chore: dev to main PR by Ragini-Microsoft · Pull Request #913 · microsoft/content-generation-solution-accelerator

Ragini-Microsoft · 2026-08-20T12:59:01Z

Purpose

This pull request updates all GitHub Actions in the repository to use explicit commit SHA references instead of version tags. This change improves security and reliability by ensuring that workflows use a specific, immutable version of each action, protecting against unexpected changes or malicious code in future releases.

The most important changes are:

Security and Reliability Improvements:

All workflow files under .github/workflows/ now reference GitHub Actions by commit SHA rather than version tags, ensuring actions are pinned to a specific version and cannot be silently updated. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14]

Action Updates Across Multiple Workflows:

Actions such as actions/checkout, actions/setup-python, docker/setup-buildx-action, docker/build-push-action, azure/login, Azure/setup-azd, actions/upload-artifact, and others have been updated to use a specific commit SHA in all relevant workflow files. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13]

Consistency and Best Practices:

All workflows now consistently use SHA-pinned actions, following GitHub's recommended best practices for workflow security. [1] [2] [3] [4] [5] [6] [7]

No Functional Changes:

There are no changes to workflow logic or functionality; only the way actions are referenced has changed. (All references)

Improved Auditability:

By pinning actions to SHAs, it is now easier to audit and track exactly which code is being executed in CI/CD pipelines. (All references)

Does this introduce a breaking change?

Yes
No

Golden Path Validation

I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

I have validated the deployment process successfully and all services are running as expected with this change.

chore: Pin github actions to commit SHAs

fix: update actions/checkout to specific commit SHAs in workflows

fix: Pin GitHub Actions to commit SHAs for content gen

chore: Pin GitHub Actions to commit SHAs

github-actions · 2026-08-20T13:04:20Z

Coverage Report •

File	Stmts	Miss	Cover	Missing
src/backend
orchestrator.py	562	109	80%	37–39, 577, 719, 753–754, 763, 765–766, 768, 774–776, 778, 810–811, 836, 856–858, 865–866, 868–869, 872–874, 876, 886–889, 893–894, 896–897, 905–907, 932, 1033–1035, 1121, 1147, 1189–1191, 1193–1195, 1225–1228, 1311–1313, 1329–1331, 1333–1335, 1349–1352, 1388–1389, 1412, 1460, 1464, 1502, 1534, 1536–1541, 1544, 1569–1570, 1572–1574, 1610, 1613, 1619–1621, 1654, 1690, 1694, 1699, 1778–1786, 1816–1818
TOTAL	7699	371	95%

Tests	Skipped	Failures	Errors	Time
426	0 💤	0 ❌	0 🔥	12.650s ⏱️

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR pins GitHub Actions used across workflows to specific commit SHAs (instead of floating version tags) to improve supply-chain security and build determinism.

Changes:

Replaced uses: owner/action@vX with uses: owner/action@<commit_sha> across multiple workflows
Pinned GitHub, Azure, Docker, and Lychee actions to fixed revisions
Left inline comments indicating the intended major version for each pinned action

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
.github/workflows/validate-bicep-params.yml	Pins `checkout`, `setup-python`, and `upload-artifact` to commit SHAs.
.github/workflows/test.yml	Pins `checkout` and `setup-python` to commit SHAs.
.github/workflows/test-automation-v2.yml	Pins `checkout`, `setup-python`, `azure/login`, and `upload-artifact` to commit SHAs.
.github/workflows/telemetry-template-check.yml	Pins `checkout` to a commit SHA.
.github/workflows/stale-bot.yml	Pins `actions/stale`, `checkout`, and `upload-artifact` to commit SHAs.
.github/workflows/scheduled-Dependabot-PRs-Auto-Merge.yml	Pins `checkout` to a commit SHA.
.github/workflows/pylint.yml	Pins `checkout` and `setup-python` to commit SHAs.
.github/workflows/pr-title-checker.yml	Pins semantic PR title checker action to a commit SHA.
.github/workflows/job-docker-build.yml	Pins `checkout`, Docker actions, and `azure/login` to commit SHAs.
.github/workflows/job-deploy.yml	Pins `checkout` and `azure/login` to commit SHAs.
.github/workflows/job-deploy-windows.yml	Pins `checkout`, `setup-azd`, and `azure/login` to commit SHAs.
.github/workflows/job-deploy-linux.yml	Pins `checkout`, `setup-azd`, and `azure/login` to commit SHAs.
.github/workflows/job-cleanup-deployment.yml	Pins `azure/login` to a commit SHA.
.github/workflows/docker-build.yml	Pins `checkout`, `setup-buildx`, `azure/login`, and `build-push` to commit SHAs.
.github/workflows/codeql.yml	Pins `checkout` and CodeQL actions to commit SHAs.
.github/workflows/broken-links-checker.yml	Pins `checkout` and `lychee-action` to commit SHAs.
.github/workflows/azure-dev.yml	Pins `checkout`, `setup-azd`, and `azure/login` to commit SHAs.
.github/workflows/azd-template-validation.yml	Pins `checkout` and template validation action to commit SHAs.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.


      - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6


+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5


      - name: Upload validation results
        if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4


Route package installs through the CFS-protected Microsoft Package Feed Proxy instead of public registries, per User Story #50858. - Add .npmrc to src/App and src/App/server pointing npm to https://packagefeedproxy.microsoft.io/npm/ and regenerate the corresponding package-lock.json files. - Add --index-url https://packagefeedproxy.microsoft.io/pypi/simple/ to src/backend/requirements.txt, tests/e2e-test/requirements.txt, and infra/vscode_web/requirements.txt (requirements-dev.txt and requirements-post-deploy.txt inherit the proxy via -r). - No NuGet or uv configuration required; repo has no .csproj/.sln/ pyproject.toml. - Validated npm install and pip install --dry-run resolve successfully through the proxy with no direct calls to npmjs.org, pypi.org, or nuget.org. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Address Copilot PR review feedback and extend proxy enforcement to direct/ad-hoc package installs that bypass requirements.txt/.npmrc. - src/App/.npmrc, src/App/server/.npmrc: add replace-registry-host=always so lockfile resolved URLs stay consistent with the configured proxy host. - src/backend/ApiApp.Dockerfile: set ENV PIP_INDEX_URL and upgrade pip/setuptools/wheel before installing requirements, so any pip invocation in the image uses the proxy. - .devcontainer/Dockerfile, devcontainer.json: set NPM_CONFIG_REGISTRY / PIP_INDEX_URL so devcontainer feature installs (e.g. node feature) and the dev environment route through the proxy instead of npmjs.org. - .github/workflows/pylint.yml, test.yml, test-automation-v2.yml: add job-level PIP_INDEX_URL env and explicit --index-url flags on standalone installs (flake8, pytest-cov, pytest-asyncio, pip self-upgrade) that don't come from a requirements.txt. - scripts/local_dev.sh, local_dev.ps1: export PIP_INDEX_URL before upgrading pip so the bare 'pip install --upgrade pip' call also uses the proxy. - infra/vscode_web/install.sh: default PIP_INDEX_URL for the install command. - docs/TECHNICAL_GUIDE.md, docs/AVMPostDeploymentGuide.md, tests/e2e-test/README.md, scripts/post_deploy.py, src/backend/orchestrator.py, tests/rai_testing.py: update copy-paste pip install commands and dependency-missing hints to reference the proxy explicitly. Validated: regenerated src/App and src/App/server package-lock.json via proxy (0 vulnerabilities), rebuilt content-gen-api Docker image from scratch, and ran a clean venv pip install of src/backend/requirements.txt - all resolved exclusively through packagefeedproxy.microsoft.io / ms-feed-*.pkgs.visualstudio.com with no direct calls to npmjs.org, pypi.org, or nuget.org. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… docs, and Dockerfile - Add --index-url directly to src/backend/requirements-dev.txt and scripts/requirements-post-deploy.txt instead of relying on -r chain inheritance - Remove redundant explicit --index-url flags in CI workflows (pylint.yml, test.yml, test-automation-v2.yml) since job/workflow-level PIP_INDEX_URL env var already covers all pip calls in those jobs - Remove redundant explicit --index-url flags from doc example commands (TECHNICAL_GUIDE.md, AVMPostDeploymentGuide.md, e2e-test README.md) since the target requirements files already embed --index-url as their first line - Fix WebApp.Dockerfile to COPY .npmrc alongside package*.json in both build stages so npm ci actually routes through the Microsoft Package Feed Proxy instead of silently falling back to the public npm registry

