apply-updates.yml

# AZLOCAL-PIPELINE-ID: apply-updates
# Apply Updates to Azure Local Clusters
# This workflow applies updates to clusters filtered by UpdateRing tag value
#
# AUTHENTICATION OPTIONS:
# This workflow supports two authentication methods:
# 1. OpenID Connect (OIDC) - RECOMMENDED - No secrets, uses federated credentials
# 2. Client Secret - LEGACY - Requires AZURE_CLIENT_SECRET (see commented section)
#
# For OIDC setup, see: https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure-openid-connect

# Workflow name carries the same Step.N - prefix as the filename so the GitHub
# Actions sidebar (which sorts workflows alphabetically by this `name:` field)
# lists the eight pipelines in execution order.
name: Step.07 - Apply Updates

on:
  # PREFERRED PATTERN - drive automated update runs from a ring-aware
  # schedule file (config/apply-updates-schedule.yml by default),
  # not from per-window crons.
  #
  # How it works:
  #   1. The resolver step in check-readiness reads apply-updates-schedule.yml,
  #      computes the current (cycleWeek, dayOfWeek) tuple in UTC, and returns
  #      the eligible UpdateRing tag value(s) for THIS firing.
  #   2. If no schedule row matches today, the resolver logs the reason and
  #      check-readiness sets ready_count=0 - apply-updates is skipped cleanly
  #      (exit 0, no errors).
  #   3. If the schedule file is MISSING and the trigger is `schedule:` (not
  #      workflow_dispatch), the resolver hard-fails with a remediation pointing
  #      at New-AzLocalApplyUpdatesScheduleConfig.
  #
  # Generate a STRAWMAN schedule file from your fleet via:
  #   New-AzLocalApplyUpdatesScheduleConfig -OutputPath .\config\apply-updates-schedule.yml
  # Every row is commented out by default - review and uncomment to activate.
  #
  # Recommended cron: once per day at a low-traffic time (the resolver is
  # day-grain; firing more often is wasteful but harmless thanks to readiness
  # idempotency). Example - 06:00 UTC every day:
  #   schedule:
  #     - cron: '0 6 * * *'
  #
  # The legacy per-UpdateStartWindow cron pattern still works (one cron per window),
  # but ring resolution then defaults to the workflow_dispatch input default,
  # which is rarely what schedule-triggered runs actually want.
  #
  # Add your schedule: cron block between the BEGIN/END markers below. That
  # region (and ONLY that region) is preserved verbatim by
  # Update-AzLocalPipelineExample across module upgrades - keep author guidance
  # like the paths above OUTSIDE the markers so module refreshes can correct it.
  # BEGIN-AZLOCAL-CUSTOMIZE:schedule-triggers
  # (No schedule by default - this pipeline is workflow_dispatch-only until you
  #  add a schedule: block here. See the guidance comments above.)
  # END-AZLOCAL-CUSTOMIZE:schedule-triggers

