Skip to content

Commit 1764c3b

Browse files
Roopan-MicrosoftAjitPadhi-MicrosoftPavan-Microsoftross-p-smithgpickett
authored
fix: merging dev to main (#2126)
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Ajit Padhi <v-padhiajit@microsoft.com> Co-authored-by: Pavan-Microsoft <v-kupavan@microsoft.com> Co-authored-by: Ross Smith <ross-p-smith@users.noreply.github.com> Co-authored-by: gpickett <122489228+gpickett@users.noreply.github.com> Co-authored-by: Francia Riesco <friesco@microsoft.com> Co-authored-by: Francia Riesco <Fr4nc3@users.noreply.github.com> Co-authored-by: Prajwal D C <v-dcprajwal@microsoft.com> Co-authored-by: Harmanpreet-Microsoft <v-harmanprka@microsoft.com> Co-authored-by: UtkarshMishra-Microsoft <v-utkamishra@microsoft.com> Co-authored-by: Priyanka-Microsoft <v-prisinghal@microsoft.com> Co-authored-by: Prasanjeet-Microsoft <v-singhprasa@microsoft.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Kiran-Siluveru-Microsoft <v-ksiluveru@microsoft.com> Co-authored-by: Prashant-Microsoft <v-pmalusare@microsoft.com> Co-authored-by: Rohini-Microsoft <v-rwalunj@microsoft.com> Co-authored-by: Avijit-Microsoft <v-aghorui@microsoft.com> Co-authored-by: RaviKiran-Microsoft <v-ravikirans@microsoft.com> Co-authored-by: Somesh Joshi <v-somejoshi@microsoft.com> Co-authored-by: Himanshi Agrawal <v-himagrawal@microsoft.com> Co-authored-by: pradeepjha-microsoft <v-pradeepjha@microsoft.com> Co-authored-by: Harmanpreet Kaur <v-harmanpkau@microsoft.com> Co-authored-by: Bangarraju-Microsoft <v-golib@microsoft.com> Co-authored-by: Harsh-Microsoft <v-hbangera@microsoft.com> Co-authored-by: Kanchan-Microsoft <v-knagshetti@microsoft.com> Co-authored-by: Cristopher Coronado <cristofima@hotmail.com> Co-authored-by: Cristopher Coronado Moreira <crcorona@pichincha.com> Co-authored-by: Vamshi-Microsoft <v-vamolla@microsoft.com> Co-authored-by: Thanusree-Microsoft <168087422+Thanusree-Microsoft@users.noreply.github.com> Co-authored-by: Niraj Chaudhari (Persistent Systems Inc) <v-nirajcha@microsoft.com> Co-authored-by: Rohini-Microsoft <168007985+Rohini-Microsoft@users.noreply.github.com> Co-authored-by: Kingshuk-Microsoft <v-kidatta@microsoft.com> Co-authored-by: Ayaz-Microsoft <v-ayazkhan@microsoft.com> Co-authored-by: Abdul-Microsoft <v-amujeebta@microsoft.com> Co-authored-by: Prekshith-Microsoft <v-pdj@microsoft.com> Co-authored-by: Rafi-Microsoft <v-rafmd@microsoft.com> Co-authored-by: Ragini-Microsoft <v-raginich@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Atulku-Microsoft <v-atulku@microsoft.com> Co-authored-by: Akhileswara-Microsoft <v-golnaidu@microsoft.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent 1cee2cd commit 1764c3b

27 files changed

Lines changed: 1117 additions & 1576372 deletions

‎.github/workflows/build-docker-images.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ on:
1919
merge_group:
2020
workflow_dispatch:
2121

22+
permissions:
23+
id-token: write
24+
contents: read
25+
packages: write
26+
2227
jobs:
2328
check-changes:
2429
runs-on: ubuntu-latest
@@ -63,7 +68,6 @@ jobs:
6368
uses: ./.github/workflows/build-docker.yml
6469
with:
6570
new_registry: 'cwydcontainerreg.azurecr.io'
66-
new_username: 'cwydcontainerreg'
6771
app_name: ${{ matrix.app_name }}
6872
dockerfile: ${{ matrix.dockerfile }}
6973
push: ${{ github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo'|| github.ref_name == 'dependabotchanges' }}

