From f9a7cd7855692f1ba646ab42d8d6d23e24e935f1 Mon Sep 17 00:00:00 2001 From: Dhruvkumar-Microsoft Date: Thu, 13 Aug 2026 19:11:30 +0530 Subject: [PATCH 1/4] updated the team upload funcationality while rerunning the postdeployment script --- .../post-provision/upload_team_config.py | 16 ---------- src/backend/api/router.py | 12 ++++---- src/backend/services/team_service.py | 30 +++++++++++++++---- 3 files changed, 30 insertions(+), 28 deletions(-) diff --git a/infra/scripts/post-provision/upload_team_config.py b/infra/scripts/post-provision/upload_team_config.py index 9d4b85952..111986a35 100644 --- a/infra/scripts/post-provision/upload_team_config.py +++ b/infra/scripts/post-provision/upload_team_config.py @@ -115,22 +115,6 @@ def check_team_exists(backend_url, team_id, user_principal_id): for filename, team_id in candidate_files: file_path = os.path.join(directory_path, filename) print(f"Uploading file: {filename}") - team_exists = check_team_exists(backend_url, team_id, user_principal_id) - if team_exists: - # Delete existing team to allow re-upload with updated config - print(f"Team (ID: {team_id}) already exists. Deleting to re-upload with latest config...") - delete_endpoint = backend_url.rstrip('/') + f'/api/v4/team_configs/{team_id}' - headers = { - 'x-ms-client-principal-id': user_principal_id - } - try: - delete_response = request_with_retry("DELETE", delete_endpoint, headers=headers) - if delete_response.status_code == 200: - print(f"Successfully deleted existing team (ID: {team_id}).") - else: - print(f"Warning: Could not delete existing team (ID: {team_id}). Status: {delete_response.status_code}. Will attempt upload anyway.") - except Exception as e: - print(f"Warning: Exception deleting team (ID: {team_id}): {str(e)}. Will attempt upload anyway.") try: with open(file_path, 'rb') as file_data: diff --git a/src/backend/api/router.py b/src/backend/api/router.py index 2297e9571..dc169fec8 100644 --- a/src/backend/api/router.py +++ b/src/backend/api/router.py @@ -1008,7 +1008,7 @@ async def upload_team_config( { "status": "failed", "user_id": user_id, - "filename": file.filename, + "file_name": file.filename, "reason": rai_error, }, ) @@ -1016,7 +1016,7 @@ async def upload_team_config( track_event_if_configured( "Config_RAI_Validation_Passed", - {"status": "passed", "user_id": user_id, "filename": file.filename}, + {"status": "passed", "user_id": user_id, "file_name": file.filename}, ) team_service = TeamService(memory_store) @@ -1034,7 +1034,7 @@ async def upload_team_config( { "status": "failed", "user_id": user_id, - "filename": file.filename, + "file_name": file.filename, "missing_models": missing_models, }, ) @@ -1042,7 +1042,7 @@ async def upload_team_config( track_event_if_configured( "Config_Model_Validation_Passed", - {"status": "passed", "user_id": user_id, "filename": file.filename}, + {"status": "passed", "user_id": user_id, "file_name": file.filename}, ) # Validate search indexes @@ -1061,7 +1061,7 @@ async def upload_team_config( { "status": "failed", "user_id": user_id, - "filename": file.filename, + "file_name": file.filename, "search_errors": search_errors, }, ) @@ -1070,7 +1070,7 @@ async def upload_team_config( logger.info(f"Search validation passed for user: {user_id}") track_event_if_configured( "Config_Search_Validation_Passed", - {"status": "passed", "user_id": user_id, "filename": file.filename}, + {"status": "passed", "user_id": user_id, "file_name": file.filename}, ) # Validate and parse the team configuration diff --git a/src/backend/services/team_service.py b/src/backend/services/team_service.py index 66a56c967..c7dea543d 100644 --- a/src/backend/services/team_service.py +++ b/src/backend/services/team_service.py @@ -164,6 +164,11 @@ async def save_team_configuration(self, team_config: TeamConfiguration) -> str: """ Save team configuration to the database. + Idempotent by team_id: if a team with the same team_id already exists + (including shared