  workflow_dispatch:
    inputs:
      update_ring:
        # accepts a single ring (Wave1), a semicolon-delimited list (Prod;Ring2),
        # or '***' (three stars - deliberate, not a typo) to match every cluster that HAS the UpdateRing tag set.
        # v0.8.5: no longer required - leave empty AND set use_schedule_file=true to resolve from apply-updates-schedule.yml instead.
        description: "UpdateRing tag value (e.g. 'Wave1', 'Prod;Ring2', or '***' for ALL clusters). Ignored when use_schedule_file=true."
        required: false
        default: 'Wave1'
      # v0.8.5 - manual override that runs the ring/AllowedUpdateVersions resolver
      # against apply-updates-schedule.yml exactly as a scheduled firing would.
      # Use this to (a) test a schedule change before the next cron tick, (b) re-run
      # a missed scheduled day, or (c) preview a future cycleWeek/dayOfWeek via the
      # resolve_for_date_utc input below.
      use_schedule_file:
        description: 'Resolve UpdateRing & AllowedUpdateVersions from apply-updates-schedule.yml (as a scheduled run would). Overrides update_ring.'
        required: false
        default: 'false'
        type: choice
        options:
          - 'false'
          - 'true'
      resolve_for_date_utc:
        description: "Only used when use_schedule_file=true. Date (UTC, YYYY-MM-DD) to resolve the schedule for. Empty = today UTC. Useful for previewing a future cycleWeek/dayOfWeek."
        required: false
        default: ''
      update_name:
        description: 'Specific update version to apply (leave empty for latest ready update)'
        required: false
        default: ''
      dry_run:
        description: 'Preview which clusters would be updated (WhatIf mode)'
        required: false
        default: 'false'
        type: choice
        options:
          - 'false'
          - 'true'
      # --- ITSM Connector (ServiceNow) ---
      # Set raise_itsm_ticket=true to open ServiceNow incidents for clusters whose
      # Status matches an entry in the trigger matrix (default config:
      # ./.itsm/azurelocal-itsm.yml). Requires the secrets listed in the env: block
      # of the 'Raise ITSM tickets' step below. Leave false to keep the existing
      # update workflow behaviour unchanged.
      raise_itsm_ticket:
        description: 'Open ITSM tickets (ServiceNow) for clusters needing manual action'
        required: false
        default: 'false'
        type: choice
        options:
          - 'false'
          - 'true'
      itsm_config_path:
        description: 'Path to ITSM matrix config (YAML or JSON)'
        required: false
        default: './.itsm/azurelocal-itsm.yml'
      itsm_dry_run:
        description: 'ITSM: build payloads + run read-only dedupe but do NOT create tickets'
        required: false
        default: 'false'
        type: choice
        options:
          - 'false'
          - 'true'
      itsm_force_create:
        description: 'ITSM: bypass dedupe and always create new tickets (use with caution)'
        required: false
        default: 'false'
        type: choice
        options:
          - 'false'
          - 'true'
      module_version:
        description: 'Pin AzLocal.UpdateManagement version (empty = latest from PSGallery). See Automation-Pipeline-Examples/README.md section 5 "Optional configuration".'
        required: false
        default: ''

env:
  # Module version this workflow YAML was generated against. The install step compares
  # this to the version actually installed and to the latest on PSGallery, and emits a
  # ::notice annotation if the YAML appears stale - prompting you to refresh via
  # Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
  GENERATED_AGAINST_MODULE_VERSION: '0.8.77'
  # Resolution order for the module version pin (leave all unset to install the latest,
  # which is the default "fix-forward" behaviour): manual workflow_dispatch input >
  # repository variable 'REQUIRED_MODULE_VERSION' > empty (latest).
  REQUIRED_MODULE_VERSION: ${{ github.event.inputs.module_version || vars.REQUIRED_MODULE_VERSION || '' }}
  # Path to the ring-aware apply-updates-schedule.yml (relative to repo
  # root). The resolver step in check-readiness reads this file when the trigger
  # is `schedule:`. Override via repository variable APPLY_UPDATES_SCHEDULE_PATH
  # if you keep the schedule outside `.github/`.
  APPLY_UPDATES_SCHEDULE_PATH: ${{ vars.APPLY_UPDATES_SCHEDULE_PATH || './config/apply-updates-schedule.yml' }}
  # v0.8.4 - opt this workflow into Node.js 24 for all JavaScript actions
  # (actions/checkout, actions/download-artifact, actions/upload-artifact,
  # azure/login, dorny/test-reporter, etc). Per GitHub's 2025-09-19 deprecation
  # notice, Node 20 is forced off by default on 2026-06-16 and removed from
  # the runner on 2026-09-16. Setting this env var now silences the deprecation
  # warnings and exercises Node 24 ahead of the cut-over. To temporarily opt
  # back out after the cut-over, set ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true.
  # See https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