‎.github/workflows/build-docker.yml‎

Lines changed: 12 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,6 @@ on:
66
new_registry:
77
required: true
88
type: string
9-
new_username:
10-
required: true
11-
type: string
129
app_name:
1310
required: true
1411
type: string
@@ -18,35 +15,28 @@ on:
1815
push:
1916
required: true
2017
type: boolean
21-
secrets:
22-
DOCKER_PASSWORD:
23-
required: false
24-
DEV_DOCKER_PASSWORD:
25-
required: false
2618

2719
jobs:
2820
docker-build:
2921
runs-on: ubuntu-latest
22+
environment: production
3023
steps:
3124
- name: Checkout
3225
uses: actions/checkout@v6
3326

34-
- name: Docker Login to cwydcontainerreg (Main)
35-
if: ${{ inputs.push == true && github.ref_name == 'main' }}
36-
uses: docker/login-action@v3
27+
- name: Login to Azure via OIDC
28+
if: ${{ inputs.push == true }}
29+
uses: azure/login@v2
3730
with:
38-
registry: ${{ inputs.new_registry }}
39-
username: ${{ inputs.new_username }}
40-
password: ${{ secrets.DEV_DOCKER_PASSWORD }}
31+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
32+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
33+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
4134

42-
# Login for 'dev' and 'demo' branches to cwydcontainerreg only
43-
- name: Docker Login to cwydcontainerreg (Dev/Demo)
44-
if: ${{ inputs.push == true && (github.ref_name == 'dev' || github.ref_name == 'demo' || github.ref_name == 'dependabotchanges') }}
45-
uses: docker/login-action@v3
46-
with:
47-
registry: ${{ inputs.new_registry }}
48-
username: ${{ inputs.new_username }}
49-
password: ${{ secrets.DEV_DOCKER_PASSWORD }}
35+
- name: Login to ACR
36+
if: ${{ inputs.push == true }}
37+
run: |
38+
REGISTRY_NAME=$(echo "${{ inputs.new_registry }}" | sed 's/.azurecr.io//')
39+
az acr login --name "$REGISTRY_NAME"
5040
5141
- name: Set up Docker Buildx
5242
uses: docker/setup-buildx-action@v3

‎.github/workflows/ci.yml‎

Lines changed: 33 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ on:
1111
workflow_dispatch:
1212

1313
permissions:
14+
id-token: write
1415
contents: read
1516
packages: write
1617

@@ -49,11 +50,11 @@ jobs:
4950
needs: check-changes
5051
if: needs.check-changes.outputs.should_deploy == 'true' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
5152
runs-on: ubuntu-latest
53+
environment: production
5254
env:
5355
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
5456
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
5557
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
56-
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
5758
PRINCIPAL_ID: ${{ secrets.PRINCIPAL_ID }}
5859
PRINCIPAL_NAME: ${{ secrets.PRINCIPAL_NAME }}
5960
PRINCIPAL_TYPE: 'ServicePrincipal'
@@ -73,12 +74,16 @@ jobs:
7374
- name: Install azd
7475
uses: Azure/setup-azd@v2
7576

