Repository navigation
fix(terraform)!: prevent unintended replacements during AIO upgrades - #884
Open
Katrien De Graeve (katriendg) wants to merge 6 commits into
Open
Katrien De Graeve (katriendg) wants to merge 6 commits into
Katrien De Graeve (katriendg) wants to merge 6 commits into
Conversation
…ipt handling - change schema registry API version to 2026-04-01 - update public network access variable in storage account module - enhance Key Vault script retrieval documentation - add lifecycle rules to ignore changes in script values - modify role assignment dependencies for Arc cluster 🔧 - Generated by Copilot
… steps - clarify Terraform state refresh process - enhance instructions for aligning configurations - add warnings about bootstrap maintenance 🔧 - Generated by Copilot
📚 Documentation Health ReportGenerated on: 2026-10-14 11:39:06 UTC 📈 Documentation Statistics
🏗️ Three-Tree Architecture Status
🔍 Quality Metrics
This report is automatically generated by the Documentation Automation workflow. |
Co-authored-by: katriendg <838216+katriendg@users.noreply.github.com>
📚 Documentation Health ReportGenerated on: 2026-10-22 15:32:53 UTC 📈 Documentation Statistics
🏗️ Three-Tree Architecture Status
🔍 Quality Metrics
This report is automatically generated by the Documentation Automation workflow. |
kgmwang1
approved these changes
Oct 23, 2026
kgmwang1
left a comment
kgmwang1
left a comment
Contributor
There was a problem hiding this comment.
Thanks for helping tighten AIO updates to prevent unintended replacements. Only one non-blocking edit requested in-line but everything else looks great
kgmwang1
reviewed
Oct 23, 2026
🔧 - Generated by Copilot
📚 Documentation Health ReportGenerated on: 2026-10-27 09:20:50 UTC 📈 Documentation Statistics
🏗️ Three-Tree Architecture Status
🔍 Quality Metrics
This report is automatically generated by the Documentation Automation workflow. |
6 of 29 tasks
Katrien De Graeve (katriendg)
added a commit
that referenced
this pull request
Oct 27, 2026
…tests (#907) ## Description Updated `docusaurus-tests.yml` with `persist-credentials: false` to address the checkout-credential requirement in #859. All other workflow configuration is unchanged. The branch also took in dependency vulnerability fixes after the failed security checks on #884 exposed repository-wide blockers. These updates address fixable findings needed for CI to pass; final validation remains with CI, and the upstream Zod finding is still unresolved. ## Related Issue Relates to #859. This PR addresses the Docusaurus checkout-credential gap only; it does not complete the Merge Queue rollout or close the issue. Related CI failure: #884. ## Type of Change <!-- What type of change does this PR introduce? Mark relevant options with 'x' --> - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] Blueprint modification or addition - [x] Component modification or addition - [ ] Documentation update - [x] CI/CD pipeline change - [x] Other (please describe): Dependency security updates and Dependabot consolidation ## Implementation Details <!-- Describe the implementation details and approach taken --> - Disabled credential persistence on the existing Docusaurus test checkout without changing its action pin, triggers, permissions, or other workflow settings. - Updated Tokio to 1.54.1 across ten affected Rust lockfiles to address RUSTSEC-2026-0386. - Updated affected npm dependency constraints and lockfiles for `body-parser`, `undici`, `fast-uri`, `ip-address`, and `serialize-javascript`. - Updated MSAL Node to 7.1.1 and aligned the Azure Identity transitive dependency with that patched version. - Consolidated the Microsoft Graph Go SDK update from #906, the Vitest updates from #904, and the certifi update from #905. - Retained the existing security thresholds and advisory policy. ## Testing Performed <!-- Describe the testing you have performed or plan to perform --> <!-- For bug fixes: A regression test verifies the fix and prevents the issue from recurring --> - [ ] Terraform plan/apply - [ ] Blueprint deployment test - [x] Unit tests - [ ] Integration tests - [ ] Bug fix includes regression test (see [Test Policy](https://github.com/microsoft/edge-ai/blob/main/docs/contributing/testing-validation.md)) - [ ] Manual validation - [x] Other: Rust dependency audits, chat server compilation, Go module verification, workflow permission validation, and patch hygiene - All 22 Rust lockfiles passed `cargo audit --deny warnings` with the repository's existing advisory and yanked-package policy. - The chat server TypeScript build and all 38 tests passed after the MSAL update, before the final Vitest patch update. CI must validate the final locked test-tool versions. - `go mod verify` passed for the updated Microsoft Graph dependency. - Workflow permission validation passed for all 38 scanned workflows. - `git diff --check origin/main...HEAD` passed. - Full builds, Go vulnerability analysis, browser and deployment tests, and final security scans remain for CI. ## Validation Steps <!