default teams), reuse its document id and partition + key (session_id) and upsert; otherwise create a new document. This + prevents duplicate rows accumulating on re-runs of the seed script. + Args: team_config: TeamConfiguration object to save @@ -171,12 +176,25 @@ async def save_team_configuration(self, team_config: TeamConfiguration) -> str: The unique ID of the saved configuration """ try: - # Use the specific add_team method from cosmos memory context - await self.memory_context.add_team(team_config) - - self.logger.info( - "Successfully saved team configuration with ID: %s", team_config.id - ) + existing = await self.memory_context.get_team(team_config.team_id) + if existing is not None: + # Preserve immutable identity fields; partition key (session_id) + # cannot change on an upsert. + team_config.id = existing.id + team_config.session_id = existing.session_id + team_config.created = existing.created + team_config.created_by = existing.created_by + await self.memory_context.update_team(team_config) + self.logger.info( + "Successfully updated team configuration with ID: %s", + team_config.id, + ) + else: + await self.memory_context.add_team(team_config) + self.logger.info( + "Successfully saved team configuration with ID: %s", + team_config.id, + ) return team_config.id except Exception as e: From d88a763c9a8f5d086beb3ca98d60a36611ccc395 Mon Sep 17 00:00:00 2001 From: Dhruvkumar-Microsoft Date: Fri, 14 Aug 2026 09:54:33 +0530 Subject: [PATCH 2/4] updated the testcases --- .../backend/services/test_team_service.py | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/src/tests/backend/services/test_team_service.py b/src/tests/backend/services/test_team_service.py index 4c6222954..90bef1834 100644 --- a/src/tests/backend/services/test_team_service.py +++ b/src/tests/backend/services/test_team_service.py @@ -329,6 +329,7 @@ class TestTeamCrudOperations: @pytest.mark.asyncio async def test_save_team_configuration_success(self): mock_context = MagicMock() + mock_context.get_team = AsyncMock(return_value=None) mock_context.add_team = AsyncMock() service = TeamService(memory_context=mock_context) @@ -337,9 +338,44 @@ async def test_save_team_configuration_success(self): assert result == "test-id-123" mock_context.add_team.assert_called_once_with(team_config) + @pytest.mark.asyncio + async def test_save_team_configuration_upserts_when_team_exists(self): + existing = MockTeamConfiguration( + id="existing-doc-id", + session_id="existing-session", + team_id="team-1", + created="2024-01-01T00:00:00Z", + created_by="original-user", + ) + mock_context = MagicMock() + mock_context.get_team = AsyncMock(return_value=existing) + mock_context.update_team = AsyncMock() + mock_context.add_team = AsyncMock() + service = TeamService(memory_context=mock_context) + + team_config = MockTeamConfiguration( + id="new-doc-id", + session_id="new-session", + team_id="team-1", + name="Updated Team", + created="2025-01-01T00:00:00Z", + created_by="seed-user", + ) + result = await service.save_team_configuration(team_config) + + assert result == "existing-doc-id" + mock_context.update_team.assert_called_once_with(team_config) + mock_context.add_team.assert_not_called() + # Immutable identity fields must be preserved from the existing document. + assert team_config.id == "existing-doc-id" + assert team_config.session_id == "existing-session" + assert team_config.created == "2024-01-01T00:00:00Z" + assert team_config.created_by == "original-user" + @pytest.mark.asyncio async def test_save_team_configuration_raises_on_db_error(self): mock_context = MagicMock() + mock_context.get_team = AsyncMock(return_value=None) mock_context.add_team = AsyncMock(side_effect=Exception("DB error")) service = TeamService(memory_context=mock_context) From 08175b20e0a368f292ad51b8af8ba68d947d0e20 Mon Sep 17 00:00:00 2001 From: Dhruvkumar-Microsoft Date: Fri, 14 Aug 2026 10:05:44 +0530 Subject: [PATCH 3/4] resolved the copilot