Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,11 @@
# This is the single source of truth for "which UpdateRing(s) is/are
# eligible to apply updates on a given UTC date". It is consumed by:
#
# * Step.7_apply-updates.yml - reads it at every cron firing and
# * apply-updates.yml - reads it at every cron firing and
# resolves the UpdateRingValue (and,
# schema v2+, the AllowedUpdateVersions
# allow-list) to use for that run.
# * Step.3_apply-updates-schedule-audit.yml
# * apply-updates-schedule-audit.yml
# - audits this file against the live
# fleet (UpdateRing + UpdateStartWindow
# tags) and emits a two-way coverage
Expand All @@ -32,7 +32,7 @@
# missing, Step.5 throws with the exact remediation command.
#
# Generate a starter file from your current fleet via:
# New-AzLocalApplyUpdatesScheduleConfig -OutputPath .\.github\apply-updates-schedule.yml
# New-AzLocalApplyUpdatesScheduleConfig -OutputPath .\config\apply-updates-schedule.yml
# =====================================================================

schemaVersion: 2
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
#
# WHY THIS PIPELINE EXISTS
# ------------------------
# Step.7_apply-updates.yml ships with NO default schedule (trigger:none) on purpose, so
# apply-updates.yml ships with NO default schedule (trigger:none) on purpose, so
# customers must consciously choose when updates fire. After you have configured
# UpdateStartWindow tags on your clusters and added cron entries to Step.7_apply-updates.yml, this
# UpdateStartWindow tags on your clusters and added cron entries to apply-updates.yml, this
# pipeline is the safety net that catches:
# - a new ring tagged with UpdateStartWindow that no cron in Step.7_apply-updates.yml will reach
# - a new ring tagged with UpdateStartWindow that no cron in apply-updates.yml will reach
# - an UpdateStartWindow tag value that fails to parse (typo / wrong syntax)
# - Step.7_apply-updates.yml cron entries that the advisor cannot reason about
# - apply-updates.yml cron entries that the advisor cannot reason about
# (DayOfMonth restrictions, step values) so you can audit them manually
#
# REPORTS GENERATED:
Expand Down Expand Up @@ -44,7 +44,7 @@ schedules:

parameters:
- name: pipelinePath
displayName: 'Path (file or folder) to Step.7_apply-updates.yml to audit, repo-relative. REQUIRED so the Recommend view can diff its proposed crons against what is already present in Step.7 and only emit a snippet for the truly missing entries. Default `.azure-pipelines` matches the standard Azure DevOps consumer layout; for repos that keep Step.7_apply-updates.yml at the repo root pass `.`'
displayName: 'Path (file or folder) to apply-updates.yml to audit, repo-relative. REQUIRED so the Recommend view can diff its proposed crons against what is already present in apply-updates.yml and only emit a snippet for the truly missing entries. Default `.azure-pipelines` matches the standard Azure DevOps consumer layout; for repos that keep apply-updates.yml at the repo root pass `.`'
type: string
default: '.azure-pipelines'