77+
- name: Login to Azure
78+
uses: azure/login@v2
79+
with:
80+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
81+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
82+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
83+
7684
- name: Run Quota Check
7785
id: quota-check
7886
run: |
79-
export AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}
80-
export AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}
81-
export AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}
8287
export AZURE_SUBSCRIPTION_ID="${{ secrets.AZURE_SUBSCRIPTION_ID }}"
8388
export GPT_MIN_CAPACITY="150"
8489
export TEXT_EMBEDDING_MIN_CAPACITY="30"
@@ -191,8 +196,9 @@ jobs:
191196
runCmd: |
192197
export optional_args="./code/tests"
193198
194-
# Azure login first
195-
az login --service-principal -u $AZURE_CLIENT_ID -p $AZURE_CLIENT_SECRET --tenant $AZURE_TENANT_ID
199+
# Azure login via OIDC federated token
200+
OIDC_TOKEN=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=api://AzureADTokenExchange" | jq -r '.value')
201+
az login --service-principal -u "$AZURE_CLIENT_ID" --tenant "$AZURE_TENANT_ID" --federated-token "$OIDC_TOKEN"
196202
az account set --subscription $AZURE_SUBSCRIPTION_ID
197203
198204
# Capture deployment output to a log file
@@ -214,9 +220,10 @@ jobs:
214220
echo "Frontend URL from logs: $(cat log_web_url.txt)"
215221
env: |
216222
AZURE_CLIENT_ID
217-
AZURE_CLIENT_SECRET
218223
AZURE_TENANT_ID
219224
AZURE_SUBSCRIPTION_ID
225+
ACTIONS_ID_TOKEN_REQUEST_URL
226+
ACTIONS_ID_TOKEN_REQUEST_TOKEN
220227
AZURE_ENV_NAME
221228
AZURE_LOCATION
222229
AZURE_RESOURCE_GROUP
@@ -308,10 +315,6 @@ jobs:
308315
env:
309316
FRONTEND_WEBSITE_URL: ${{ env.FRONTEND_WEBSITE_URL }}
310317
ADMIN_WEBSITE_URL: ${{ env.ADMIN_WEBSITE_URL }}
311-
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
312-
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
313-
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
314-
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
315318

316319
- name: Export PostgreSQL Host Endpoint from Makefile
317320
run: |
@@ -348,19 +351,23 @@ jobs:
348351
python - <<EOF
349352
import os
350353
import psycopg2
351-
from azure.identity import ClientSecretCredential
354+
from azure.identity import DefaultAzureCredential
352355
353-
tenant_id = os.environ["AZURE_TENANT_ID"]
354-
client_id = os.environ["AZURE_CLIENT_ID"]
355-
client_secret = os.environ["AZURE_CLIENT_SECRET"]
356356
pg_host = os.environ.get("PG_HOST_DESTINATION", "localhost")
357357
358-
# Acquire Azure AD access token for PostgreSQL
359-
credential = ClientSecretCredential(tenant_id, client_id, client_secret)
358+
# Acquire Azure AD access token for PostgreSQL via OIDC (Azure CLI credential)
359+
credential = DefaultAzureCredential()
360360
token = credential.get_token("https://ossrdbms-aad.database.windows.net/.default").token
361361
362+
# Get the service principal display name for PostgreSQL user
363+
import subprocess
364+
sp_display_name = subprocess.run(
365+
["az", "ad", "sp", "show", "--id", os.environ["AZURE_CLIENT_ID"], "--query", "displayName", "-o", "tsv"],
366+
capture_output=True, text=True
367+
).stdout.strip()
368+
362369
db_params = {
363-
"user": client_id, # Use service principal clientId
370+
"user": sp_display_name, # Use service principal display name
364371
"password": token, # Use AAD token instead of password
365372
"host": pg_host,
366373
"port": "5432",
@@ -382,10 +389,6 @@ jobs:
382389
except Exception as e:
383390
print(f"❌ Error during import: {e}")
384391
EOF
385-
env:
386-
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
387-
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
388-
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
389392
390393
- name: Final Status Check
391394
id: final-status
@@ -421,12 +424,12 @@ jobs:
421424
if: always() && needs.deploy.result != 'skipped'
422425
needs: [check-changes, deploy, e2e-test]
423426
runs-on: ubuntu-latest
427+
environment: production
424428

