Pin GitHub Actions to full-length commit SHAs

.github/copilot-instructions.md

@@ -46,6 +46,7 @@ GMM automates Entra ID group membership synchronization at enterprise scale. The
 - **PlaceMembershipObtainer**: Obtains the users that are found in the result of a Graph users GET call based on and filters applied.
 - **SyncJobUpdater**: Updates sync job properties in a centralized function, including tracking logs as well.
 - **AutoApprover**: Processes auto-approval requests for configuration workflow.
+- **SqlDataChecker**: Validates SQL data integrity by comparing recent ADF pipeline runs for table structure and row count changes.
 
 #### Web Application
 - **React SPA** located in `UI/web-app/`

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -24,10 +24,10 @@ jobs:
     steps:
 
     - name: Checkout Action
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
 
     - name: Use .NET Core
-      uses: actions/setup-dotnet@v1
+      uses: actions/setup-dotnet@871f041373faaad213a635d9afb62905ec029bbb # v1.10.1
       with:
         dotnet-version: 8.0.303
 
@@ -64,7 +64,7 @@ jobs:
       shell: powershell
 
     - name: publish functions to artifact
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
       with:
         name: ${{ github.run_number }}
         path: upload/**
@@ -78,7 +78,7 @@ jobs:
       shell: powershell
 
     - name: publish artifact
-      uses: actions/upload-artifact@v2
+      uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
       with:
         name: ${{ github.run_number }}
         path: |

Deployment/computeResources.bicep

@@ -61,7 +61,6 @@ module jobTriggerDataResources '../Service/GroupMembershipManagement/Hosts/JobTr
   name: 'jobTriggerDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -91,7 +90,6 @@ module destinationAttributesUpdaterDataResources '../Service/GroupMembershipMana
   name: 'destinationAttributesUpdaterDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -121,7 +119,6 @@ module groupMembershipObtainerDataResources '../Service/GroupMembershipManagemen
   name: 'groupMembershipObtainerDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -150,7 +147,6 @@ module sqlMembershipObtainerDataResources '../Service/GroupMembershipManagement/
   name: 'sqlMembershipObtainerDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -173,7 +169,7 @@ module sqlMembershipObtainerComputeResources '../Service/GroupMembershipManageme
     setRBACPermissions: setRBACPermissions
   }
   dependsOn: [
-    groupMembershipObtainerDataResources
+    sqlMembershipObtainerDataResources
   ]
 }
 
@@ -182,7 +178,6 @@ module groupOwnershipObtainerDataResources '../Service/GroupMembershipManagement
   name: 'groupOwnershipObtainerDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -211,7 +206,6 @@ module placeMembershipObtainerDataResources '../Service/GroupMembershipManagemen
   name: 'placeMembershipObtainerDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -240,7 +234,6 @@ module teamsChannelMembershipObtainerDataResources '../Service/GroupMembershipMa
   name: 'teamsChannelMembershipObtainerDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -269,7 +262,6 @@ module membershipAggregatorDataResources '../Service/GroupMembershipManagement/H
   name: 'membershipAggregatorDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -305,13 +297,11 @@ module graphUpdaterDataResources '../Service/GroupMembershipManagement/Hosts/Gra
   name: instance == '' ? 'graphUpdaterDataResourcesTemplate' : 'graphUpdater${instance}DataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
     instanceIdentifier: instance
   }
-}
-]
+}]
 
 module graphUpdaterComputeResources '../Service/GroupMembershipManagement/Hosts/GraphUpdater/Infrastructure/compute/template.bicep' = [for instance in guinstanceIds: {
   name: instance == '' ? 'graphUpdaterComputeResourcesTemplate' : 'graphUpdater${instance}ComputeResourcesTemplate'
@@ -341,7 +331,6 @@ module teamsChannelUpdaterDataResources '../Service/GroupMembershipManagement/Ho
   name: 'teamsChannelUpdaterDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -370,7 +359,6 @@ module nonProdServiceDataResources '../Service/GroupMembershipManagement/Hosts/N
   name: 'nonProdServiceDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -401,7 +389,6 @@ module azureUserReaderDataResources '../Service/GroupMembershipManagement/Hosts/
   name: 'azureUserReaderDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -432,7 +419,6 @@ module notifierDataResources '../Service/GroupMembershipManagement/Hosts/Notifie
   name: 'notifierDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -463,7 +449,6 @@ module autoApproverDataResources '../Service/GroupMembershipManagement/Hosts/Aut
   name: 'autoApproverDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -492,7 +477,6 @@ module jobSchedulerDataResources '../Service/GroupMembershipManagement/Hosts/Job
   name: 'jobSchedulerDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -522,7 +506,6 @@ module syncJobUpdaterDataResources '../Service/GroupMembershipManagement/Hosts/S
   name: 'syncJobUpdaterDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -553,16 +536,14 @@ var instanceIds = [
 ]
 
 module messageSplitterDataResources '../Service/GroupMembershipManagement/Hosts/MessageSplitter/Infrastructure/data/template.bicep' = [for instance in instanceIds: {
-    name: 'messageSplitter${instance}DataResources'
-    scope: resourceGroup(dataResourceGroupName)
-    params: {
-      location: location
-      environmentAbbreviation: environmentAbbreviation
-      solutionAbbreviation: solutionAbbreviation
-      instanceIdentifier: instance
-    }
+  name: 'messageSplitter${instance}DataResources'
+  scope: resourceGroup(dataResourceGroupName)
+  params: {
+    environmentAbbreviation: environmentAbbreviation
+    solutionAbbreviation: solutionAbbreviation
+    instanceIdentifier: instance
   }
-]
+}]
 