# prevent overlapping apply-updates runs from racing on the same
# fleet. cancel-in-progress=false means a newly-triggered run queues behind an
# in-flight one instead of cancelling it (cancellation mid-apply could leave
# a cluster in a half-updated state).
concurrency:
  group: apply-updates-${{ github.workflow }}
  cancel-in-progress: false

jobs:
  # Optional: Add a readiness check job first
  check-readiness:
    name: Check Update Readiness
    runs-on: windows-latest
    # Required for OIDC authentication and dorny/test-reporter (Check Run publishing)
    permissions:
      id-token: write
      contents: read
      checks: write
    outputs:
      ready_count: ${{ steps.readiness.outputs.READY_COUNT }}
      total_count: ${{ steps.readiness.outputs.TOTAL_COUNT }}
      # v0.8.74: Up-to-Date vs Not-Ready breakdown so the No Clusters Ready
      # job can explain WHY there is nothing to apply (already-patched clusters
      # are a healthy steady state, not a failure).
      up_to_date_count: ${{ steps.readiness.outputs.UP_TO_DATE_COUNT }}
      not_ready_count: ${{ steps.readiness.outputs.NOT_READY_COUNT }}
      # surface the timestamped readiness-artifact name so the downstream
      # apply-updates job can download it (cross-job step outputs are not visible -
      # everything passed to the next job has to go through the job 'outputs' map).
      readiness_artifact: azlocal-step.7-apply-updates-readiness-report_${{ steps.artifact-stamp.outputs.timestamp }}
      # the ring(s) the schedule resolver picked for this firing.
      # Empty when the trigger was workflow_dispatch (downstream falls back to
      # the manual `update_ring` input). When the trigger was `schedule:`, this
      # is a ';'-joined UpdateRing value ready for -UpdateRingValue.
      resolved_update_ring: ${{ steps.resolve-ring.outputs.RESOLVED_UPDATE_RING }}
      # v0.7.90: ';'-joined allow-list of update names / version strings
      # resolved from the schema-v2 'allowedUpdateVersions' field of
      # apply-updates-schedule.yml (top-level OR per matched-row, with per-row
      # winning). Empty string when the trigger was workflow_dispatch OR
      # when no allow-list is configured anywhere in the schedule. Downstream
      # apply step passes this via -AllowedUpdateVersions; when empty, the
      # cmdlet falls back to its default "install latest Ready update".
      resolved_allowed_update_versions: ${{ steps.resolve-ring.outputs.RESOLVED_ALLOWED_UPDATE_VERSIONS }}

    steps:
    - name: Checkout repository
      uses: actions/checkout@v5

    # OPTION 1: OpenID Connect (OIDC) - RECOMMENDED
    # No client secret required - uses federated credentials
    - name: Azure CLI Login (OIDC)
      uses: azure/login@v3
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID }}
        tenant-id: ${{ vars.AZURE_TENANT_ID }}
        # AZURE_SUBSCRIPTION_ID is a repository *Variable* (vars.*), not a Secret. It
        # is consumed ONLY here: azure/login@v3 runs `az account set --subscription
        # <id>` after the OIDC token exchange so the runner has a default
        # `az account` context. It is NOT used to scope Azure Resource Graph queries
        # (those run fleet-wide across every subscription the federated identity can
        # read) and is NOT interpolated into Azure portal deep-link URLs (those use
        # the per-row `subscriptionId` returned by ARG).
        # Set it via: gh variable set AZURE_SUBSCRIPTION_ID --body <subId>
        subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

    # OPTION 2: Client Secret - LEGACY (uncomment if OIDC not available)
    # - name: Azure CLI Login (Client Secret)
    #   uses: azure/login@v3
    #   with:
    #     creds: '{"clientId":"${{ secrets.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ vars.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ vars.AZURE_TENANT_ID }}"}'

    - name: Install Azure CLI Resource Graph Extension
      shell: pwsh
      run: |
        az extension add --name resource-graph --yes

