\*:\s*\[([a-fA-F0-9]+)\]') {
    $sourceCommit = $Matches[1]
    $commitLabel = if ($isForwardFlow) { "Source Commit" } else { "VMR Commit" }
    Write-Status $commitLabel $sourceCommit
}
# Keep $vmrCommit alias for backflow compatibility
$vmrCommit = $sourceCommit

# Extract build info
if ($body -match '\*\*Build\*\*:\s*\[([^\]]+)\]\(([^\)]+)\)') {
    Write-Status "Build" "$($Matches[1])"
    Write-Status "Build URL" $Matches[2]
}

# Extract date produced
if ($body -match '\*\*Date Produced\*\*:\s*(.+)') {
    Write-Status "Date Produced" $Matches[1].Trim()
}

# Extract source branch
$vmrBranch = $null
if ($body -match '\*\*Branch\*\*:\s*\[([^\]]+)\]') {
    $vmrBranch = $Matches[1]
    $branchLabel = if ($isForwardFlow) { "Source Branch" } else { "VMR Branch" }
    Write-Status $branchLabel $vmrBranch
}

# Extract commit diff
if ($body -match '\*\*Commit Diff\*\*:\s*\[([^\]]+)\]\(([^\)]+)\)') {
    Write-Status "Commit Diff" $Matches[1]
}