Configure Dependabot for WTA Rust dependencies

[vanzue]

Summary of the Pull Request

Enables weekly Dependabot version updates for WTA's Rust dependencies while keeping Microsoft's internal Rust toolchain isolated to Azure DevOps builds.

References and Relevant Issues

Tracks #521.

Detailed Description of the Pull Request / Additional comments

• Checks Cargo dependencies under /tools/wta every Monday at 09:00 Asia/Shanghai.
• Groups routine minor and patch updates to reduce PR noise.
• Keeps agent-client-protocol* updates in dedicated PRs for focused ACP compatibility review.
• Uses the public Rust 1.93 channel for local development and GitHub automation.
• Keeps ADO fetch, build, and test steps on the matching internal ms-prod-1.93 toolchain.
• Documents the required WTA third-party notice regeneration step.
• Adds the wta-rust-dependency-update skill to regenerate and verify attribution when completing WTA Cargo or Dependabot PRs.

After merge, maintainers can trigger an update from Insights → Dependency graph → Dependabot → Check for updates.

Validation Steps Performed

• Validated .github/dependabot.yml and the ADO pipeline with yaml-lint.
• Added and exercised the offline Generate-WtaThirdPartyNotices.ps1 -Verify check against all 276 runtime crates.
• Confirmed normal third-party notice generation remains byte-stable.
• Resolved Cargo metadata using the public Rust 1.93 toolchain.
• Reproduced the original ms-prod-1.93 failure in the personal fork.
• Confirmed the fix by manually triggering Dependabot, which created five update PRs, including the grouped minor/patch update and the dedicated ACP update.

PR Checklist

• Closes #xxx
• Tests added/passed (configuration and toolchain validation)
• Documentation updated
• Schema updated (not necessary)

[Copilot]

🟢 Ready to approve

The Dependabot configuration is syntactically valid, scoped to /tools/wta, and the documented notice-regeneration script path exists in the repo.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Adds a GitHub Dependabot configuration to automate dependency update PRs for the WTA Rust (Cargo) workspace under tools/wta, with grouping rules to reduce PR noise while isolating agent-client-protocol* updates for focused review.

Changes:

• Configured weekly Dependabot checks for Cargo dependencies in /tools/wta (Monday 09:00 Asia/Shanghai).
• Grouped routine minor/patch version updates while excluding agent-client-protocol* from that group.
• Documented the follow-up step to regenerate third-party notices after accepting dependency updates.

File summaries

File	Description
.github/dependabot.yml	Adds Dependabot v2 config for Cargo updates in tools/wta, including grouping and notice-regeneration guidance.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Low

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

🟢 Ready to approve

The changes are cohesive configuration/documentation updates with consistent toolchain handling across local and Azure DevOps builds.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

🟡 Not ready to approve

The new -Verify path is described as offline-friendly, but it still runs cargo metadata without an offline/locked mode, which may undermine the intended “offline” CI verification behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Suppressed comments (1)

build/scripts/Generate-WtaThirdPartyNotices.ps1:145

• -Verify is described (in the PR description) as an offline verification path, but the script still unconditionally runs cargo metadata before entering the if ($Verify) block and does not use --offline/--locked (or CARGO_NET_OFFLINE). This can make the CI verification step dependent on network/index freshness even though it’s intended to be offline-friendly after cargo fetch.

if ($Verify) {
    $expected = @($attributed | ForEach-Object { "$($_.name)@$($_.version)" } | Sort-Object)

    $cgManifest = Get-Content -Raw $cgManifestPath | ConvertFrom-Json -Depth 20
    $actualCg = @(
        $cgManifest.Registrations |
            ForEach-Object { "$($_.component.cargo.name)@$($_.component.cargo.version)" } |

• Files reviewed: 14/14 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

🟡 Not ready to approve

The new/updated guidance around pinned toolchain usage is inconsistent in a couple of places and could lead to running attribution/verification under an unintended toolchain.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Suppressed comments (2)

build/scripts/Generate-WtaThirdPartyNotices.ps1:40

• The .NOTES section says this script uses the public toolchain pinned in tools/wta/rust-toolchain.toml, but the script invokes cargo from the current working directory (typically repo root), so rustup will not discover that pin unless the caller runs from tools/wta or sets RUSTUP_TOOLCHAIN. As written, the guidance is easy to misread and can lead to generating/validating attribution with an unintended toolchain.

    Requires `cargo` on PATH. The repo pins a public Rust version in
    tools/wta/rust-toolchain.toml. Set `$env:RUSTUP_TOOLCHAIN = 'stable'`
    before invoking the script only when intentionally overriding that pin.

.github/skills/wta-rust-dependency-update/SKILL.md:25

• This skill’s prerequisites say to run commands from the repository root, but this PR’s toolchain guidance elsewhere requires running Rust/rustup operations from tools/wta so rustup discovers tools/wta/rust-toolchain.toml. The current prerequisite can cause contributors to run the workflow under an unpinned toolchain.

- Run commands from the repository root.

• Files reviewed: 15/15 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

🟡 Not ready to approve

The quick-start documentation still contains an inconsistent build invocation that can mislead contributors about how to ensure the pinned Rust toolchain is actually used.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Suppressed comments (1)

doc/quick-start-local-dev.md:32

• The quick-start still says to build WTA using --manifest-path, but the surrounding guidance now emphasizes running Cargo from tools/wta so rustup picks up the pinned toolchain. This section should be rewritten to avoid suggesting an invocation that bypasses toolchain discovery.

   Push-Location tools/wta
   cargo build --target x86_64-pc-windows-msvc
   Pop-Location

• Files reviewed: 15/15 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

🟡 Not ready to approve

The ADO pipeline verification step uses $Matches.version after -notmatch, which can yield an incorrect/empty match and break CI even when the toolchain pin is valid.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Suppressed comments (1)

build/pipelines/templates-v2/job-build-project.yml:219

• In this pipeline check, $Matches.version is used after -notmatch. In PowerShell, -notmatch is not guaranteed to populate $Matches, so $expectedInternalChannel may be computed from stale/empty data and the job can fail even when rust-toolchain.toml is correct. Use -match (or an explicit [regex]::Match) to capture the version reliably before using it.

      $toolchainFile = Get-Content -Raw tools/wta/rust-toolchain.toml
      if ($toolchainFile -notmatch '(?m)^\s*channel\s*=\s*"(?<version>\d+\.\d+)"\s*$') {
        throw 'tools/wta/rust-toolchain.toml must pin a public major.minor Rust channel.'
      }
      $expectedInternalChannel = "ms-prod-$($Matches.version)"

• Files reviewed: 15/16 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.