    # v0.8.5 thin-YAML - install + drift detection + version banner via shared helper.
    - name: Install AzLocal.UpdateManagement from PSGallery
      shell: pwsh
      id: module-version
      run: |
        $ErrorActionPreference = 'Stop'
        $installArgs = @{ Name = 'AzLocal.UpdateManagement'; Scope = 'CurrentUser'; Force = $true; AllowClobber = $true }
        if ($env:REQUIRED_MODULE_VERSION) { $installArgs.RequiredVersion = $env:REQUIRED_MODULE_VERSION }
        Install-Module @installArgs
        Import-Module AzLocal.UpdateManagement -Force
        Add-AzLocalPipelineVersionBanner -GeneratedAgainstVersion $env:GENERATED_AGAINST_MODULE_VERSION

    # v0.8.5 thin-YAML - Resolve UpdateRing (+ AllowedUpdateVersions) from
    # schedule file (or pass manual input through verbatim).
    - name: Resolve UpdateRing from schedule
      id: resolve-ring
      shell: pwsh
      env:
        INPUT_UPDATE_RING: ${{ github.event.inputs.update_ring }}
        USE_SCHEDULE_FILE: ${{ github.event.inputs.use_schedule_file }}
        RESOLVE_FOR_DATE_UTC: ${{ github.event.inputs.resolve_for_date_utc }}
      run: |
        Import-Module AzLocal.UpdateManagement -Force
        $params = @{ ManualUpdateRing = $env:INPUT_UPDATE_RING; ResolveForDateUtc = $env:RESOLVE_FOR_DATE_UTC }
        if ($env:USE_SCHEDULE_FILE -eq 'true') { $params['UseScheduleFile'] = $true }
        Resolve-AzLocalPipelineUpdateRing @params

    # v0.8.5 thin-YAML - readiness gate query + step outputs + per-cluster
    # markdown summary.
    - name: Check Cluster Readiness
      shell: pwsh
      id: readiness
      env:
        INPUT_UPDATE_RING: ${{ steps.resolve-ring.outputs.RESOLVED_UPDATE_RING }}
      run: |
        Import-Module AzLocal.UpdateManagement -Force
        Export-AzLocalClusterReadinessGateReport -UpdateRing $env:INPUT_UPDATE_RING -OutputDirectory './artifacts'

    - name: Compute Artifact Timestamp
      if: always()
      id: artifact-stamp
      shell: pwsh
      # every downloadable artifact gets a UTC timestamp suffix so multiple runs on
      # the same day produce distinct zip names.
      run: |
        $stamp = (Get-Date).ToUniversalTime().ToString('yyyyMMdd_HHmmss')
        "timestamp=$stamp" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
        Write-Host "Artifact timestamp: $stamp"

    - name: Upload Readiness Report
      uses: actions/upload-artifact@v6
      with:
        name: azlocal-step.7-apply-updates-readiness-report_${{ steps.artifact-stamp.outputs.timestamp }}
        path: ./artifacts/readiness-report.csv
        retention-days: 30

  # Main job to apply updates
  apply-updates:
    name: Apply Updates
    runs-on: windows-latest
    # Required for OIDC authentication and dorny/test-reporter (Check Run publishing)
    permissions:
      id-token: write
      contents: read
      checks: write
    needs: check-readiness
    # Only run if there are clusters ready for update
    if: ${{ needs.check-readiness.outputs.ready_count > 0 }}

    steps:
    - name: Checkout repository
      uses: actions/checkout@v5

    # OPTION 1: OpenID Connect (OIDC) - RECOMMENDED
    - name: Azure CLI Login (OIDC)
      uses: azure/login@v3
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID }}
        tenant-id: ${{ vars.AZURE_TENANT_ID }}
        # AZURE_SUBSCRIPTION_ID is a repository *Variable* (vars.*), not a Secret. It
        # is consumed ONLY here: azure/login@v3 runs `az account set --subscription
        # <id>` after the OIDC token exchange so the runner has a default
        # `az account` context. It is NOT used to scope Azure Resource Graph queries
        # (those run fleet-wide across every subscription the federated identity can
        # read) and is NOT interpolated into Azure portal deep-link URLs (those use
        # the per-row `subscriptionId` returned by ARG).
        # Set it via: gh variable set AZURE_SUBSCRIPTION_ID --body <subId>
        subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

