Task: Move ACR deployment to deploy stage #2285
Conversation
Onokaev
requested review from
irvinesunday,
darrelmiller,
gavinbarron,
millicentachieng,
MaggieKimani1 and
baywet
as code owners
.azure-pipelines/ci-build.yml
Outdated
| Write-Host "Found version in PropertyGroup array: $version" | ||
| break | ||
| - deployment: deploy_docker_image | ||
| environment: kiota-github-releases |
There was a problem hiding this comment.
| environment: kiota-github-releases |
We don't need this environment since we're not writing to github releases here
There was a problem hiding this comment.
re-opening this since I saw that you added it back. Could you please provide some context?
There was a problem hiding this comment.
The job fails without an environment variable. I'll create a relevant one on ADO.
I put it back to test it
.azure-pipelines/ci-build.yml
Outdated
| pool: | ||
| vmImage: 'ubuntu-latest' | ||
| steps: | ||
| - checkout: self |
There was a problem hiding this comment.
we might not be allowed to checkout the repository in a deployment stage, have you tested this?
There was a problem hiding this comment.
It actually works. Let me remove the checkout step
There was a problem hiding this comment.
Also, why is this not allowed?
There was a problem hiding this comment.
deployment phases are not allowed to use checkout steps per security policy. Effectively they don't want scripts that could lead to some kind of injection I suppose.
If we revert to a regular job (not a deployment one) it'd be allowed though.
I have no doubt that it can work, but I'm fairly confident it'll trigger security items down the road.
Co-authored-by: Vincent Biret <vibiret@microsoft.com>
|
| displayName: 'Copy repository files for deploy stage' | ||
| inputs: | ||
| SourceFolder: '$(Build.SourcesDirectory)' | ||
| Contents: | |
There was a problem hiding this comment.
have you considered this option instead of copying the whole repo which is effectively working around the security constraints?
https://stackoverflow.com/questions/66468815/how-to-publish-docker-image-as-an-artifact-in-azure-devops
Completed fix, but holding until tomorrow to test end to end.Deployment is blocked because of docker pull rate limits
Successful run: https://microsoftgraph.visualstudio.com/Graph%20Developer%20Experiences/_build/results?buildId=184590&view=logs&j=94deceea-7f99-5fa2-dcf4-7ec60dc7cc5a&t=94deceea-7f99-5fa2-dcf4-7ec60dc7cc5a