comments --- .../post-provision/upload_team_config.py | 30 ------------------- 1 file changed, 30 deletions(-) diff --git a/infra/scripts/post-provision/upload_team_config.py b/infra/scripts/post-provision/upload_team_config.py index 111986a35..5dccef39d 100644 --- a/infra/scripts/post-provision/upload_team_config.py +++ b/infra/scripts/post-provision/upload_team_config.py @@ -34,36 +34,6 @@ def request_with_retry(method, url, **kwargs): return response -def check_team_exists(backend_url, team_id, user_principal_id): - """ - Check if a team already exists in the database. - - Args: - backend_url: The backend endpoint URL - team_id: The team ID to check - user_principal_id: User principal ID for authentication - - Returns: - exists: bool - """ - check_endpoint = backend_url.rstrip('/') + f'/api/v4/team_configs/{team_id}' - headers = { - 'x-ms-client-principal-id': user_principal_id - } - - try: - response = request_with_retry("GET", check_endpoint, headers=headers) - if response.status_code == 200: - return True - elif response.status_code == 404: - return False - else: - print(f"Error checking team {team_id}: Status {response.status_code}, Response: {response.text}") - return False - except Exception as e: - print(f"Exception checking team {team_id}: {str(e)}") - return False - if len(sys.argv) < 3: print("Usage: python upload_team_config.py [] []") sys.exit(1) From e7eba873d98f866d3f1a53810cb5de4b8ecb46f1 Mon Sep 17 00:00:00 2001 From: "Prekshith DJ (Persistent Systems Limited)" Date: Fri, 14 Aug 2026 12:26:35 +0530 Subject: [PATCH 4/4] Pin GitHub Actions to commit SHAs --- .github/workflows/agnext-biab-02-containerimage.yml | 8 ++++---- .github/workflows/azd-template-validation.yml | 4 ++-- .github/workflows/azure-dev.yml | 6 +++--- .github/workflows/broken-links-checker.yml | 6 +++--- .github/workflows/codeql.yml | 6 +++--- .github/workflows/deploy-waf.yml | 4 ++-- .github/workflows/deploy.yml | 6 +++--- .github/workflows/docker-build-and-push.yml | 12 ++++++------ .github/workflows/job-cleanup-deployment.yml | 2 +- .github/workflows/job-deploy-linux.yml | 8 ++++---- .github/workflows/job-deploy-windows.yml | 8 ++++---- .github/workflows/job-deploy.yml | 4 ++-- .github/workflows/job-docker-build.yml | 12 ++++++------ .github/workflows/pr-title-checker.yml | 2 +- .github/workflows/pylint.yml | 4 ++-- .../scheduled-Dependabot-PRs-Auto-Merge.yml | 2 +- .github/workflows/stale-bot.yml | 6 +++--- .github/workflows/telemetry-template-check.yml | 2 +- .github/workflows/test-automation-v2.yml | 8 ++++---- .github/workflows/test-automation.yml | 8 ++++---- .github/workflows/test.yml | 4 ++-- .github/workflows/validate-bicep-params.yml | 6 +++--- 22 files changed, 64 insertions(+), 64 deletions(-) diff --git a/.github/workflows/agnext-biab-02-containerimage.yml b/.github/workflows/agnext-biab-02-containerimage.yml index 15f9a794a..59f2f5dd4 100644 --- a/.github/workflows/agnext-biab-02-containerimage.yml +++ b/.github/workflows/agnext-biab-02-containerimage.yml @@ -16,26 +16,26 @@ jobs: packages: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 # - name: Download deps # run: | # curl -fsSL ${{ vars.AUTOGEN_WHL_URL }} -o agnext-biab-02/autogen_core-0.3.dev0-py3-none-any.whl - name: Log in to the Container registry - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@v6 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=ref,event=branch type=sha - name: Build and push Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: agnext-biab-02/ file: agnext-biab-02/Dockerfile diff --git a/.github/workflows/azd-template-validation.yml b/.github/workflows/azd-template-validation.yml index 8b87dbb0e..cef3cd809 100644 --- a/.github/workflows/azd-template-validation.yml +++ b/.github/workflows/azd-template-validation.yml @@ -15,12 +15,12 @@ jobs: name: azd template validation environment: production steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set timestamp run: echo "HHMM=$(date -u +'%H%M')" >> $GITHUB_ENV - - uses: microsoft/template-validation-action@v0.4.4 + - uses: microsoft/template-validation-action@bae4895d0a8abd4f0d5aad68ae8647b3027f4c91 # v0.4.4 with: validateAzd: ${{ vars.TEMPLATE_VALIDATE_AZD }} validateTests: ${{ vars.TEMPLATE_VALIDATE_TESTS }} diff --git a/.github/workflows/azure-dev.yml b/.github/workflows/azure-dev.yml index a73745595..c045a42de 100644 --- a/.github/workflows/azure-dev.yml +++ b/.github/workflows/azure-dev.yml @@ -23,7 +23,7 @@ jobs: AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set timestamp and env name run: | @@ -31,10 +31,10 @@ jobs: echo "AZURE_ENV_NAME=azd-${{ vars.AZURE_ENV_NAME }}-${HHMM}" >> $GITHUB_ENV - name: Install azd - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/broken-links-checker.yml b/.github/workflows/broken-links-checker.yml index bf9a41b1c..b918b1e3a 100644 --- a/.github/workflows/broken-links-checker.yml +++ b/.github/workflows/broken-links-checker.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout Repo - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 @@ -34,7 +34,7 @@ jobs: - name: Check Broken Links in Changed Markdown Files id: lychee-check-pr if: github.event_name == 'pull_request' && steps.changed-markdown-files.outputs.any_changed == 'true' - uses: lycheeverse/lychee-action@v2.8.0 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 with: args: > --verbose --no-progress --exclude ^https?:// @@ -47,7 +47,7 @@ jobs: - name: Check Broken Links in All Markdown Files in Entire Repo (Manual Trigger) id: lychee-check-manual if: github.event_name == 'workflow_dispatch' - uses: lycheeverse/lychee-action@v2.8.0 + uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 with: args: > --verbose --no-progress --exclude ^https?:// diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 56643c391..e25cb5f51 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -71,11 +71,11 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v4 + uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -103,6 +103,6 @@ jobs: exit 1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 + uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4 with: category: "/language:${{matrix.language}}" \ No newline at end of file diff --git a/.github/workflows/deploy-waf.yml b/.github/workflows/deploy-waf.yml index 02c2e78a4..7a100cd3e 100644 --- a/.github/workflows/deploy-waf.yml +++ b/.github/workflows/deploy-waf.yml @@ -25,10 +25,10 @@ jobs: GPT_5_4_MIN_CAPACITY: 1 steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 8f3480e59..1bdf45eb6 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -33,10 +33,10 @@ jobs: CONTAINER_APP: ${{steps.get_backend_url.outputs.CONTAINER_APP}} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -226,7 +226,7 @@ jobs: RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }} steps: - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/docker-build-and-push.yml b/.github/workflows/docker-build-and-push.yml index 5d53c14a5..d0dd77cb2 100644 --- a/.github/workflows/docker-build-and-push.yml +++ b/.github/workflows/docker-build-and-push.yml @@ -54,14 +54,14 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - name: Login to Azure if: ${{ github.ref_name == 'main' || github.ref_name == 'dev'|| github.ref_name == 'demo-v4' || github.ref_name == 'hotfix' }} - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -103,7 +103,7 @@ jobs: echo "HISTORICAL_TAG=${{ env.TAG }}_${DATE_TAG}_${RUN_ID}" >> $GITHUB_ENV - name: Build and optionally push Backend Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: ./src/backend file: ./src/backend/Dockerfile @@ -113,7 +113,7 @@ jobs: ${{ steps.registry.outputs.ext_registry }}/macaebackend:${{ env.HISTORICAL_TAG }} - name: Build and optionally push Frontend Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: ./src/App file: ./src/App/Dockerfile @@ -123,7 +123,7 @@ jobs: ${{ steps.registry.outputs.ext_registry }}/macaefrontend:${{ env.HISTORICAL_TAG }} - name: Build and optionally push MCP Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: ./src/mcp_server file: ./src/mcp_server/Dockerfile diff --git a/.github/workflows/job-cleanup-deployment.yml b/.github/workflows/job-cleanup-deployment.yml index f03da25f4..e23486194 100644 --- a/.github/workflows/job-cleanup-deployment.yml +++ b/.github/workflows/job-cleanup-deployment.yml @@ -56,7 +56,7 @@ jobs: steps: - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-deploy-linux.yml b/.github/workflows/job-deploy-linux.yml index 79b4cebc6..385fde416 100644 --- a/.github/workflows/job-deploy-linux.yml +++ b/.github/workflows/job-deploy-linux.yml @@ -58,7 +58,7 @@ jobs: MACAE_URL_API: ${{ steps.get_output_linux.outputs.BACKEND_URL }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Validate Workflow Input Parameters shell: bash @@ -222,10 +222,10 @@ jobs: fi - name: Install azd - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -331,7 +331,7 @@ jobs: echo "WEBAPP_URL=$WEBAPP_URL" >> $GITHUB_OUTPUT - name: Refresh Azure login # token expires for WAF deployments due to long deployment time - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-deploy-windows.yml b/.github/workflows/job-deploy-windows.yml index 0ba7f3691..acb5f8a47 100644 --- a/.github/workflows/job-deploy-windows.yml +++ b/.github/workflows/job-deploy-windows.yml @@ -57,7 +57,7 @@ jobs: MACAE_URL_API: ${{ steps.get_output_windows.outputs.BACKEND_URL }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Validate Workflow Input Parameters shell: bash @@ -221,10 +221,10 @@ jobs: fi - name: Install azd - uses: Azure/setup-azd@v2 + uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -335,7 +335,7 @@ jobs: "WEBAPP_URL=$WEBAPP_URL" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append - name: Refresh Azure login # token expires for WAF deployments due to long deployment time - uses: azure/login@v2 + uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-deploy.yml b/.github/workflows/job-deploy.yml index ff38620c0..8590e706f 100644 --- a/.github/workflows/job-deploy.yml +++ b/.github/workflows/job-deploy.yml @@ -288,10 +288,10 @@ jobs: echo "Final EXP status: $EXP_ENABLED" - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/job-docker-build.yml b/.github/workflows/job-docker-build.yml index a39de966d..cf4b9fedc 100644 --- a/.github/workflows/job-docker-build.yml +++ b/.github/workflows/job-docker-build.yml @@ -22,7 +22,7 @@ jobs: IMAGE_TAG: ${{ steps.generate_docker_tag.outputs.IMAGE_TAG }} steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Generate Unique Docker Image Tag id: generate_docker_tag @@ -39,10 +39,10 @@ jobs: echo "Generated unique Docker tag: $UNIQUE_TAG" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -56,7 +56,7 @@ jobs: az acr login --name "$ACR_NAME" - name: Build and optionally push Backend Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 env: DOCKER_BUILD_SUMMARY: false with: @@ -68,7 +68,7 @@ jobs: ${{ vars.ACR_TEST_LOGIN_SERVER }}/macaebackend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }} - name: Build and optionally push Frontend Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 env: DOCKER_BUILD_SUMMARY: false with: @@ -79,7 +79,7 @@ jobs: ${{ vars.ACR_TEST_LOGIN_SERVER }}/macaefrontend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }} ${{ vars.ACR_TEST_LOGIN_SERVER }}/macaefrontend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }} - name: Build and optionally push MCP Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 env: DOCKER_BUILD_SUMMARY: false with: diff --git a/.github/workflows/pr-title-checker.yml b/.github/workflows/pr-title-checker.yml index 9a3090fc8..a35d5ddd8 100644 --- a/.github/workflows/pr-title-checker.yml +++ b/.github/workflows/pr-title-checker.yml @@ -17,6 +17,6 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event_name != 'merge_group' }} steps: - - uses: amannn/action-semantic-pull-request@v6 + - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml index 62e001075..963675255 100644 --- a/.github/workflows/pylint.yml +++ b/.github/workflows/pylint.yml @@ -17,10 +17,10 @@ jobs: matrix: python-version: ["3.11"] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: ${{ matrix.python-version }} diff --git a/.