Expand Down Expand Up @@ -87,7 +87,7 @@ parameters:
default: false

variables:
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
REQUIRED_MODULE_VERSION: '${{ parameters.moduleVersion }}'
reportsPath: '$(Build.ArtifactStagingDirectory)/reports'
# v0.8.7 sideload advisor defaults. Override at the pipeline / variable-group
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,7 @@ variables:
# log if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
- name: GENERATED_AGAINST_MODULE_VERSION
value: '0.8.7'
value: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
# 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# Step.5 - Assess Update Readiness (Pre-flight go/no-go gate)
# --------------------------------------------------
# Runs Get-AzLocalClusterUpdateReadiness and Test-AzLocalClusterHealth -BlockingOnly
# against a target UpdateRing (or the whole fleet) BEFORE Step.7_apply-updates.yml runs.
# against a target UpdateRing (or the whole fleet) BEFORE apply-updates.yml runs.
#
# Publishes two JUnit XML diagnostic results to the Azure DevOps Tests tab:
# - readiness.xml (one test per cluster; fails if ReadyForUpdate = $false)
Expand All @@ -15,7 +15,7 @@
# does NOT block downstream runs. In large fleets, day-to-day environmental issues
# (transient storage noise, a single node out, etc.) routinely affect a small subset of
# clusters; blocking the entire wave for one unhealthy cluster is rarely the desired
# behavior. Step.7_apply-updates.yml is itself per-cluster scoped, so clusters that are not
# behavior. apply-updates.yml is itself per-cluster scoped, so clusters that are not
# ready will simply no-op there too.
#
# If you want a hard pass/fail signal for a chained gate, read the output variables
Expand Down Expand Up @@ -70,7 +70,7 @@ variables:
# the version actually installed and to the latest on PSGallery, and emits a warning
# log if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
# 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
# 5. Subscription scope: total count and full Subscription ID / Name table
# visible to the pipeline identity.
#
# Unlike the GitHub Actions twin (Step.0_authentication-test.yml in github-actions/), ADO
# Unlike the GitHub Actions twin (authentication-test.yml in github-actions/), ADO
# does not expose env-scoped federated credentials at the auth layer - the service
# connection IS the federation. So this pipeline only validates one auth path. Environment
# approval gates (Pipelines -> Environments) are a separate concern and are not exercised
Expand Down Expand Up @@ -60,7 +60,7 @@ variables:
# log if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
- name: GENERATED_AGAINST_MODULE_VERSION
value: '0.8.7'
value: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
# 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ variables:
# the version actually installed and to the latest on PSGallery, and emits a warning
# log if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
# 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@ variables:
# the version actually installed and to the latest on PSGallery, and emits a warning
# log if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
# 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ variables:
# the version actually installed and to the latest on PSGallery, and emits a warning
# log if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
# 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ variables:
# log if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
- name: GENERATED_AGAINST_MODULE_VERSION
value: '0.8.7'
value: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
# 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ variables:
# log if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
- name: GENERATED_AGAINST_MODULE_VERSION
value: '0.8.7'
value: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
# 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ parameters:
default: ''

variables:
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
REQUIRED_MODULE_VERSION: '${{ parameters.moduleVersion }}'
reportsPath: '$(Build.ArtifactStagingDirectory)/reports'