    # OPTION 2: Client Secret - LEGACY (uncomment if OIDC not available)
    # - name: Azure CLI Login (Client Secret)
    #   uses: azure/login@v3
    #   with:
    #     creds: '{"clientId":"${{ secrets.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ vars.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ vars.AZURE_TENANT_ID }}"}'

    - name: Install Azure CLI Resource Graph Extension
      shell: pwsh
      run: |
        az extension add --name resource-graph --yes

    # v0.8.5 thin-YAML - apply-updates job re-installs the module (each runs-on
    # is a fresh runner). Version-banner upload is deliberately skipped on this
    # second install (already emitted by check-readiness) to avoid duplicating
    # the banner in the rendered run summary.
    - name: Install AzLocal.UpdateManagement from PSGallery
      shell: pwsh
      run: |
        $ErrorActionPreference = 'Stop'
        $installArgs = @{ Name = 'AzLocal.UpdateManagement'; Scope = 'CurrentUser'; Force = $true; AllowClobber = $true }
        if ($env:REQUIRED_MODULE_VERSION) { $installArgs.RequiredVersion = $env:REQUIRED_MODULE_VERSION }
        Install-Module @installArgs
        Import-Module AzLocal.UpdateManagement -Force
        $installed = (Get-Module AzLocal.UpdateManagement | Sort-Object Version -Descending | Select-Object -First 1).Version
        Write-Host "Installed AzLocal.UpdateManagement v$installed on apply-updates job runner."

    # Consume the readiness CSV produced by check-readiness instead of
    # re-discovering clusters by tag. Apply Updates now operates ONLY on the
    # clusters that the readiness gate marked ReadyForUpdate=True (gated by
    # ClusterState=ConnectedRecently, no [Critical] health failures, etc.).
    # Apply still re-validates each cluster (Step 1b connectivity, Step 3b
    # health, Step 3c schedule, Step 3b1 sideloaded) as defence in depth in
    # case state drifts between the two jobs.
    - name: Download Readiness Report
      uses: actions/download-artifact@v6
      with:
        # artifact name now carries a UTC timestamp - resolve via the
        # upstream job's outputs.readiness_artifact so re-runs on the same day
        # don't collide.
        name: ${{ needs.check-readiness.outputs.readiness_artifact }}
        path: ./artifacts

    # v0.8.5 thin-YAML - readiness-gated apply: validates CSV, fans out to
    # Start-AzLocalClusterUpdate, emits 7 step outputs, writes apply-results.json.
    - name: Apply Updates
      shell: pwsh
      id: apply-updates
      env:
        # resolved by check-readiness's resolve-ring step. For
        # workflow_dispatch this passes the operator's manual input through
        # verbatim; for schedule:cron firings it is the ring(s) the resolver
        # picked from apply-updates-schedule.yml.
        INPUT_UPDATE_RING: ${{ needs.check-readiness.outputs.resolved_update_ring }}
        INPUT_UPDATE_NAME: ${{ github.event.inputs.update_name }}
        INPUT_DRY_RUN: ${{ github.event.inputs.dry_run }}
        # v0.7.90: ';'-joined allow-list resolved from apply-updates-schedule.yml
        # 'allowedUpdateVersions' (schema v2). Empty for workflow_dispatch or
        # when no allow-list is configured - in either case the cmdlet falls
        # back to "install latest Ready update" (or to -UpdateName when set).
        INPUT_ALLOWED_UPDATE_VERSIONS: ${{ needs.check-readiness.outputs.resolved_allowed_update_versions }}
      run: |
        Import-Module AzLocal.UpdateManagement -Force
        $params = @{
            ReadinessCsvPath      = './artifacts/readiness-report.csv'
            UpdateRing            = $env:INPUT_UPDATE_RING
            UpdateName            = $env:INPUT_UPDATE_NAME
            AllowedUpdateVersions = $env:INPUT_ALLOWED_UPDATE_VERSIONS
            OutputDirectory       = './artifacts'
        }
        if ($env:INPUT_DRY_RUN -eq 'true') { $params['DryRun'] = $true }
        Invoke-AzLocalReadinessGatedClusterUpdate @params