-- Provide steps that reviewers should follow to validate your changes --> 1. Confirm the only workflow change is `persist-credentials: false` on the Docusaurus test checkout. 2. Verify Docusaurus tests, dependency review, Cargo Audit, and Security Scan results on the final branch commit. 3. Confirm the chat application builds and its tests pass with the final npm lockfile. 4. Keep #859 open for the remaining trust gates, hosted activation, and live Merge Queue proof. ## Checklist <!-- Mark relevant options with 'x' --> - [ ] I have updated the documentation accordingly - [ ] I have added tests to cover my changes - [ ] All new and existing tests passed - [ ] I have run `terraform fmt` on all Terraform code - [ ] I have run `terraform validate` on all Terraform code - [ ] I have run `az bicep format` on all Bicep code - [ ] I have run `az bicep build` to validate all Bicep code - [ ] I have checked for any sensitive data/tokens that should not be committed - [ ] Lint checks pass (run applicable linters for changed file types) ## Security Review - [ ] No credentials, secrets, or tokens are hardcoded or logged - [ ] RBAC and identity changes follow least-privilege principles - [ ] No new network exposure or public endpoints introduced without justification - [ ] Dependency additions or updates have been reviewed for known vulnerabilities - [ ] Container image changes use pinned digests or SHA references ## Additional Notes <!-- Add any other context about the PR here --> - Zod remains a known security-scan blocker because the upstream Agents SDK requires v3. A forced v4 override was not applied because its schema API is incompatible. - The Checkov portion of #905 was not included because it introduces `ecdsa`, which has an unpatched high-severity advisory. - No security checks were disabled, and these changes do not assert that hosted CI has passed. ## Screenshots (if applicable) <!-- Add screenshots to show the changes, if applicable --> Not applicable. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
📚 Documentation Health ReportGenerated on: 2026-10-27 12:18:17 UTC 📈 Documentation Statistics
🏗️ Three-Tree Architecture Status
🔍 Quality Metrics
This report is automatically generated by the Documentation Automation workflow. |
5 of 29 tasks
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Prevent deferred Arc cluster lookups from causing unintended replacement cascades during Azure IoT Operations (AIO) upgrades, and keep existing Linux VM bootstrap payloads unchanged during routine reconciliation. Also correct storage-account provider compatibility and update the Bicep schema-registry API version.
Bootstrap content becomes create-only: later script and template-input changes require explicitly reviewed maintenance instead of automatically updating deployed secrets or rerunning VM setup.
Related Issue
Closes #883.
This implements the source safeguards and bootstrap maintenance documentation.
Type of Change
Implementation Details
valueandcontent_type, and Linux VM extensionprotected_settings. Other attributes remain managed; deletion or identity changes can still destroy or replace resources.public_network_access_enabledto preserve the Boolean input behavior with AzureRM 5.3.0 and 5.9.0. Provider constraints remain unchanged.2024-09-01-previewto2026-04-01and regenerate its resource reference.No cluster setup scripts, extension version pins, or deployment-specific dataflow graph inputs are changed by this commit.
Testing Performed
Evidence collected during implementation:
The plan evidence is not a fresh-deployment or Kubernetes workload-health test. No regression tests were added. Hosted CI and first-deployment ordering verification remain pending.
Validation Steps
Checklist
terraform fmton all Terraform codeterraform validateon all Terraform codeaz bicep formaton all Bicep codeaz bicep buildto validate all Bicep codeSecurity Review
Additional Notes
The storage Boolean argument is deprecated toward AzureRM v6; this change retains compatibility within the existing v5 constraint rather than upgrading the provider.
Bootstrap fixes, including changes to in-cluster administrator bindings, will no longer propagate automatically through the ignored payload fields. Maintainers must plan explicit maintenance for existing deployments.
Screenshots (if applicable)
Not applicable: infrastructure and documentation changes only.