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ variables:
# the version actually installed and to the latest on PSGallery, and emits a warning
# log if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): queue-time parameter > pipeline variable
# 'REQUIRED_MODULE_VERSION' overridden at queue time > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
#
# WHY THIS PIPELINE EXISTS
# ------------------------
# Step.7_apply-updates.yml ships with NO default schedule (workflow_dispatch only) on purpose,
# apply-updates.yml ships with NO default schedule (workflow_dispatch only) on purpose,
# so customers must consciously choose when updates fire. After you have configured
# UpdateStartWindow tags on your clusters and added cron entries to Step.7_apply-updates.yml, this
# UpdateStartWindow tags on your clusters and added cron entries to apply-updates.yml, this
# pipeline is the safety net that catches:
# - a new ring tagged with UpdateStartWindow that no cron in Step.7_apply-updates.yml will reach
# - a new ring tagged with UpdateStartWindow that no cron in apply-updates.yml will reach
# - an UpdateStartWindow tag value that fails to parse (typo / wrong syntax)
# - Step.7_apply-updates.yml cron entries that the advisor cannot reason about
# - apply-updates.yml cron entries that the advisor cannot reason about
# (DayOfMonth restrictions, step values) so you can audit them manually
#
# REPORTS GENERATED
Expand Down Expand Up @@ -47,7 +47,7 @@ on:
workflow_dispatch:
inputs:
pipeline_path:
description: 'Path (file or folder) to Step.7_apply-updates.yml to audit, repo-relative. Required so the Recommend view can diff its proposed crons against what is already present in Step.7 and only emit a snippet for the truly missing entries. Default `.github/workflows` matches the standard GitHub Actions consumer layout where you paste the bundled `Step.7_apply-updates.yml` sample.'
description: 'Path (file or folder) to apply-updates.yml to audit, repo-relative. Required so the Recommend view can diff its proposed crons against what is already present in apply-updates.yml and only emit a snippet for the truly missing entries. Default `.github/workflows` matches the standard GitHub Actions consumer layout where you paste the bundled `apply-updates.yml` sample.'
required: true
default: '.github/workflows'
schedule_path:
Expand Down Expand Up @@ -96,7 +96,7 @@ env:
# this to the version actually installed and to the latest on PSGallery, and emits a
# ::notice annotation if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
REQUIRED_MODULE_VERSION: ${{ github.event.inputs.module_version || vars.REQUIRED_MODULE_VERSION || '' }}
# v0.8.4 - opt this workflow into Node.js 24 for all JavaScript actions
# (actions/checkout, actions/download-artifact, actions/upload-artifact,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@ env:
# this to the version actually installed and to the latest on PSGallery, and emits a
# ::notice annotation if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): manual workflow_dispatch input >
# repository variable 'REQUIRED_MODULE_VERSION' > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
# Assess Update Readiness (Pre-flight go/no-go gate)
# --------------------------------------------------
# Runs Get-AzLocalClusterUpdateReadiness and Test-AzLocalClusterHealth -BlockingOnly
# against a target UpdateRing (or the whole fleet) BEFORE Step.7_apply-updates.yml runs.
# against a target UpdateRing (or the whole fleet) BEFORE apply-updates.yml runs.
#
# Outputs two JUnit XML diagnostic artifacts consumed by the Actions test reporter:
# - readiness.xml (one test per cluster; fails if ReadyForUpdate = $false)
Expand All @@ -17,7 +17,7 @@
# summary - but it does NOT block downstream runs. In large fleets, day-to-day
# environmental issues (transient storage noise, a single node out, etc.) routinely affect
# a small subset of clusters; blocking the entire wave for one unhealthy cluster is rarely
# the desired behavior. Step.7_apply-updates.yml is itself per-cluster scoped, so clusters that
# the desired behavior. apply-updates.yml is itself per-cluster scoped, so clusters that
# are not ready will simply no-op there too.
#
# If you want a hard pass/fail signal for a chained gate, read the job outputs
Expand Down Expand Up @@ -72,7 +72,7 @@ env:
# this to the version actually installed and to the latest on PSGallery, and emits a
# ::notice annotation if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): manual workflow_dispatch input >
# repository variable 'REQUIRED_MODULE_VERSION' > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,10 @@
#
# HOW TO TRIGGER (after the file is committed to the default branch):
# # Branch-scoped run - exercises the 'GitHubActions-main' federated credential.
# gh workflow run Step.0_authentication-test.yml --repo <owner>/<repo>
# gh workflow run authentication-test.yml --repo <owner>/<repo>
#
# # Environment-scoped run - exercises the env-scoped federated credentials.
# gh workflow run Step.0_authentication-test.yml --repo <owner>/<repo> -f environment=DevTest
# gh workflow run authentication-test.yml --repo <owner>/<repo> -f environment=DevTest
#
# # Watch the most recent run live.
# gh run watch --repo <owner>/<repo>
Expand Down Expand Up @@ -79,7 +79,7 @@ env:
# this to the version actually installed and to the latest on PSGallery, and emits a
# ::notice annotation if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): manual workflow_dispatch input >
# repository variable 'REQUIRED_MODULE_VERSION' > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ env:
# PSGallery, and emits a ::notice annotation if the YAML appears stale -
# prompting you to refresh via Copy-AzLocalPipelineExample -Update. See
# Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install
# the latest, the default "fix-forward" behaviour): manual workflow_dispatch
# input > repository variable 'REQUIRED_MODULE_VERSION' > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ env:
# this to the version actually installed and to the latest on PSGallery, and emits a
# ::notice annotation if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): manual workflow_dispatch input >
# repository variable 'REQUIRED_MODULE_VERSION' > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@ env:
# this to the version actually installed and to the latest on PSGallery, and emits a
# ::notice annotation if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): manual workflow_dispatch input >
# repository variable 'REQUIRED_MODULE_VERSION' > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ env:
# this to the version actually installed and to the latest on PSGallery, and emits a
# ::notice annotation if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): manual workflow_dispatch input >
# repository variable 'REQUIRED_MODULE_VERSION' > empty (latest).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ env:
# this to the version actually installed and to the latest on PSGallery, and emits a
# ::notice annotation if the YAML appears stale - prompting you to refresh via
# Copy-AzLocalPipelineExample -Update. See Automation-Pipeline-Examples/README.md section 5.
GENERATED_AGAINST_MODULE_VERSION: '0.8.7'
GENERATED_AGAINST_MODULE_VERSION: '0.8.71'
# Resolution order for the module version pin (leave all unset to install the latest,
# which is the default "fix-forward" behaviour): manual workflow_dispatch input >
# repository variable 'REQUIRED_MODULE_VERSION' > empty (latest).
Expand Down
Loading
Loading