425429
env:
426430
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
427431
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
428432
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
429-
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
430433
AZURE_ENV_NAME: ${{ needs.deploy.outputs.solution_suffix }} # Get from deploy job
431434
AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
432435
imageTag: ${{ needs.deploy.outputs.imageTag }}
@@ -442,12 +445,17 @@ jobs:
442445
push: never
443446
imageName: ghcr.io/azure-samples/chat-with-your-data-solution-accelerator
444447
imageTag: ${{ env.imageTag }}
445-
runCmd: make destroy
448+
runCmd: |
449+
OIDC_TOKEN=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=api://AzureADTokenExchange" | jq -r '.value')
450+
az login --service-principal -u "$AZURE_CLIENT_ID" --tenant "$AZURE_TENANT_ID" --federated-token "$OIDC_TOKEN"
451+
az account set --subscription $AZURE_SUBSCRIPTION_ID
452+
make destroy
446453
env: |
447454
AZURE_CLIENT_ID
448-
AZURE_CLIENT_SECRET
449455
AZURE_TENANT_ID
450456
AZURE_SUBSCRIPTION_ID
457+
ACTIONS_ID_TOKEN_REQUEST_URL
458+
ACTIONS_ID_TOKEN_REQUEST_TOKEN
451459
AZURE_ENV_NAME
452460
AZURE_LOCATION
453461
AZURE_RESOURCE_GROUP

‎.github/workflows/deploy-orchestrator.yml‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -107,9 +107,25 @@ jobs:
107107
TEST_SUITE: ${{ inputs.trigger_type == 'workflow_dispatch' && inputs.run_e2e_tests || 'GoldenPath-Testing' }}
108108
secrets: inherit
109109

110+
cleanup-deployment:
111+
if: "!cancelled() && needs.deploy.outputs.RESOURCE_GROUP_NAME != '' && inputs.existing_webapp_url == '' && (inputs.trigger_type != 'workflow_dispatch' || inputs.cleanup_resources)"
112+
needs: [deploy, e2e-test]
113+
uses: ./.github/workflows/job-cleanup-deployment.yml
114+
with:
115+
runner_os: ${{ inputs.runner_os }}
116+
trigger_type: ${{ inputs.trigger_type }}
117+
cleanup_resources: ${{ inputs.cleanup_resources }}
118+
existing_webapp_url: ${{ inputs.existing_webapp_url }}
119+
RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
120+
AZURE_LOCATION: ${{ needs.deploy.outputs.AZURE_LOCATION }}
121+
AZURE_ENV_OPENAI_LOCATION: ${{ needs.deploy.outputs.AZURE_ENV_OPENAI_LOCATION }}
122+
ENV_NAME: ${{ needs.deploy.outputs.ENV_NAME }}
123+
IMAGE_TAG: ${{ needs.deploy.outputs.IMAGE_TAG }}
124+
secrets: inherit
125+
110126
send-notification:
111127
if: "!cancelled()"
112-
needs: [deploy, e2e-test]
128+
needs: [deploy, e2e-test, cleanup-deployment]
113129
uses: ./.github/workflows/job-send-notification.yml
114130
with:
115131
trigger_type: ${{ inputs.trigger_type }}
@@ -119,26 +135,10 @@ jobs:
119135
existing_webapp_url: ${{ inputs.existing_webapp_url }}
120136
deploy_result: ${{ needs.deploy.result }}
121137
e2e_test_result: ${{ needs.e2e-test.result }}
138+
cleanup_result: ${{ needs.cleanup-deployment.result }}
122139
WEB_APPURL: ${{ needs.deploy.outputs.WEB_APPURL || inputs.existing_webapp_url }}
123140
RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
124141
QUOTA_FAILED: ${{ needs.deploy.outputs.QUOTA_FAILED }}
125142
TEST_SUCCESS: ${{ needs.e2e-test.outputs.TEST_SUCCESS }}
126143
TEST_REPORT_URL: ${{ needs.e2e-test.outputs.TEST_REPORT_URL }}
127144
secrets: inherit
128-
129-
cleanup-deployment:
130-
if: "!cancelled() && needs.deploy.outputs.RESOURCE_GROUP_NAME != '' && inputs.existing_webapp_url == '' && (inputs.trigger_type != 'workflow_dispatch' || inputs.cleanup_resources)"
131-
needs: [deploy, e2e-test]
132-
uses: ./.github/workflows/job-cleanup-deployment.yml
133-
with:
134-
runner_os: ${{ inputs.runner_os }}
135-
trigger_type: ${{ inputs.trigger_type }}
136-
cleanup_resources: ${{ inputs.cleanup_resources }}
137-
existing_webapp_url: ${{ inputs.existing_webapp_url }}
138-
RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
139-
AZURE_LOCATION: ${{ needs.deploy.outputs.AZURE_LOCATION }}
140-
AZURE_ENV_OPENAI_LOCATION: ${{ needs.deploy.outputs.AZURE_ENV_OPENAI_LOCATION }}
141-
ENV_NAME: ${{ needs.deploy.outputs.ENV_NAME }}
142-
IMAGE_TAG: ${{ needs.deploy.outputs.IMAGE_TAG }}
143-
RESOURCE_TOKEN: ${{ needs.deploy.outputs.RESOURCE_TOKEN }}
144-
secrets: inherit

