Repository navigation
[ci] Validate Deployment E2E workflow changes on pull requests #20491
Description
Is there an existing issue for this?
- I have searched the existing issues
Is your feature request related to a problem? Please describe the problem.
Changes to deployment-tests.yml and its checked-in scripts do not currently run dedicated Deployment E2E workflow validation on pull requests. The trigger map reports job:deployment-e2e as advisory, but the workflow itself runs only on its nightly schedule or through manual dispatch. Workflow integration problems can therefore remain undiscovered until a later deployment run.
Describe the solution you'd like
Add an unprivileged PR validation path that runs when the Deployment E2E workflow or its local runner scripts change.
The validation should cover the non-Azure portions of the pipeline, including workflow loading, test-matrix enumeration, build and artifact preparation, and the directly executable workflow-script tests.
The PR validation must not:
- Request
id-token: write. - Use the
deployment-testingenvironment. - Receive repository or environment secrets.
- Authenticate to Azure or create Azure resources.
Real deployments should remain on the nightly schedule or an explicitly authorized manual run. The validation should not be implemented by adding a PR trigger to the privileged workflow and relying only on job-level conditions, because a PR can modify those conditions and the workflow definition.
Additional context
#20308 exposed this gap while changing deployment-tests.yml, run-deployment-test.sh, and the shared MTP exit-code normalizer. Static workflow analysis such as zizmor can complement this validation, but it does not prove that the Azure/OIDC privilege boundary is safe.
Activity
joperezr commentedon Sep 25, 2026
🤖 Aspire triage pass — 2026-09-25 20:32 UTC
Area:
area-engineering-systems,area-deploymentKind: feature-request
Repro: partial — see lines 7–26 of the issue body
Affected version(s): repository CI (latest Aspire release: 13.5.4)
Severity: S3 — deployment workflow changes lack dedicated PR validation, but nightly and authorized manual runs remain available
Urgency: 🟡 vNext — recommend milestone 13.6
Reason: concrete, actionable CI safety work for the active release train; no servicing release is required
Suggested owner(s): David Pine (@IEvangelist) (score 83), Mitch Denny (@mitchdenny) (score 83)
Evidence:
area-engineering-systemsand closed Support for Azure Container Apps (ACA) Express #19034, publish: generated Compose/Kubernetes charts pin the Aspire Dashboard to mutable nightly ":latest" (not reproducible, not overridable via Helm values) #19239 as completed inarea-deploymentarea-deploymentConfidence: high
Needs human?: no