    - name: Compute Artifact Timestamp
      if: always()
      id: artifact-stamp
      shell: pwsh
      # every downloadable artifact gets a UTC timestamp suffix so multiple runs on
      # the same day produce distinct zip names. Both update-logs and itsm-results use this stamp.
      run: |
        $stamp = (Get-Date).ToUniversalTime().ToString('yyyyMMdd_HHmmss')
        "timestamp=$stamp" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
        Write-Host "Artifact timestamp: $stamp"

    - name: Upload Update Logs
      uses: actions/upload-artifact@v6
      with:
        name: azlocal-step.7-apply-updates-logs_${{ steps.artifact-stamp.outputs.timestamp }}
        path: ./artifacts/*
        retention-days: 30

    - name: Publish JUnit Diagnostic Results
      uses: dorny/test-reporter@v3
      if: always()
      with:
        name: '[JUnit Debug] Azure Local Update Results'
        path: ./artifacts/update-results.xml
        reporter: java-junit
        list-suites: failed
        list-tests: failed
      continue-on-error: true

    # ----------------------------------------------------------------------
    # ITSM Connector (ServiceNow)
    #
    # This block is fully opt-in (gated on inputs.raise_itsm_ticket == 'true').
    # It runs AFTER the update results are published so a) failing clusters are
    # already surfaced via test reporting, and b) the ITSM action is a strict
    # additive step that never affects the apply-updates exit status.
    #
    # Secrets are mapped explicitly into the step's `env:` block so the module
    # picks them up via env:// references in the config file. Do NOT pass them
    # on the PowerShell command line - that pollutes process listings and CI logs.
    # ----------------------------------------------------------------------
    - name: Install powershell-yaml (ITSM config parser)
      if: ${{ github.event.inputs.raise_itsm_ticket == 'true' }}
      shell: pwsh
      run: |
        if (-not (Get-Module -ListAvailable -Name powershell-yaml)) {
            Install-Module powershell-yaml -Scope CurrentUser -Force -AllowClobber
        }

    # v0.8.5 thin-YAML - ITSM ticketing via Invoke-AzLocalItsmTicketingFromArtifact.
    # Wrapper auto-populates RunMetadata from GitHub env vars.
    - name: Raise ITSM tickets
      if: ${{ github.event.inputs.raise_itsm_ticket == 'true' }}
      shell: pwsh
      id: itsm
      env:
        # BEGIN-AZLOCAL-CUSTOMIZE:itsm-secrets
        # Bind your ITSM connector secrets here. Defaults below assume the
        # ServiceNow OAuth client_credentials grant naming used by
        # azurelocal-itsm.yml (env://ITSM_SN_*). If your secret names differ,
        # update them here - this block is preserved by
        # Update-AzLocalPipelineExample across module upgrades.
        ITSM_SN_INSTANCE_URL: ${{ secrets.ITSM_SN_INSTANCE_URL }}
        ITSM_SN_CLIENT_ID:    ${{ secrets.ITSM_SN_CLIENT_ID }}
        ITSM_SN_CLIENT_SECRET: ${{ secrets.ITSM_SN_CLIENT_SECRET }}
        # END-AZLOCAL-CUSTOMIZE:itsm-secrets
        INPUT_ITSM_CONFIG_PATH: ${{ github.event.inputs.itsm_config_path }}
        INPUT_ITSM_DRY_RUN:     ${{ github.event.inputs.itsm_dry_run }}
        INPUT_ITSM_FORCE_CREATE: ${{ github.event.inputs.itsm_force_create }}
      run: |
        Import-Module AzLocal.UpdateManagement -Force
        $params = @{
            ConfigPath        = $env:INPUT_ITSM_CONFIG_PATH
            InputArtifactPath = './artifacts/update-results.xml'
            ExportDirectory   = './artifacts'
        }
        if ($env:INPUT_ITSM_DRY_RUN -eq 'true')      { $params['DryRun']      = $true }
        if ($env:INPUT_ITSM_FORCE_CREATE -eq 'true') { $params['ForceCreate'] = $true }
        Invoke-AzLocalItsmTicketingFromArtifact @params

    - name: Upload ITSM Artefacts
      if: ${{ github.event.inputs.raise_itsm_ticket == 'true' }}
      uses: actions/upload-artifact@v6
      with:
        name: azlocal-step.7-apply-updates-itsm-results_${{ steps.artifact-stamp.outputs.timestamp }}
        path: ./artifacts/itsm-*.*
        retention-days: 30
      continue-on-error: true

    - name: Publish ITSM Test Results
      if: ${{ github.event.inputs.raise_itsm_ticket == 'true' }}
      uses: dorny/test-reporter@v3
      with:
        name: ITSM Tickets
        path: ./artifacts/itsm-results.xml
        reporter: java-junit
      continue-on-error: true

    # v0.8.5 thin-YAML - Update Application Summary via shared helper.
    - name: Summary
      shell: pwsh
      env:
        INPUT_UPDATE_RING: ${{ needs.check-readiness.outputs.resolved_update_ring }}
        INPUT_DRY_RUN: ${{ github.event.inputs.dry_run }}
      run: |
        Import-Module AzLocal.UpdateManagement -Force
        $params = @{
            UpdateRing           = $env:INPUT_UPDATE_RING
            TotalCount           = "${{ needs.check-readiness.outputs.total_count }}"
            ReadyCount           = "${{ needs.check-readiness.outputs.ready_count }}"
            Succeeded            = "${{ steps.apply-updates.outputs.SUCCEEDED }}"
            Skipped              = "${{ steps.apply-updates.outputs.SKIPPED }}"
            Failed               = "${{ steps.apply-updates.outputs.FAILED }}"
            HealthBlocked        = "${{ steps.apply-updates.outputs.HEALTH_BLOCKED }}"
            ScheduleBlocked      = "${{ steps.apply-updates.outputs.SCHEDULE_BLOCKED }}"
            SideloadedBlocked    = "${{ steps.apply-updates.outputs.SIDELOADED_BLOCKED }}"
            ExcludedByTag        = "${{ steps.apply-updates.outputs.EXCLUDED_BY_TAG }}"
            ApplyResultsJsonPath = './artifacts/apply-results.json'
            ReadinessCsvPath     = './artifacts/readiness-report.csv'
        }
        if ($env:INPUT_DRY_RUN -eq 'true') { $params['DryRun'] = $true }
        Add-AzLocalApplyUpdatesStepSummary @params

  # Handle case when no clusters are ready
  no-clusters-ready:
    name: No Clusters Ready
    runs-on: windows-latest
    needs: check-readiness
    if: ${{ needs.check-readiness.outputs.ready_count == 0 }}

    steps:
    # Module install is required so the no-clusters-ready summary helper is
    # available on this job's runner.
    - name: Install AzLocal.UpdateManagement from PSGallery
      shell: pwsh
      run: |
        $ErrorActionPreference = 'Stop'
        $installArgs = @{ Name = 'AzLocal.UpdateManagement'; Scope = 'CurrentUser'; Force = $true; AllowClobber = $true }
        if ($env:REQUIRED_MODULE_VERSION) { $installArgs.RequiredVersion = $env:REQUIRED_MODULE_VERSION }
        Install-Module @installArgs
        Import-Module AzLocal.UpdateManagement -Force

    # v0.8.5 thin-YAML - No-clusters-ready summary via shared helper.
    - name: Report No Ready Clusters
      shell: pwsh
      env:
        INPUT_UPDATE_RING: ${{ needs.check-readiness.outputs.resolved_update_ring }}
      run: |
        Import-Module AzLocal.UpdateManagement -Force
        Add-AzLocalNoReadyClustersStepSummary -UpdateRing $env:INPUT_UPDATE_RING -TotalCount "${{ needs.check-readiness.outputs.total_count }}" -UpToDateCount "${{ needs.check-readiness.outputs.up_to_date_count }}" -NotReadyCount "${{ needs.check-readiness.outputs.not_ready_count }}"