chore: Down merging to dev #411
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request introduces several improvements to the deployment workflows and Docker setup, focusing on enhanced input validation, security, and workflow reliability. The most significant changes are the addition of a comprehensive input validation job for the Linux deployment workflow, updates to workflow permissions for improved security, and refinements to job conditionals to better handle workflow cancellations and job dependencies.
Workflow Input Validation and Orchestration:
validate-inputsjob to.github/workflows/deploy-linux.ymlthat validates all workflow input parameters (such as Azure region, resource group name, booleans, and resource IDs) before proceeding with deployment, ensuring only valid values are used and failing early on errors. Downstream jobs now consume validated outputs instead of raw inputs.Security and Permissions:
permissionsfor GitHub Actions workflows (build-docker-image.yml,deploy-linux.yml,deploy-orchestrator.yml) to restrict access to onlycontents: readandactions: read, improving workflow security posture. [1] [2] [3]Workflow Reliability and Job Conditionals:
deploy-orchestrator.ymlto use!cancelled()and more precise success/skipped checks, ensuring jobs only run when appropriate and are skipped on workflow cancellation, improving reliability and correctness of deployments, tests, notifications, and cleanup. [1] [2] [3] [4]Dockerfile Maintenance:
.devcontainer/Dockerfileto avoid GPG key expiration issues, streamlining the container build process.## PurposeDoes this introduce a breaking change?
Golden Path Validation
Deployment Validation
What to Check
Verify that the following are valid
Other Information