Skip to content

Conversation

@Prekshith-Microsoft
Copy link
Contributor

This pull request introduces several improvements to the deployment workflows and Docker setup, focusing on enhanced input validation, security, and workflow reliability. The most significant changes are the addition of a comprehensive input validation job for the Linux deployment workflow, updates to workflow permissions for improved security, and refinements to job conditionals to better handle workflow cancellations and job dependencies.

Workflow Input Validation and Orchestration:

  • Added a new validate-inputs job to .github/workflows/deploy-linux.yml that validates all workflow input parameters (such as Azure region, resource group name, booleans, and resource IDs) before proceeding with deployment, ensuring only valid values are used and failing early on errors. Downstream jobs now consume validated outputs instead of raw inputs.

Security and Permissions:

  • Explicitly set permissions for GitHub Actions workflows (build-docker-image.yml, deploy-linux.yml, deploy-orchestrator.yml) to restrict access to only contents: read and actions: read, improving workflow security posture. [1] [2] [3]

Workflow Reliability and Job Conditionals:

  • Updated job conditionals in deploy-orchestrator.yml to use !cancelled() and more precise success/skipped checks, ensuring jobs only run when appropriate and are skipped on workflow cancellation, improving reliability and correctness of deployments, tests, notifications, and cleanup. [1] [2] [3] [4]

Dockerfile Maintenance:

  • Removed the Yarn repository from .devcontainer/Dockerfile to avoid GPG key expiration issues, streamlining the container build process.## Purpose
  • ...

Does this introduce a breaking change?

  • Yes
  • No

Golden Path Validation

  • I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

  • I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

  • ...

Other Information

@Prajwal-Microsoft Prajwal-Microsoft merged commit 586b608 into dev Jan 28, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants