Pin GitHub Actions to full-length commit SHAs - #53
Closed
Dan Fiedler (danfiedler-msft) wants to merge 11 commits into
Closed
Dan Fiedler (danfiedler-msft) wants to merge 11 commits into
Dan Fiedler (danfiedler-msft) wants to merge 11 commits into
Conversation
This update brings the public source repository current with internal development activity. Highlights - Configurable auto-approval for eligible onboarding submissions, backed by a new AutoApprover Azure Function. - Bulk approval, rejection feedback by email, and a dedicated Submission Rejector role for the review workflow. - "Take action" controls (including Pause Sync) for runs that exceed membership-change thresholds. - Redesigned Run History panel with sortable columns, a combined Configuration view, friendlier status text, and before/after membership counts. - New Action Required job statuses for nested-group and guest-user conditions, with email notifications. - New Azure Functions supporting larger, session-ordered workloads: MessageSplitter, SyncJobUpdater, and RunLimiter. - Membership download from the UI. - Dark mode across the application. Approval and review - Configurable auto-approval for eligible onboarding submissions (group-membership-only sources; single SQL-membership source when the requestor is the organization leader). Backed by a new AutoApprover Azure Function. - Bulk approval and reviewer-experience refinements in the UI. - Rejection feedback delivered to submitters by email. - Submission Rejector role with permission to reject but not approve. - Policy controlling whether reviewers may review their own submissions. - Check that submission requestor is still a group owner at review time. - Optional business-justification field for onboardings and updates. User interface and end-user experience - Redesigned Run History panel with a combined Run History and Configuration view, sortable columns, friendlier status text, a role-aware Sync tab, before/after membership counts, and a /history route that auto-opens the panel. - "Take action" workflow for runs that exceed thresholds, including Pause Sync, wired to a dedicated threshold-notification endpoint. - New Action Required job statuses: NestedGroupsFound (with email notifications when nested groups are detected in the destination) and GuestUsersCannotBeAddedToUnifiedGroup. - Membership download from the UI, backed by a new WebAPI endpoint. - Dark mode toggle across the application. - Deeplinking from emails and the UI to groups, Teams channels, and Entra ID resources. - Bulk download with a companion console app for CSV-driven updates. - Job configuration history, last-modified-by, and last-modified-time columns in the Jobs list; preserved filter state. - Advanced Query: IS NULL / IS NOT NULL, NOT IN operator support, and inline SQL validation. - Source Parts: expand/collapse-all with preserved state, configurable AI-assisted titles, attribute-list reordering, and clearer include/exclude wording. - HR source parts: searchable dropdowns combining descriptions and codes, grouping support, and improved depth controls. - People Picker enhancements, "Requested on behalf of" group-owners dropdown, group creation from the UI, and the "Manage Membership" button renamed to "Add". - Sync-job deletion from the UI; "Remove GMM Management" for jobs in the DestinationGroupNotFound state. - Maintenance page and configurable first-visit disclaimer. - SignalR-powered live updates when resetting or stopping GMM. - Accessibility improvements and broad copy refinements across the application (including the "Members auto-follow group conversations" disclosure). Architecture, throughput, and scale - Multi-lane processing introduced (new Service Bus topics and subscriptions, GraphUpdater multilane support) and later consolidated by removing the Medium and Onboarding lanes, with session-enabled handling adopted for the remaining lanes. - New Azure Functions: MessageSplitter (large membership payloads, multilane preparation), SyncJobUpdater (sync-job lifecycle), and RunLimiter (run-concurrency limiting via deferred message handling). - Out-of-memory conditions addressed in SqlMembershipObtainer and in GroupMembershipObtainer transitive and delta calls. - Strengthened retry logic for general and session-enabled flows; defensive checks for missing settings and sender disposal. - Atomic sync-job claim path for safer concurrent processing. - Membership-processing throughput tuned via refined batch-size limits, surfaced concurrent-write settings (with separate add and remove controls), earlier source-member-ID extraction, and improved cache file evolution. - Brotli decompression for aggregated membership payloads. Administration and configuration - General and Operations tabs in the Admin Center, with corresponding General Settings Admin and Operations Setting Admin roles. - Admin support for setting attribute descriptions, disabling filter attributes, and viewing attribute values in custom source configuration. - Source-part details preview in the job details page; resubmission support for jobs in the SubmissionRejected state. Data, persistence, and observability - SyncJobHistory introduced, with CreatedAt and UpdatedAt auditing on update paths, and BeforeSyncUserCount / AfterSyncUserCount columns for membership-change visibility. - Job-history purging managed by the AzureMaintenance function. - ResourceUnitsUsed and JobTrigger dashboard tile improvements; lane No-Op tracking to tune lane thresholds and schedule heuristics. - Shared telemetry foundation introduced for ILogger migration, with source-generated log messages and refreshed Application Insights configuration. - Destination and TargetOfficeGroupId columns retired in favor of Group and Channel EF entities. Deployment and infrastructure - New deployment documentation covering resource overview, sync setup driven by Azure Data Factory and HR data, and end-to-end deployment instructions. - Deployment-script dependency check, ordered and labeled parameters, optional skipping of privileged directory actions, centralized retry logic, and Linux container support. - Configurable JobScheduler schedule, and JobTrigger updated to use ScheduledDate only for more even job distribution. - Bicep and template updates, including session-enabled subscriptions and function-plan adjustments. - Storage-account access grants via PostDeployment.ps1. - Reset-GMM.ps1 for clean redeployment. Platform and engineering - Migrated to .NET 8 and adopted .NET Central Package Management. - Migrated multiple functions to Flex Consumption hosting, with supporting migration scripts and PreDeploymentMigrations support. - Function-level authentication enabled and locked down to explicit principal lists. - Adopted the Azure Functions isolated worker model across multiple function apps. - Replaced Newtonsoft.Json with System.Text.Json on the backend. - ILogger adoption across functions with source-generated logging. - Added Playwright integration tests for the web application; expanded unit-test coverage across services. - Build-number stamping on binaries; broad dependency updates, including hardening of front-end dependencies. Retired components - Medium and Onboarding processing lanes (code, infrastructure templates, UI tiles, and unused subscriptions). - Repositories.AzureBlobBackupRepository. - Repositories.Notifications and associated tests. - "Include leader" option in source parts. - UI/Scripts directory.
Rebase release onto main: release was reset to main (75d1de7) and 161 commits replayed (160 release-only + 1 lockfile regen). Backup at users/lipalath/release-backup-6-9. Related work items: #16240791
Get-FirewallIPRules.ps1 now inlines a temporary IP allowlist provided by the Azure Functions team (pending inclusion in Get-MsIdAzureIpRange) and appends it to ipRules.txt after the upstream filtering step, gated on case-insensitive westus2 match. No change to script parameters or to the Set-KeyVaultFirewallRules caller contract. ADO Task: #16235682 ADO Story: #16223086 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
### What does this PR change? <span style="color:red">*</span> <!-- What problem are you trying to solve? Details can be in related work items. Briefly describe your change. Provide necessary comments in PR to help reviewers to understand it. For UX changes please provide screenshots of BEFORE and AFTER this change. --> ### How was this PR tested? <span style="color:red">*</span> <!-- What scenarios does this PR impact and how did you test them? How can reviewers test this PR? Please provide a link to a location where the reviewers can test the changes. --> ### What can this change break and what is your recovery plan? <span style="color:red">*</span> <!-- Is this change behind a killswitch, flight, or any other mitigation tactic? --> ### Checklist and Horizontals <!-- These checkboxes are here to remind the contributor to think about these things before opening the PR. A checked item [x] indicates to the reviewer that these items were evaluated by the contributor before submitting the PR. --> - [ ] **Test Automation** <span style="color:red">*</span> (E.g. Unit/Integration/Load Tests) - [ ] Linked related work item - [ ] Added corresponding owners/experts as reviewers - [ ] Tested with protection activated (feature flags off) - [ ] Accessibility <!-- UI: did you run a Fast Pass with Accessibility Insights? --> - [ ] Localization <!-- UI: Did you ensure strings are localized --> - [ ] Telemetry / Logging <!-- Are you logging / tracking any new GMM / UX events? --> - [ ] Documentation <!-- Have you created / updated required documentation for your changes? --> Related work items: #16250559
…StorageAccountName wiring (deployment-script-fixes-05262026 issue microsoftgraph#1) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…fixes-05262026 issue microsoftgraph#2) Add Scripts/FunctionAppCompat.ps1 with REST-based compat wrappers for seven Az.Functions cmdlets that fail with NullReferenceException when the Functions Stacks API returns new entries without FUNCTIONS_WORKER_RUNTIME (Azure/azure-powershell#29630): - Get-FunctionAppCompat - Get-FunctionAppSettingCompat - Update-FunctionAppSettingCompat - Stop-FunctionAppCompat - Start-FunctionAppCompat - Restart-FunctionAppCompat - Remove-FunctionAppCompat Wrappers use Az.Websites + Invoke-AzRestMethod and preserve the shape contract (.Name, .Kind, .ServerFarmId, .State) consumed downstream. Update-FunctionAppSettingCompat merges settings rather than replacing, neutralizing the prod-wipe risk in the original cmdlet semantics. Swap all hot-path Az.Functions call sites in: - Deployment/Deploy-Resources.ps1 (10 sites) - Scripts/PreDeploymentMigrations/Start-FlexConsumptionMigration.ps1 (1 cmdlet swap + Remove-AzFunctionApp -> Remove-FunctionAppCompat) - Scripts/PreDeploymentMigrations/Remove-MultiLaneResources.ps1 (2 cmdlet swaps + Remove-AzFunctionApp -> Remove-FunctionAppCompat) Dot-source FunctionAppCompat.ps1 from each consumer. Local variable in Invoke-FunctionAppCompatRest is named $splat to avoid shadowing the $args automatic variable. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…not-set' sender creds (deployment-script-fixes-05262026 issue microsoftgraph#3) - Deployment/parameters.json is the public default ARM parameter file used by dev/test deployments and deployment-script-test. Prod uses its own private parameter file (parameters.private.prodv2.json); ARM parameter files do not layer/merge, so this public default never reaches prod. - dataResources.bicep declares 'param skipMailNotifications bool = false', so any deployment whose param file omits the key (including prod) still gets the safe-for-prod default of false. - The C# MailSender consumer does not short-circuit on 'not-set' for sender credentials, so the actual mechanism that prevents MailSender failures in non-prod is the App Configuration flag Mail:SkipMailNotifications=true. The 'not-set' sentinel here mirrors the convention used by the Skip-SenderRecipientCredentials.ps1 helper for non-prod environments. - supportEmailAddresses is intentionally left unchanged; its consumer path is skipped via the App Config flag and is out of scope for this change. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Fix corepack signature verification failure in ADO pipelines. The pnpm@9.15.4 sha512 hash can no longer be verified by corepack due to npm registry or agent environment changes between June 8-18. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Collaborator
|
Hi Dan Fiedler (@danfiedler-msft), |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR pins GitHub Actions to full-length commit SHAs for improved security and reproducibility and adds a 7 day cooldown to Dependabot configuration for GitHub Actions. This work is described in more detail at https://aka.ms/action-pinning.
Why?
Pinning actions to commit SHAs prevents supply-chain attacks where a tag could be moved to point to malicious code. This is a recommended security best practice per the GitHub Actions security hardening guide.
This change mitigates the risk of tag retargeting to malicious code as seen in incidents like the tj-actions/changed-files action compromise or codfish/semantic-release-action compromise and improves the integrity and reproducibility of the CI/CD pipeline.
What changed?
Action pinning: Third-party action references in
.github/workflows/that used mutable tag-based references (e.g.,actions/checkout@v4) have been updated to full-length commit SHAs with a version comment (e.g.,actions/checkout@<sha> # v4) using the pinact tool. References that were already pinned to a SHA, or that used immutable release tags, were left unchanged.Dependabot configuration:
.github/dependabot.ymlhas been updated to ensure agithub-actionspackage-ecosystem section is present with acooldownconfiguration (default-days: 7). If the file did not exist, it was created. If agithub-actionssection already existed, only thecooldownblock was added or itsdefault-daysvalue was increased to 7 if it was lower. The 7-day cooldown provides a window for the community to detect and report compromised releases before they are automatically proposed as updates, reducing exposure to supply-chain attacks via newly published malicious versions.Is this safe to merge?
Yes. The pinned SHAs correspond to the same commits that the existing tags pointed to. No behavioral changes in action execution are introduced. You can verify the pinned SHA value using the GitHub REST API (e.g., the commit hash for
actions/checkout@v7can be found in theshaproperty in the JSON response forGET https://api.github.com/repos/actions/checkout/commits/v7).Additional Information
For more information, please see https://aka.ms/action-pinning