The ternary condition 'contains(zoneSupportedJumpboxLocations, solutionLocation) ? -1 : -1' always evaluated to -1 regardless of the condition, making the zoneSupportedJumpboxLocations variable and the location check dead code. Simplified to a flat 'availabilityZone: -1' (matches AVM convention for 'no specific availability zone', as also adopted in the sibling Conversation-Knowledge-Mining-Solution-Accelerator PR #1052) and removed the now-unused zoneSupportedJumpboxLocations variable. Recompiled infra/main.json from the updated main.bicep to keep the ARM template in sync.

build: Configure Microsoft Package Feed Proxy for npm and pip

Copilot

Pull request overview

Copilot reviewed 38 out of 40 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

src/App/server/package-lock.json: Generated file

+    env:
+      PIP_INDEX_URL: https://packagefeedproxy.microsoft.io/pypi/simple/


      ]
    }
-    availabilityZone: contains(zoneSupportedJumpboxLocations, solutionLocation) ? 1 : -1
+    availabilityZone: -1 // -1 indicates no specific availability zone (AVM convention)


    "node_modules/@types/http-proxy": {
      "version": "1.17.17",
-      "resolved": "https://registry.npmjs.org/@types/http-proxy/-/http-proxy-1.17.17.tgz",
-      "integrity": "sha512-ED6LB+Z1AVylNTu7hdzuBqOgMnvG/ld6wGCG8wFnAzKX5uyW2K3WD52v0gnLCTK/VLpXtKckgWuyScYK6cSPaw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/http-proxy/-/http-proxy-1.17.17.tgz",
+      "integrity": "sha1-2eLEVx/jUHNDyyEM1BeQN15ZpTM=",
      "license": "MIT",


PrekshithD-Microsoft and others added 7 commits August 17, 2026 19:00

Pin GitHub Actions to commit SHAs

17753c7

Pin github actions to commit SHAs

f3eb95d

Merge pull request #1 from KanchanN-Microsoft/psl-commitesha

d2071b4

chore: Pin github actions to commit SHAs

fix: update actions/checkout to specific commit SHAs in workflows

72b29fc

Merge pull request #2 from KanchanN-Microsoft/psl-commitesha

d494e6a

fix: update actions/checkout to specific commit SHAs in workflows

Merge pull request #909 from microsoft/psl-workflow-update

804f6ce

fix: Pin GitHub Actions to commit SHAs for content gen

Merge pull request #910 from KanchanN-Microsoft/dev

1070bcf

chore: Pin GitHub Actions to commit SHAs

Copilot AI lite review requested due to automatic review settings August 20, 2026 12:59

Ragini-Microsoft requested review from Avijit-Microsoft, Prajwal-Microsoft, Roopan-Microsoft, Vinay Sharma (Vinay-Microsoft), Anish Arora (aniaroramsft), malrose07, nchandhi and Todd Herman (toherman-msft) as code owners August 20, 2026 12:59

Copilot started reviewing on behalf of Ragini-Microsoft August 20, 2026 13:04 View session

Copilot AI reviewed Aug 20, 2026

View reviewed changes

MohdRafi-Microsoft and others added 6 commits August 21, 2026 16:14

fix: correct availability zone logic in jumpbox VM module

536c375

Merge pull request #914 from microsoft/PSL-rf-MSPackageFeedProxy

48a2c31

build: Configure Microsoft Package Feed Proxy for npm and pip

Copilot AI review requested due to automatic review settings August 24, 2026 09:20

Copilot started reviewing on behalf of Roopan-Microsoft August 24, 2026 09:20 View session

Copilot AI reviewed Aug 24, 2026

View reviewed changes

Navigation Menu

Uh oh!

chore: dev to main PR - #913

chore: dev to main PR#913
Ragini-Microsoft wants to merge 13 commits into
mainfrom
dev

Ragini-Microsoft commented Aug 20, 2026

Uh oh!

github-actions Bot commented Aug 20, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

		env:
		PIP_INDEX_URL: https://packagefeedproxy.microsoft.io/pypi/simple/

Uh oh!

Conversation

Ragini-Microsoft commented Aug 20, 2026

Purpose

Does this introduce a breaking change?

Golden Path Validation

Deployment Validation

Uh oh!

github-actions Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

github-actions Bot commented Aug 20, 2026 •

edited

Loading