‎.github/workflows/deploy-v2.yml‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,12 @@ on:
2222
options:
2323
- 'codespace'
2424
- 'Local'
25-
default: 'codespace'
25+
default: 'Local'
2626

2727
resource_group_name:
28-
description: 'Existing Resource Group Name'
29-
required: true
28+
description: 'Resource Group Name (Optional - auto-generated if not provided)'
29+
required: false
30+
default: ''
3031
type: string
3132

3233
DATABASE_TYPE:
@@ -108,6 +109,10 @@ on:
108109
schedule:
109110
- cron: '0 9,21 * * *' # Runs at 9:00 AM and 9:00 PM GMT
110111

112+
permissions:
113+
id-token: write
114+
contents: read
115+
111116
# concurrency:
112117
# group: ${{ github.event_name == 'workflow_dispatch' && format('manual-{0}', github.run_id) || 'deploy-auto-triggered' }}
113118
# cancel-in-progress: false
@@ -174,7 +179,7 @@ jobs:
174179
echo "✅ runner_os derived as: '$RUNNER_OS'"
175180
176181
# Validate resource_group_name (Azure naming convention)
177-
RESOURCE_GROUP="${INPUT_RESOURCE_GROUP_NAME:-rg-cwyd-ci}"
182+
RESOURCE_GROUP="${INPUT_RESOURCE_GROUP_NAME}"
178183
if [[ -n "$RESOURCE_GROUP" ]]; then
179184
if [[ ! "$RESOURCE_GROUP" =~ ^[a-zA-Z0-9._\(\)-]+$ ]] || [[ "$RESOURCE_GROUP" =~ \.$ ]]; then
180185
echo "❌ ERROR: resource_group_name '$RESOURCE_GROUP' is invalid. Must contain only alphanumerics, periods, underscores, hyphens, and parentheses. Cannot end with period."
@@ -188,7 +193,7 @@ jobs:
188193
echo "✅ resource_group_name: '$RESOURCE_GROUP' is valid"
189194
fi
190195
else
191-
echo "✅ resource_group_name: Not provided (will use default 'rg-cwyd-ci')"
196+
echo "✅ resource_group_name: Not provided (will be auto-generated during deployment)"
192197
fi
193198
194199
# Validate DATABASE_TYPE (specific allowed values)
@@ -370,8 +375,8 @@ jobs:
370375
needs: validate-inputs
371376
uses: ./.github/workflows/deploy-orchestrator.yml
372377
with:
373-
runner_os: ${{ needs.validate-inputs.outputs.runner_os || 'ubuntu-latest' }}
374-
resource_group_name: ${{ github.event_name == 'workflow_dispatch' && needs.validate-inputs.outputs.resource_group_name || 'rg-cwyd-ci' }}
378+
runner_os: ${{ needs.validate-inputs.outputs.runner_os || 'windows-latest' }}
379+
resource_group_name: ${{ needs.validate-inputs.outputs.resource_group_name || '' }}
375380
waf_enabled: ${{ needs.validate-inputs.outputs.waf_enabled == 'true' }}
376381
EXP: ${{ needs.validate-inputs.outputs.exp == 'true' }}
377382
cleanup_resources: ${{ github.event_name != 'workflow_dispatch' || needs.validate-inputs.outputs.cleanup_resources == 'true' }}

0 commit comments

Comments
 (0)