[SIkebe]

Summary

• Fix the scheduled APM Dependency Update failure. APM CLI 0.35.0 removed tracked skill files during a cold frozen install, then skipped redeployment because the runner had no local deployment baseline. The subsequent audit failed with missing files and drift.
• Pin apm-cli==0.34.0 in tools/apm/requirements.txt and install it into an isolated runner-temporary Python virtual environment instead of downloading the latest CLI.
• Enable daily Dependabot pip updates for /tools/apm, excluding only the known-broken 0.35.0 release. Preserve the upstream regression reference in the requirements comment and document the shared pin location for contributors.

Related Issues

N/A - no issue to close.

Upstream regression: microsoft/apm#3372.

Scope

• App UI / workflow
• Core services / data model
• Copilot SDK / agent behavior
• Preview / WebView2
• Documentation / release readiness
• Tests / tooling
• Other: APM CLI dependency management and scheduled automation

Validation

• N/A - dotnet build RepoSyncRadar.sln -warnaserror not run; changes affect tooling configuration only, not application code.
• N/A - dotnet test RepoSyncRadar.sln -- --filter-not-trait Category=Manual not run; changes affect tooling configuration only, not application code.
• Focused tests: python -c "import yaml; [yaml.safe_load(open(p, encoding='utf-8')) for p in ('.github/dependabot.yml', '.github/workflows/apm-update.yml')]; print('YAML syntax OK')" passed; git diff --check passed; gh actions-lock passed; gh actions-lock --verify passed (all 6 workflows valid, lockfile unchanged).
• N/A - Manual smoke / screenshots: no UI/WebView changes.

Additional validation limits:

• ghalint run could not run because ghalint and Go are not installed locally.
• An isolated pip install --requirement tools/apm/requirements.txt attempt failed because the configured package feed returned HTTP 404. Retrying against public PyPI failed with a TLS handshake error to files.pythonhosted.org. The package metadata confirms that 0.34.0 exists, but CLI startup and the Linux cold-install/audit flow were not executed locally.

Risk And Rollback

• User impact: No application runtime changes; restores reproducible APM skill-update automation.
• Operational risk: The workflow now depends on the hosted runner's Python venv support and PyPI connectivity. Version 0.35.0 is intentionally excluded until the upstream cold-install regression is resolved; future versions remain eligible for Dependabot updates.
• Rollback plan: Revert this PR to restore the previous installer and dependency-update configuration.

Release Notes

• User-facing change
• Internal-only change
• No release note needed

Release note draft:

Pin the APM CLI to a working release and manage future CLI updates through Dependabot instead of consuming unreviewed latest releases.

[Copilot]

🔵 Needs a closer look

No concrete defects were identified, but CLI installation and the Linux cold-install/audit flow remain unvalidated.

No open issues 🎉

What changed in this PR

This PR makes APM skill-update automation use a pinned CLI version to avoid the reported cold-install regression, while managing future updates through Dependabot.

Changes:

• Pin apm-cli to 0.34.0 and install it in an isolated runner-temporary Python virtual environment.
• Enable daily Dependabot pip updates, excluding the known-broken 0.35.0 release.
• Document the shared CLI pin and upstream regression reference.

File	Description
tools/​apm/​requirements.txt	Pins the CLI version and references the upstream regression.
.github/​workflows/​apm-update.yml	Replaces the latest-version installer with installation from requirements in a virtual environment.
.github/​dependabot.yml	Adds daily pip updates with a 0.35.0 exclusion.
.github/​copilot-instructions.md	Documents the shared pin and workflow installation requirement.

_{Review effort: Balanced}