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml b/.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml index e29507533..4bb09636c 100644 --- a/.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml +++ b/.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml @@ -36,7 +36,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Install GitHub CLI run: | diff --git a/.github/workflows/stale-bot.yml b/.github/workflows/stale-bot.yml index ea2d288f2..9abfe8581 100644 --- a/.github/workflows/stale-bot.yml +++ b/.github/workflows/stale-bot.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Mark Stale Issues and PRs - uses: actions/stale@v10 + uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10 with: stale-issue-message: "This issue is stale because it has been open 180 days with no activity. Remove stale label or comment, or it will be closed in 30 days." stale-pr-message: "This PR is stale because it has been open 180 days with no activity. Please update or it will be closed in 30 days." @@ -24,7 +24,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: fetch-depth: 0 # Fetch full history for accurate branch checks - name: Fetch All Branches @@ -75,7 +75,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload CSV Report of Inactive Branches - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: merged-branches-report path: merged_branches_report.csv diff --git a/.github/workflows/telemetry-template-check.yml b/.github/workflows/telemetry-template-check.yml index ddf173926..2d80d8f13 100644 --- a/.github/workflows/telemetry-template-check.yml +++ b/.github/workflows/telemetry-template-check.yml @@ -14,7 +14,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Check for required metadata template line run: | diff --git a/.github/workflows/test-automation-v2.yml b/.github/workflows/test-automation-v2.yml index 6cff2a3aa..354888b5d 100644 --- a/.github/workflows/test-automation-v2.yml +++ b/.github/workflows/test-automation-v2.yml @@ -43,15 +43,15 @@ jobs: TEST_REPORT_URL: ${{ steps.upload_report.outputs.artifact-url }} steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.13' - name: Login to Azure - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -138,7 +138,7 @@ jobs: - name: Upload test report id: upload_report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: ${{ !cancelled() }} with: name: test-report diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml index 7e7b691ff..8e8db6130 100644 --- a/.github/workflows/test-automation.yml +++ b/.github/workflows/test-automation.yml @@ -40,15 +40,15 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" - name: Azure CLI Login - uses: azure/login@v3 + uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} @@ -139,7 +139,7 @@ jobs: - name: Upload test report id: upload_report - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 if: ${{ !cancelled() }} with: name: test-report-${{ github.run_id }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c4b21b382..8eb9d0d31 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -46,10 +46,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.11' diff --git a/.github/workflows/validate-bicep-params.yml b/.github/workflows/validate-bicep-params.yml index 235f6ac0c..1624aff0a 100644 --- a/.github/workflows/validate-bicep-params.yml +++ b/.github/workflows/validate-bicep-params.yml @@ -24,10 +24,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Code - uses: actions/checkout@v6 + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: '3.11' @@ -63,7 +63,7 @@ jobs: - name: Upload validation results if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: bicep-validation-results path: |