 module messageSplitterComputeResources '../Service/GroupMembershipManagement/Hosts/MessageSplitter/Infrastructure/compute/template.bicep' = [for instance in instanceIds: {
   name: 'messageSplitter${instance}ComputeResources'
@@ -589,7 +570,6 @@ module azureMaintenanceDataResources '../Service/GroupMembershipManagement/Hosts
   name: 'azureMaintenanceDataResourcesTemplate'
   scope: resourceGroup(dataResourceGroupName)
   params: {
-    location: location
     environmentAbbreviation: environmentAbbreviation
     solutionAbbreviation: solutionAbbreviation
   }
@@ -611,6 +591,38 @@ module azureMaintenanceComputeResources '../Service/GroupMembershipManagement/Ho
   ]
 }
 
+// ----------------- SqlDataChecker
+module sqlDataCheckerDataResources '../Service/GroupMembershipManagement/Hosts/SqlDataChecker/Infrastructure/data/template.bicep' = {
+  name: 'sqlDataCheckerDataResourcesTemplate'
+  scope: resourceGroup(dataResourceGroupName)
+  params: {
+    environmentAbbreviation: environmentAbbreviation
+    solutionAbbreviation: solutionAbbreviation
+  }
+}
+
+module sqlDataCheckerComputeResources '../Service/GroupMembershipManagement/Hosts/SqlDataChecker/Infrastructure/compute/template.bicep' = {
+  name: 'sqlDataCheckerComputeResourcesTemplate'
+  scope: resourceGroup(computeResourceGroupName)
+  params: {
+    location: location
+    environmentAbbreviation: environmentAbbreviation
+    solutionAbbreviation: solutionAbbreviation
+    tenantId: tenantId
+    authority: 'https://login.windows.net/${tenantId}'
+    subscriptionId: subscription().subscriptionId
+    pipeline: pipeline
+    prereqsKeyVaultResourceGroup: prereqsResourceGroupName
+    dataKeyVaultResourceGroup: dataResourceGroupName
+    setRBACPermissions: setRBACPermissions
+    featureFlags: featureFlags
+    functionAuthAppClientId: functionAuthAppClientId
+  }
+  dependsOn: [
+    sqlDataCheckerDataResources
+  ]
+}
+
 /// Functions Post Compute tasks
 module azureUserReaderPostCompute '../Service/GroupMembershipManagement/Hosts/AzureUserReader/Infrastructure/compute/postCompute.bicep' = {
   name: 'azureUserReaderPostCompute'
@@ -682,6 +694,19 @@ module notifierPostCompute '../Service/GroupMembershipManagement/Hosts/Notifier/
   ]
 }
 
+module sqlDataCheckerPostCompute '../Service/GroupMembershipManagement/Hosts/SqlDataChecker/Infrastructure/compute/postCompute.bicep' = {
+  name: 'sqlDataCheckerPostCompute'
+  params: {
+    dataKeyVaultName: '${solutionAbbreviation}-data-${environmentAbbreviation}'
+    dataKeyVaultResourceGroup: dataResourceGroupName
+    environmentAbbreviation: environmentAbbreviation
+    solutionAbbreviation: solutionAbbreviation
+  }
+  dependsOn:[
+    sqlDataCheckerComputeResources
+  ]
+}
+
 // web api
 module webApiDataResources '../Service/GroupMembershipManagement/Hosts/WebApi/Infrastructure/data/template.bicep' = {
   name: 'webApiDataResourcesTemplate'
@@ -733,4 +758,4 @@ module uiComputeResources '../Service/GroupMembershipManagement/Hosts/UI/Infrast
   dependsOn: [
     webApiComputeResources
   ]
-}
+}

Deployment/dataResources.bicep

@@ -17,10 +17,15 @@ param isProduction bool = false
 param notificationAlertThreshold int = 10
 param skipMailNotifications bool = false
 param isMailApplicationPermissionGranted bool = false
+param enableStyledFallbackEmails bool = false
 param isTeamsChannelApplicationPermissionGranted bool = false
 param featureFlags object = {
   enableOpenAI: false
 }
+
+@description('When true, networking resources (private endpoints, DCR, DCR association) are skipped.')
+param skipNetworkingDeployment bool = true
+
 param emailReceivers array = [
   {
     name: 'Example name'
@@ -358,6 +363,14 @@ var defaultAppConfigurationKeyData = [
       tag1: 'Mail'
     }
   }
+  {
+    key: 'Mail:EnableStyledFallbackEmails'
+    value: string(enableStyledFallbackEmails)
+    contentType: 'boolean'
+    tag: {
+      tag1: 'Mail'
+    }
+  }
   {
     key: 'TeamsChannel:IsChannelReadWriteApplicationPermissionGranted'
     value: isTeamsChannelApplicationPermissionGranted
@@ -448,5 +461,6 @@ module dataInfrastructureTemplate '../Infrastructure/data/template.bicep' = {
     availableMembershipUpdaters: availableMembershipUpdaters
     aiLocation: aiLocation
     featureFlags: featureFlags
+    skipNetworkingDeployment: skipNetworkingDeployment
   }
 }